Subject: RE: [mobile-ip] Re: mobile-ip] Re: mobile-ip] Multiple flows with single NAI

From: "Glenn Morrow" <[email-masked]>
Date: Wed, 16 May 2001 09:28:55 -0500

GM] Below

-----Original Message-----
From: Madhavi Subbarao [mailto:[email-masked]]
Sent: Tuesday, May 15, 2001 3:00 PM
To: [email-masked]
Subject: [mobile-ip] Re: mobile-ip] Re: mobile-ip] Multiple flows with
single NAI

On Mon, May 14, 2001 at 10:15:03AM -0500, Glenn Morrow wrote:
> There is nothing wrong with allowing multiple devices to use the same NAI.
I
> wouldn't call it a user address, though. I would call it a subscription
> identifier. I know this could be construed as a semantics thing but user
> address just brings up the wrong concoction of what it should really be
used
> for. 

Agreed.  We are interpreting the NAI in the same way as you describe
for 'subsription ID'.

GM] Excellent - now if we can just get people to stop calling it user.

> 
> NAI is a generic definition that can be used to identify almost anything.
> MIP specifications need to be explicit in what fields which use the NAI
form
> mean and in what context, IMO.  
> 
> On PAT's question about each device having it's own NAIs - you can. But if
> you enforce this (i.e. no two devices can use the same NAI) then you've
> essentially begun using the NAI as a device identifier. 

Exactly.  The idea is to keep the NAI as a user/subscription ID and
authenticate based on the NAI as usual, and then identify the devices
based on another ID...Device/Binding ID.

> Perhaps we need a device identifier which uses the NAI form, as well, to
> allow the HAs to blacklist known fraudulent devices?

Well, the Device/Binding ID could indeed be a 'globally' unique
identifier similar to the NAI form (although I'm not sure how you
guarantee uniqueness).   As I mentioned on another email in this
thread, there are several choices on how to define the Device/Binding
ID.  Glenn, did you have any thoughts on those formats?  

GM] Yes - identify the MAC technology and vendor that does with a level of
certainty guarantee uniqueness ex.  imei.umts, eid.cdma-2k,
ether-address.ieee802xxx, etc..

> Maybe we need more than one field, (user, subscription, device) that use
the
> NAI form?

Subscription ID = NAI as is today, Device ID = Device/Binding ID to be
defined...so what's 'User ID'?  Why you feel we need another level of
identification?

GM] I don't believe we should use the term user and associate "user id" in
any way with a node mobility solution - subscription and device are what it
should be concerned with. I'm glad you agree. I was just saying that if some
belligerents can't seem to figure out that user-id in MIP is the wrong thing
and they must include a user id then please at least make it separate.

> I wouldn't define user in MIP because there are simply some user mobility
> functions that can't be solved at layer 3 - again the wrong concoction.
> 
> Another option would be to do something like
> [email-masked] but then you get into coupled
business
> models i.e. the application provider must be the network service provider
or
> have a special directory updating arrangement etc.. - not exactly the
> WWW-way.

I'm not sure we need to get that detailed or coupled.

GM] Again we agree.

Thanks,

Glenn