Re: [MEXT] [!! SPAM] Re: Well-known problem with authentication/etc. in wireless networks

["Charles E. Perkins" <[e-mail]>]

Hello Pete,

Your analysis of operator concerns is quite correct,
it seems to me, but on the other hand maybe the IETF
would be able to alleviate operator concerns once
they are properly understood.  And, if operators
could be assured that they would suffer no harm by
following some revised IETF protocol steps, there
would be a good chance for progress.

Address assignment is perhaps the stickiest case.
Here are some observations:
- The UE doesn't necessarily have to know its
   care-of address until after handover is complete
   (and, according to [netext], not even then)
- The access network does not have to complete the
   assignment of the care-of address until it has
   verified the authentication
- As mentioned before, the home agent is a viable
   candidate for AAA relay, actually appearing as the
   AAA server to the access network
- An IPv6 address can't really be considered a
   valuable resource if it isn't routable, and so
   even if UE knew its IPv6 care-of address, it would
   not get any benefit until authentication completes.

If there is any disagreement about these points, I would
be surprised, but every day brings new surprises.  I am
proposing that we should try to make a higher-performance
handover specification that is less complicated than, say,
S101/S102/S103.  Almost anything the IETF could possibly
do would be less complicated than those, and I fully
expect much easier to configure, administer, and operate.

So, the problem statement could be:

Enable Mobile IP to provide high-performance mobility management that
is better able to be deployed in modern wireless access networks
that already utilize alternate access authentication protocols.
Determine the suitability of network-based versus client-based
variations of the candidate solutions.


Regards,
Charlie P.



On 8/25/2011 12:54 PM, Pete McCann wrote:
> Hi, Charlie,
>
> The problem seems to be we have the following three steps that have
> to be carried out in order:
>
> 1) access authentication
> 2) address assignment
> 3) mobility management
>
> (3) depends on (2) because you can't bind your home address to a
> care-of address until you have a care-of address.  (2) depends on (1)
> because operators don't like to give out resources until they know they
> will get paid.
>
> It's possible to combine all these things into one protocol (perhaps PANA
> could have been that vehicle, if certain decisions had not been made) but
> the IETF seems to like breaking problems down into layered solutions.
>
> -Pete
>
> On Thu, Aug 25, 2011 at 3:19 PM, Charles E. Perkins
> <[e-mail]>  wrote:
>> Hello Pete,
>>
>> Yes, putting Mobile IP inside of EAP would be one approach.
>> It would have some interesting advantages.  Other approaches
>> might be more properly done in [netext] -- or perhaps have
>> already been looked; I could have possibly missed some of
>> the relevant discussion there.
>>
>> Regards,
>> Charlie P.
>>
>>
>>
>> On 8/25/2011 11:40 AM, Pete McCann wrote:
>>>
>>> Hi, Julien,
>>>
>>> Are you talking about EAP inside IKEv2?  That presupposes that the MN
>>> is already attached to the network somewhere and has an IP address (i.e.,
>>> it has already passed access authentication).
>>>
>>> It may be interesting to look at whether access authentication and
>>> mobility
>>> management can be combined.  For example, we could put Mobile IP (or
>>> some variant of it) inside an EAP exchange used for access authentication.
>>> Charlie, are you proposing something like this?
>>>
>>> -Pete
>>>
>>> On Thu, Aug 25, 2011 at 1:44 PM, Julien Laganier<[e-mail]>
>>>   wrote:
>>>>
>>>> Charlie,
>>>>
>>>> I am not sure I understand what is missing in MIPv6; a MN and an HA
>>>> can already mutually authenticate using EAP, and this is incidentally
>>>> what 3GPP leverages on, together with the EAP-AKA method. What is
>>>> missing?
>>>>
>>>> --julien
>>>>
>>>> On Wed, Aug 24, 2011 at 12:06 PM, Charles E. Perkins
>>>> <[e-mail]>    wrote:
>>>>>
>>>>> Hello folks,
>>>>>
>>>>> It's now 2011.  Mobile IP was standardized late in
>>>>> 1996, after work had already been started nearly
>>>>> ten years before.  Over two decades! -- and regardless
>>>>> of lip service to fixed/mobile convergence we still
>>>>> don't have seamless mobility in user devices across
>>>>> heterogeneous media, and standards organizations
>>>>> (notably 3GPP) are not properly taking advantage of
>>>>> what Mobile IP can do. The losers are the end-users,
>>>>> which means all of us.
>>>>>
>>>>> There are many reasons for this, but one of the
>>>>> main reasons has to do with authentication at the
>>>>> access network.  EAP in various forms is being
>>>>> utilized for this purpose, and Mobile IP is not,
>>>>> even though there has never been any reported
>>>>> failure of the RFC 5944 or RFC 4285 or RFC 6275
>>>>> (to my knowledge).  Moreover, unless there is
>>>>> something wrong with the cryptography that also
>>>>> has not been reported, these authentication methods
>>>>> enable _mutual_ authentication between the network
>>>>> and the client, not just client authentication.
>>>>>
>>>>> In order for Mobile IP to enable the real promise
>>>>> of high performance heterogeneous networking, we
>>>>> have to do some more work.  I would like to initiate
>>>>> some more discussion about this.  DMM is interesting
>>>>> in its own right, but it's not at all the whole
>>>>> story.  Moreover, with proper design, it is likely
>>>>> the supposed burden of signaling to the home agent
>>>>> can be substantially reduced.  As one simple example,
>>>>> if handovers are accomplished locally between trusted
>>>>> access agents (routers, 802.11 access controllers, ...)
>>>>> then the actual timing of tunnel redirection from the
>>>>> home agent becomes much less critical.  This is also
>>>>> intricately intertwined with authentication.
>>>>>
>>>>> If the Home Agent were recognized as a robust security
>>>>> appliance, then it could naturally sit on the network
>>>>> boundary as an IP-addressable device.  Mobile IP
>>>>> authentication could become the primary means of
>>>>> validating user access, instead of an afterthought
>>>>> to enable IP-address preservation after all the heavy
>>>>> lifting has been done a lower levels.
>>>>>
>>>>> I would like to propose that in this working group we
>>>>> should go about making this happen.  It seems to be
>>>>> important, and undeniably aligned with our working
>>>>> group responsibilities.
>>>>>
>>>>> Regards,
>>>>> Charlie P.
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> MEXT mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/mext
>>>>>
>>>> _______________________________________________
>>>> MEXT mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/mext
>>>>
>>>
>>
>>
>