Subject: [netlmm] getting the identity of the mobile node

From: Jari Arkko <[email-masked]>
Date: Thu, 02 Aug 2007 13:24:32 +0300

This is a continuation of my comment on the mike in
Chicago.

When Julien was explaining what to do about the
identity on the MN-AR interface, he referred to
getting the identity from EAP. This is also reflected
in draft-ietf-netlmm-mn-ar-if Section 6.1.

I just wanted to remind everyone that this is not
as trivial as it sounds:

   When the MN_ATTACH functions includes a network access authentication
   protocol, such as EAP [RFC3748], the MN identifier authenticated by
   the network access authentication protocol is a valid MN ID it
   satisfies above constraints (freshness of authentication, verifiable
   by the MAG).

EAP protocol does carry an identifier in the EAP Identity Response
message. However, there are a few factors that complicate its
use:

o  There is no requirement that the identity exchange be employed
    always (RFC 3748).

o  The identity supplied in this could be a privacy NAI (RFC 4282).
    Such a NAI only contains domain, not username part.

o  The identity supplied in this could be a pseudonym that changes
    for every new authentication (RFC 4187).

o  The identity could be supplied within a method (RFC 4186) so
    that its only available for the peer and the server, not the
    authenticator. Hence the access network would not be able to
    get it.

o  It is not recommended to start dictating EAP usage or method
    selection based on what the access network needs from EAP.
    EAP usage is largely decided between the server and the
    peer, and is a provisioning issue that should stay independent
    of what access networks do.

As a result, it is practically not possible to retrieve the identity
from EAP in this manner.

Please take this issue into account when working on the protocol.
I don't think its impossible to employ the network access facilities
for delivery of the MN ID. But if you have not already done so,
you must explain the recommendations to the readers in your
documents so that they realize what they have to do. Some of
possibilities that could be employed include:

o   Every fast-reauthentication scheme at L2 has some concept
     of a session identifier; this could be used to provide the same
     identity to the MN while it is transitioning through the network
     using fast-reauthentication. But this does not work for
     completely new auth. Not clear it has to, though...

o   AAA could provide a stable identifier to the access network from
     home (e.g., Chargeable-User-Identifier attribute in RADIUS).
     This is not a perfect scheme, however, because then you require
     deployment of this attribute on the server side before you can
     use this. Also, since the server has no idea what's going on in 
     the access network, it would probably give the same ID every
     time, making all access networks (netlmm or not) get
     privacy sensitive information.

o   Specific link layers may have specific capabilities to do what
     is needed here. Cellular networks have this, for instance.

Jari

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 2 Aug 2007 09:52:04 -0700

Hi Jari,
Thanks for starting this thread.  I agree with everything below.  In
addition to the notes below, I will also note that some systems do not
employ EAP for network access authentication and some systems may be
open access systems - even though we may not know of open access systems
employing NETLMM today, I don't think we should shut the door to that by
assuming that the identity is acquired from network access
authentication.  

One of my suggestions from early on has been that we don't specify a
single method of obtaining the identity of the MN; rather, we specify
the possible ways in which an identity may be obtained - some are just
specific to link layers and may even be MAC addresses, for instance.
Others may be things like CUI or perhaps the Accounting-Session-ID in
RADIUS or even an ID returned from AAA for network use as long as a
mobile is attached to that network (available in some systems).  It
could be the APN in 3gpp LTE or UATI in 3gpp2 UMB.  

So, the spec would say that the specific means of obtaining the identity
of the MN is out of scope and list some of the possible ways of getting
it.  At the moment too, we have not specified any normative behavior
requirements for getting the identity, but, the behavior seems to be too
focused on using network access authentication for this purpose.  So,
some rewording would be appropriate in my view. 

Thoughts? 

Vidya

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Thursday, August 02, 2007 3:25 AM
> To: [email-masked]
> Subject: [netlmm] getting the identity of the mobile node
> 
> 
> This is a continuation of my comment on the mike in Chicago.
> 
> When Julien was explaining what to do about the identity on 
> the MN-AR interface, he referred to getting the identity from 
> EAP. This is also reflected in draft-ietf-netlmm-mn-ar-if Section 6.1.
> 
> I just wanted to remind everyone that this is not as trivial 
> as it sounds:
> 
> EAP protocol does carry an identifier in the EAP Identity 
> Response message. However, there are a few factors that complicate its
> use:
> 
> As a result, it is practically not possible to retrieve the 
> identity from EAP in this manner.
> 
> I don't think its impossible to employ the network access 
> facilities for delivery of the MN ID. But if you have not 
> already done so, you must explain the recommendations to the 
> readers in your documents so that they realize what they have 
> to do. Some of possibilities that could be employed include:
>

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Thu, 2 Aug 2007 16:13:25 -0400

Hi Jari,

Thanks for bringing this issue up for discussion. I have a few comments
on the possible solutions, please see inline....

>      completely new auth. Not clear it has to, though...

For fast-reauth and complete-reauth (basically any re-auth) the access
network / MAG should not be changing the MN-ID that was used initially
to create the PMIP6 binding in the LMA. Access auth is an independent
process which has no tie-in with PMIP6. So, there will be situations
where the MN has to go through re-auth which may create new identifiers.
However, to circumvent the change of MN-ID in the middle of a PMIP6
session, the MAG should remember the initial one that was used to create
the PMIP6 binding.

>      privacy sensitive information.

The AAA server should handout a stable MN-ID that the MAG can use. This
is useful in the case where the access auth does not require exchange of
MN-ID or the MN-ID exchanged during access auth only contains the domain
part of the NAI. This stable ID won't have to be static (i.e. never
change or change after very long time). The AAA server can send a new ID
every time the MN performs attach. This will mitigate the privacy
concerns to some degree.

>      is needed here. Cellular networks have this, for instance.

Yes. For instance what I mention regarding the MAG remembering the first
MN-ID is used in WiMAX NWG 1.0.

BR,
Kuntal

> Sent: Thursday, August 02, 2007 5:25 AM
> To: [email-masked]

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Thu, 2 Aug 2007 16:20:55 -0400

Hi Vidya,

I think it makes sense to leave the door open for the MAG to discover
the MN-ID that it should use in a variety of ways. Access-Auth can be
one of the possible ways.

Besides, we should also add a requirement that the MAG needs to use a
stable MN-ID that won't change in the middle of the PMIP6 session. In
case of those access systems where the MN-ID changes every time there is
an auth/re-auth, and the MAG relies on Access-Auth to discover MN-ID,
the MAG needs to remember the first MN-ID that was used to create the
PMIP6 session. Moreover, during inter MAG HO that the MN-ID should be
passed to the new MAG.

BR,
Kuntal

> From: Narayanan, Vidya [mailto:[email-masked]]
> Sent: Thursday, August 02, 2007 11:52 AM
> To: Jari Arkko; [email-masked]
> Subject: RE: [netlmm] getting the identity of the mobile node
> 
> Hi Jari,

---

From: Bruno Mongazon-Cazavet <[email-masked]>
Date: Fri, 03 Aug 2007 17:11:17 +0200

> some rewording would be appropriate in my view. 
Sounds good and reasonable!
Bruno.

---

From: "Sri Gundavelli" <[email-masked]>
Date: Sat, 4 Aug 2007 13:49:36 -0700

Hi Jari,

Ok. Currently, the spec does not specify the exact method
on how the MN-ID needs to be obtained. We just stated that
the mobile access gateway must be able to identify the
mobile node by its MN-Identifier and it must also be able
to associate this identity to the sender of any IPv4 or IPv6
packets on the access link. How this identifier is acquired
is not specified, as there are simply too many approaches.
We will try provide some guidance on how it could be done
using the Session Identifier or other approaches as you have
described below. We will work on it. Thanks for bringing this
up.

Regards
Sri