Subject: [MOBILE-IP] micromobility in IPv6 ?

From: Lieve Bos <[email-masked]>
Date: Fri, 11 Feb 2000 19:44:29 +0100

Hi guys,

I am pretty new in this area so don't shoot me if I ask a stupid
question. I am trying to get a grip on all this macro and micro mobility
stuff.

As I understand it, there are two possible (in the case of FA care off
addresses) levels of mobility in IPv4: mobile IP for solving the macro
mobility problem until the FA and micro mobility between the FA and the
terminal.

What happens now in IPv6 where there is no FA concept (all co-located
care off addresses)? Is there nothing specific that supports fast
handoffs in IPv6? As I understand it in IPv6 you have to obtain a new
address (network prefix) every time you enter a new network, get
authenticated and update bindings (in HA and Correspondent Nodes). Isn't
this going to be slower than protocols like cellular IP where routing
tables only have to be updated locally...

Lieve

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 11 Feb 2000 15:02:52 -0800

Hello Lieve,

> question. I am trying to get a grip on all this macro and micro mobility

So are a lot of people.

> mobility problem until the FA and micro mobility between the FA and the

These are not necessarily different.  On the other hand, it is
always possible to make a difference even if one is not necesary.

> care off addresses)?

How about using the routers?

>                   Is there nothing specific that supports fast
> handoffs in IPv6?

I reckon it depends on how fast the stateless or stateful address
allocation works.  So, it would be nice to make that fast.
However, that does not mean that IPv6 is inherently slow.

>            As I understand it in IPv6 you have to obtain a new

I don't see anywhere in the specifications where it says you have to
do a remote authentication on every new network.

Regards,
Charlie P.

---

From: Claude Castelluccia <[email-masked]>
Date: Mon, 14 Feb 2000 10:18:28 +0100

Hello,

> tables only have to be updated locally...

maybe, unless you use some kind of Hierarchical Mobile IPv6 scheme  ( see
 for an example  of such scheme
http://www.inrialpes.fr/planete/people/ccastel/hmip.ps.gz).
In this case you will have comparable performance.....

regards,

Claude.

--

----------------------------------------
Claude CASTELLUCCIA, INRIA Rhone-Alpes
ph:  +33 4.76.61.52.15 (fax: 52.52)
http://www.inrialpes.fr/planete/

---

From: Frank Paehlke <[email-masked]>
Date: Mon, 14 Feb 2000 14:26:49 +0100

Hello,

> > question. I am trying to get a grip on all this macro and micro mobility

... including me :-)

I am currently involved in a research project focussing on secure
micro-mobility support for mobile IP. Since I have already spent a lot
of time thinking on how to transparently integrate such mechanisms, the

> do a remote authentication on every new network.

the problem, at least as far as I can tell, is the following sentence
which appears in RFC 2002 as well as in the latest RFC 2002bis draft
(section 3.6.2.1):

"[...] if the Code field indicates that the registration was accepted
by the home agent, exactly one Mobile-Home Authentication Extension
MUST be present in the Registration Reply, and the mobile node MUST
check the  Authenticator value in the Extension."

This specification, if strictly followed, seems to inhibit any
re-registration without involving the home network. Perhaps it would be
better to add a statement like "The Mobile-Home Authentication
Extension is not needed if a security association is established between
the Mobile Node and the foreign network's infrastructure, and the
Registration Reply contains a valid Mobile-Foreign Authentication
Extension." This is already explicitly demanded by the HAWAII draft and
implemented, for example, in HUT Dynamics.

Please correct me if I have understood something wrong.

Best regards,
Frank
-- 
Frank Paehlke
Institut fuer Telematik       Phone: +49 721 608-6398
Universitaet Karlsruhe (TH)   Fax:   +49 721 388097
D-76128 Karlsruhe, Germany    EMail: [email-masked]

---

From: Jari T Malinen <[email-masked]>
Date: Mon, 14 Feb 2000 18:53:16 +0200

Hi, Frank,

I would like to give an alternative interpretation to the 3.6.2.1 that
you quote below.

> implemented, for example, in HUT Dynamics.

In fact, the draft might be interpreted so that with code 0 it is not
necessarily the HA that accepted the message. In such a case, the
section 3.6.2.1 would still be valid even though the Mobile-Foreign
Authentication extension is used with localized replies. Then, only
such message that really comes from HA would be the one to which the
MUSTs fully apply. This interpretation would keep the text as is, would
properly support at non-regional MN with both MUSTs in place, and
would allow regional features as implemented in Dynamics - HUT Mobile IP.

> Please correct me if I have understood something wrong.

Likewise, e.g. our code interpretation is not 100% clear in this..

Regards,

--jari

Jari Malinen (http://www.cs.hut.fi/~jtm)
Researcher, HUT/CS Lab. Tel. +358 9 451 4774, fax +358 9 451 5351.

---

From: Lieve Bos <[email-masked]>
Date: Mon, 14 Feb 2000 18:28:28 +0100

> would allow regional features as implemented in Dynamics - HUT Mobile IP.

Are you suggesting here that registration reply messages should not
always necessarily come from the HA? Can a mobile simply register with a
FA (without the HA involved) and get a registration reply from the FA?

In that case how do you explain then the following sentence in RFC 2002
bis draft (section 3.4):
"  If the mobile node is requesting service from a foreign agent,
   that foreign agent will receive the Reply from the home agent and
   subsequently relay it to the mobile node."

---

From: Jari T Malinen <[email-masked]>
Date: Mon, 14 Feb 2000 20:10:39 +0200

>    subsequently relay it to the mobile node."

Instantaneously yes, on a longer term, no. The non-regional registration
would immediately behave like the above sentence while a regional
registration caches the functionality of the HA. Once a MN enters a
regional network, the first registration would strictly go as quoted above
while the subsequent exchanges could use the dynamic trust relationship
built from the MN-HA trust relatioinship and delegated down to the access
network, e.g. with a session key protocol. Then, a regional-aware FA (or
access router) would just cache HA functionality. So, the above would
happen, but in a delayed manner.

The question is, if the RFC enables the interpretation for this behavior
and the implementing messages with the current wording. Since
the relay functionality needs not to be instantaneous, and a cache
hierarchy would relay the service reply through the access FA, then why
not?

Regards,

--jari

---

From: Ashish Baweja <[email-masked]>
Date: Wed, 16 Feb 2000 17:48:04 +0530

Hi,
        I am pretty new on this to this area and am interested in doing my major
B.Tech. project on mobile IP over IPV6.
I have just started reading documents and trying sampe implementations. I
have few basic queries to sort out before i start:
1. I don't have access to wavelan cards. So can I implement and test MIPV6
over ethernet networks and does any of sample implmentation work over
ethernet.
2. Can i implement MIPV6 over NS-2 and can code will be ported easily frm
NS-2 to wavelan and ethernet.
Ashish Baweja

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 28 Feb 2000 20:27:11 -0800

Hello Frank,

I take your comment as relevant to the recently announced Last Call
for RFC2002bis.  In that case, we should get some clarification so
that I can figure out whether to change the current draft.

> check the  Authenticator value in the Extension."

Yes, the idea being that a mobile node registers _only_ with its
home agent.

>                                             Perhaps it would be

In the first place, any new protocol specification that advances
to Proposed Standard can suggest modifications to RFC2002bis that
have the effect of obsoleting part of the prior specification for
any network device that adheres to the later specification.

Even so, I would agree that minor adjustments to RFC2002bis are
preferable to waiting for advancement of other specifications,
whenever the adjustments are known to be interoperable and effective
and so on.

I don't see that this change satisfies those criteria.  But, if
others in the working group ask for the change, I would not mind
putting something in.

One major problem would be to have an unambiguous definition of the
words "foreign network's infrastructure".  That's pretty vague, it
seems to me.

Regards,
Charlie P.

---

From: Frank Paehlke <[email-masked]>
Date: Tue, 29 Feb 2000 09:22:19 +0100

Hello,

> that I can figure out whether to change the current draft.

many thanks for your interest, which I consider a big honour. Since the
mentioned comment was my first posting to this list, I was really a bit
afraid of being flamed.

> Yes, the idea being that a mobile node registers _only_ with its

This is surely the most obvious approach as far as optimized local
handoff is not an issue. It also guarantees secure mutual authentication
of an MN and its home agent.

> whenever the adjustments are known to be interoperable and effective

The idea behind my comment was to facilitate the development of
specifications which provide fast local handoffs (I am doing research in
this area, together with some colleagues, for my PhD thesis). As far as
I can see, such handoffs will have to be carried out without involving
the HA, which is difficult to achieve without breaking the standard in
its current form. All proposals for fast handoff (e.g., HAWAII the HUT
Dynamics implementation) require the establishment of a security
association between the MN and the foreign network, which is then used
to authenticate the MN upon subsequent registrations without involving
the home agent.

> words "foreign network's infrastructure".  That's pretty vague, it

Probably the most common approach would be to establish a security
association between the MN and the foreign agent (e.g., as specified in
the AAA-regkey draft). When saying "foreign network's infrastructure", I
was thinking that perhaps there could also be a security association
with some other entity, e.g., a AAA server or the like. In HUT Dynamics,
for example, the security association is between the MN and *all*
foreign agents on the path towards the "highest FA".

But as long as these thoughts are relatively vague, I now agree with you
that it would probably be better to explicitly demand a security
association between the MN and a foreign agent (old, new, or first
common parent of old and new). I deliberately chose the wording "a
statement like..." because I was not 100% sure (and because I am not a
native speaker of English :-)

Regards,
Frank Paehlke