Subject: RE: [mobile-ip] Re: mobile-ip] Multiple flows with single NAI

From: "Glenn Morrow" <[email-masked]>
Date: Mon, 14 May 2001 10:15:03 -0500

There is nothing wrong with allowing multiple devices to use the same NAI. I
wouldn't call it a user address, though. I would call it a subscription
identifier. I know this could be construed as a semantics thing but user
address just brings up the wrong concoction of what it should really be used
for. 

NAI is a generic definition that can be used to identify almost anything.
MIP specifications need to be explicit in what fields which use the NAI form
mean and in what context, IMO.  

On PAT's question about each device having it's own NAIs - you can. But if
you enforce this (i.e. no two devices can use the same NAI) then you've
essentially begun using the NAI as a device identifier. 

Perhaps we need a device identifier which uses the NAI form, as well, to
allow the HAs to blacklist known fraudulent devices?

Maybe we need more than one field, (user, subscription, device) that use the
NAI form?

I wouldn't define user in MIP because there are simply some user mobility
functions that can't be solved at layer 3 - again the wrong concoction.

Another option would be to do something like
[email-masked] but then you get into coupled business
models i.e. the application provider must be the network service provider or
have a special directory updating arrangement etc.. - not exactly the
WWW-way.

Glenn

-----Original Message-----
From: Gopal Dommety [mailto:[email-masked]]
Sent: Friday, May 11, 2001 4:20 PM
To: [email-masked]; [email-masked]
Subject: Re: [mobile-ip] Re: mobile-ip] Multiple flows with single NAI

At 09:10 AM 5/11/2001 -0700, Pat Calhoun wrote:
>On Fri, May 11, 2001 at 12:13:33PM -0400, Madhavi Subbarao wrote:
> >
> > The FA should maintain pending registrations by
> > (USER NAI, Binding ID)...because it cannot rely just on NAI for
> > identification anymore.
>
>I've been disconnected from this thread since it began, but have one
>question that may have already been asked.
>
>Why can't a device have a single NAI per binding? This seems like a
>simple approach, and doesn't require any protocol changes.

Pat,

What the operators want is to be able to have a single NAI and allow 
multiple devices to
be on the network at the same time based on that NAI. Basically the same 
security Key, and
possibly accounting will be used for all of the devices. In order to 
distinguish one  device from
another during registration/address allocation, we need the Binding ID.

One way of solving the problem is , as you suggested, by using different 
NAIs. The reason that the operators
do not want to do that is that of  operations, management, and billing. 
Since all these devices are with the
same account, they want to have one NAI, one Key, and billing etc.

This operator request is similar to that of in the dial-up world of having 
multiple sessions. In that space people
use the NAS Port to be able to distinguish (I am sure you are aware of the 
ugliness of this solution).

Thanks
Gopal

>PatC

---

From: Madhavi Subbarao <[email-masked]>
Date: Tue, 15 May 2001 16:00:28 -0400

> address just brings up the wrong concoction of what it should really be used

Agreed.  We are interpreting the NAI in the same way as you describe
for 'subsription ID'.

> essentially begun using the NAI as a device identifier. 

Exactly.  The idea is to keep the NAI as a user/subscription ID and
authenticate based on the NAI as usual, and then identify the devices
based on another ID...Device/Binding ID.

> allow the HAs to blacklist known fraudulent devices?

Well, the Device/Binding ID could indeed be a 'globally' unique
identifier similar to the NAI form (although I'm not sure how you
guarantee uniqueness).   As I mentioned on another email in this
thread, there are several choices on how to define the Device/Binding
ID.  Glenn, did you have any thoughts on those formats?  

> Maybe we need more than one field, (user, subscription, device) that use the

Subscription ID = NAI as is today, Device ID = Device/Binding ID to be
defined...so what's 'User ID'?  Why you feel we need another level of
identification?

> have a special directory updating arrangement etc.. - not exactly the

I'm not sure we need to get that detailed or coupled.

-Madhavi