Subject: RE: Security Model (was Re: [netlmm] I-D Submission: draft-sgundave-mip6-proxymip6-01.txt)

From: "Ahmad Muhanna" <[email-masked]>
Date: Mon, 5 Feb 2007 13:31:58 -0600

Hi Vijay,
Correction, please see one correction below.

Regards,
Ahmad

> > > 
> > > You (sorry for pointing, no mean intention :-) keep saying
> > that a PMA
> > > is authenticated and authorized.  By whom?  By HA?  Or by
> > MN?  How can
> > > MN indicate to PMA that that PMA from now on can do 'proxy' 
> > operations
> > > on its behalf?
> > > 
> > > AR (PMA) authenticated and authorized by HA - yes, I 
> agree, a small 
> > > domain, feasible.  One would describe how the keys are
> > distributed, etc.
> > > It happens in all routing domains today.
> > 
> > The solution for this is very much deployment specific.
> > That is why we haven't described a solution for this.
> > 
> > I can describe on possible solution. For authentication the easiest 
> > mechanism would be have the PMA and the HA to run
> > IKEv2 to authenticate each other. They can even go ahead 
> and setup a 
> > fat tunnel that can be used to carry all PMIPv6 related signaling 
> > messages and all data traffic for the mobile nodes.
> 
> [Ahmad]
> I am not sure if this solution addresses the problem.

[Ahmad]
I am sorry I overlooked this, I was thinking that you are offering
another solution to address the same problem below. 

> 
> > 
> > Authorization is very deployment specific. Lets assume 
> there is a AAA 
> > infrastructure. AAA home server knows which PMA the mobile node is 
> > currently attached to, assuming there was some kind of access 
> > authentication.
> > The HA before processing the BU just needs to check with 
> the AAA home 
> > server if the PMA is authorized to send BUs for the mobile node.
> 
> [Ahmad]
> Yes, as you just pointed out, for the PMIP security model to 
> work and be as secure as Client Mobile IP, Home Agent needs 
> to know of the current location of the Mobile Node via a 
> trusted entity other than PMA, e.g. AAA. One thing I disagree 
> with is to label this as an implementation specific. I 
> believe this is a security threat that is introduce by 
> allowing MAG/PMA to send BU on behalf of other MN to inform 
> the HA with the current location of the MN. If we guarantee 
> that every time the MN moves from a MAG/PMA to another, HA 
> will get confirmation from a trusted entity other than 
> MAG/PMA with the current MN location, then that takes care of 
> the problem.
> 
> BTW: this is only one option but at least I see that we are 
> finally converging on this issue.
> 
> > 
> > Another option is for the HA to be configured with all 
> authorized PMAs 
> > for a particular domain.
> > 
> > I guess we will get to this later.
> > 
> > But if the PMA is not authenticated and authorized, the home agent 
> > will ofcourse drop the proxy BU. I think we all agree on that.
> > 
> > Vijay
> > 
> 

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm