[Mobopts] Fwd: RG Last Call for Media-independent Pre-Authentication Document

["Rajeev Koodli" <[e-mail]>]

A Review. Thanks Madjid.


---------- Forwarded message ----------
From: Nakhjiri Madjid-VXT746 <[e-mail]>
Date: Thu, May 29, 2008 at 5:24 PM
Subject: RE: [Mobopts] RG Last Call for Media-independent
Pre-Authentication Document
To: Rajeev Koodli <[e-mail]>
Cc: Nakhjiri Madjid-VXT746 <[e-mail]>

...........................

 I unfortunately think the doc has too much background material and
abstraction that takes the user through a lot of text (15 pages)
before it introduces any of its framework concepts and that makes
reviewing very tough if you are time constraint, sorry

I think one of the strong points that any doc about Pre-auth needs to
make is that many of the procedures such as handover keying and
reauthentication deal with cases where there is a single source of
trust at the top and all underlying AAA domains trust that top source
of trust and any keys it generates and distributes. In cases of
multiple operators without roaming relationship, or without agreement
to participate in a key management scheme, you do have to perform a
pre-auth function to establish the security mechanisms without
assuming a common source of trust.



the first paragraph of the intro can be toned down a bit with respect
to ordering of the challenges.

Is this expects to solve the seamless mobility problem even when there
is a single L2 interface? (intro) As much as this being a noble goal,
I think with the advances in Silicon and wireless devices, this is
overcomplication of the requirements. I do agree that the
multi-interface assumption has been one of the barriers for 802.21
though. I am wondering how a mobile performs pre-auth with an
authentication agent of a new access technology, while still connected
to the old one if it is single interface, also not clear how the
mobile acquires the IP address of this agent, as section 6.3 states if
it is not tuned to the new technology, sorry if I have not gone to end
of the document and not being far.
Third, a mobility
   optimization mechanism needs to support not only multi-interface
   terminals where multiple simultaneous connectivity through multiple
   interfaces can be expected, but also single-interface terminals.
section 1.1.
I am not sure if the document needs to go into a serial analysis of
every source of delay in the system. Since this is about pre-auth and
IP address acquisition, etc, it could simply just talk about those
things. so section 1.1 can undergo a serious diet.
A QoS style description of delay would not be needed either, IMO. On
the other hand, what that section really is missing is a description
of issues around reestablishing link security (authentication, link
key management, access authorization) in conjunction to network access
and handovers (inter or intra domain), because that is really the
focus of a pre-auth framework.

section 2
This type of Inter-technology handover is often
   called as Vertical Handover since the mobile makes movement between
   two different cell sizes.
I don't think Vertical handover is defined based on cell size, it is
defined based on the type of access technology (as listed).

I think an important point about Inter-domain, is not just where the
mobile is authenticated, but also where his user profile, credentials
are stored and where his payment is associated to. Because that will
define the difference between home and visited domains from the
security standpoint, the mobile has an initial and permanent trust
relationship with its home and any interaction with a visited domain
is based on a temporary and transitive trust established based on a
mobile-home trust and a home-visited domain roaming relationship.

I know it is a sticky subject, but probably AA (authentication agent)
needs to provide some IETF or other wireless examples (EAP
authenticator, ASN GW, etc) and also how the Authentication signaling
is to traverse over the new network if there is only one interface.

The parts with pre-configuration are ok from 802.21 perspective,
however I don't think this doc or framework should get into decisions
of which network to use is a network discover issue that assumes a
general broadcasting broker (I think 802.21 calls it information
server).
 Decision regarding which
   candidate network the mobile needs to pre-authenticate with will
   depend upon several policies, such as signaling overhead, bandwidth
   requirement (QoS), mobile's location, communication cost, and
   handover robustness etc.
This just makes the framework for this protocol too large, and
academic, specially if things like specific server (that nobody would
take ownership of in a inter-domain scenario) come in.

.......................
_______________________________________________
Mobopts mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/mobopts