Subject: RE: [SeaMoby] Topic #3: Cache contamination

From: Singh Ajoy-ASINGH1 <[email-masked]>
Date: Sat, 15 Mar 2003 09:08:55 -0600

I think the security requirement of CARD is not same 
as that of FMIP. In CARD, the routers have to mutually 
authorize each other for validating and updating 
the L3->L3 mapping and capabilities based upon indication 
from a random MN which will eventually impact the other mobile 
nodes in the long run. Whereas in the fast handoff,  
this only impacts the mobile node in handoff. So, we need to 
better understand how such authorization will work in context of 
CARD especially  dyCard. What are the possible tools available 
for enabling such inter-AR authorization of dyCard ARs? In server based 
approach I do see server (e.g.,AAA) playing such a role. 

Regards,
Ajoy 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, March 14, 2003 6:21 PM
To: Ajoy Singh; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: [SeaMoby] Topic #3: Cache contamination

Security of all handoff schemes depends upon existence of inter-AR SA. BCPs
should be used for this - take cues from routing, policy framework, FMIP and
CT. - Hemant

-----Original Message-----
From: ext Singh Ajoy-ASINGH1 [mailto:[email-masked]]
Sent: Friday, March 14, 2003 6:13 PM
To: 'Robert Chalmers'; Singh Ajoy-ASINGH1
Cc: 'Eunsoo Shim'; [email-masked]
Subject: RE: [SeaMoby] Topic #3: Cache contamination

-----Original Message-----
From: Robert Chalmers [mailto:[email-masked]]
Sent: Friday, March 14, 2003 2:18 PM
To: Singh Ajoy-ASINGH1
Cc: 'Eunsoo Shim'; [email-masked]
Subject: Re: [SeaMoby] Topic #3: Cache contamination

Singh Ajoy-ASINGH1 wrote:

<snip>
> AJOY-> BTW, I have a cache contamination question about dycard. Let us
> assume that 
> a fake MN has some collaboration with fake router which is 
> also connected to the internet and the fake MN sends 
> a message  to the current AR indicating that fake router 
> is the valid CAR ?  How the dycard assures that it 
> does create an entry in its local cache?
> 
It is clearly stated in the draft that the two routers must mutually
authenticate one another with the explicit authorization to perform
CARD. Are you assuming that this fake AR can in some way authenticate
and authorize itself with respect to the attacked AR? If not, the
question is moot. If so, then I would question your
authentication/authorization scheme.

AJOY-> You have rightly pointed out that security of 
dycard scheme would depend upon how routers authorize and 
authenticate each other. BTW, what is the proposed 
scheme for mutual authentication and authorization?
Do you believe manual configuration of SA is enough? 

-- 
/****************************************************************

 Robert Chalmers
 UCSB Computer Science Doctoral Candidate
 Network and Multimedia Systems Lab (NMSL)

 "My heart is in the code, but my soul lies in the process"

 | [email-masked] || http://www.cs.ucsb.edu/~robertc/ |

*****************************************************************/
_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby
_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "Eunsoo Shim" <[email-masked]>
Date: Sat, 15 Mar 2003 10:49:42 -0800

Ajoy,

The role of the server in the server approach is currently storing all L2-L3
mapping entries and providing them at the request by ARs.
You may say the program of the CARD server can be also running in the AAA
server but two servers are very different in terms of functionality and
involved protocols. Dycard does not exclude existence of an AAA server at
all.

I think the security requirements for CARD regarding AR authorization is
quite similar to that of IP routing protocols. There are already
proposed/implemented solutions for IP routing protocol security.

We had a separate thread for the need of the server for CARD. It was being
summarized and so far there was no compelling reason to have a server for
CARD. If you want to propose the server as the AAA server, please can you do
it in that thread?

Eunsoo

----- Original Message -----
From: "Singh Ajoy-ASINGH1" <[email-masked]>
To: <[email-masked]>; "Singh Ajoy-ASINGH1" <[email-masked]>;
<[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Saturday, March 15, 2003 7:08 AM
Subject: RE: [SeaMoby] Topic #3: Cache contamination

---

From: "Eunsoo Shim" <[email-masked]>
Date: Sat, 15 Mar 2003 10:49:42 -0800

Ajoy,

Eunsoo

----- Original Message -----
From: "Singh Ajoy-ASINGH1" <[email-masked]>
To: <[email-masked]>; "Singh Ajoy-ASINGH1" <[email-masked]>;
<[email-masked]>