Subject: [nemo] Multiple Home Networks

From: William D Ivancic <[email-masked]>
Date: Tue, 15 Apr 2003 09:07:39 -0400

While preparing for a talk I'm giving to the Aeronautical Internet 
Collaboration working group, I've been considering the various entities 
that may use a mobile network onboard an aircraft including:  Air Traffic 
Control, the Airline maintenance, Airline Entertainment 
Services,  etcetera.   I believe each of these may desire to have their own 
Home Agent.  I have not yet figured out how one secures such a system, 
however, I certainly see a potential to operate in this manner.   The 
alternative it to have one Home Agent with various networks distributed 
from that point (does not exclude geographically distributed Home Agents 
provide by one ISP).  I know how to secure this using IPv4, but it does 
restrict the architecture.

Will

---

From: "Stuart W. Card" <[email-masked]>
Date: Tue, 15 Apr 2003 15:19:03 -0400

At 09:07 AM 4/15/2003 -0400, William D Ivancic wrote:

>Services,  etcetera.   I believe each of these may desire to have their 
>own Home Agent...

Interesting: the MR essentially becomes a mobile ISP POP,
providing connectivity for multiple user groups, each of
which has its own home network etc.  The 'obvious' approach
would be for the router directly attached to the egress links
to be controlled not by any of the various user groups but
rather by an ISP (I'm using strictly the denotation of the
term here, not necessarily any of its usual connotations),
and to have another tier of routers behind it, each acting
as the MR for one particular user group.  This approach would
be costly (in several types of coin), complex and inflexible.

So the next obvious possibility would be to consolidate the
multiple MRs as 'virtual' MRs in a single box, which of course
reduces (from a pure routing perspective) to a single router
handling traffic not for a single prefix but rather a list of
prefixes, which is commonplace in wireline networks.  Issues
appear limited to management and security, surprise.  :-/

The case where this can be simplified by forcing all the
user groups to share a common HA is a special one; I believe
it would be worthwhile to seek a more general solution.

Can partial trust relationships be defined, so that LFNs and HAs
can decide whether or not to trust a 3rd party controlled MR to
behave properly as such, without requiring any prior association
and without implying any other form of trust? Can simple and cheap
mechanisms be devised to detect (with few missed detections and
few false alarms) whether the MR is living up to this trust?

Stuart W. Card, Chief Scientist & VP, Critical Technologies Inc.
* Creativity * Diversity * Expertise * Flexibility * Integrity *
Suite 400 Technology Center, 4th Floor 1001 Broad St, Utica NY 13501
315-793-0248 x141 FAX -9710 <[email-masked]> www.critical.com

---

From: William D Ivancic <[email-masked]>
Date: Tue, 15 Apr 2003 16:11:25 -0400

At 03:19 PM 4/15/2003 -0400, Stuart W. Card wrote:
>which has its own home network etc.

Exactly. This is one possible use.  I think it may be a rather  common 
use.  Take you car for instance.  You may have your personal ISP for 
surfing, downloading maps, VOIP.  Then you may have the manufacturer who 
would like to access the vehicle for maintenance, preventative maintenance 
and software/firmware updates.

Will

---

From: Ryuji Wakikawa<[email-masked]>
Date: Wed, 16 Apr 2003 05:59:25 +0900

Hello Will.

At Tue, 15 Apr 2003 16:11:25 -0400,
> and software/firmware updates.

Exactly. As far as I know, car companies consider this issue. They
really want to divide operations of manufacturer's managed network
and the other network which user can configure. The manufacture
network must be completely secured and isolated.

The possible idea is assignment different prefixes to each network.
There are 4 choices to operate these prefixes such as:

1. single HA and single MR 
2. single HA and multiple MR
3. multiple HA and single MR
4. multiple HA and multiple MR

I think some company assumes No.4, because it is unforgivable that user
configurable network affects any packets sent by the manufacture network
regarding "control" such as traffic control, maintenance, and motion
control.

Furthermore, they also consider to use different egress interfaces for
each networks. The system configuration may become complicated
like multiple HA, MR, and egress interfaces...

regards,
ryuji

---

From: William D Ivancic <[email-masked]>
Date: Wed, 16 Apr 2003 10:55:26 -0400

>regarding "control" such as traffic control, maintenance, and motion

No. 4 is easiest to handle security wise, but number 3 is most cost 
effective.  No. 3 allows one to share the RF links.  No. 4 probably does 
not as (IMHO) the idea behind N0. 4 is to keep the networks completely 
separate.

We just have to figure out how to secure No. 3 and prove to the end users 
that this is acceptable.

Will

---

From: Alper Yegin <[email-masked]>
Date: Tue, 22 Apr 2003 17:44:11 -0700

> We just have to figure out how to secure No. 3 and prove to the end users

From security perspective, I think #3 and #4 are not as different. An MR in
#3 can have multiple physical interfaces on the NEMO side and hence able to
physically separate prefixes and the hosts using them.

Alper