Subject: RE: [mobile-ip] Re: mobile-ip] Multiple flows with single NAI

From: "Glenn Morrow" <[email-masked]>
Date: Tue, 8 May 2001 12:17:24 -0500

Madhavi,

I'm saying that layer 3 in general doesn't solve the more complex user
mobility functions and so the NAI used in MIP should probably not be used as
a user identifier. 

For instance, how could an HA (router) discriminate between devices to
tunnel the packet to? The NAI does not exist in every IP packet that comes
in. 

The HA also does not know when to multi-cast to a set of devices or try one
device at a time. Nor does it know which devices are appropriate for the
communication or not. 

There certainly are not any standardized extensions to MIP for these
functions; although, I really wouldn't even try to go there. The solution
leads to a sniffing HA.

I guess for single device communications you could use it as a user id. But
this will only work for a limited set of application functionality in the
long term.

I would recommend using it as an (network-layer provider) subscription id
for authentication. 

A user id and the more complex applications of user mobility is a layer 5
and above problem set.

Glenn

-----Original Message-----
From: Madhavi Subbarao [mailto:[email-masked]]
Sent: Wednesday, May 02, 2001 3:56 PM
To: [email-masked]
Subject: [mobile-ip] Re: mobile-ip] Multiple flows with single NAI

Hi Glenn,

Sorry for the delayed response...

On Tue, May 01, 2001 at 11:19:29AM -0500, Glenn Morrow wrote:
> Madhavi,
> 
> 
> Are you thinking of the NAI as a:
> 
> subscription identifier
> user identifier
> Equipment identifier?

As a user identifier.  The NAI identifies the user, not the device.

> It seems to me that each device might have different home
> addresses. 

Yes, actually that's what we are saying.  Each device will have a
different home address...authentication is based on NAI (as is currently).
The HA authorizes the (NAI, IP address) combination.

> The key
> can be a bit more complex than just an NAI into a database/directory used
> for any purpose.

I'm afraid I didn't catch your point.  Are you saying that you can't
still authenticate based on NAI?  Please elaborate...

Regards,
Madhavi

> -----Original Message-----
> From: Madhavi Subbarao [mailto:[email-masked]]
> Sent: Monday, April 30, 2001 6:53 PM
> To: [email-masked]
> Cc: Madhavi W Subbarao
> Subject: [mobile-ip] Multiple flows with single NAI
> 
> 
> Hi All,
> 
> For viable deployment of MIP, it seems necessary to support single NAI
> with multiple static IP flows.  For example, if a user opens a MIP
> session on his laptop and then wants another MIP session on his phone,
> he couldn't do that now with a single NAI .  Now when an HA receives
> an RRQ with NAI and homeIP#2, but it already has a binding for NAI
> and homeIP#1, the binding gets 'overwritten'.  Hence, only one MIP
> flow can be supported per NAI.  Theoretically, we can say to use
> multiple NAIs, but practically, it's not possible.  Many service providers
> do not want to create multiple NAIs and user records for multiple
> devices/applications or instances of the mobile user.
> 
> While it seems natural then to allow multiple static IPs for the same NAI 
> (dynamic IPs also, but that needs another level of identification),
> neither RFC2002 nor RFC2974 outline the behavior that should be
> followed by the various entities.  The specs certainly do not preclude
> the above, but clarity in behavior is needed.
> 
> We believe this is a simple, yet important issue for deployment and would
> like feedback from the WG.
> 
> We've submitted a draft that addresses the above.
>
http://search.ietf.org/internet-drafts/draft-subbarao-mobileip-multipleip-00
> .txt
> Thanks,
> Madhavi

---

From: Madhavi Subbarao <[email-masked]>
Date: Wed, 9 May 2001 16:47:59 -0400

Hi Glenn,

> tunnel the packet to? The NAI does not exist in every IP packet that comes

True...every IP packet does not have an NAI.  However, the HA can
distinguish between different MN bindings using the tuple 
(NAI, IP address).  The draft we propose outlines the behavior for NAI
and multiple STATIC IP addresses...(NAI, IP address) is used as the
'identifier' at the HA.  There is no need for the HA to multicast or
sniff.  We are thinking of the NAI as an identifier for the USER
behind the device...if that makes sense.  It's analogous to what you
describe below as a 'subscription id', so I think we are on the same
page.

Since NAI identifies and authenticates the USER, it shouldn't matter
which device the USER is coming in on.  Moreover, the USER shouldn't
be constrained to use only a single device.

-Madhavi