Subject: RE: [mobile-ip] Re: mobile-ip] Re: mobile-ip] Re: mobile-ip] Mult iple flows with single NAI

From: Mukesh Sharma <[email-masked]>
Date: Thu, 10 May 2001 13:20:29 -0400

> -----Original Message-----
> From: Madhavi Subbarao [mailto:[email-masked]]
> Sent: Thursday, May 10, 2001 12:00 PM
> To: [email-masked]
> Subject: [mobile-ip] Re: mobile-ip] Re: mobile-ip] Re: mobile-ip]
> Multiple flows with single NAI
> 
> Yes, this draft is specific to Static IP addresses.  We will be
> submitting another draft detailing the behavior for Dynamic IP address
> allocation with a single NAI.  At first glance, it might seem 
> similar, but
> infact there are other issues.  Another level of abstraction is needed
> to distinguish between different MIP 'flows'.  For example, if a USER
> is registering on two different devices, the RRQ's would look 
> the same...
> (NAI, 0.0.0.0 as the home address).  But, when introducing
> another level of identification, additional measures need to be taken
> to ensure no security hole is being introduced.
> 
> Thanks,
> Madhavi
> 

That was the point I was making, need another level of abstraction for it to
work at all the levels including the FA and HA. Plus at FA, how will FA know
that if Mobile station is sending multiple requests or just retrying.

Sharma

---

From: Madhavi Subbarao <[email-masked]>
Date: Thu, 10 May 2001 17:56:40 -0400

Sharma,

> that if Mobile station is sending multiple requests or just retrying.

We were thinking along the lines of a Binding ID...an ID to identify
the particular binding/flow using a single NAI.  The FA and HA 
will then use the (NAI, Binding ID) as the identifier to distinguish
the different bindings/flows.

We've been debating on what form the Binding ID should take...
- globally unique - can be used directly as the ClientID to a DHCP/DNS
server...(but, how do you ensure uniqueness).
- index - tied to NAI for interpretation (requires some sort of
Binding ID management on the MN to know which indices have been used,
etc.)
- index-marker - again, tied to NAI for interpretation, but each
device uses a particular index-marker, and the HA does a mapping of
this index-marker and authorizes the Binding ID.

Note that HA would still have to authorize the Binding ID
because it's not possible to authenticate based on NAI and identify
based on something else...opens up security holes.

Then, ClientIDs would have to be some combination of the NAI and
Binding ID.  

Thoughts?

-Madhavi