Subject: Re: [MOBILE-IP] AAA functionality

From: "Martin Johnsson (ERA)" <[email-masked]>
Date: Wed, 5 Jan 2000 15:39:50 +0100

Hello Charlie and others,

First of all, I think it is of importance that the procedures of authentication and authorization are something being specified by the AAA group as part of their charter. AAA may come up with different solutions for different technologies, e.g. one for MIP and another one for PPP (if they can be separated), or perhaps AAA defines something self-contained in which case the interoperation with other protocols should be defined.

Just out from semantics, the AAA process is something different from MIP registration and should thus not be intermixed (actually the AAA process might result in that the MIP service is available to the user?).

Do we know anything about what the AAA guys think about this?

Cheers,
   /Martin

-----Original Message-----
From: Charles E. Perkins [mailto:[email-masked]]
Sent: den 4 januari 2000 18:11
To: [email-masked]
Subject: [MOBILE-IP] AAA functionality

Hello,

There has been some discussion about how to let AAA authorize
a mobile node's connectivity separately from the process of
Mobile IP registration.  The idea would be to give a mobile
node a little unauthorized time while the AAA process
goes to completion.  It is expected that a Mobile IP registration
will be faster than authentication/authorization by AAA.

Suppose that the Mobile IP registration succeeds, and the AAA
authentication fails.  Then, one might expect that the Mobile IP
registration should be terminated immediately without waiting for
the registration lifetime to expire.  Mobile IP does not currently
have any mechanism to do this.  I think the mobile node has to
be notified that something went wrong.  Thus, we need a way to
send the notification to the mobile node.

This could be a new Mobile IP message, or ICMP, or ... ?
Any such message would have to be authenticated in some
way that is credible to the mobile node.

The alternative would be just to cut off service to the mobile
node without notification, which seems rather draconian.

Can anyone offer a good solution to enable this sort of
parallel processing for mobile node registrations?

Regards,
Charlie P.

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 7 Jan 2000 00:17:59 -0800

>AAA may come up with different solutions for different technologies, e.g.
one for MIP and >another one for PPP (if they can be separated)

The charter of the AAA WG is to define requirements for a AAA protocol based
on inputs from the WGs that would use that protocol. It is explicitly *not*
in the AAA WG charter to define how Mobile IP will use AAA. That is the job
of the Mobile IP WG, which is best qualified for that task. Among other
things, this ensures that issues of Mobile IP architecture are discussed
within the WG that best understands Mobile IP.

Bernard Aboba
Co-Chair, AAA WG