Subject: RE: [seamoby] Some proposed changes to the requirements draft.

From: "Gary Kenward" <[email-masked]>
Date: Tue, 13 Nov 2001 16:32:59 -0500

Sharif:
 
Sorry, but no, I do not agree. We had an extensive debate last spring over
the role of the MN
in CT, and (it is my understanding) that the MN should not, could not be
required to participate 
in CT. The rationale was that MN involvement would likely slow down the
process, and thus,
degrade the seamlessness.
 
CT is in support of seamless mobility (or at least, that's what I thought
this was all about).
If CT works, then the handover will be seamless. If, by exception, CT does
not work, then
seamlessness is lost and the service will degrade. What it degrades to is,
IMHO, a policy 
set by the operator (or a forced drop of all IP sessions due to the physics
of the channel). 
Having the MN authenticate the context does not improve seamlessness,
indeed, it can only degrade it, as the authentication process implies over
the air signalling,
and significant additional delays. And, definitely, if CT fails - e.g. if
the context has become
"stale" for some reason, then authentication does not help maintain
seamlessness. 
 
If CT failures, whether due to stale context or something else, creates
security problems, then
these need to be addressed. But, we should wait until we understand the
requirements for security
context transfer, before we state requirements for solutions to speculated
problems.
 
Gary
-----Original Message-----
From: Shahrier, Sharif M. [mailto:[email-masked]]
Sent: November 13, 2001 16:17
To: 'Nakhjiri Madjid-MNAKHJI1'; Shahrier, Sharif M.; Kenward, Gary
[WDLN2:AN10:EXCH]
Cc: [email-masked]
Subject: RE: [seamoby] Some proposed changes to the requirements draft.

Majid,
 
            Consider the case where the context transfer occurs before
handover. So, the context will arrive at the newAR before
            The mobile node does. What if something goes wrong - the context
is not correctly received by the newAR.
            When the MN arrives at the newAR, it needs to know this fact.
So, the MN should authenticate the received context, just
            To make sure that its context was successfully received by the
newAR.
 
-Sharif. 
 
Maybe you mean that the MN should authenticate the received context data,
but
then why does the MN should do this. The context is going to the new AR,
anyway.
If authentication of data is needed, new AR does it on behalf of MN.
 
Why are we dragging MN into the authentication process.
 
these issues are attacking the basic framework of CT, IMHO
 
Madjid
-----Original Message-----
From: Shahrier, Sharif M. [mailto:[email-masked]]
Sent: Tuesday, November 13, 2001 10:44 AM
To: 'Gary Kenward'; Shahrier, Sharif M.
Cc: [email-masked]
Subject: RE: [seamoby] Some proposed changes to the requirements draft.
Gary,
 
                Understood. However, the requirements contains nothing (?)
about the mobile authenticating with its context, after the context 
Has been transferred. 
 
I think a requirement should be there for this, otherwise, without
authentication, the MN can "get at" any context, or context feature that its
not authorized access to.
 
How about:
 
                There MUST be mutual authentication between the MN and its
context, after the context transfer has occurred.
 
-Sharif.
 
-----Original Message-----
From: Gary Kenward [mailto:[email-masked]]
Sent: Tuesday, November 13, 2001 11:07 AM
To: 'Shahrier, Sharif M.'
Cc: [email-masked]'
Subject: RE: [seamoby] Some proposed changes to the requirements draft.
 
Sharif:
 
  This requirement is for the ARs to authenticate each other so that a ct
exchange can
be trusted. It has nothing to do with the MN and handoff per se.
 
Gary
-----Original Message-----
From: Shahrier, Sharif M. [mailto:[email-masked]]
Sent: November 13, 2001 09:51
To: Shahrier, Sharif M.
Cc: [email-masked]'
Subject: RE: [seamoby] Some proposed changes to the requirements draft.

I have some issues with the following requirement in the CT draft.
 
4.9 The entities transferring context MUST have completed a mutual
authentication process prior to
      initiating the transfer.
 
I don't support this requirement.
 
It appears to me this may not fit the case for "break-before-make" handover
.  For instance, the mobile may break connection with the old
AP, and re-establish connection with the new AP. 
 
Assuming that the context is transferred prior to re-establishing the new
connection.
 
The mobile will need to re-authenticate after it makes a new connection at
its new AP.
 
I have seen several practical cases that supports this scanario, thus I feel
it is necessary for authentication after the transfer of context 
in "break-before-make".
 
-Sharif.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 13 Nov 2001 15:26:25 -0800

I agree with Gary. We were here last year, and consensus was clear. I see no reason
to start this whole debacle over again.

PatC