Subject: [MOBILE-IP] AAA MIP requirements comment

From: Patrik Flykt <[email-masked]>
Date: Wed, 27 Oct 1999 16:56:23 +0300

Hello all,

Thanks to the authors of draft-ietf-mobileip-aaa-reqs-01.txt for taking
some of our previous comments. The current version looks pretty good,
we have one major comment regarding it.

A strongly stated requirement in this draft is that all needed AAA and
mobile-IP interactions should be processed during a 'single Internet
traversal'. This essentially forces any MIP/AAA integration to bundle
mobile-IP registration messages in AAA messages.

We think this should not be mandated for the following reasons:

1 the 'AAA home domain' may be different from the 'mobile-IP home
  domain".

  Consider the following example: I have an ISP who is willing to
  provide Mobile IP HA service (i.e. my Mobile IP home domain belongs
  to this ISP).  While I am travelling, I find a foreign ISP who will
  allow IP access if I pay them, e.g. using a credit card, or some
  other form of Internet payment.  My AAA home domain (the domain which
  is used by the foreign ISP for authorizing my access) is elsewhere: it
  is the credit-card company's Internet authorization server, or some other
  Internet bank server.

2 in the interest of supporting fast mobility, the foreign network
  provider may be willing to allow 'x minutes of free access' to
  visiting mobile users. If no successful authorization is obtained
  from the AAA service within x minutes, the foreign network will cut
  off connection.  Some users may abuse this even if the 'x minutes' is
  quite short. If the majority of the users are well-behaved, such a policy
  may be cost-effective for the foreign network operator, since it allows
  customers to do a quick handoff into the foreign network. We suspect that
  the AAA can take a few seconds to complete, during which there will be no
  connectivity. No connectivity could be somewhat annoying e.g. if the
  customer has a time-critical application such as a voice call going on
  while moving from one foreign network to another.  Our point is that in
  the end, it is a policy decision of the foreign network to allow or deny
  this kind of short amount of free access.  Mandating that AAA and Mobile
  IP messages MUST be bound together will disallow such a policy.

3 AAA processing is likely to be in user space; Mobile IPv6 signalling
  is handled within the IPv6 stack in the kernel.  While it is possible to
  extract Mobile IPv6 binding updates and acknowledgements from the IPv6
  destination options and bundle them with AAA messages, it will be a rather
  hairy operation.

Still, it is important to stick to the 'single Internet traversal'
limit when it is possible to do so.  Therefore, we propose:
- to not make the bundling of AAA and mobile-IP messages mandatory but
  leave it to the 'attendant' (e.g., mobile-IPv4 FA) to decide, presumably
  based on
  1) local policy,
  2) preference indicated by MN, and/or
  3) whether the domain part of the MN-NAI and the home address of the MN
  (when supplied) correspond to the same domain
- to optionally allow MN to indicate its preference to the attendant. The
  preferences could be: none, 'bundle AAA and MIP messages', or 'send AAA
  and MIP messages in parallel'

What do you think of the above points ?  Do they make any sense ?

Best Regards,

        Patrik Flykt <[email-masked]> & N.Asokan
<[email-masked]>

---

From: Basavaraj Patil <[email-masked]>
Date: Wed, 27 Oct 1999 14:46:58 -0500

>  is the credit-card company's Internet authorization server, or some other

It's an interesting point. Another thing to consider here is that
a small ISP who provides Mobile IP service does not want to
manage/maintain their own AAA entities may be served by a AAA service
provider. In such a case the home domain of the MN which is the ISP,
and the AAA entity which provides AAA services to this ISP may be
different administrative domains. There is an implicit assumption in
the requirements document that the home domain of the MN will also
include AAA services within the same administrative domain.

In this scenario I agree that AAA and MIP integration MUST not be
mandated.

>  IP messages MUST be bound together will disallow such a policy.

I am infering quick/smooth handoff from your example here. This may be
possible by ensuring that the adjacent network that the mobile node
roams into, is already aware of the possibility of providing service to
the MN, prior to the MN actually being transitioned to it's
network. Presumably the new network that the MN roams into has already
authenticated the MN via the AAA infrastructure or may interact with
the previous network that the MN was in to perform AAA functions. This
may significantly reduce the time taken before connectivity is
provided. Another possibility is that the new network that the mobile
roams in may provide 'x' amount of access time free, which would give
the network sufficient time to perform the AAA functions and hence you
would not see any (significant) impact on time-sensitive applications
like voice. There are many possibilities here and there is work
ongoing in this area (as seen by a couple of I-Ds being presented at
this IETF).

I do not see as much a concern here w.r.t AAA and Mobile IP messages
being bound together.

>  and MIP messages in parallel'

Your proposal SHOULD be considered. I hope we can do so either at
IETF46 or on the discussion list.

>What do you think of the above points ?  Do they make any sense ?
I agree with a couple of your points (1 & 3).

Cheers,
-Raj

---

From: Patrik Flykt <[email-masked]>
Date: Thu, 28 Oct 1999 09:22:20 +0300

Hello again,

>ongoing in this area (as seen by a couple of I-Ds being presented at

Actually, we were thinking of a MN moving between two separate foreign
networks, i.e. the only mobility agent these two service providers would
"share" would be the HA of the roaming MN.  Therefore, MN would have to do
a new registration with its HA. Since the MN also is using a time-critical
service at the same time, having to do time-consuming AAA processing will
negatively impact the time-critical service.

However, the foreign network wishing to avoid interruptions in
time-critical services to its customers, could make a policy decision to
give 'x minutes' of free access time' during which the AAA processing
could take place. However, avoiding interruptions implies doing mobile IP
registration with the HA as quickly as possible. We saw this yet another
argument against the 'MUST' in binding the Mobile IP messages and the AAA
messages together.

If more discussion arises, we are happy to continue it here on the
mailing list and/or at IETF46.

Best Regards,