Subject: Re: [MOBILE-IP] AAA functionality

From: "N. Asokan" <[email-masked]>
Date: Wed, 5 Jan 2000 17:26:29 +0200

Steven Glass - Solaris Software <[email-masked]> wrote:
> I don't think I'd be in favor of parallel AAA and MIP authentications where
> the MN is allowed some short access time.  I am assuming you mean only the first
> registration with a FA would be allowed for a short time, otherwise the MN will
> simply 'renew' every second to stay within that window.  If a good parallel
> mechanism came forward I might be in favor of that, but not where the MN has
> some free time (figuratively, and literally).  I see this as allowing a short
> security violation on the grounds that it may not really be a security
> violation.

I think whether to allow free time or not is ultimately a policy issue.
Seems to me that we shouldn't devise a mechanism that precludes that
policy.  A visited network that makes this policy decision (to support
fast handoffs, or for whatever reason) can easily use its own local
mechanisms to detect and prevent attacks like the above -- it is not
necessary to standardize them.

As we pointed out earlier, there can be other reasons for not bundling the
AAA and MIP signalling: e.g., AAA and MIP home domains could be completely
different and far apart.

I too agree that there are other scenarios where a visited network may
want to unilaterally terminate service: e.g., in the pre-paid access model
when the pre-paid amount is used up. So it would be nice to have a clean
way to inform MN when its registration is being revoked.

Regards,
- Asokan

---
N. Asokan, Communication Systems Lab, Nokia Research Center, Helsinki

---

From: Tom Weckström <[email-masked]>
Date: Mon, 10 Jan 2000 01:17:13 +0200

Hello,

I bring in my vote for the grace period...

N. Asokan wrote:
> policy.

I agree with Asokan, Patrik and others, that allowing the grace period
is a policy issue. Furthermore, we should not forbid such liberal
policies with our protocol design!
Telcos may not like the possibility of using their network even for
short periods of time. However, telcos are certainly not the only ones
providing wireless services in the future. As someone pointed out
earlier, the pure Ip accessibility may even not be the ultimate source
for cash flows. I hope every university lab or airport lobby bar will be
able to set up its own wireless AP and start providing access to the
Internet. As the number of access provider increases, the number of
"inter-domain" handoffs may significantly increase. I really do not want
to mandate _everyone_ to disable the grace period and thus end up in
rediculous latencies and unbearable glitches in the connections.

Best regards,
                Tom

--
        Tom Weckström           [email-masked]
        Otakaari 20 B 39        Helsinki University of Technology
        02150 Espoo             Department of Computer Science