Subject: RE: [mobile-ip] Mult iple flows with single NAI

From: Mukesh Sharma <[email-masked]>
Date: Fri, 11 May 2001 13:59:14 -0400

Madhavi,

> -----Original Message-----
> From: Madhavi Subbarao [mailto:[email-masked]]
> Sent: Thursday, May 10, 2001 5:57 PM
> To: [email-masked]
> Subject: [mobile-ip] Re: mobile-ip] Re: mobile-ip] Re: mobile-ip] Re:
> mobile-ip] Mult iple flows with single NAI
> 
> We were thinking along the lines of a Binding ID...an ID to identify
> the particular binding/flow using a single NAI.  The FA and HA 
> will then use the (NAI, Binding ID) as the identifier to distinguish
> the different bindings/flows.

If you are thinking on the lines of Binding ID, then the draft
(draft-subbarao-mobileip-multipleip-00.txt) of static IP address, where you
are using the IP address as binding doesn't make sense. It does describe the
problem though. We can have a single solution for both static and dynamic
case. Only we need to define a single and unique Binding ID as a means which
along with NAI can be used to identify a MIP flow.

> We've been debating on what form the Binding ID should take...
> - globally unique - can be used directly as the ClientID to a DHCP/DNS
> server...(but, how do you ensure uniqueness).
> - index - tied to NAI for interpretation (requires some sort of
> Binding ID management on the MN to know which indices have been used,
> etc.)
> - index-marker - again, tied to NAI for interpretation, but each
> device uses a particular index-marker, and the HA does a mapping of
> this index-marker and authorizes the Binding ID.

NAI of the device (as pointed out by Haseeb) along with some index which is
managed by the MS (point 2 of yours) - needed to differenciate multiple MIP
sessions from the same device - should make the binding ID and should be
sent in RRQ. 

> Note that HA would still have to authorize the Binding ID
> because it's not possible to authenticate based on NAI and identify
> based on something else...opens up security holes.

If the Binding ID is unique, for authorization only NAI should be enough. I
am not sure why do you think that Binding ID need to be authorized by the
HA. If it is not unique, then we have other problems to worry about -
identify MIP flow at HA/FA again.

Sharma

---

From: Madhavi Subbarao <[email-masked]>
Date: Fri, 11 May 2001 15:40:56 -0400

Sharma,

> are using the IP address as binding doesn't make sense. It does describe the

We are thinking of Binding ID for the dynamic case.  As I mentioned
before, draft-subbarao-mobileip-mulitpleip-00.txt is for the
static IP address case and just clarifies behavior.  So, it does make sense.

> case. 

The solutions for both cases will be different.  The static case does
not require any change to the standards, just clarification.  The
solution for the dynamic case will require modifications.  Maybe at
the end, we can merge the two drafts, but to say that there is a
single solution is not accurate.

>Only we need to define a single and unique Binding ID as a means which

Oh, are you suggesting a Binding ID for the static case also?  I don't
think you need to do this.

> sessions from the same device - should make the binding ID and should be

Yes, that is the intention...to send the Binding/Device ID in the RRQ,
authenticated by the MHAE.

> identify MIP flow at HA/FA again.

If there is no authorization, the HA will authenticate based on NAI,
and then just take the Binding ID as part of the identifier.  But, the
Binding ID can be spoofed by another MN say.  I ran this by some
security folks, and that's the feedback that I received. 

I like the Binding ID being unique, but how do we guarantee that?

-Madhavi