Subject: [MOBILE-IP] The grace period (AAA requirements)

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 7 Jan 2000 09:48:37 -0800

Hello folks,

The revised AAA draft is due out soon, and some decision has
to be made regarding whether to explicitly put in the requirement
for allowing a grace period for Mobile IP registrations, in the
AAA requirements draft.

From the discussion on the mailing list, it does not seem that
any consensus has been reached.

But, perhaps more importantly, this discussion may not even belong
in the AAA requirements draft.  My reasoning is as follows.

The original point is that sometimes a foreign agent might want
to forward a Registration Request before getting an answer back
from the AAA infrastructure.

Whether or not the foreign agent does this does not necessarily
limit its ability to rely on the AAA infrastructure for answers.

So, for instance, we should try to make sure that the AAA
infrastructure can provide the necessary authorization to a foreign
agent, independent of whether or not the messages from the foreign
agent to the AAAF contain the Mobile IP registration data.

On the other hand, the discussion about whether a foreign agent
should be allowed to offer this grace period is pretty important,
and I hope will continue even if it is not crucial for the wording
of the AAA requirements draft.

Does this sound like a reasonable resolution for now?

Regards,
Charlie P.

> "Lipford, Mark" wrote:
>
> As a wireless carrier interested in deploying a MIP solution I don't feel
> comfortable allowing a "grace" period.  We have received many request for
> potential customers on how quickly they could send a "short burst" of data
> through our network for particular applications (i.e. telemetry and
> telematics are two big ones).  If we allow users a grace period they could
> potentially run their business without getting properly authorized.  While
> there are possibly other ways to block this usage AAA is the best solution.

>>                 -----Original Message-----
>> From:   Patrik Flykt [mailto:[email-masked]]
>> Sent:   Wednesday, January 05, 2000 2:40 AM
>> To:     [email-masked]
>> Subject:        Re: [MOBILE-IP] AAA functionality
>>
>> Hi,
>>
>>> Perhaps I am missing something, but I *really* don't see how the AAA
>>> and Mobile-IP requests can be done in parallel. If a requirement is
>>> that it must be possible to separate the two, then I would prefer to
>>> see that both requests are done sequentially, first AAA then Mobile-IP.
>>> This would remove many strange interactions, and would be a much cleaner
>>> approach.
>>
>> I suppose there is a requirement that AAA and MIP messages can be separated
>> (be it parallell or serial message sending). When you pay for access with
>> your credit card the authorization/accounting goes to the credit card
>> company's AAA server, while the Mobile IP messages go to your home agent.
>>
>> The sequential approach is extremely useful if the only case of using AAA
>> with MIP is to ensure that the provider of the foreign agent is able to
>> account for every second of foreign agent usage. However, the provider could
>> also be interested in allowing a short grace period to ensure that the
>> real-time applications used in the mobile node would experience the shortest
>> possible service disruption. I suppose the AAA processing will take at least
>> a couple of seconds and even longer when there are several brokers between
>> the visited and home domains. The grace period enables of course a
>> possibility of fraud, which the provider has to take into account.
>> Minimizing fraud could be done for example by allowing the grace period only
>> to those who have visited the same provider's network earlier and have been
>> given a session key, as described in the "Minimal Latency Secure Hand-off"
>> draft. There is also a third possibility when the provider is providing free
>> access for everyone without any accounting but with authorization. The
>> provider wants to be sure that the home AAA domain authorizes the mobile
>> node, i.e. it is not stolen, in the (for some reason) wrong domain, etc.