Subject: Re: [MOBILE-IP] AAA functionality

From: Steven Glass - Solaris Software <[email-masked]>
Date: Tue, 4 Jan 2000 18:20:12 -0500

I don't think I'd be in favor of parallel AAA and MIP authentications where
the MN is allowed some short access time.  I am assuming you mean only the first
registration with a FA would be allowed for a short time, otherwise the MN will
simply 'renew' every second to stay within that window.  If a good parallel
mechanism came forward I might be in favor of that, but not where the MN has
some free time (figuratively, and literally).  I see this as allowing a short
security violation on the grounds that it may not really be a security
violation.

    A mechanism to allow the registration reply to have a short timeout,
requireing the MN to be 'honorable' and stop trying to use it's binding is
silly, since the FA is the enforcement point.  I agree the FA killing the
service without letting the MN node is draconian, so there needs to be a way for
the MN to know its been cut off.  The FA could simply send a registration reply
with a denial, though this breaks RFC2002[-bis] in that an FA isn't allowed to
generate a registration reply that is not in response to a request (though I
suppose you could argue it's simply the second response to a request).
Personally, I've always thought there should be a way to terminate a binding in
MIP, independant of what AAA may need it for.

                              Cheers,
                                  Steve

>X-Virus-Scanned: Tue, 4 Jan 2000 09:10:55 -0800 Nokia Silicon Valley AntiVirus
Appliance
>X-Accept-Language: en
>MIME-Version: 1.0
>Content-Transfer-Encoding: 7bit
>From: "Charles E. Perkins" <[email-masked]>
>Subject: [MOBILE-IP] AAA functionality
>To: [email-masked]
>
>Hello,
>
>There has been some discussion about how to let AAA authorize
>a mobile node's connectivity separately from the process of
>Mobile IP registration.  The idea would be to give a mobile
>node a little unauthorized time while the AAA process
>goes to completion.  It is expected that a Mobile IP registration
>will be faster than authentication/authorization by AAA.
>
>Suppose that the Mobile IP registration succeeds, and the AAA
>authentication fails.  Then, one might expect that the Mobile IP
>registration should be terminated immediately without waiting for
>the registration lifetime to expire.  Mobile IP does not currently
>have any mechanism to do this.  I think the mobile node has to
>be notified that something went wrong.  Thus, we need a way to
>send the notification to the mobile node.
>
>This could be a new Mobile IP message, or ICMP, or ... ?
>Any such message would have to be authenticated in some
>way that is credible to the mobile node.
>
>The alternative would be just to cut off service to the mobile
>node without notification, which seems rather draconian.
>
>Can anyone offer a good solution to enable this sort of
>parallel processing for mobile node registrations?
>
>Regards,
>Charlie P.

---

From: Xinhua Zhao <[email-masked]>
Date: Tue, 4 Jan 2000 16:39:27 -0800

> the MN to know its been cut off.  The FA could simply send a registration reply

Steve,

Actually, I agree that relying on a well-behaving mobile node is not
sufficient. The idea was just to use the absence of AAA authorization
messages before the timeout to implicitly signal the mobile node that
something may have gone wrong. It's just that instead of requiring a
mobile node to be prepared to process explicit negative notifications,
it requires the mobile node to be prepared for failure by itself in
the absence of positive notifications. The FA should still enforce
the cut-off of traffic to a mobile node when it fails AAA authorization.

This implicit signaling avoids new packets that have to be sent and
processed. But it can potentially take longer for a mobile to notice
the failure as compared to explicit notification. Though it has both
pros and cons, in my opinion it is an alternative nonetheless.

> MIP, independant of what AAA may need it for.

A mechanism to explicitly terminate a binding can potentially be useful
in the scenario when an FA needs to be turned down and allow another FA
in the same subnet to take over. Waiting for the mobile node to figure
this out by its own through the loss of FA "beacons" can take too long.
Is this what is in your mind for such a mechanism?

Regards,

Xinhua

MosquitoNet Project on Mobile and Wireless Computing
Stanford University
http://MosquitoNet.Stanford.EDU