Subject: RE: [Seamoby] CARD between Routers - will CT do?

From: [email-masked]
Date: Wed, 15 Jan 2003 11:25:37 -0500

Hi James:

In event of IP-layer handoff, at some point MN needs to know IP address of router it is going to connect to. So, MN will know IP address of new AR, latest after handoff. 

I am not sure if I understood your example below.

Hemant

-----Original Message-----
From: ext James Kempf [mailto:[email-masked]]
Sent: Wednesday, January 15, 2003 11:18 AM
To: Chaskar Hemant (NRC/Boston); [email-masked]; [email-masked]
Subject: Re: [Seamoby] CARD between Routers - will CT do?

> Hemant --> I  agree with you that CARD should not mess with Internet routing
infrastructure. With Mobile IP, MN will know its old router and new router.
Thus, information about their geographical adjacency is already exposed to third
party. CARD should only be concerned about this information (however you
distribute it and use it) without impacting routing infrastructure in any way.
CARD is an edge phenomenon.

The MN only knows the AP identifier, it doesn't know the router.

For example, suppose I have an MN with an 802.11b card and two hotspot
providers, in different ASs, are providing service in the airport I happen to be
in: one does the United lounge and the other does the rest of the airport. If I
am standing next to the United lounge and using the provider for the rest of the
airport, my laptop may be able to see the BSSID for the United lounge but it
won't know anything about the IP routing infrastructure, unless, of course, CARD
or some other protocol tells it. Similarly, the routers in the other provider
won't know anything about the routers in the United provider.

            jak

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "James Kempf" <[email-masked]>
Date: Wed, 15 Jan 2003 13:16:02 -0800

The MN only knows the other router after it has a link connection with the other
ISP. And that typically requires the MN to negotiate an authentication exchange
with the other ISP's NAS.

In the example, the MN can hear the other ISP's AP layer 2 id, but, because it
hasn't negotiated an authentication exchange, it cannot discover the address of
the router.

The router in the current ISP's network doesn't learn the other ISP's router at
all.

Anyway, I'm not saying necessarily that the topic of interprovider CARD should
not be examined at some point, I just think that the problem is harder than
intraprovider CARD, and so probably ought to wait.

            jak

----- Original Message -----
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, January 15, 2003 8:25 AM
Subject: RE: [Seamoby] CARD between Routers - will CT do?

> Hi James:
>
> In event of IP-layer handoff, at some point MN needs to know IP address of
router it is going to connect to. So, MN will know IP address of new AR, latest
after handoff.

---

From: "James Kempf" <[email-masked]>
Date: Wed, 15 Jan 2003 13:16:02 -0800

jak

---

From: "Eunsoo Shim" <[email-masked]>
Date: Wed, 15 Jan 2003 17:03:25 -0800

I certainly agree that the inter-provider CARD should be more tricky than
the intra-provider CARD case.
BTW, the example given by Hemant is the following in my understanding.

"The MN hands over from an AR of an ISP to an AR of another ISP
(inter-provider handoff).
Then the MN can remember the IP address of the previous AR ( AR of the
previous ISP) and inform it to the new AR (AR of the new ISP to which the MN
is currently attached). So regardless of the willingness of the ISPs, the MN
can distribute the IP addresses and L2 IDs of the ARs of one ISP to another
ISP."

Now the question is how the AR can verify the information delivered by the
MN, in particular, about the ARs of a different ISP.
That is the key security problem we have to tackle. And this is the question
James asked me, I think.

In the case the two ISPs are cooperative, the problem becomes similar to
that of the intra-provider CARD.
If not, well, then, each ISP should decide what to do.
Since the IP address and the L2 IDs can be disclosed anyway, I think, the
ISPs can get more benefits by cooperating with each other to verify the
information delivered by the MN. So I'd suggest we work on the protocol
design assuming/requiring the cooperation first.

Eunsoo

----- Original Message -----
From: "James Kempf" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, January 15, 2003 1:16 PM
Subject: Re: [Seamoby] CARD between Routers - will CT do?

> > Thus, information about their geographical adjacency is already exposed
to
> third
> > providers, in different ASs, are providing service in the airport I
happen to
> be
> > in: one does the United lounge and the other does the rest of the
airport. If
> I
> > am standing next to the United lounge and using the provider for the
rest of
> the
> > won't know anything about the IP routing infrastructure, unless, of
course,
> CARD

---

From: "Eunsoo Shim" <[email-masked]>
Date: Wed, 15 Jan 2003 17:03:25 -0800

Eunsoo

----- Original Message -----
From: "James Kempf" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, January 15, 2003 1:16 PM
Subject: Re: [Seamoby] CARD between Routers - will CT do?

to
happen to
airport. If
rest of
course,

---

From: "James Kempf" <[email-masked]>
Date: Wed, 15 Jan 2003 14:29:38 -0800

> design assuming/requiring the cooperation first.

I don't think any interprovider transfer of topology information can assume
co-operation. There need to be the correct security mechanisms in place.

That said, I believe it might be possible to apply the intra-provider solution
to the interprovider case by simply extending the intraprovider example based
on, for example, standard AAA practice between two providers (this is just an
example, other techniques might be better).

So, I think getting a secure intra-provider CARD first, then looking at the
inter-provider problem is the best course.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Wed, 15 Jan 2003 14:29:38 -0800

jak

---

From: "Eunsoo Shim" <[email-masked]>
Date: Wed, 15 Jan 2003 17:40:30 -0800

> co-operation. There need to be the correct security mechanisms in place.

(eunsoo) I certainly agree that proper security mechanisms are required. I
took it granted in my previous email.
BTW, what the CARD protocol exchange between ARs is subset of the topology
information of each domain since it deals with only ARs and BSs. Also it
does not even tell how two ARs are connected in the wired network side even
though it may reveal the IP subnets. So we should not think that CARD
discloses the whole network topology of one administrative domain to another
domain. I'd say it discloses only what MN can figure out regarding the
topology.

> inter-provider problem is the best course.

(eunsoo) Good idea!

Eunsoo

---

From: "Eunsoo Shim" <[email-masked]>
Date: Wed, 15 Jan 2003 17:40:30 -0800

(eunsoo) Good idea!

Eunsoo