Subject: [DMM] draft requirement REQ-6: authentication and authorization

From: h chan <[email-masked]>
Date: Mon, 7 May 2012 18:14:31 +0000

REQ-6: Mutual authentication and authorization to access to the DMM service.
The protocol solutions for DMM SHALL rely on mutual authentication and authorization mechanisms that allow a legitimate mobile host/router to access to the DMM service.

REQ-6M (Motivation and problem statement)
Mutual authentication and authorization between a mobile host/router and an access router providing the DMM service to the mobile host/router are required to prevent potential attacks in the access network of the DMM service. Otherwise, various attacks such as impersonation, denial of service, man-in-the-middle attacks, etc are present to obtain illegitimate access or to collapse the DMM service.

(The above has been drafted with contributions, inputs and discussions from various people. Additional contributions and comments are most welcome.)

H Anthony Chan

---

From: jouni korhonen <[email-masked]>
Date: Fri, 18 May 2012 03:07:40 +0300

> The protocol solutions for DMM SHALL rely on mutual authentication and authorization mechanisms that allow a legitimate mobile host/router to access to the DMM service.

Would this requirement rule out e.g. use of IPv6 NDP for DMM
purposes unless SeND is also deployed?

- Jouni

> _______________________________________________
> dmm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmm

---

From: Jong-Hyouk Lee <[email-masked]>
Date: Fri, 18 May 2012 14:09:19 +0200

Jouni,

This requirement is for access network security between a mobile node and
an access router. The actual link is required to be protected with L2
(link-layer) or L3 (IP layer) security protection. Then, it is expected to
be protected with mostly L2 security protection; in this case, the use of
SeND is not required. If L2 security protection is not provided for access
network security, L3 security protection, e.g., SeND, is required.

When we developed this requirement, we didn’t consider to rule out the use
of NDP in any case.

Cheers.

On Fri, May 18, 2012 at 2:07 AM, jouni korhonen <[email-masked]>wrote:

> > The protocol solutions for DMM SHALL rely on mutual authentication and
> authorization mechanisms that allow a legitimate mobile host/router to
> access to the DMM service.
>
> > Mutual authentication and authorization between a mobile host/router and
> an access router providing the DMM service to the mobile host/router are
> required to prevent potential attacks in the access network of the DMM
> service. Otherwise, various attacks such as impersonation, denial of
> service, man-in-the-middle attacks, etc are present to obtain illegitimate
> access or to collapse the DMM service.
> >
> > (The above has been drafted with contributions, inputs and discussions
> from various people. Additional contributions and comments are most
> welcome.)
> >
> > H Anthony Chan
> >
> >

-- 
RSM Department, TELECOM Bretagne, France
Jong-Hyouk Lee, living somewhere between /dev/null and /dev/random

#email: jonghyouk (at) gmail (dot) com
#webpage: http://sites.google.com/site/hurryon/