Subject: RE: [netlmm] getting the identity of the mobile node

From: "Jari Arkko" <[email-masked]>
Date: Thu, 2 Aug 2007 20:26:30 +0300

Agreed that there are non-eap accesses, and that open access is a possibility.

Regarding allowing multiple schemes: yes, we have to do that. However, for truth in advertising reasons and for convincing ourselves of the correctness of our design, leaving this completely out of scope would be bad, too. I would suggest documenting the SEND and AAA schemes, at least on the level I outlined in the previous mail.

Jari

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 2 Aug 2007 10:57:30 -0700

Yes, that sounds reasonable. 

Vidya 

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Thursday, August 02, 2007 10:27 AM
> To: Narayanan, Vidya
> Cc: [email-masked]
> Subject: RE: [netlmm] getting the identity of the mobile node
> 
> Regarding allowing multiple schemes: yes, we have to do that. 
> However, for truth in advertising reasons and for convincing 
> ourselves of the correctness of our design, leaving this 
> completely out of scope would be bad, too. I would suggest 
> documenting the SEND and AAA schemes, at least on the level I 
> outlined in the previous mail.
> 
> Jari
> 
>

---

From: Julien Laganier <[email-masked]>
Date: Mon, 6 Aug 2007 15:30:58 +0200

On Thursday 02 August 2007, Jari Arkko wrote:
> Regarding allowing multiple schemes: yes, we have to
> do that. However, for truth in advertising reasons
> and for convincing ourselves of the correctness of
> our design, leaving this completely out of scope
> would be bad, too. I would suggest documenting the
> SEND and AAA schemes, at least on the level I

Jari,

Thanks for the comments, I agree completely since I had 
came across the issues you're mentioning when 
designing a complete mechanism for MN identification 
based on network access authentication.

At that time I concluded that something else was needed 
in addition to network access authentication, and 
thought that was better left out of scope of the 
document since there were multiple ways to realize the 
missing part (such as, as you suggest, relying on, 
e.g. an L2-specific identity, or a RADIUS 
Chargeable-User-Identifier attribute).

I think it is reasonable to document as much as we can 
what's needed for proof or correctness of the design.

Regarding open-access system, the current document 
describes the use of a SEND-based mechanism that 
handles secure identification of the MN based on its 
SEND public key. 

Regarding a AAA scheme, the document could specify the 
use of a RADIUS Chargeable-User-Identifier attribute 
to carry to the MAG an identifier to be used as a MN 
ID which remains constant during the presence of the 
MN in a given NETLMM domain. It is unclear to me what 
would be the DIAMETER counterpart to RADIUS CUI. 

Finally, for others systems (e.g. 3GPP, 3GPP2, etc.) we 
could state that the MAGs of a NETLMM domain requires 
knowledge of MN ID that is 1) securely bound to the 
MN, and 2) remains stable across handovers, and 
perhaps suggest couple of such identifiers...

Thoughts?

--julien

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Mon, 6 Aug 2007 09:51:14 -0400

Hi Julien,

> 2) remains stable across handovers,...

I think this should be a requirement in general (not 3GPP, 3GPP2
specific). Otherwise, we have to deal with changing MN IDs for an
ongoing PMIP6 session. 

Do you agree?

-Kuntal

> From: Julien Laganier [mailto:[email-masked]]
> Sent: Monday, August 06, 2007 8:31 AM
> To: [email-masked]; Jari Arkko
> Subject: Re: [netlmm] getting the identity of the mobile node
>

---

From: Jari Arkko <[email-masked]>
Date: Mon, 06 Aug 2007 16:56:41 +0300

> handles secure identification of the MN based on its 

Yes.

> would be the DIAMETER counterpart to RADIUS CUI. 

RADIUS attributes can be carried on top of Diameter;
generally speaking there is no need to define another
attribute to duplicate the same functionality in
Diameter.

Jari

---

From: <[email-masked]>
Date: Tue, 21 Aug 2007 15:22:36 +0200

Hi Julien,

Just a quick comment on this old mail.

> Regarding a AAA scheme, the document could specify the use of 
> a RADIUS Chargeable-User-Identifier attribute to carry to the 
> MAG an identifier to be used as a MN ID which remains 
> constant during the presence of the MN in a given NETLMM 
> domain. It is unclear to me what would be the DIAMETER 
> counterpart to RADIUS CUI. 

Some SDOs use RFC4006 Subscription-ID as a CUI counterpart. One
could also use CUI ~directly in Diameter (based on the RADIUS
attribute compatibility space rule).

Cheers,
	Jouni