Subject: RE: Issue 5: Updating device identifier

From: <[email-masked]>
Date: Tue, 13 May 2003 09:29:00 +0300

Alper,

MIPv6 is an example of mobility management, where the basic 
movement detection is based on the subnet prefix of the router 
advertisement. This means that client changes it's CoA address 
(even inside one domain). 

- Dan

> -----Original Message-----
> From: ext Alper Yegin [mailto:[email-masked]]
> Sent: 13 May, 2003 03:33
> To: pana
> Subject: Issue 5: Updating device identifier
> 
> 
> 
> http://danforsberg.info:8080/pana-issues/issue5
> 
> So, when does the PaC need to update its device identifier?
> 
> I don't think it ever needs to update its device identifier 
> if DI is its
> link-layer address. Generally an IP node should not have to change its
> link-layer address.
> 
> If it is using RFC3041 - Privacy Extensions, this should not 
> effect the IPv6
> address used either. When IP address is used as the DI, it'd be the
> link-local IPv6 address. Changing the global IPv6 addresses which are
> tunneled inside packets whose src/dst is the link-local address won't
> require a change in DI.
> 
> I'm not sure what is meant by "mobility management". What 
> form of mobility
> will require change in DI in the context of a PANA session?
> 
> One scenario we have identified so far which potentially requires a DI
> modification:
>     
>     Imagine a network which uses IPsec for access control but does not
>     assign any IP address to PaC before they are authenticated.
>     
>     PaC successfully authenticates with the PAA without 
> acquiring an IP
>     address initially. At this point, DI is the IP address, 
> but its value is
>     0.0.0.0 or 0::0. Using the PANA SA and the PANA session 
> identifier, PaC
>     can securely obtain an IP address from DHCP. Now PaC can 
> re-auth in
>     order to notify the PAA (and, in turn EPs) about its IP 
> address. When
>     the EP learns the new IP address, it can engage in IKE, etc. to
>     kick-start IPsec-based access control.
> 
> I don't know of this really requires DI change, but here is 
> something else
> to consider:
> 
>     When a PaC moves within the same access domain, instead of
>     requiring a full authentication, network might be able to
>     re-authenticate it using its ongoing PANA session with 
> another PAA of
>     the domain (if it hasn't expired already).
> 
>     PaC can send its PANA session ID along with PANA_start 
> message sent to
>     PAA. If the PAA has means to obtain a still valid PANA SA from the
>     previous PAA, it can respond with a PANA_reauth, instead 
> initiating a
>     full authentication. Now PaC can respond with 
> PANA-reauth, and tag along
>     the new DI.
> 
>     The mechanisms needed to transfer PANA SA from one PAA to 
> another would
>     be outside the scope of PANA. Context transfer protocol 
> (see Seamoby WG)
>     might be used here.
> 
> Comments?
> 
> Alper
> 
>

---

From: Alper Yegin <[email-masked]>
Date: Tue, 13 May 2003 11:09:31 -0700

Dan,

> (even inside one domain).

OK, that'd not be changing DI in the "same PANA session" in my mind.
So far a PANA session is tied to a link. We have not defined how they a PANA
session survives when PaC changes its attachment. [actually, I don't think
we need to either].

But please see the last part of my message below. I think this maps to what
you are referring to. PANA session is not migrated from one link to another,
but instead some bits of PANA SA is transferred, PaC inserts the new DI, and
a new PANA session is established at the new link.

Alper