Subject: RE: device ID types

From: <[email-masked]>
Date: Wed, 6 Nov 2002 19:08:17 +0200

Alper,

Then, in both cases, it would be possible for the authenticated PANA clients to spoof IP addresses. What is the control mechanism for preventing this?

- Dan

> -----Original Message-----
> From: ext Alper E. YEGIN [mailto:[email-masked]]
> Sent: 06 November, 2002 09:27
> To: Pana (E-mail)
> Subject: device ID types
> 
> 
> 
> More thoughts on the device ID....
> 
> In most of the cases, a device ID could be the link-layer
> address of the client's device. Since PaC, PAA, and EP are on 
> the same link, this should work. Also, it'd inefficient to require
> PaC to use PANA for each IP address it configures. PAA can grant
> access to a link-layer address regardless of the configured
> IP addresses.
> 
> When PANA is followed by IPsec for per-packet authentication,
> an IP address should be used as the DI for the PaC. An IPsec
> tunnel will be created between PaC and, say, router. The IP
> addres would be the local tunnel end-point on the PaC. This time
> PaC can configure other IP addresses inside this tunnel,
> and the tunnel is seen as lower-layer. As long as these
> addresses are used inside the tunnel, they don't have to be used
> as DI with additional PANA exchanges.
> 
> Comments?
> 
> alper
> 
> 
> 
>

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 6 Nov 2002 12:05:18 -0800

> Alper,
>
> Then, in both cases, it would be possible for the authenticated PANA
clients to spoof IP addresses. What is the control mechanism for preventing
this?

Quick answer would be, this problem is outside the scope of PANA :)

This authorization problem might relate to or benefit from SEND work.
It requires dealing with ownership of IP addresses.

alper