Subject: RE: [mobile-ip] RR frequency and cdma2000

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Mon, 25 Mar 2002 10:55:50 -0600

>Hi,
>
>The draft states:
>
>> 14.3. Security for the Binding Updates to the Correspondent Nodes
>
>>    [..]  For this reason, this specification limits the validity of
>>    RR authorized bindings to a maximum of five minutes after the
>>    last RR check has been performed.
>
>
> In cdma2000 spectrum is expensive and quite a lot of attention is
> given to minimizing control/signaling overhead, not to mention
> compressing packet headers. Having to send the RR check messages
> every five minutes is an issue.
> Also, after mobile sends data it stays active some number of seconds
> (like 20-30) beyond the last bit sent.  The five minute requirement
> implies that mobiles using the RR check would be active 5-10% of the
> time even when they have nothing to send because they have to wake up
> every five minutes just to do the RR check.  That's a problem.

The lifetime of the entry in the BCE is 5 minutes. If the MN does not
have an ongoing session (sending or receiving packets) it does not
have to wake up to update the BCE in the CN. And CNs may simply let a
BCE cache entry expire. CNs are not required to send a binding request
to MNs for which they have a BCE. So the RR check would not be
required. The RR check needs to be done only when you have an active
session. The implication of the 5 minutes is that there would be
additional messaging every 5 minutes in order to maintain RO between
the MN and CN.

>
> If the CN is a voice gateway or conference bridge that is owned by
> the same carrier that owns the HA, and the route between the HA and
> CN resides within the carrier, the risk of an attacker being able to
> monitor the CN-HA route could bezero for practical purposes.  Another
> case would be if the mobile runs TLS above MIPv6. It doesn't seem
> that frequent RRs buy very much.
>

Well you have to remember that the RR based RO is for the cases where
you do not have any infrastructure to verify the valdity of a home
address claimed by an MN. In the above example, you would not be
required to do RR at all. You could use an infrastructure based
solution and establish a binding security association with the CN
whose lifetime can be significantly higher.

> Is it really necessary to mandate a five minute lifetime for all
> applications?
>

RO itself is not required in all cases. If you are only doing a DNS
query for example, you do not need to do RR and have RO traffic
between the MN and the DNS server.

> thanks,
> Tom Hiller

-Basavaraj