Subject: RE: [netlmm] Trust models

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 6 Nov 2006 01:06:15 -0800

> > => Not at all. I think you're assuming a per-mobile SA. My 
 > email talked
 > > about the same trust model as routing protocols, i.e. 
 > aggregate trust.
 > > So you don't need to transfer credentials between ARs.
 > 
 > So, is that allowed by current MIPv6 HA? 

=> sure, but it's not encouraged :) because the use of something like
network-based MIP was neither anticiapated nor favoured. But yes, it is
allowed.

 > 
 > It seems you are saying MIPv6 specified IPSec is turned off 
 > and different
 > type of IPSec per AR-HA is employed. Is this right understanding? 

=> Yes.

 > 
 > I am just wondering how much impact on MIPv6 HA would required and if
 > such modified HA can serve for both MIP terminals and PMIP 
 > ARs as some
 > people seems to have a single HA for both scenarios.

=> Well, they wouldn't have a single HA if the netlmm protocol is used
instead of PMIP, but anyway, I think it is possible to have a single HA
for both with different SAs for ARs and MNs. It might involve a small
amount of specification but I don't think there is anything major to do.
Do you see a particular problem with it? 

Hesham

 > Katsutoshi
 > > Hesham

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 6 Nov 2006 15:59:23 -0800 (PST)

Hesham, are you suggesting something like a group key approach used in msec protocols? 

----- Original Message ----
From: "Soliman, Hesham" <[email-masked]>
To: Katsutoshi Nishida <[email-masked]>
Cc: [email-masked]
Sent: Monday, November 6, 2006 12:12:00 AM
Subject: RE: [netlmm] Trust models

 > Regarding the trust model, I think the additional 
 > functionality shall be
 > supported within a scope of PMIP protocol in order to be 
 > able to reuse
 > MIPv6 specified home agent. 
 > 
 > This means ARs would need to share or forward IPSec security 
 > credentials
 > specific to the MN in order to support handover with minimum delay.
 > Without having this function, new AR needs to re-negotiate SA with HA
 > and would result in slow handover.

=> Not at all. I think you're assuming a per-mobile SA. My email talked
about the same trust model as routing protocols, i.e. aggregate trust.
So you don't need to transfer credentials between ARs.

Hesham

---

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 6 Nov 2006 22:24:26 -0800

No it doesn't need to be a group key, a trusted certificate would
suffice. 
 
Hesham

________________________________

	From: Behcet Sarikaya [mailto:[email-masked]] 
	Sent: Tuesday, November 07, 2006 10:59 AM
	To: Soliman, Hesham
	Cc: [email-masked]
	Subject: Re: [netlmm] Trust models

	Hesham, are you suggesting something like a group key approach
used in msec protocols? 

	----- Original Message ----
	From: "Soliman, Hesham" <[email-masked]>
	To: Katsutoshi Nishida <[email-masked]>
	Cc: [email-masked]
	Sent: Monday, November 6, 2006 12:12:00 AM
	Subject: RE: [netlmm] Trust models

	> and would result in slow handover.
	
	=> Not at all. I think you're assuming a per-mobile SA. My email
talked
	about the same trust model as routing protocols, i.e. aggregate
trust.
	So you don't need to transfer credentials between ARs.
	
	Hesham