MOBOPTS Research Group                                    A. Dutta (Ed.)
Internet-Draft                                                 Telcordia
Intended status: Informational                                V. Fajardo
Expires: February 17, 2008                                       Y. Ohba
                                                             K. Taniuchi
                                                                    TARI
                                                          H. Schulzrinne
                                                          Columbia Univ.
                                                         August 16, 2007


  A Framework of Media-Independent Pre-Authentication (MPA) for Inter-
                      domain Handover Optimization
                  draft-irtf-mobopts-mpa-framework-00

Status of this Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on February 17, 2008.

Copyright Notice

   Copyright (C) The IETF Trust (2007).








Dutta (Ed.), et al.     Expires February 17, 2008               [Page 1]


Internet-Draft                MPA Framework                  August 2007


Abstract

   This document describes a framework of Media-independent Pre-
   Authentication (MPA), a new handover optimization mechanism that
   addresses the issues on existing mobility management protocols and
   mobility optimization mechanisms to support inter-domain handover.
   MPA is a mobile-assisted, secure handover optimization scheme that
   works over any link-layer and with any mobility management protocol
   and is best applicable to support optimization during inter-domain
   handover.  MPA's pre-authentication, pre-configuration, and proactive
   handover techniques allow many of the handoff related operations to
   take place before the mobile has moved to the new network.  We
   describe the details of all the associated techniques and its
   applicability for different scenarios involving various mobility
   protocols during inter-domain handover.


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.1.  Performance Requirements . . . . . . . . . . . . . . . . .  6
   2.  Inter-domain Handover  . . . . . . . . . . . . . . . . . . . .  8
   3.  Existing Work on Fast Handover . . . . . . . . . . . . . . . . 12
   4.  Applicability  of MPA  . . . . . . . . . . . . . . . . . . . . 14
   5.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . . 15
   6.  MPA Framework  . . . . . . . . . . . . . . . . . . . . . . . . 17
     6.1.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . 17
     6.2.  Functional Elements  . . . . . . . . . . . . . . . . . . . 18
     6.3.  Basic Communication Flow . . . . . . . . . . . . . . . . . 20
   7.  MPA Operations . . . . . . . . . . . . . . . . . . . . . . . . 24
     7.1.  Discovery  . . . . . . . . . . . . . . . . . . . . . . . . 24
     7.2.  Pre-authentication in multiple CTN environment . . . . . . 25
     7.3.  Proactive IP address acquisition . . . . . . . . . . . . . 26
       7.3.1.  PANA-assisted proactive IP address acquisition . . . . 26
       7.3.2.  IKEv2-assisted proactive IP address acquisition  . . . 27
       7.3.3.  Proactive IP address acquisition using DHCP only . . . 27
       7.3.4.  Proactive IP address acquisition using stateless
               autoconfiguration  . . . . . . . . . . . . . . . . . . 28
     7.4.  Address resolution . . . . . . . . . . . . . . . . . . . . 29
       7.4.1.  Proactive duplicate address detection  . . . . . . . . 29
       7.4.2.  Proactive address resolution update  . . . . . . . . . 29
     7.5.  Tunnel management  . . . . . . . . . . . . . . . . . . . . 30
     7.6.  Binding Update . . . . . . . . . . . . . . . . . . . . . . 31
     7.7.  Preventing packet loss . . . . . . . . . . . . . . . . . . 32
       7.7.1.  Packet loss prevention in single interface MPA . . . . 32
       7.7.2.  Preventing packet losses for multiple interfaces . . . 33
       7.7.3.  Reachability test  . . . . . . . . . . . . . . . . . . 33
     7.8.  Link-layer security and mobility . . . . . . . . . . . . . 34



Dutta (Ed.), et al.     Expires February 17, 2008               [Page 2]


Internet-Draft                MPA Framework                  August 2007


     7.9.  IP layer security and mobility . . . . . . . . . . . . . . 35
     7.10. Authentication in initial network attachment . . . . . . . 36
   8.  MPA Deployment Issues  . . . . . . . . . . . . . . . . . . . . 37
     8.1.  Considerations for failed switching and switch-back  . . . 37
     8.2.  Authentication state management  . . . . . . . . . . . . . 38
     8.3.  Pre-allocation of QoS resources  . . . . . . . . . . . . . 39
     8.4.  Resource allocation issue during pre-authentication  . . . 39
   9.  MPA Case Studies for Inter-Domain Handoff  . . . . . . . . . . 42
     9.1.  Homogeneous Mobility Protocol in each domain . . . . . . . 42
       9.1.1.  Mobile IPv6  . . . . . . . . . . . . . . . . . . . . . 42
       9.1.2.  SIP Mobility . . . . . . . . . . . . . . . . . . . . . 42
       9.1.3.  MIPv4 FA-CoA . . . . . . . . . . . . . . . . . . . . . 42
       9.1.4.  Proxy MIPv6  . . . . . . . . . . . . . . . . . . . . . 44
     9.2.  Diverse Mobility Protocol in each domain . . . . . . . . . 49
     9.3.  Multicast mobility . . . . . . . . . . . . . . . . . . . . 49
     9.4.  Coexistence of MPA with other optimization technique . . . 50
   10. Security Considerations  . . . . . . . . . . . . . . . . . . . 51
   11. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 52
   12. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 53
   13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 54
     13.1. Normative References . . . . . . . . . . . . . . . . . . . 54
     13.2. Informative References . . . . . . . . . . . . . . . . . . 55
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 58
   Intellectual Property and Copyright Statements . . . . . . . . . . 60



























Dutta (Ed.), et al.     Expires February 17, 2008               [Page 3]


Internet-Draft                MPA Framework                  August 2007


1.  Introduction

   As wireless technologies including cellular and wireless LAN are
   beginning to get popular, supporting terminal handovers across
   different types of access networks, such as from a wireless LAN to
   CDMA or to GPRS is considered a clear challenge.  On the other hand,
   supporting terminal handovers between access networks of the same
   type is still more challenging, especially when the handovers are
   across IP subnets or administrative domains.  To address those
   challenges, it is important to provide terminal mobility that is
   agnostic to link-layer technologies in an optimized and secure
   fashion without incurring unreasonable complexity.  In this document
   we discuss terminal mobility that provides seamless handovers with
   low latency and low loss.  Seamless handovers are characterized in
   terms of performance requirements as described in Section 1.1.
   [I-D.ohba-mobopts-mpa-implementation] is an accompanying document
   which shows two sets of implementation of MPA including performance
   results to show how existing protocols could be leveraged to realize
   the functionalities of MPA.

   Terminal mobility is accomplished by a mobility management protocol
   that maintains a binding between a locator and an identifier of a
   mobile terminal, where the binding is referred to as the mobility
   binding.  The locator of the mobile node may dynamically change when
   there is a movement of the mobile terminal.  The movement that causes
   a change of the locator may occur when there is a change in
   attachment point due to physical movement or network change.  A
   mobility management protocol may be defined at any layer.  In the
   rest of this document, the term "mobility management protocol" refers
   to a mobility management protocol which operates at the network layer
   or higher.

   There are several mobility management protocols at different layers.
   Mobile IP [RFC3344] and Mobile IPv6 [RFC3775] are mobility management
   protocols that operate at the network layer.  Similarly, MOBIKE
   (IKEv2 Mobility and Multihoming) [RFC4555] is an extension to IKEv2
   that provides the ability to deal with a change of an IP address of
   an IKEv2 end-point.  There are several ongoing activities in the IETF
   to define mobility management protocols at layers higher than network
   layer.  HIP (the Host Identity Protocol) [I-D.ietf-hip-base] defines
   a new protocol layer between network layer and transport layer to
   provide terminal mobility in a way that is transparent to both
   network layer and transport layer.  Also, SIP-based mobility is an
   extension to SIP to maintain the mobility binding of a SIP user agent
   [SIPMM].

   While mobility management protocols maintain mobility bindings, these
   cannot provide seamless handover if used in their current form.  An



Dutta (Ed.), et al.     Expires February 17, 2008               [Page 4]


Internet-Draft                MPA Framework                  August 2007


   additional optimization mechanism that works in the visited network
   of the mobile terminal to prevent loss of outstanding packets
   transmitted while updating the mobility binding is needed to achieve
   seamless handovers.  Such a mechanism is referred to as a mobility
   optimization mechanism.  For example, mobility optimization
   mechanisms [RFC4881] and [RFC4068] are defined for Mobile IPv4 and
   Mobile IPv6, respectively, by allowing neighboring access routers to
   communicate and carry information about mobile terminals.  There are
   protocols that are considered as "helpers" of mobility optimization
   mechanisms.  The CARD (Candidate Access Router Discovery Mechanism)
   protocol [RFC4065] is designed to discover neighboring access
   routers.  The CTP (Context Transfer Protocol) [RFC4066] is designed
   to carry state that is associated with the services provided for the
   mobile terminal, or context, among access routers.

   There are several issues in existing mobility optimization
   mechanisms.  First, existing mobility optimization mechanisms are
   tightly coupled with specific mobility management protocols.  For
   example, it is not possible to use mobility optimization mechanisms
   designed for Mobile IPv4 or Mobile IPv6 for MOBIKE.  What is strongly
   desired is a single, unified mobility optimization mechanism that
   works with any mobility management protocol.  Second, there is no
   existing mobility optimization mechanism that easily supports
   handovers across administrative domains without assuming a pre-
   established security association between administrative domains.  A
   mobility optimization mechanism should work across administrative
   domains in a secure manner only based on a trust relationship between
   a mobile node and each administrative domain.  Third, a mobility
   optimization mechanism needs to support not only multi-interface
   terminals where multiple simultaneous connectivity through multiple
   interfaces can be expected, but also single-interface terminals.

   This document describes a framework of Media-independent Pre-
   Authentication (MPA), a new handover optimization mechanism that
   addresses all those issues.  MPA is a mobile-assisted, secure
   handover optimization scheme that works over any link-layer and with
   any mobility management protocol including Mobile IPv4, Mobile IPv6,
   MOBIKE, HIP, SIP mobility.  In MPA, the notion of IEEE 802.11i pre-
   authentication is extended to work at higher layer, with additional
   mechanisms to perform early acquisition of IP address from a network
   where the mobile terminal may move as well as proactive handover to
   the network while the mobile terminal is still attached to the
   current network.  Since this document focuses on the MPA framework,
   it is left to future work to choose the protocols for MPA and define
   detailed operations.  The accompanying document
   [I-D.ohba-mobopts-mpa-implementation] provides one method that
   describes usage and interactions between existing protocols to
   accomplish MPA functionality.



Dutta (Ed.), et al.     Expires February 17, 2008               [Page 5]


Internet-Draft                MPA Framework                  August 2007


1.1.  Performance Requirements

   In order to provide desirable quality of service for interactive VoIP
   and streaming traffic, one needs to limit the value of end-to-end
   delay, jitter and packet loss to a certain threshold level.  ITU-T
   and ITU-E standards define the acceptable values for these
   parameters.  For example for one-way delay, ITU-T G.114 [RG98]
   recommends 150 ms as the upper limit for most of the applications,
   and 400 ms as generally unacceptable delay.  One way delay tolerance
   for video conferencing is in the range of 200 to 300 ms [ITU98].
   Also if an out-of-order packet is received after a certain threshold,
   it is considered lost.  References [RFC2679], [RFC2680] and 2681
   [RFC2681] describe some of the measurement techniques for delay and
   jitter.

   An end-to-end delay consists of several components, such as network
   delay, operating system (OS) delay, codec delay and application
   delay.  Network delay consists of transmission delay, propagation
   delay, queueing delay in the intermediate routers.  Operating System
   related delay consists of scheduling behavior of the operating system
   in the sender and receiver. codec delay is generally caused due to
   packetization and depacketization at the sender and receiver end.
   Application delay is mainly attributed to playout delay that helps
   compensate for delay variation within a network.  End-to-end delay
   and amount of jitter can be adjusted using proper value of the
   playout buffer at the receiver end.  In case of interactive VoIP
   traffic, end-to-end delay affects the jitter value, and is an
   important issue to consider.  During a mobile's handover, transient
   traffic cannot reach the mobile and this contributes to the jitter as
   well.  If the end system has a playout buffer, then this jitter is
   subsumed by the playout buffer delay, but otherwise this adds to the
   delay for interactive traffic.  Packet loss is typically caused by
   congestion, routing instability, link failure, lossy links such as
   wireless links.  During a mobile's handover a mobile is subjected to
   packet loss because of its change in attachment to the network.  Thus
   for both streaming traffic and VoIP interactive traffic packet loss
   will contribute to the service quality of the real-time application.
   Number of packets lost is proportional to the delay during handover
   and rate of traffic the mobile is receiving.  Lost packets contribute
   to congestion in case of TCP traffic because of re-transmission, but
   it does not add to any congestion in case of streaming traffic that
   is RTP/UDP based.  Thus it is essential to reduce the packet loss and
   effect of handover delay in any mobility management scheme.  In
   Section 3, we describe some of the fast-handover scheme that have
   tried to reduce the handover delay.

   According to ETSI TR 101 [ETSI], a normal voice conversation can
   tolerate up to 2% packet loss.  If a mobile is subjected to handoff



Dutta (Ed.), et al.     Expires February 17, 2008               [Page 6]


Internet-Draft                MPA Framework                  August 2007


   during a conversation, each handoff will contribute to packet loss
   for the period of handoff.

   ITU-T and ITU-R standards define the acceptable values for these
   parameters.  For example for one-way delay, ITU-T G.114 recommends
   150 ms as the upper limit for most of the applications, and 400 ms as
   generally unacceptable delay.  One way delay tolerance for video
   conferencing is in the range of 200 to 300 ms.  Also if an out-of-
   order packet is received after a certain threshold it is considered
   lost.  References [RFC2679], [RFC2680] and 2681 [RFC2681] describe
   some of the measurement techniques for delay and jitter.








































Dutta (Ed.), et al.     Expires February 17, 2008               [Page 7]


Internet-Draft                MPA Framework                  August 2007


2.  Inter-domain Handover

   Based on the type of movement, type of access network, and underlying
   mobility support, one can primarily define the handover as inter-
   technology, intra-technology, inter-domain, and intra-domain.  We
   describe briefly each of these handover process.

   Inter-technology: A mobile may be equipped with multiple interfaces,
   where each interface can support different access technology (802.11,
   CDMA).  A mobile may like to communicate with one interface at any
   time in order to conserve the power.  During the handover the mobile
   may move out of the footprint of one access technology (e.g., 802.11)
   and move into the footprint of a different access technology (e.g.,
   CDMA).  This will warrant switching of the communicating interface on
   the mobile as well.  This type of Inter-technology handover is often
   called as Vertical Handover since the mobile makes movement between
   two different cell sizes.

   Intra-technology: An intra-technology handover is defined when a
   mobile moves between the same type of access technology such as
   between 802.11[a,b,n] and 802.11 [a,b,n] or between CDMA1XRTT and
   CDMA1EVDO.  In this scenario a mobile may be equipped with a single
   interface (with multiple PHY types of the same technology) or with
   multiple interfaces.  An Intra-technology handover may involve intra-
   subnet or inter-subnet movement and thus may need to change its L3
   identifier depending upon type of movement.

   Inter-domain: A domain can be defined in several ways.  But for the
   purposes of roaming we define domain as an administrative domain
   which consists of networks that are managed by a single
   administrative entity which authenticates and authorizes a mobile for
   accessing the networks.  An administrative entity may be a service
   provider, an enterprise and any organization.  Thus an Inter-domain
   handover will by-default be subjected to inter-subnet handover and in
   addition it may be subjected to either inter-technology or intra-
   technology handover.  Inter-domain handover will be sujected to all
   the transition steps a subnet handover goes through and in addition
   it will be subjected to authentication and authorization process as
   well.  It is also likely that type of mobility support in each
   administrative domain will be different.  For example, administrative
   domain A may have MIPv6 support, while administrative domain B may
   use Proxy MIPv6.

   Intra-domain: When a mobile's movement is confined to movement within
   an administrative domain it is called intra-domain movement.  An
   intra-domain movement may involve intra-subnet, inter-subnet, intra-
   technology and inter-technlogy as well.




Dutta (Ed.), et al.     Expires February 17, 2008               [Page 8]


Internet-Draft                MPA Framework                  August 2007


   Both inter-domain and intra-domain handovers can be subjected to
   either inter-technology or intra-technology handover based on the
   network access characteristics.  Inter-domain handover requires
   authorization for acquisition or modification of resources assigned
   to a mobile and the authorization needs interaction with a central
   authority in a domain.  In many cases, an authorization procedure
   during inter-domain handover follows an authentication procedure that
   also requires interaction with a central authority in a domain.
   Thus, security association between the network entities such as
   routers in the neighboring administrative domains need to be
   established before any interaction takes place between these
   entities.  Similarly, an inter-domain mobility may involve different
   mobility protocol in each of its domains, such as MIPv6 and Proxy-
   MIPv6.  In that case, one needs a generalized framework to achieve
   the optimization during inter-domain handover.  Figure 1 shows a
   typical example of inter-domain mobility.  A mobile maybe using a
   specific mobility protocol and associated mobility optimization
   technique during intra-domain movement in either domain.  But the
   same optimization technique may not be appropriate to support inter-
   domain handover independent of whether it uses the same or different
   mobility protocol in either domain.






























Dutta (Ed.), et al.     Expires February 17, 2008               [Page 9]


Internet-Draft                MPA Framework                  August 2007


                      +-----------------------------+
                      |      +--------+             |
                      |      |        |             |
                      |      | AAAH   --------------------|
                      |      |        |             |     |
                      |      +|-------+             |     |
                      |       |                     |     |
                      |       |  Home Domain        |     |
                      |       |                     |     |
                      +-------|---------------------+     |
                              |                           |
                              |                           |
                              |                           |
                              |                           |
                              |                           |
                              |                           |
                              |                           |
 +----------------------------|-----------+ +-------------|------------+
 |                            |           | |            +|-------+    |
 | Domain A           +-------|+          | | +-----+    |        |    |
 |                    |        |          | | |     ------ AAAV2  |    |
 |                    | AAAV1  |          | | | AA  |    |        |    |
 |      +--------------        |          | | +|----+    +--------+    |
 |      |     |       +--------+          | |  |                       |
 |      |AA   |                           | |  |---         ----       |
 |      +--|--+                           | | /    \       /    \      |
 |         |              /----\          | || AR   |     | AR   |     |
 |        -|--           /      \         | | \    /       \    /      |
 |       /    \         | AR     |        | |  -|--         --|-       |
 |      | AR   -----------      /         | |+--|---+  +------|------+ |
 |       \    /           \--|-/          | || AP4  |  |             | |
 |        -/--         +-----|------+     | ||      |  +-|---------|-+ |
 |        /            |  L2 Switch |     | |+------+    |         |   |
 |       /             +-|-------|--+     | |        +---|--+ +----|-+ |
 | +----/-+         +----|-+   +-|----+   | |Domain B|      | |      | |
 | |      |         |      |   |      |   | |        | AP5  | |AP6   | |
 | | AP1  |         | AP2  |   | AP3  |   | |        +--|---+ +------+ |
 | +------+         +------+   +--|---+   | |           |              |
 +--------------------------------|-------+ +-----------|--------------+
                                --|---------            |
                            ////            \\\\   -----|-----
                          //    +------+       ////  +------+ \\\\
                          |     | MN   ------------->|MN  |     \\\
                         |      |      |    |     |  |      |       |
                          |     +------+   |     |   +------+        |
                          \\                |   //                  |
                            \\\\            \\\/                  ///
                                ------------   \\\\           ////



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 10]


Internet-Draft                MPA Framework                  August 2007


                                                   -----------



                      Figure 1: Inter-domain Mobility














































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 11]


Internet-Draft                MPA Framework                  August 2007


3.  Existing Work on Fast Handover

   While basic mobility management protocols such as Mobile IP
   [RFC3344], Mobile IPv6 [RFC3775], SIP-Mobility [SIPMM] provide
   continuity to TCP and RTP traffic, these are not optimized to reduce
   the handover latency during mobile's movement between subnets and
   domains.  In general these mobility management protocols suffer from
   handover delays incurred at several layers such as, layer 3 and
   application layer for updating the mobile's mobility binding.  These
   protocols also get affected due to underlying layer 2 delay as well.

   There have been several optimization techniques that apply to current
   mobility management schemes that try to reduce handover delay and
   packet loss during a mobile's movement between cells, subnets and
   domain.  Micro-mobility management schemes [CELLIP], [HAWAII], and
   intra-domain mobility management schemes such as [IDMP],
   [I-D.ietf-mobileip-reg-tunnel] and [RFC4140] provide fast-handover by
   limiting the signaling updates within a domain.  Fast Mobile IP
   protocols for IPv4 and IPv6 networks [RFC4881], [RFC4068] utilize
   mobility information made available by link layer triggers.  Yokota
   et al.  [YOKOTA] propose joint use of access point and a dedicated
   MAC bridge to provide fast-handover without altering the MIPv4
   specification.  Shin et al [MACD] propose a scheme reduces the delay
   due to MAC layer handoff by providing a cache-based algorithm.  In
   this scheme, the mobile caches the neighboring channels that it has
   already visited and thus uses a selective scanning method.  This
   helps to reduce the associated scanning time.

   Some mobility management schemes use dual interfaces thus providing
   make-before-break [SUM].  In a make-before-break situation,
   communication usually continues with one interface, when the
   secondary interface is in the process of getting connected.  The IEEE
   802.21 working group is discussing these scenarios in details
   [802.21].  Providing fast-handover using a single interface needs
   more careful design than for a client with multiple interfaces.
   Dutta et al [SIPFAST] provide an optimized handover scheme for SIP-
   based mobility management, where the transient traffic is forwarded
   from the old subnet to the new one by using an application layer
   forwarding scheme.  [MITH] provides a fast handover scheme for the
   single interface case that uses mobile-initiated tunneling between
   the old foreign agent and new foreign agent.  [MITH] defines two
   types of handover schemes such as Pre-MIT (Mobile Initiated
   Tunneling) and Post-MIT (Media Initiated Tunneling).  The proposed
   MPA scheme is very similar to MITH's predictive scheme where the
   mobile communicates with the foreign agent before actually moving to
   the new network.  However, MPA scheme is not limited to MIP type
   mobility protocol only and in addition this scheme takes care of
   movement between domains and performs pre-authentication in addition



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 12]


Internet-Draft                MPA Framework                  August 2007


   to proactive handover.  Thus, MPA reduces the overall delay to close
   to link-layer handover delay.  Most of the mobility optimization
   techniques developed so far are restricted to a specific type of
   mobility protocol only.  While supporting optimization for inter-
   domain mobility, these protocols asssume that there is a pre-
   established security arrangement between two administrative domains.
   But this assumption may not be viable always.  Thus, there is a need
   to develop an optimization framework that can support inter-domain
   mobility without any underlying constraints or security related
   assumption.









































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 13]


Internet-Draft                MPA Framework                  August 2007


4.  Applicability  of MPA

   MPA is categorized as a proactive handover optimization mechanism.
   In other words, MPA is more applicable where an accurate prediction
   of movement can be easily made.  For other environments, a special
   care must be taken to deal with issues such as pre-authentication to
   multiple CTNs (Section 5.2) and failed switching and switching back
   (Section 5.8), however, addressing those issues in actual deployments
   may not be easier.

   Even if accurate prediction of movement is easily made, effectiveness
   of MPA may be relatively reduced if the network employs network-
   controlled localized mobility management in which the MN does not
   need to change its IP address while moving within the network.
   Effectiveness of MPA may also be relatively reduced if signaling for
   network access authentication is already optimized for movements
   within the network, e.g., when simultaneous use of multiple
   interfaces during handover is allowed.

   In other words, MPA is most viable solution for inter-administrative
   domain predictive handover without simultaneous use of multiple
   interfaces.  Since MPA is not tied to a specific mobility protocol,
   it is also applicable to support optimization for inter-domain
   handover where each domain maybe equipped with different mobility
   protocol.  Figure 1 shows an example of Inter-domain mobility where
   MPA could be applied.  In some cases, each administrative domain may
   be equipped with a different mobility protocol.  In such situation
   the mobile could use a specific optimization technique during its
   movement within a domain, but would revert to MPA to provide
   optimization during inter-domain movement.  For example, domain A may
   support just Proxy MIPv6, whereas domain B may support Client Mobile
   IPv6.  In that scenario, it is desirable to have an optimization
   technique that is not tightly coupled with either of these mobility
   protocols to support proactive handover.  MPA's different functional
   components can provide the desired optimization techniques
   proactively.  Depending upon the mobility protocol in the target
   network, it can use network controlled or mobile controlled technique
   associated with MPA.  Thus, during mobile's movement between two
   diverse mobile networks, that may belong to two different
   administrative domains, MPA can provide proactive optimization.











Dutta (Ed.), et al.     Expires February 17, 2008              [Page 14]


Internet-Draft                MPA Framework                  August 2007


5.  Terminology


   Mobility Binding:  A binding between a locator and an identifier of a
      mobile terminal.


   Mobility Management Protocol (MMP):  A protocol that operates at
      network layer or above to maintain a binding between a locator and
      an identifier of a mobile terminal.


   Binding Update:  A procedure to update a mobility binding.


   Media-independent Pre-Authentication Mobile Node (MN):  A mobile
      terminal of media-independent pre-authentication (MPA) which is a
      mobile-assisted, secure handover optimization scheme that works
      over any link-layer and with any mobility management protocol.  An
      MPA mobile node is an IP node.  In this document, the term "mobile
      node" or "MN" without a modifier refers to "MPA mobile node".  An
      MPA mobile node usually has a functionality of a mobile node of a
      mobility management protocol as well.


   Candidate Target Network (CTN):

      A network to which the mobile may move in the near future.


   Target Network (TN):  The network to which the mobile has decided to
      move.  The target network is selected from one or more candidate
      target network.


   Proactive Handover Tunnel (PHT):  A bidirectional IP tunnel [RFC1853]
      that is established between the MPA mobile node and an access
      router of a candidate target network.  In this document, the term
      "tunnel" without a modifier refers to "proactive handover tunnel.


   Point of Attachment (PoA):  A link-layer device (e.g., a switch, an
      access point or a base station) that functions as a link-layer
      attachment point for the MPA mobile node to a network.







Dutta (Ed.), et al.     Expires February 17, 2008              [Page 15]


Internet-Draft                MPA Framework                  August 2007


   Care-of Address (CoA):  An IP address used by a mobility management
      protocol as a locator of the MPA mobile node.

















































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 16]


Internet-Draft                MPA Framework                  August 2007


6.  MPA Framework

6.1.  Overview

   Media-independent Pre-Authentication (MPA) is a mobile-assisted,
   secure handover optimization scheme that works over any link layer
   and with any mobility management protocol.  With MPA, a mobile node
   is not only able to securely obtain an IP address and other
   configuration parameters for a CTN, but also able to send and receive
   IP packets using the IP address obtained before it actually attaches
   to the CTN.  This makes it possible for the mobile node to complete
   the binding update of any mobility management protocol and use the
   new CoA before performing a handover at link-layer.

   MPA provides four basic procedures to provide this functionality.
   The first procedure is referred to as "pre-authentication", the
   second procedure is referred to as "pre-configuration", the
   combination of the third and fourth procedures are referred to as
   "secure proactive handover".  The security association established
   through pre-authentication is referred to as an "MPA-SA".

   This functionality is provided by allowing a mobile node which has
   connectivity to the current network but is not yet attached to a CTN,
   to (i) establish a security association with the CTN to secure the
   subsequent protocol signaling, then (ii) securely execute a
   configuration protocol to obtain an IP address and other parameters
   from the CTN as well as a execute tunnel management protocol to
   establish a PHT (Proactive Handover Tunnel) [RFC1853] between the
   mobile node and an access router of the CTN, then (iii) send and
   receive IP packets, including signaling messages for binding update
   of an MMP and data packets transmitted after completion of binding
   update, over the PHT using the obtained IP address as the tunnel
   inner address, and finally (iv) deleting or disabling the PHT
   immediately before attaching to the CTN when it becomes the target
   network and then re-assigning the inner address of the deleted or
   disabled tunnel to its physical interface immediately after the
   mobile node is attached to the target network through the interface.
   Instead of deleting or disabling the tunnel before attaching to the
   the target network, the tunnel may be deleted or disabled immediately
   after being attached to the target network.

   Especially, the third procedure described above (i.e., binding update
   procedure) makes it possible for the mobile to complete the higher-
   layer handover before starting link-layer handover.  This means that
   the mobile is able to send and receive data packets transmitted after
   completing the binding update over the tunnel, while data packets
   transmitted before completion of binding update do not use the
   tunnel.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 17]


Internet-Draft                MPA Framework                  August 2007


6.2.  Functional Elements

   In the MPA framework, the following functional elements are expected
   to reside in each CTN to communicate with a mobile node:
   Authentication Agent (AA), Configuration Agent (CA) and Access Router
   (AR).  These elements can reside in one more network devices.

   An authentication agent is responsible for pre-authentication.  An
   authentication protocol is executed between the mobile node and the
   authentication agent to establish an MPA-SA.  The authentication
   protocol MUST be able to derive a key between the mobile node and the
   authentication agent and SHOULD be able to provide mutual
   authentication.  The authentication protocol SHOULD be able to
   interact with a AAA protocol such as RADIUS and Diameter to carry
   authentication credentials to an appropriate authentication server in
   the AAA infrastructure.  The derived key is used for further deriving
   keys used for protecting message exchanges used for pre-configuration
   and secure proactive handover.  Other keys that are used for
   bootstrapping link-layer and/or network-layer ciphers MAY also be
   derived from the MPA-SA.  A protocol that can carry EAP [RFC3748]
   would be suitable as an authentication protocol for MPA.

   A configuration agent is responsible for one part of pre-
   configuration, namely securely executing a configuration protocol to
   securely deliver an IP address and other configuration parameters to
   the mobile node.  The signaling messages of the configuration
   protocol MUST be protected using a key derived from the key
   corresponding to the MPA-SA.

   An access router is a router that is responsible for the other part
   of pre-configuration, i.e., securely executing a tunnel management
   protocol to establish a proactive handover tunnel to the mobile node.
   The signaling messages of the configuration protocol MUST be
   protected using a key derived from the key corresponding to the
   MPA-SA.  IP packets transmitted over the proactive handover tunnel
   SHOULD be protected using a key derived from the key corresponding to
   the MPA-SA.














Dutta (Ed.), et al.     Expires February 17, 2008              [Page 18]


Internet-Draft                MPA Framework                  August 2007


                                                  +----+
                                                  |    |
                                                  | CN |
                                                  *----+
                                                //
                                 /--------\    /
                              |//          \\//
                             |    Core      / |
                              |\X Network     \
                               / \--------/    \\
                              /                  \
                             /                    \
                            /                      \\
             +-------------/-----------+    +--------\-------------+
             | +-----+                 |    |+-----+               |
             | |     |        +-----+  |    ||     |       +-----+ |
             | | AA  |        |CA   |  |    ||AA   |       | CA  | |
             | +--+--+        +--+--+  |    |+--+--+       +--+--+ |
             |    |   +------+   |     |    |   | +-----+     |    |
             |    |   | pAR  |   |     |    |   | |nAR  |     |    |
             | ---+---+      +---+-----+----+---+-+     +-----+    |
             |        +---+--+         |    |     +-----+          |
             |            |            |    |                      |
             |            |            |    |                      |
             |            |            |    |                      |
             +------------+------------+    +--------|--------------+
             Current      |                 Candidate| Target Network
             Network      |                          |
                          |                          |
                          |                          |
                          |                          |
                          |                          |
                       ---+--------          --------|-----
                  /////            \\\\\/////             \\\\\
                //                    //\\                     \\
               |        +-+----+     |    |                      |
              |  oPoA   | MN   |    |      |                      |
              |         |      |     |     |                     |
               |        +------+      \\  |                    //
                \\                      XX\\\ nPoA        /////
                  \\\\\            /////     -------------
                       ------------


                    Figure 2: MPA Functional Components






Dutta (Ed.), et al.     Expires February 17, 2008              [Page 19]


Internet-Draft                MPA Framework                  August 2007


6.3.  Basic Communication Flow

   Assume that the mobile node is already connected to a point of
   attachment, say oPoA (old point of attachment), and assigned a
   care-of address, say oCoA (old care-of address).  The communication
   flow of MPA is described as follows.  Throughout the communication
   flow, data packet loss should not occur except for the period during
   the switching procedure in Step 5, and it is the responsibility of
   link-layer handover to minimize packet loss during this period.

   Step 1 (pre-authentication phase): The mobile node finds a CTN
   through some discovery process and obtains the IP addresses of an
   authentication agent, a configuration agent and an access router in
   the CTN (Candidate Target Network) by some means.  The mobile node
   performs pre-authentication with the authentication agent.  If the
   pre-authentication is successful, an MPA-SA is created between the
   mobile node and the authentication agent.  Two keys are derived from
   the MPA-SA, namely an MN-CA key and an MN-AR key, which are used to
   protect subsequent signaling messages of a configuration protocol and
   a tunnel management protocol, respectively.  The MN-CA key and the
   MN-AR key are then securely delivered to the configuration agent and
   the access router, respectively.

   Step 2 (pre-configuration phase): The mobile node realizes that its
   point of attachment is likely to change from oPoA to a new one, say
   nPoA (new point of attachment).  It then performs pre-configuration,
   with the configuration agent using the configuration protocol to
   obtain an IP address, say nCoA (new care-of address), and other
   configuration parameters from the CTN, and with the access router
   using the tunnel management protocol to establish a proactive
   handover tunnel.  In the tunnel management protocol, the mobile node
   registers oCoA and nCoA as the tunnel outer address and the tunnel
   inner address, respectively.  The signaling messages of the pre-
   configuration protocol are protected using the MN-CA key and the
   MN-AR key.  When the configuration and the access router are co-
   located in the same device, the two protocols may be integrated into
   a single protocol like IKEv2.  After completion of the tunnel
   establishment, the mobile node is able to communicate using both oCoA
   and nCoA by the end of Step 4.

   Step 3 (secure proactive handover main phase): The mobile node
   decides to switch to the new point of attachment by some means.
   Before the mobile node switches to the new point of attachment, it
   starts secure proactive handover by executing the binding update
   operation of a mobility management protocol and transmitting
   subsequent data traffic over the tunnel (main phase).  In some cases,
   it may cache multiple nCOA addresses and perform simultaneous binding
   with the CH or HA.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 20]


Internet-Draft                MPA Framework                  August 2007


   Step 4 (secure proactive handover pre-switching phase): The mobile
   node completes the binding update and becomes ready to switch to the
   new point of attachment.  The mobile may execute the tunnel
   management protocol to delete or disable the proactive handover
   tunnel and cache nCoA after deletion or disabling of the tunnel.  The
   decision as to when the mobile node is ready to switch to the new
   point of attachment depends on the handover policy.

   Step 5 (switching): It is expected that a link-layer handover occurs
   in this step.

   Step 6 (secure proactive handover post-switching phase): The mobile
   node executes the switching procedure.  Upon successful completion of
   the switching procedure, the mobile node immediately restores the
   cached nCoA and assigns it to the physical interface attached to the
   new point of attachment.  If the proactive handover tunnel was not
   deleted or disabled in Step 4, the tunnel is deleted or disabled as
   well.  After this, direct transmission of data packets using nCoA is
   possible without using a proactive handover tunnel.

   An example call flow for MPA is shown in Figure 3 and Figure 4.






























Dutta (Ed.), et al.     Expires February 17, 2008              [Page 21]


Internet-Draft                MPA Framework                  August 2007


                                                         IP address(es)
                                                          Available for
                                                             Use by MN
                                                                   |
                           +-----------------------------------+   |
                           |     Candidate Target Network      |   |
                           |     (Future Target Network)       |   |
             MN       oPoA | nPoA     AA        CA        AR   |   |
             |         |   |  |       |         |         |    |   |
             |         |   +-----------------------------------+   |
             |         |      |       |         |         |        .
    +---------------+  |      |       |         |         |        .
    |(1) Found a CTN|  |      |       |         |         |        .
    +---------------+  |      |       |         |         |        |
             |   Pre-authentication   |         |         |        |
             |   [authentication protocol]      |         |        |
             |<--------+------------->|MN-CA key|         |        |
             |         |      |       |-------->|MN-AR key|        |
   +-----------------+ |      |       |------------------>|        |
   |(2) Increased    | |      |       |         |         |     [oCoA]
   |chance to switch | |      |       |         |         |        |
   |     to CTN      | |      |       |         |         |        |
   +-----------------+ |      |       |         |         |        |
             |         |      |       |         |         |        |
             |   Pre-configuration    |         |         |        |
             |   [configuration protocol to get nCoA]     |        |
             |<--------+----------------------->|         |        |
             |   Pre-configuration    |         |         |        |
             |   [tunnel management protocol to establish PHT]     V
             |<--------+--------------------------------->|
             |         |      |       |         |         |        ^
   +-----------------+ |      |       |         |         |        |
   |(3) Determined   | |      |       |         |         |        |
   |to switch to CTN | |      |       |         |         |        |
   +-----------------+ |      |       |         |         |        |
             |         |      |       |         |         |        |
             |   Secure proactive handover main phase     |        |
             |   [execution of binding update of MMP and  |        |
             |    transmission of data packets through AR | [oCoA, nCoA]
             |    based on nCoA over the PHT]   |         |        |
             |<<=======+================================>+--->...  |
             .         .      .       .         .         .        .
             .         .      .       .         .         .        .
             .         .      .       .         .         .        .

                 Figure 3: Basic Communication Flow (1/2)





Dutta (Ed.), et al.     Expires February 17, 2008              [Page 22]


Internet-Draft                MPA Framework                  August 2007


             |         |      |       |         |         |        |
   +----------------+  |      |       |         |         |        |
   |(4) Completion  |  |      |       |         |         |        |
   |of MMP BU and   |  |      |       |         |         |        |
   |ready to switch |  |      |       |         |         |        |
   +----------------+  |      |       |         |         |        |
             |   Secure proactive handover pre-switching phase     |
             |   [tunnel management protocol to delete PHT]        V
             |<--------+--------------------------------->|
    +---------------+         |       |         |         |
    |(5)Switching   |         |       |         |         |
    +---------------+         |       |         |         |
             |                |       |         |         |
    +---------------+         |       |         |         |
    |(6) Completion |         |       |         |         |
    |of switching   |         |       |         |         |
    +---------------+         |       |         |         |
             o<- Secure proactive handover post-switching phase ^
             |   [Re-assignment of TIA to the physical I/F]        |
             |                |       |         |         |        |
             |   Transmission of data packets through AR  |     [nCoA]
             |   based on nCoA|       |         |         |        |
             |<---------------+---------------------------+-->...  |
             |                |       |         |         |        .

                 Figure 4: Basic Communication Flow (2/2)

























Dutta (Ed.), et al.     Expires February 17, 2008              [Page 23]


Internet-Draft                MPA Framework                  August 2007


7.  MPA Operations

   In order to provide an optimized handover for a mobile experiencing
   rapid subnet and domain handover, one needs to look into several
   operations.  These issues include discovery of neighboring networking
   elements, choosing the right network to connect to based on certain
   policy, changing the layer 2 point of attachment, obtaining an IP
   address from a DHCP or PPP server, confirming the uniqueness of the
   IP address, pre-authenticating with the authentication agent, sending
   the binding update to the correspondent host and obtaining the
   redirected streaming traffic to the new point of attachment, ping-
   pong effect, probability of moving to more than one network and
   associating with multiple target networks.  We describe these issues
   in details in the following paragraphs and describe how we have
   optimized these in case of MPA-based secure proactive handover.

7.1.  Discovery

   Discovery of neighboring networking elements such as access points,
   access routers, authentication servers help expedite the handover
   process during a mobile's rapid movement between networks.  After
   discovering the network neighborhood with a desired set of
   coordinates, capabilities and parameters the mobile can perform many
   of the operation such as pre-authentication, proactive IP address
   acquisition, proactive address resolution, and binding update while
   in the previous network.

   There are several ways a mobile can discover neighboring networks.
   The Candidate Access Router Discovery protocol [RFC4066] helps
   discover the candidate access routers in the neighboring networks.
   Given a certain network domain SLP (Service Location Protocol) and
   DNS help provide addresses of the networking components for a given
   set of services in the specific domain.  In some cases many of the
   network layer and upper layer parameters may be sent over link layer
   management frames such as beacons when the mobile approaches the
   vicinity of the neighboring networks.  IEEE 802.11u is considering
   issues such as discovering neighborhood using information contained
   in link layer.  However, if the link-layer management frames are
   encrypted by some link layer security mechanism, then the mobile node
   may not be able to obtain the requisite information before
   establishing link layer connectivity to the access point.  In
   addition this may add burden to the bandwidth constrained wireless
   medium.  In such cases a higher layer protocol is preferred to obtain
   the information regarding the neighboring elements.  There is some
   proposal such as [802.21] that helps obtain these information about
   the neighboring networks from a mobility server.  When the mobile's
   movement is imminent, it starts the discovery process by querying a
   specific server and obtains the required parameters such as the IP



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 24]


Internet-Draft                MPA Framework                  August 2007


   address of the access point, its characteristics, routers, SIP
   servers or authentication servers of the neighboring networks.  In
   the event of multiple networks, it may obtain the required parameters
   from more than one neighboring networks and keep these in cache.  At
   some point the mobile finds out several CTN's out of many probable
   networks and starts the pre-authentication process by communicating
   with the required entities in the CTN's.  Futher details of this
   scenario is in Section 7.2.

7.2.  Pre-authentication in multiple CTN environment

   In some cases, although a mobile decides a specific network to be the
   target network, it may actually end up with moving into a neighboring
   network other than the target network due to factors that are beyond
   the mobile's control.  Thus it may be useful to perform the pre-
   authentication with a few probable candidate target networks and
   establish time-bound tunnels with the respective access routers in
   those networks.  Thus, in the event of a mobile moving to a candidate
   target network other than that was chosen as the target network, it
   will not be subjected to packet loss due to authentication and IP
   address acquisition delay that could incur if the mobile did not pre-
   authenticate with that candidate target network.  It may appear that
   by pre-authenticating with a number of candidate target networks and
   reserving the IP addresses, the mobile is provisioning resources that
   could be used otherwise.  But since this happens for a time-limited
   period it should not be a big problem.  However, it depends upon the
   mobility pattern and duration.  Mobile uses pre-authentication
   procedure to obtain IP address proactively and set up the time bound
   tunnels with the access routers of the candidate target networks.
   Also, MN may hold some or all of the nCoAs for future movement.

   The mobile may choose one of these addresses as the binding update
   address and send it to the CN (Correspondent Node) or HA (Home
   Agent), and will thus receive the tunneled traffic via the target
   network while in the previous network.  But in some instances, the
   mobile may eventually end up moving to a network that is other than
   the target network.  Thus, there will be a disruption in traffic as
   the mobile moves to the new network since the mobile has to go
   through the process of assigning the new IP address and sending the
   binding update again.  Two solutions can take care of this problem.
   The mobile can take advantage of the simultaneous mobility binding
   and send multiple binding updates to the corresponsing host or HA.
   Thus, the corresponsing host or HA forwards the traffic to multiple
   IP addresses assigned to the virtual interfaces for a specific period
   of time.  This binding update gets refreshed at the CH after the
   mobile moves to the new network, thus stopping the flow to the other
   candidate networks.  Wakikawa [I-D.wakikawa-mobileip-multiplecoa]
   discusses different scenarios of mobility binding with multiple care-



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 25]


Internet-Draft                MPA Framework                  August 2007


   of-addresses.  In case simultaneous binding is not supported in a
   specific mobility scheme, forwarding of traffic from the previous
   target network will help take care of the transient traffic until the
   new binding update is sent from the new network.

7.3.  Proactive IP address acquisition

   In general a mobility management protocol works in conjunction with
   the Foreign Agent or in co-located address mode.  MPA approach can
   use both co-located address mode and foreign agent address mode.  We
   discuss here the address assignment component that is used in co-
   located address mode.  There are several ways a mobile node can
   obtain an IP address and configure itself.  Most commonly a mobile
   can configure itself statically in the absence of any configuration
   element such as a server or router in the network.  The IETF Zeroconf
   working group defines auto-IP mechanism where a mobile is configured
   in an ad-hoc manner and picks a unique address from a specified range
   such as 169.254.x.x.  In a LAN environment the mobile can obtain an
   IP address from DHCP servers.  In case of IPv6 networks, a mobile has
   the option of obtaining the IP address using stateless auto-
   configuration or DHCPv6.  In a wide area networking environment, the
   mobile uses PPP to obtain the IP address by communicating with a NAS.

   Each of these processes takes of the order of few hundred
   milliseconds to few seconds depending upon the type of IP address
   acquisition process and operating system of the clients and servers.
   Since IP address acquisition is part of the handover process, it adds
   to the handover delay and thus it is desirable to reduce this delay
   as much as possible.  There are few optimized techniques such as DHCP
   Rapid Commit [RFC4039], GPS-coordinate based IP address [GPSIP]
   available that attempt to reduce the handover time due to IP address
   acquisition time.  However, in all these cases the mobile also
   obtains the IP address after it moves to the new subnet and incurs
   some delay because of the signaling handshake between the mobile node
   and the DHCP server.

   In the following paragraph we describe few ways a mobile node can
   obtain the IP address proactively from the CTN and the associated
   tunnel setup procedure.  These can broadly be divided into four
   categories such as PANA-assisted proactive IP address acquisition,
   IKE-assisted proactive IP address acquisition, proactive IP address
   acquisition using DHCP only and stateless autoconfiguration.

7.3.1.  PANA-assisted proactive IP address acquisition

   In case of PANA-assisted proactive IP address acquisition, the mobile
   node obtains an IP address proactively from a CTN.  The mobile node
   makes use of PANA [I-D.ietf-pana-pana] messages to trigger the



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 26]


Internet-Draft                MPA Framework                  August 2007


   address acquisition process on the DHCP relay agent [RFC3046] that is
   colocated with the PANA authentication agent in the access router in
   the CTN.  Upon receiving a PANA message from the mobile node, the
   DHCP relay agent performs normal DHCP message exchanges to obtain the
   IP address from the DHCP server in the CTN.  This address is piggy-
   backed in a PANA message and is delivered to the client.  In case of
   MIPv6 with stateless autoconfiguration, the router advertisement from
   the new target network is passed to the client as part of PANA
   message.  Mobile uses this prefix and its MAC address to construct
   the unique IPv6 address as it would have done in the new network.
   Mobile IPv6 in stateful mode works very similar to DHCPv4.

7.3.2.  IKEv2-assisted proactive IP address acquisition

   IKEv2-assisted proactive IP address acquisition works when an IPsec
   gateway and a DHCP relay agent are resident within each access router
   in the CTN.  In this case, the IPsec gateway and DHCP relay agent in
   a CTN help the mobile node acquire the IP address from the DHCP
   server in the CTN.  The MN-AR key established during the pre-
   authentication phase is used as the IKEv2 pre-shared secret needed to
   run IKEv2 between the mobile node and the access router.  The IP
   address from the CTN is obtained as part of standard IKEv2 procedure,
   with using the co-located DHCP relay agent for obtaining the IP
   address from the DHCP server in the target network using standard
   DHCP.  The obtained IP address is sent back to the client in the
   IKEv2 Configuration Payload exchange.  In this case, IKEv2 is also
   used as the tunnel management protocol for a proactive handover
   tunnel (see Section 7.5).  Alternatively VPN-GW can itself dispense
   the IP address from its IP address pool.

7.3.3.  Proactive IP address acquisition using DHCP only

   As another alternative, DHCP may be used for proactively obtaining an
   IP address from a CTN without relying on PANA or IKEv2-based
   approaches by allowing direct DHCP communication between the mobile
   node and the DHCP relay or DHCP server in the CTN.  In this case, the
   mobile node sends a unicast DHCP message to the DHCP relay agent or
   DHCP server in the CTN requesting an address, while using the address
   associated with the current physical interface as the source address
   of the request.

   When the message is sent to the DHCP relay agent, the DHCP relay
   agent relays the DHCP messages back and forth between the mobile node
   and the DHCP server.  In the absence of a DHCP relay agent the mobile
   can also directly communicate with the DHCP server in the target
   network.  The broadcast option in client's unicast DISCOVER message
   should be set to 0 so that the relay agent or the DHCP server can
   send the reply directly back to the mobile using the mobile node's



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 27]


Internet-Draft                MPA Framework                  August 2007


   source address.  This mechanism also works for an IPv6 node using
   stateful configuration.

   In order to prevent malicious nodes from obtaining an IP address from
   the DHCP server, DHCP authentication should be used or the access
   router should install a filter to block unicast DHCP message sent to
   the remote DHCP server from mobile nodes that are not pre-
   authenticated.  When DHCP authentication is used, the DHCP
   authentication key may be derived from the MPA-SA established between
   the mobile node and the authentication agent in the candidate target
   network.

   The proactively obtained IP address is not assigned to the mobile
   node's physical interface until the mobile has moved to the new
   network.  The IP address thus obtained proactively from the target
   network should not be assigned to the physical interface but rather
   to a virtual interface of the client.  Thus, such a proactively
   acquired IP address via direct DHCP communication between the mobile
   node and the DHCP relay or the DHCP server in the CTN may be carried
   with additional information that is used to distinguish it from other
   address as assigned to the physical interface.

   Upon the mobile's entry to the new network, the mobile node can
   perform DHCP over the physical interface to the new network to get
   other configuration parameters such as SIP server, DNS server by
   using DHCP INFORM.  This should not affect the ongoing communication
   between the mobile and correspondent host.  Also, the mobile node can
   perform DHCP over the physical interface to the new network to extend
   the lease of the address that was proactively obtained before
   entering the new network.

7.3.4.  Proactive IP address acquisition using stateless
        autoconfiguration

   For IPv6, network address is configured either using DHCPv6 or
   stateless autoconfiguration.  In order to obtain the new IP address
   proactively, the router advertisement of the next hop router can be
   sent over the established tunnel, and a new IPv6 address is generated
   based on the prefix and MAC address of the mobile.  Generating a COA
   from the new network will avoid the time needed to obtain an IP
   address and perform Duplicate Address Detection.

   In order to maintain the DHCP binding for the mobile node and keep
   track of the dispensed IP address before and after the secure
   proactive handover, the same DHCP client identifier needs to be used
   for the mobile node for both DHCP for proactive IP address
   acquisition and DHCP performed after the mobile node enters the
   target network.  The DHCP client identifier may be the MAC address of



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 28]


Internet-Draft                MPA Framework                  August 2007


   the mobile node or some other identifier.  In case of stateless
   autoconfiguration, the mobile checks to see the prefix of the router
   advertisement in the new network and matches it with the prefix of
   newly assigned IP address.  If these turn out to be the same then the
   mobile does not go through the IP address acquisition phase again.

7.4.  Address resolution

   Address resolution includes two operations, such as duplicate address
   detection, and updating next access router's neighbor cache.  We
   briefly describe these two operations below.

7.4.1.  Proactive duplicate address detection

   When the DHCP server dispenses an IP address, it updates its lease
   table, so that this same address is not given to another client for
   that specific period of time.  At the same time the client also keeps
   a lease table locally so that it can renew when needed.  In some
   cases where a network consists of both DHCP and non-DHCP enabled
   clients, there is a probability that another client in the LAN may
   have been configured with an IP address from the DHCP address pool.
   In such scenario the server detects a duplicate address based on ARP
   (Address Resolution Protocol) or IPv6 Neighbor Discovery before
   assigning the IP address.  This detection procedure may take from 4
   sec to 15 sec [MAGUIRE] and will thus contribute to a larger handover
   delay.  In case of proactive IP address acquisition process, this
   detection is performed ahead of time and thus does not affect the
   handover delay at all.  By performing the duplicate address detection
   ahead of time, we reduce the IP address acquisition time.

7.4.2.  Proactive address resolution update

   During the process of pre-configuration, the MAC address resolution
   mappings needed by the mobile node to communicate with nodes in the
   target network after attaching to the target network can also be
   known, where the communicating nodes maybe the access router,
   authentication agent, configuration agent and correspondent node.
   There are several possible ways of performing such proactive MAC
   address resolution.


   o  Use an information service mechanism [802.21] to resolve the MAC
      addresses of the nodes.  This might require each node in the
      target network to be involved in the information service so that
      the server of the information service can construct the database
      for proactive MAC address resolution.





Dutta (Ed.), et al.     Expires February 17, 2008              [Page 29]


Internet-Draft                MPA Framework                  August 2007


   o  Extend the authentication protocol used for pre-authentication or
      the configuration protocol used for pre-configuration to support
      proactive MAC address resolution.  For example, if PANA is used as
      the authentication protocol for pre-authentication, PANA messages
      may carry AVPs used for proactive address resolution.  In this
      case, the PANA authentication agent in the target network may
      perform address resolution for on behalf of the mobile node.


   o  One can also make use of DNS to map the MAC address of the
      specific interface associated with a specific IP address of the
      network element in the target network.  One may define a new DNS
      resource record (RR) to proactively resolve the MAC addresses of
      the nodes in the target network.  But this approach may have its
      own limitations since a MAC address is a resource that is bound to
      an IP address, not directly to a domain name.

   When the mobile node attaches to the target network, it installs the
   proactively obtained address resolution mappings without necessarily
   performing address resolution queries for the nodes in the target
   network.

   On the other hand, the nodes that reside in the target network and
   are communicating with the mobile node should also update their
   address resolution mappings for the mobile node as soon as the mobile
   node attaches to the target network.  The above proactive address
   resolution methods could also be used for those nodes to proactively
   resolve the MAC address of the mobile node before the mobile node
   attaches to the target network.  However, this is not useful since
   those nodes need to detect the attachment of the mobile node to the
   target network before adopting the proactively resolved address
   resolution mapping.  A better approach would be integration of
   attachment detection and address resolution mapping update.  This is
   based on gratuitously performing address resolution [RFC3344],
   [RFC3775] in which the mobile node sends an ARP Request or an ARP
   Reply in the case of IPv4 or a Neighbor Advertisement in the case of
   IPv6 immediately after the mobile node attaches to the new network so
   that the nodes in the target network can quickly update the address
   resolution mapping for the mobile node.

7.5.  Tunnel management

   After an IP address is proactively acquired from the DHCP server in a
   CTN, a proactive handover tunnel is established between the mobile
   node and the access router in the CTN.  The mobile node uses the
   acquired IP address as the tunnel's inner address.

   The proactive handover tunnel is established using a tunnel



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 30]


Internet-Draft                MPA Framework                  August 2007


   management protocol.  When IKEv2 is used for proactive IP address
   acquisition, IKEv2 is also used as the tunnel management protocol.
   Alternatively, when PANA is used for proactive IP address
   acquisition, PANA may be used as the secure tunnel management
   protocol.

   Once the proactive handover tunnel is established between the mobile
   node and the access router in the candidate target network, the
   access router also needs to perform proxy address resolution (Proxy
   ARP) on behalf of the mobile node so that it can capture any packets
   destined to the mobile node's new address.

   Since the mobile needs to be able to communicate with the
   correspondent node while in the previous network some or all parts of
   binding update and data from the correspondent node to mobile node
   need to be sent back to the mobile node over a proactive handover
   tunnel.  Details of these binding update procedure are described in
   Section 5.7.

   In order for the traffic to be directed to the mobile node after the
   mobile node attaches to the target network, the proactive handover
   tunnel needs to be deleted or disabled.  The tunnel management
   protocol used for establishing the tunnel is used for this purpose.
   Alternatively, when PANA is used as the authentication protocol the
   tunnel deletion or disabling at the access router can be triggered by
   means of PANA update mechanism as soon as the mobile moves to the
   target network.  A link-layer trigger ensures that the mobile node is
   indeed connected to the target network and can also be used as the
   trigger to delete or disable the tunnel.

7.6.  Binding Update

   There are several kinds of binding update mechanisms for different
   mobility management schemes.

   In case of Mobile IPv4 and Mobile IPv6, the mobile performs a binding
   update with the home agent only, if route optimization is not used.
   Otherwise, the mobile performs binding update with both the home
   agent (HA) and corresponding node (CN).

   In case of SIP-based terminal mobility, the mobile sends binding
   update using INVITE to the correspondent node and REGISTER message to
   the Registrar.  Based on the distance between the mobile and the
   correspondent node, the binding update may contribute to the handover
   delay.  SIP-fast handover [SIPFAST] provides several ways of reducing
   the handover delay due to binding update.  In case of secure
   proactive handover using SIP-based mobility management we do not
   encounter the delay due to binding update completely, as it takes



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 31]


Internet-Draft                MPA Framework                  August 2007


   place in the previous network.

   Thus, this scheme looks more attractive when the correspondent node
   is too far from the communicating mobile node.  Similarly, in case of
   Mobile IPv6, the mobile sends the newly acquired CoA from the target
   network as the binding update to the HA and CN.  Also all signaling
   messages between MN and HA and between MN and CN are passed through
   this proactive tunnel that is set up.  These messages include Binding
   Update (BU), Binding Acknowledgement (BA) and the associated return
   routability messages such as Home Test Init (HoTI), Home Test (HoT),
   Care-of Test Init (CoTI), Care-of Test (COT).

   If the proactive handover tunnel is realized as an IPsec tunnel, it
   will also protect these signaling messages between the tunnel end
   points and will make the return routability test more secured.  Any
   subsequent data will also be tunneled through as long as the mobile
   is in the previous network.  The accompanying document
   [I-D.ohba-mobopts-mpa-implementation] talks about the details of how
   binding updates and signaling for return routability are sent over
   the secured tunnel.

7.7.  Preventing packet loss

7.7.1.  Packet loss prevention in single interface MPA

   For single interface MPA, there may be some transient packets during
   link-layer handover that are directed to the mobile node at the old
   point of attachment before the mobile node is able to attach to the
   target network.  Those transient packets can be lost.  Buffering
   these packets at the access router of the old point of attachment can
   eliminate packet loss.  Dynamic buffering signals that are signalled
   from the MN can temporarily hold transient traffic during handover
   and then these packets can be forwarded to the MN once it attaches to
   the target network.  A detailed analysis of buffering can technique
   can be found in [PIMRC06].

   An alternative method is to use bicasting.  Bicasting helps to
   forward the traffic to two destinations at the same time.  However,
   it does not eliminate packet loss if link-layer handover is not
   seamlessly performed.  On the other hand, buffering does not reduce
   packet delay.  While packet delay can be compensated by playout
   buffer at the receiver side for streaming application, playout buffer
   does not help much for interactive VoIP application that cannot
   tolerate for large delay jitters.  Thus it is still important to
   optimize the link-layer handover anyway.






Dutta (Ed.), et al.     Expires February 17, 2008              [Page 32]


Internet-Draft                MPA Framework                  August 2007


7.7.2.  Preventing packet losses for multiple interfaces

   MPA usage in multi-interface handover scenario involves preparing the
   second interface for use via the current active interface.  This
   preparation involves pre-authentication and provisioning at a target
   network where the second interface would be the eventual active
   interface.  An example, during inter-technology handover from a Wi-Fi
   to a CDMA network, pre-authentication at the CDMA network can be
   performed via the Wi-Fi interface.  Handover occurs when the CDMA
   interface becomes the active interface for the MN.

   In such scenario, if handover occurs while both interfaces are
   active, there is generally no packet loss since transient packets
   directed towards the old interface will still reach the MN.  However,
   if sudden disconnection of the current active interface is used to
   initiate handover to the prepared interface then transient packets
   for the disconnected interface will be lost while the MN attempts to
   be reachable at the prepared interface.  In such cases, a specialized
   form of buffering can be used to eliminate packet loss where packets
   are merely copied at an access router in the current active network
   prior to disconnection.  If sudden disconnection does occur, copied
   packets can be forwarded to the MN once the prepared interface
   becomes the active reachable interface.  The copy-and-foward
   mechanism is not limited to multi-interface handover.

   A notable side-effect of this process is the possible duplication of
   packets during forwarding to the new active interface.  Several
   approaches can be employed to minimize this effect.  Relying on upper
   layer protocols such as TCP to detect and eliminate duplicates is the
   most common approach.  Customized duplicate detection and handling
   techniques can also be used.  In general, packet duplication is a
   well known issue that can also be handled locally by the MN.

   If the mobile takes a longer amount of time to detect the
   disconnection event of the current active interface, it can also have
   an adverse effect on the length of the handover process.  Thus it
   becomes necessary to use an optimized scheme of detecting interface
   disconnection in such scenarios.

7.7.3.  Reachability test

   In addition to previous techniques, the MN may also want to ensure
   reachability of the new point of attachment before switching from the
   old one.  This can be done by exchanging link-layer management frames
   with the new point of attachment.  This reachability check should be
   performed as quickly as possible.  In order to prevent packet loss
   during this reachability check, transmission of packets over the link
   between the MN and old point of attachment should be suspended by



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 33]


Internet-Draft                MPA Framework                  August 2007


   buffering the packets at the both ends of the link during the
   reachability check.  How to perform this buffering is out of scope of
   this document.  Some of the results using this buffering scheme are
   explained in the accompanying implementation document.

7.8.  Link-layer security and mobility

   Using the MPA-SA established between the mobile node and the
   authentication agent for a CTN, during the pre-authentication phase,
   it is possible to bootstrap link-layer security in the CTN while the
   mobile node is in the current network in the following way.  Figure 5
   shows the sequence of operation.

   (1) The authentication agent and the mobile node derives a PMK (Pair-
   wise Master Key) [I-D.ietf-eap-keying] using the MPA-SA that is
   established as a result of successful pre-authentication.  Successful
   operation of EAP and an AAA protocol may be involved during pre-
   authentication to establish the MPA-SA.  From the PMK, distinct TSKs
   (Transient Session Keys) [I-D.ietf-eap-keying] for the mobile node
   are directly or indirectly derived for each point of attachment of
   the CTN.

   (2) The authentication agent may install the keys derived from the
   PMK and used for secure association to points of attachment.  The
   derived keys may be TSKs or intermediary keys from which TSKs are
   derived.

   (3) After the mobile node chooses a CTN as the target network and
   switches to a point of attachment in the target network (which now
   becomes the new network for the mobile node), it executes a secure
   association protocol such as the IEEE 802.11i 4-way handshake
   [802.11] using the PMK in order to establish PTKs (Pair-wise
   Transient Keys) and GTKs (Group Transient Keys) [I-D.ietf-eap-keying]
   used for protecting link-layer packets between the mobile node and
   the point of attachment.  No additional execution of EAP
   authentication is needed here.

   (4) While the mobile node is roaming in the new network, the mobile
   node only needs to perform a secure association protocol with its
   point of attachment point and no additional execution of EAP
   authentication is needed either.  Integration of MPA with link-layer
   handover optimization mechanisms such as 802.11r can be archived this
   way.

   The mobile node may need to know the link-layer identities of the
   point of attachments in the CTN to derive TSKs.





Dutta (Ed.), et al.     Expires February 17, 2008              [Page 34]


Internet-Draft                MPA Framework                  August 2007


    _________________        ____________________________
   | Current Network |      |           CTN              |
   |   ____          |      |                 ____       |
   |  |    |      (1) pre-authentication     |    |      |
   |  | MN |<------------------------------->| AA |      |
   |  |____|         |      |                |____|      |
   |    .            |      |                  |         |
   |    .            |      |                  |         |
   |____.____________|      |                  |         |
        .movement           |                  |(2) Keys |
    ____.___________________|                  |         |
   |   _v__                      _____         |         |
   |  |    |(3) secure assoc.   |     |        |         |
   |  | MN |<------------------>| AP1 |<-------+         |
   |  |____|                    |_____|        |         |
   |    .                                      |         |
   |    .movement                              |         |
   |    .                                      |         |
   |    .                                      |         |
   |   _v__                      _____         |         |
   |  |    |(4) secure assoc.   |     |        |         |
   |  | MN |<------------------>| AP2 |<-------+         |
   |  |____|                    |_____|                  |
   |_____________________________________________________|

                Figure 5: Bootstrapping Link-layer Security

7.9.  IP layer security and mobility

   IP layer security is typically maintained between the mobile and
   first hop router or any other network element such as SIP proxy by
   means of IPsec.  This IPSec SA can be set up either in tunnel mode or
   in ESP mode.  However, as the mobile moves IP address of the router
   and outbound proxy will change in the new network, mobile's IP
   address may or may not change depending upon the mobility protocol
   being used.  This will warrant re-establishing a new security
   association between the mobile and the desired network entity.  In
   some cases such as in 3GPP/3GPP2 IMS/MMD environment data traffic is
   not allowed to pass through unless there is an IPsec SA established
   between the mobile and outbound proxy.  This will of course add
   unreasonable delay to the existing real-time communication during
   mobile's movement.  In this scenario key exchange is done as part of
   SIP registration that follows a key exchange procedure called AKA
   (Authentication and Key Agreement).

   MPA can be used to bootstrap this security association as part of
   pre-authentication via the new outbound proxy.  Prior to the movement
   if the mobile can pre-register via the new outbound proxy in the



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 35]


Internet-Draft                MPA Framework                  August 2007


   target network and completes the pre-authentication procedure, then
   the new SA state between the mobile and new outbound proxy can be
   established prior to the movement to the new network.  A similar
   approach can also be applied if a key exchange mechanism other than
   AKA is used or the network element with which the security
   association has to be established is different than an outbound
   proxy.

   By having the security association established ahead of time, the
   mobile does not need to involve in any exchange to set up the new
   security association after the movement.  Any further key exchange
   will be limited to renew the expiry time.  This will also reduce the
   delay for real-time communication as well.

7.10.  Authentication in initial network attachment

   When the mobile node initially attaches to a network, network access
   authentication would occur regardless of the use of MPA.  The
   protocol used for network access authentication when MPA is used for
   handover optimization can be a link-layer network access
   authentication protocol such as IEEE 802.1X or a higher-layer network
   access authentication protocol such as PANA.





























Dutta (Ed.), et al.     Expires February 17, 2008              [Page 36]


Internet-Draft                MPA Framework                  August 2007


8.  MPA Deployment Issues

   In this section we describe some of the deployment issues related to
   MPA.

8.1.  Considerations for failed switching and switch-back

   The ping-Pong effect is one of the common problems found during
   handover.  The Ping-pong effect arises when a mobile is located at
   the borderline of the cell or decision point and a handover procedure
   is frequently executed.  This results in higher call drop
   probability, lower connection quality, increased signaling traffic
   and waste of resources.  All of these affect mobility optimization.
   Handoff algorithms are the deciding factors for performing the
   handoff between the networks.  Traditionally these algorithms employ
   a threshold to compare the values of different metrics to decide on
   the handoff.  These metrics include signal strength, path loss,
   carrier-to-interference ratios (CIR), Signal to Interference Ratios
   (SIR), Bit Error Rate (BER), power budget.  In order to avoid the
   ping-pong effect, some additional parameters are employed by the
   decision algorithm such as hystereris margin, dwell timers, and
   averaging window.  For a vehicle moving with a high speed, other
   parameters such as distance between the mobile node and the point of
   attachment, velocity of the mobile, location of the mobile, traffic
   and bandwidth characteristics are also taken into account to reduce
   the ping-pong effect.  Most recently there are other handoff
   algorithms that help reduce the ping-pong effect in a heterogeneous
   network environment that are based on techniques such as hypothesis
   testing, dynamic programming and pattern recognition techniques.
   While it is important to devise smart handoff algorithms to reduce
   the ping-pong effect, it is also important to devise methods to
   recover from these effect.

   In the case of MPA framework, the ping-pong effect will result in the
   back-and-forth movement of the mobile between the current network and
   target network and between the candidate target networks.  MPA in its
   current form will be affected because of many number of tunnel setup,
   number of binding updates and associated handoff latency resulting
   out of ping-pong situation.  Mobile's handoff rate may also
   contribute to delay and packet loss.  We propose several algorithms
   that will help reduce the probability of ping-pong and propose
   several methods for the MPA framework so that it can recover from the
   packet loss resulting out of ping-pong effect.

   The MPA framework can take advantage of the mobile's geo-location
   with respect to APs in the neighboring networks using GPS.  In order
   to avoid the oscillation between the networks, a location-based
   intelligent algorithm can be derived by using a co-relation between



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 37]


Internet-Draft                MPA Framework                  August 2007


   user's location and cached data from the previous handover attempts.
   In some cases only location may not be the only indicator for a
   handoff decision.  For example in Manhattan type grid networks,
   although a mobile is close to an AP, it may not have enough SNR
   (Signal to Noise Ration) to make a good connection.  Thus knowledge
   of mobility pattern, dwell time in a call and path identification
   will help avoid the ping-pong problem to a great extent.

   In the absence of a good handoff algorithm that can avoid ping-pong
   effect, it may be required to put in place a good recovery mechanism
   so as to mitigate the effect of ping-pong.  It may be necessary to
   keep the established context in the current network for a period of
   time, so that it can be quickly recovered when the mobile comes back
   to the network where the context was last used.  These context may
   include security association, IP address used, tunnels established.
   Bicasting the data to both previous network and new network for a
   predefined period will also the mobile help take care of the lost
   packets in case the mobile moves back and forth between the networks.
   The mobile can also take certain action, after it determines that it
   is in a stable state with respect to ping-pong situation.

   When MPA framework takes advantage of a combination of IKEv2 and
   MOBIKE, the ping-pong effect can be reduced further [mpa-mobike].

8.2.  Authentication state management

   In case of pre-authentication with multiple target networks, it is
   useful to maintain the state in the authentication agent of each of
   the neighboring networks for certain time.  Thus if the mobile does
   move back and forth between neighboring networks, already maintained
   authentication state can be helpful.  We provide some highlights on
   multiple security association state management below.

   A MN that has pre-authenticated to an authentication agent in a
   candidate target network and has a MPA-SA, may need to continue to
   keep the MPA-SA while it continues to stay in the current network or
   even after it does handover to a network that is different from the
   candidate target network.

   When an MN that has been authenticated and authorized by an
   authentication agent in the current network makes a handover to a
   target network, it may want to hold the SA that has been established
   between the MN and the authentication agent for a certain time period
   so that it does not have to go through the entire authentication
   signaling to create an SA from scratch in case it returns to the
   previous network.  Such an SA being held at the authentication agent
   after the MN's handover to other network is considered as an MPA-SA.
   In this case, the authentication agent should change the fully



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 38]


Internet-Draft                MPA Framework                  August 2007


   authorized state for the MN to an unauthorized state.  The
   unauthorized state can be changed to the fully authorized state only
   when the MN comes back to the network and provides a proof of
   possession of a key associated with the MPA-SA.

   While an MPA-SA is being held at an authentication agent, the MN will
   need to keep updating the authentication agent when an IP address of
   the MN changes due to a handover to re-establish the new SA.

8.3.  Pre-allocation of QoS resources

   In the pre-configuration phase, it is also possible to pre-allocate
   QoS resources that may be used by the mobile node not only after
   handover but also before handover.  When pre-allocated QoS resources
   are used before handover, it is used for application traffic carried
   over a proactive handover tunnel.

   It is possible that QoS resources are pre-allocated in an end-to-end
   fashion.  One method to achieve this proactive end-to-end QoS
   reservation is to execute NSLP [I-D.ietf-nsis-qos-nslp] or RSVP
   [RFC2205] over a proactive handover tunnel where pre-authentication
   can be used for bootstrapping a security association for the
   proactive handover tunnel to protect the QoS signaling.  In this
   case, QoS resources are pre-allocated on the path between the
   correspondent node and a target access router can be used
   continuously before and after handover.  On the other hand, duplicate
   pre-allocation of QoS resources between the target access router and
   the mobile node is necessary when using pre-allocated QoS resources
   before handover due to difference in paths between the target access
   router and the mobile node before and after handover.  QoS resources
   to be used for the path between the target access router and the
   mobile node after handover may be pre-allocated by extending NSLP to
   work for off-path signaling (Note: this path can be viewed as off-
   path before handover) or by media-specific QoS signaling at layer 2.

8.4.  Resource allocation issue during pre-authentication

   In case of multiple CTNs, establishing multiple tunnels with the
   neighboring target networks provides some additional benefits.  But
   it also contributes to some resource utilization issues as well.
   Pre-authentication process with multiple candidate target networks
   can happen in several ways.

   The very basic scheme involves authenticating the mobile with the
   multiple authentication agents in the neighboring networks, but
   actual pre-configuration and binding update take place only after
   layer 2 movement to a specific network is complete.




Dutta (Ed.), et al.     Expires February 17, 2008              [Page 39]


Internet-Draft                MPA Framework                  August 2007


   Similarly, in addition to pre-authentication, the mobile can also
   complete the pre-configuration while in the previous network, but can
   postpone the binding update until after the mobile has moved.  Like
   the previous case, in this case the mobile also does not need to set
   up the pre-configured the tunnels.  While pre-authentication process
   and part of pre-configuration process are taken care of before the
   mobile has moved to the new network, binding update is actually done
   after the mobile has moved.

   The third type of multiple pre-authentication involves all the three
   steps while the mobile is in the previous networks, such as
   authentication, configuration and binding update.  But, this specific
   process utilizes the most amount of resources.  Some of the resources
   that get used during this process are as follows:

   1)Additional signaling for pre-authentication in the neighboring
   networks

   2)Holding the IP address of the neighboring networks in mobiles cache
   for certain amount of time.  It needs additional processing in the
   mobile for storing these IP addresses.  In addition it also uses up
   the temporary IP addresses from the neighboring routers.

   3)There is an additional cost associated with setting up additional
   transient tunnels with the target routers in the neighboring networks
   and mobile.

   4) In case of binding update with multiple IP addresses obtained from
   the neighboring networks, multiple transient streams flow between the
   CN and mobile using these transient tunnels.

   When only pre-authentication and pre-configuration are done ahead of
   time with multiple networks, the mobile sends one binding update to
   the CN.  In this case it is important to find out when to send the
   binding update after the layer 2 handoff.

   In case binding update with multiple contact addresses is sent,
   multiple media streams stem out of CN using the transient tunnels.
   But in that case one needs to send another Binding Update after the
   handover with the contact address set to the new address (only one
   address) where the mobile has moved.  This way the mobile stops
   sending media to other neighboring networks where the mobile did not
   move.

   The following is an illustration of this specific case that takes
   care of multiple binding streams, when the mobile moves only to a
   specific network, but sends multiple binding updates in the previous
   network.  MN sends a binding update to CH with multiple contact



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 40]


Internet-Draft                MPA Framework                  August 2007


   addresses such as c1,c2, and c3 that were obtained from three
   neighboring networks.  This allows the CN to send transient multiple
   streams to the mobile over the pre-setablished tunnels.  After the
   mobile moves to the actual network, it sends another binding update
   to the CN with the care-of-address of the mobile in the network where
   the mobile has moved in.  Some of the issues with multiple stream are
   consumption of extra bandwidth for a small period of time.

   Alternatively, one can apply the buffering technique at the target
   access router or at the home agent.  Transient data can be forwarded
   to the mobile after it has moved in.  Forwarding of data can be
   triggered by the mobile either as part of Mobile IP registration or
   as a separate buffering protocol.






































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 41]


Internet-Draft                MPA Framework                  August 2007


9.  MPA Case Studies for Inter-Domain Handoff

   In this section, we illustrate various case studies where MPA can be
   used to optimize Inter-domain handoff.

9.1.  Homogeneous Mobility Protocol in each domain

   In this section we provide illustration of how MPA can be used to
   optimize inter-domain handoff for several mobility protocols, such as
   MIPv6, SIP-based mobility, MIPv4, ProxyMIP, and Multicast.  In this
   specific case each domain has similar type of mobility protocol.
   Also it is noteworthy to mention that MPA can help bootstrap layer 2
   security for all the mobility protocols.

9.1.1.  Mobile IPv6

   MPA can provide proactive optimization, if the neighboring domains
   are MIPv6 enabled.  Detailed explanation about MPA's implementation
   with MIPv6 can be found in the accompanying implementation draft
   [I-D.ohba-mobopts-mpa-implementation].

9.1.2.  SIP Mobility

   MPA can provide proactove optimization during inter-domain handover
   when the neighboring domains support SIP-based mobility.  Detailed
   explanation about MPA's demonstration with SIP-based mobility can be
   found in the accompanying implementation draft
   [I-D.ohba-mobopts-mpa-implementation].

9.1.3.  MIPv4 FA-CoA

   In many of the deployment scenarios such as in IMS/MMD (IP Multimedia
   Subsystem/Multimedia Domain) architecture using MIPv4 as the binding
   protocol, IP address of the mobile does not change as the mobile
   moves from one visited network to another.  A typical example is when
   the mobile uses MIPv4 and uses FA Care-of-Address and interacts with
   the outbound SIP proxy.  In such a situation the mobile has only its
   Home Address (HoA) assigned to its interface.  MPA mechanism in its
   current form will give rise to routing loop, if the mobile uses HoA
   as the outer address of the MPA proactive tunnel described
   previously.

   In this scenario while the mobile is still with pFA, if it sets up a
   proactive tunnel with nFA using the HoA as the outer address and
   sends the binding update with with nFA's care-of-address, then any
   packet destined to mobile will first be routed to nFA and then
   because of the associated tunnel, it will be sent back to the HA,
   resulting in a routing loop.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 42]


Internet-Draft                MPA Framework                  August 2007


   In order to take care of this routing problem we propose different
   ways of creating two tunnels such as forward proactive and reverse
   proactive tunnels.  Forward proactive tunnel helps tunnel the traffic
   from nFA to MN whereas the packets from the mobile goes over the
   reverse proactive tunnel.  We propose to use p-FA's CoA as the tunnel
   outer address of the MN for forward proactive tunnel and propose to
   use mobile's HoA as the outer address of the reverse proactive
   tunnel.  Traffic destined to HoA when arrives at nFA will get routed
   to pFA over proactive tunnel using the host based routing set up at
   nFA.  Figure 6 shows a scenario of assymmetric procative tunnel that
   is needed to care of this routing loop.

   This will work only when both serving and target networks support FA-
   CoA.





































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 43]


Internet-Draft                MPA Framework                  August 2007


                                         +------+         +----+
                                         |      +---------|    |
                                         |HA    |         |CN  |
                                         +-++---+         +----+
                        Forward Proactive  ||
                        Handover Tunnel    ||/       Mobile IP
                                           ||--------Forward and Reverse
                                |          ||\       Tunnel
                                |          ||
                  +------+     \|/      +--++--+
                  |      +--------------+      |
                  |pFA   +--------------+nFA   |
                  |     -+--------------+      |
                  +---+-++--------------+------+
                      | |       /|\
                      | |/       |
                      | |--------Reverse Proactive
                      | |\       Handover Tunnel
                   +--+-+
                   |MN  |
                   |    |
                   +----+


                    Figure 6: MPA with FA-CoA Scenario

9.1.4.  Proxy MIPv6

   In this section, we describe how one can achieve fast handoff for
   ProxyMIPv6 using Media-independent Pre-Authentication (MPA)
   technique.  PrxyMIPv6 is a network layer localized protocol being
   discussed in NETLMM working group within IETF currently.  The goals
   and advantages for local mobility management have duly been
   documented in the problem statement [RFC4830] and no-host-requirement
   [RFC4831] drafts.

   Advantage of local mobility management is to optimize many of the
   functions related to mobility and reduce the number of signaling
   messages over the air.  ProxyMIPv6 [I-D.sgundave-mipv6-proxymipv6] is
   currently one of the candidate protocols that can take care of the
   localized mobility management when the mobile's movement is limited
   within a domain.  It follows many of the goals and advantages that
   have been discussed as part of the problem statement and no host-
   requirement drafts.  However, ProxyMIPv6 in its current form still
   needs a mechanism to provide fast-handover.  There are several
   components within ProxyMIPv6 that contribute to the overall handoff
   delay.  These components include access authentication, profile
   verification, home address reconfiguration, and binding update.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 44]


Internet-Draft                MPA Framework                  August 2007


   However, things appear to be more complicated and handoff takes more
   time for inter-domain case, as it involves two home agents in each
   domain and the home prefix advertisement is different in each domain.

   MPA-based fast-handover takes advantage of the pre-authentication
   mechanism so that the mobile can perform the access authentication
   and other related handover operations while under the previous proxy
   mobility agent (PMA) domain.  In this section, we describe how Media
   Independent Pre-authentication techniques can be used to provide fast
   handover for both intra-domain and inter-domain roaming involving
   ProxyMIPv6.  The draft [I-D.taniuchi-netlmm-mpa-proxymipv6] discusses
   the details of MPA-assisted fast-handover techniques for ProxyMIPv6.
   We only provide the highlights of MPA framework in the context of
   ProxyMIPv6.  In particular, we limit our discussion to the intra-
   domain movement scenario only.  The bootstrapping scenario remains
   same independent of if the mobile is going to be subjected to intra-
   domain or inter-domain handoff.  Next, we discuss how pre-
   authentication technique helps to achieve fast-handoff for intra-
   domain handover scenario.

   When the mobile is in the previous network, access authentication
   takes place according to the standard proxyMIPv6 specification.  In
   case of intra-domain handoff, both the PMAs (Proxy Mobile Agents)
   share the same home agent (HA).  We consider the scenario where the
   mobile moves from one PMA to another PMA within the same home agent
   domain.  We describe the steps associated with the pre-
   authentication.

   During the pre-authentication phase, the mobile can complete the
   layer 3 and layer 2-based access authentication while still in the
   previous network, thereby reducing the time due to pre-
   authentication.  Figure 7 shows an example of pre-authentication in
   proxyMIPv6 case.


















Dutta (Ed.), et al.     Expires February 17, 2008              [Page 45]


Internet-Draft                MPA Framework                  August 2007


                      +-----+              +-----+
                      |     \              | AAA |
                      |CN   |\\            |     |
                      +-----+  \           *-+---+
                                \*-----+  /|\|
                                 /\    |   | |
                                /|HA   |   | |
                               / *-----+   | |
                              / /          | |
                             / /           | |
                            / /            | |
                       +---|-*/           ++-+---+
                       |pPMA X------------+|nPMA |
                       |pPAA |\           ||nPAA |
                       |pAR-+-+-----------++nNAR |
                       +--\*-*            +------+
                           \\ \
                            \\ \
                             \\ \
                              \\ \
                               \\ \      -----------
                         -------\\-\  ///           \\\
                      ///        \\\XX                 \\
                    ||          +-\\+\+|                |
                   |            |  |  | |                |
                   |            | MN| | |               |
                    ||          +-----+|               //
                      \\\          ///\\\           ///
                         ----------      -----------



                    Figure 7: Pre-authentication phase

   As part of the pre-authentication phase, a proactive tunnel is
   created between pPMA and nPMA.  After the tunnel is created between
   the pPMA and nPMA during the authentication phase, nPMA sends a proxy
   binding update on behalf of the mobile.  During the proxy binding
   update the the data still flows through the pPMA.

   After the proxy-binding update is sent to the HA from nPMA on behalf
   of the mobile, another tunnel is created between HA and nPMA.  Figure
   8 shows this procedure.  However, while this tunnel is being created,
   the data still flows through pPMA.  Thus, data loss is avoided during
   this tunnel creation.  However, after the tunnel is created the new
   data gets forwarded to oPoA via two tunnels - the tunnel between HA
   and nPMA and the tunnel between nPMA and pPMA.  The tunnel between HA
   and pPMA can time-out, it does not need to be deleted specifically.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 46]


Internet-Draft                MPA Framework                  August 2007


               +-----+
               |     |                   +-----+
               | CN  |                   |AAA  |
               +-----*                   |     |
                      \                  +-----+
                       \
                        \   +------+
                         \  | HA   |
                          \ |      \
                           \*-/---\+\
                           / /     \ \
                          / /       \ \
                         / /         \ \
               +-------+/ /           \+-------+
               | pPMA  / /             |nPMA   |
               | pPAA  |/              |nPAA   |
               | pAR   +---------------+nAR    |
               |       +---------------+       |
               +----\--+               +-------+
                     \
                      \
                -------\---        ------------
            ////        \  \\\\////            \\\\
          ||             *---+++|                  ||
         |               |  |  | |                   |
         |               |MN|  | |                   |
          ||             +---+++|                  ||
            \\\\           ////\\\\            ////
                -----------        ------------


               Figure 8: Tunnel Creation between nPMA and HA

   Since the tunnel between pPMA and nPMA should not be there when the
   mobile is nPoA, this tunnel should be deleted by the mobile just
   before it moves to the nPoA.  Figure 9 shows the tunnel deletion
   procedure.  In some cases, it is advisable to keep the tunnel on to
   avoid the ping-pong effect.

   At a certain threshold, the mobile finally ends up moving to the
   nPoA.  Based on the RA from the NAR, the mobile realizes that it is
   in a new network, and changes its default router.  But, since pre-
   authentication and binding update have already been taken care of
   ahead of time, the mobile does not need to go through the process of
   access authentication.  This will reduce the effective handoff time
   and eventually the packet loss as well.  Once the HA detects that the
   mobile is already within nPMA, it can always delete the tunnel
   between pPMA and HA.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 47]


Internet-Draft                MPA Framework                  August 2007


               +-------+             +------+
               | CN    |             |      |
               |       \             | AAA  |
               +-------+\            +------+
                         \
                          \
                          +\-----+
                          | HA   |
                          |      |
                          *--\-\-*
                              \ \
                               \ \
                                \ \
                                 \ \
             +-----+              *-\-\-+
             |pPMA +              +nPMA |
             |pPAA +--------------+nPAA |
             |pAR  +              +nAR  |
             +-----+              +-----*
                                       /
                                      / Tunnel Delete
                                     /
                  ------------   ---/-------
              ////            XXX\ /        \\\
            //              //    X\           \\
           |                | +--/-+|           |
          |                |  |MN  | |           |
          |                 | |    | |          |
           |                \\+----+|          //
            \\                \\\ //        ///
              \\\\            ///-----------
                  ------------


              Figure 9: Tunnel deletion between pPMA and nPMA

   This preauthentication technique can also be applicable to inter-
   domain handoff scenario, wherep PMA and nPMA are in two different
   domains.  Thus there is a different HA designed for each Proxy
   Mobility Agent.  Details of inter-domain handoff are described in the
   draft [I-D.taniuchi-netlmm-mpa-proxymipv6].

   This solution will work when both serving and target networks support
   ProxyMIP.







Dutta (Ed.), et al.     Expires February 17, 2008              [Page 48]


Internet-Draft                MPA Framework                  August 2007


9.2.  Diverse Mobility Protocol in each domain

   In some cases, each administrative domain maybe equipped with
   different kind of mobility protocol, such as domain A may use Mobile
   IP protocol and domain B maybe equipped with PMIPv6 or vice-versa.
   Since MPA's optimization technique is not tightly coupled with any
   mobility protocol, as long as it is aware of the mobility protocol in
   the target domain, it can utilize its pre-authentication and
   proactive handodd technique accordingly during the inter-domain
   handoff.  However, it needs to consider other CMIPv6 and PMIPv6
   interactions on the client.  Similarly, it can support handover
   between two domains, one supporting MIPv6 and other SIP-based
   mobility.

9.3.  Multicast mobility

   A specific mobile can subscribe to one or more IP multicast group.
   When a mobile moves to a new network multicast communication is
   interrupted because of the associated join latency.  This
   interruption can be minimized by reducing the join latency during the
   mobile's movement.  Multicast mobility can be home subscription-based
   or remote subscription based.  In home subscription-based approach
   there is a multicast router in the home network, that joins on behalf
   of the mobile.  But all the data and control signal are tunneled
   between the home agent and foreign agent or the mobile.  Home
   subscription based approach is not suitable for mobility protocols
   other than MIPv4 or MIPv6 as it depends upon the multicast router at
   the home network and the tunnel.  On the other hand remote
   subscription-based approach does not add any burden on the home agent
   unlike the previous approach but communicates with the first hop
   router in the remote network everytime it moves.

   MPA can help to provide proactive multicast mobility support for both
   the approaches.  We first describe the remote subscription-based
   approach in case of MPA.  There are two ways to reduce the join
   latency in case of MPA by joining the multicast tree proactively.  In
   MPA scenario, Next Access Router (NAR) can behave as the multicast
   proxy when the mobile is about to move to the new network.  During
   the pre-configuration phase of the MPA process after the mobile has
   been pre-authenticated, the mobile can pass on the information about
   the multicast groups that it is currently subscribed to.  As an
   example, if PANA is used as the protocol to preconfigure the mobile
   in the current network by interacting with the configuration server
   in the next network, then it can also pass on the currently
   subscribed group information to the PAA (Pana Authentication Agent)
   as part of the PNR message.  PAA in turn can communicate with the NAR
   to trigger the multicast join to the upstream router.  Thus during
   the tunnel setup process between the mobile and NAR, NAR also joins



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 49]


Internet-Draft                MPA Framework                  August 2007


   the multicast group on behalf of the mobile.

   Alternatively the mobile can directly send the multicast join request
   to the NAR using the tunnel created in the current network even
   before the mobile has moved in.  In this case the source address of
   the multicast join request will be set to that of mobile's tunnel
   end-point address, so that the NAR can figure out from which
   interface the request has come in and assumes that there is a host
   subscribed in that interface.  In both the cases we assume that NAR
   is configured as a multicast router as well.  When the mobile is in
   the current network, it can still receive the multicast traffic via
   the PAR on its currently configured IP address.  But as soon as the
   mobile moves to the new network and deletes the tunnel, it starts
   receiving the multicast traffic on the same group multicast address
   with almost zero join latency.  Since the mobile already has obtained
   an address ahead of time it also does not need to spend any time to
   configure its interface.

   In case of home subscription based approach, MPA can provide the
   mobility support for multicast services the way it provides unicast
   services for both MIPv4 and MIPv6.  The data gets delivered to the
   mobile in the previous network via the transient MPA tunnel between
   the mobile and the next access router.  This tunnel is usually a
   tunnel within a tunnel.  As the mobile moves to the new network,
   regular MIP tunnel takes care of delivering the multicast traffic in
   the new network.  This mechanism provides fast delivery of multicast
   stream, as the home agent has already started to send multicast
   traffic destined to the new network.

9.4.  Coexistence of MPA with other optimization technique

   Although MPA can provide optimization techniques by itself, it can
   also augment other optimization techniques and thus can co-exist.
   There are some similarities between the techniques associated with
   MPA and other related fast-handoff mecahnisms such as proactive part
   of FMIPv6.  Experimental results from both of these handoff
   techniques demonstrate that these results are bounded by layer 2
   delay.  However if these could be augmented by IEEE 802.21 network
   discovery mechanism, layer 2 handoff delay can also be optimized.
   This has been demonstrated in the accompanying draft
   [I-D.ohba-mobopts-mpa-implementation].  On the other hand, certain
   features of MPA could also be used to enhance the functionality of
   FMIPv6 [RFC4068].  In particular, MPA's pre-authentication feature
   for both layer-2 and layer-3, and stateful pre-configuration feature
   can also be used for FMIPv6.  MPA's layer-2 security bootstrapping
   feature can also reduce the layer-2 authentication delay for FMIPv6.
   Support for pre-authentication technique to augment FMIPv6 during
   inter-domain mobility is future work.



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 50]


Internet-Draft                MPA Framework                  August 2007


10.  Security Considerations

   This document describes a framework of a secure handover optimization
   mechanism based on performing handover-related signaling between a
   mobile node and one or more candidate target networks to which the
   mobile node may move in the future.  This framework involves
   acquisition of the resources from the CTN as well as data packet
   redirection from the CTN to the mobile node in the current network
   before the mobile node physically connects to one of those CTN.

   Acquisition of the resources from the candidate target networks must
   accompany with appropriate authentication and authorization
   procedures in order to prevent unauthorized mobile node from
   obtaining the resources.  For this reason, it is important for the
   MPA framework to perform pre-authentication between the mobile node
   and the candidate target networks.  The MN-CA key and the MN-AR key
   generated as a result of successful pre-authentication can protect
   subsequent handover signaling packets and data packets exchanged
   between the mobile node and the MPA functional elements in the CTN's.

   The MPA framework also addresses security issues when the handover is
   performed across multiple administrative domains.  With MPA, it is
   possible for handover signaling to be performed based on direct
   communication between the mobile node and routers or mobility agents
   in the candidate target networks.  This eliminates the need for a
   context transfer protocol for which known limitations exist in terms
   of security and authorization.  [I-D.ietf-eap-keying].  For this
   reason, the MPA framework does not require trust relationship among
   administrative domains or access routers, which makes the framework
   more deployable in the Internet without compromising the security in
   mobile environments.




















Dutta (Ed.), et al.     Expires February 17, 2008              [Page 51]


Internet-Draft                MPA Framework                  August 2007


11.  IANA Considerations

   This document has no actions for IANA.
















































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 52]


Internet-Draft                MPA Framework                  August 2007


12.  Acknowledgments

   We would like to thank Farooq Anjum and Raziq Yakub for their review
   of this document, and Subir Das for standardization support in the
   IEEE 802.21 WG.














































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 53]


Internet-Draft                MPA Framework                  August 2007


13.  References

13.1.  Normative References

   [RFC3344]  Perkins, C., "IP Mobility Support for IPv4", RFC 3344,
              August 2002.

   [RFC3748]  Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
              Levkowetz, "Extensible Authentication Protocol (EAP)",
              RFC 3748, June 2004.

   [RFC3775]  Johnson, D., Perkins, C., and J. Arkko, "Mobility Support
              in IPv6", RFC 3775, June 2004.

   [RFC2205]  Braden, B., Zhang, L., Berson, S., Herzog, S., and S.
              Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1
              Functional Specification", RFC 2205, September 1997.

   [RFC4140]  Soliman, H., Castelluccia, C., El Malki, K., and L.
              Bellier, "Hierarchical Mobile IPv6 Mobility Management
              (HMIPv6)", RFC 4140, August 2005.

   [RFC4068]  Koodli, R., "Fast Handovers for Mobile IPv6", RFC 4068,
              July 2005.

   [RFC4881]  El Malki, K., "Low-Latency Handoffs in Mobile IPv4",
              RFC 4881, June 2007.

   [RFC4066]  Liebsch, M., Singh, A., Chaskar, H., Funato, D., and E.
              Shim, "Candidate Access Router Discovery (CARD)",
              RFC 4066, July 2005.

   [RFC4830]  Kempf, J., "Problem Statement for Network-Based Localized
              Mobility Management (NETLMM)", RFC 4830, April 2007.

   [RFC4831]  Kempf, J., "Goals for Network-Based Localized Mobility
              Management (NETLMM)", RFC 4831, April 2007.

   [RFC4065]  Kempf, J., "Instructions for Seamoby and Experimental
              Mobility Protocol IANA Allocations", RFC 4065, July 2005.

   [I-D.ietf-eap-keying]
              Aboba, B., "Extensible Authentication Protocol (EAP) Key
              Management Framework", draft-ietf-eap-keying-18 (work in
              progress), February 2007.

   [I-D.ietf-pana-pana]
              Forsberg, D., "Protocol for Carrying Authentication for



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 54]


Internet-Draft                MPA Framework                  August 2007


              Network Access (PANA)", draft-ietf-pana-pana-17 (work in
              progress), June 2007.

   [I-D.taniuchi-netlmm-mpa-proxymipv6]
              Taniuchi, K., "Media Independent Pre-authentication
              supporting fast-handoff in PMIPv6",
              draft-taniuchi-netlmm-mpa-proxymipv6-00 (work in
              progress), March 2007.

   [RG98]     ITU-T, "General Characteristics of International Telephone
              Connections and International Telephone Circuits: One-Way
              Transmission Time", ITU-T Recommendation G.114 1998.

   [ITU98]    ITU-T, "The E-Model, a computational model for use in
              transmission planning", ITU-T Recommendation G.107 1998.

   [ETSI]     ETSI, "Telecommunications and Internet Protocol
              Harmonization Over Networks (TIPHON) Release 3: End-to-end
              Quality of Service in TIPHON systems; Part 1: General
              aspects of Quality of Service.", ETSI TR 101 329-6 V2.1.1.

13.2.  Informative References

   [RFC4555]  Eronen, P., "IKEv2 Mobility and Multihoming Protocol
              (MOBIKE)", RFC 4555, June 2006.

   [I-D.ietf-hip-base]
              Moskowitz, R., "Host Identity Protocol",
              draft-ietf-hip-base-08 (work in progress), June 2007.

   [RFC2679]  Almes, G., Kalidindi, S., and M. Zekauskas, "A One-way
              Delay Metric for IPPM", RFC 2679, September 1999.

   [RFC2680]  Almes, G., Kalidindi, S., and M. Zekauskas, "A One-way
              Packet Loss Metric for IPPM", RFC 2680, September 1999.

   [RFC2681]  Almes, G., Kalidindi, S., and M. Zekauskas, "A Round-trip
              Delay Metric for IPPM", RFC 2681, September 1999.

   [RFC1853]  Simpson, W., "IP in IP Tunneling", RFC 1853, October 1995.

   [RFC3046]  Patrick, M., "DHCP Relay Agent Information Option",
              RFC 3046, January 2001.

   [RFC4039]  Park, S., Kim, P., and B. Volz, "Rapid Commit Option for
              the Dynamic Host Configuration Protocol version 4
              (DHCPv4)", RFC 4039, March 2005.




Dutta (Ed.), et al.     Expires February 17, 2008              [Page 55]


Internet-Draft                MPA Framework                  August 2007


   [I-D.ohba-mobopts-mpa-implementation]
              Ohba, Y., "Media-Independent Pre-Authentication (MPA)
              Implementation Results",
              draft-ohba-mobopts-mpa-implementation-04 (work in
              progress), July 2007.

   [I-D.wakikawa-mobileip-multiplecoa]
              Wakikawa, R., "Multiple Care-of Addresses Registration",
              draft-wakikawa-mobileip-multiplecoa-05 (work in progress),
              March 2006.

   [I-D.ietf-nsis-qos-nslp]
              Manner, J., "NSLP for Quality-of-Service Signaling",
              draft-ietf-nsis-qos-nslp-15 (work in progress), July 2007.

   [I-D.sgundave-mipv6-proxymipv6]
              Gundavelli, S., "Proxy Mobile IPv6",
              draft-sgundave-mipv6-proxymipv6-00 (work in progress),
              October 2006.

   [SIPMM]    Schulzrinne, H. and E. Wedlund, "Application Layer
              Mobility Using SIP",  ACM MC2R.

   [CELLIP]   Cambell, A., Gomez, J., Kim, S., Valko, A., and C. Wan,
              "Design, Implementation, and Evaluation of Cellular IP",
              IEEE Personal communication Auguest 2000.

   [HAWAII]   Ramjee, R., Porta, T., Thuel, S., Varadhan, K., and S.
              Wang, "HAWAII: A Domain-based Approach for Supporting
              Mobility in Wide-area Wireless networks", International
              Conference on Network Protocols ICNP'99.

   [IDMP]     Das, S., Dutta, A., Misra, A., and S. Das, "IDMP: An
              Intra-Domain Mobility Management Protocol for Next
              Generation Wireless Networks", IEEE Wireless Communication
              Magazine October 2000.

   [I-D.ietf-mobileip-reg-tunnel]
              Calhoun, P., Montenegro, G., Perkins, C., and E.
              Gustafsson, "Mobile IPv4 Regional Registration",
              draft-ietf-mobileip-reg-tunnel-09 (work in progress),
              July 2004.

   [YOKOTA]   Yokota, H., Idoue, A., and T. Hasegawa, "Link Layer
              Assisted Mobile IP Fast Handoff Method over Wireless LAN
              Networks", Proceedings of ACM Mobicom 2002.

   [MACD]     Shin, S., "Reducing MAC Layer Handoff Latency in IEEE



Dutta (Ed.), et al.     Expires February 17, 2008              [Page 56]


Internet-Draft                MPA Framework                  August 2007


              802.11 Wireless LANs", MOBIWAC Workshop .

   [SUM]      Dutta, A., Zhang, T., Madhani, S., Taniuchi, K., Ohba, Y.,
              and H. Schulzrinne, "Secured Universal Mobility",
              WMASH 2004.

   [SIPFAST]  Dutta, A., Madhani, S., and H. Schulzrinne, "Fast handoff
              Schemes for Application Layer Mobility Management",
              PIMRC 2004.

   [PIMRC06]  Dutta, A., Ohba, Y., and H. Schulzrinne, "Dynamic
              Buffering Protocol for Mobile", PIMRC 2006.

   [MITH]     Gwon, Y., Fu, G., and R. Jain, "Fast Handoffs in Wireless
              LAN Networks using Mobile initiated Tunneling Handoff
              Protocol for IPv4 (MITHv4)", Wireless Communications and
              Networking 2003, January 2005.

   [802.21]   "Draft IEEE Standard for Local and Metropolitan Area
              Networks:  Media Independent Handover Services, IEEE
              P802.21/D00.01,", A contribution to IEEE 802.21 WG ,
              July 2005.

   [802.11]   "IEEE Wireless LAN Edition A compilation based on IEEE Std
              802.11-1999(R2003)", Institute of Electrical and
              Electronics Engineers September 2003.

   [GPSIP]    Dutta, A., "GPS-IP based fast-handoff for Mobiles", IEEE
              Sarnoff Symposium 2006.

   [MAGUIRE]  Vatn, J. and G. Maguire, "The effect of using co-located
              care-of-address on macro handover latency", 14th Nordic
              Teletraffic Seminar 1998.

   [mpa-mobike]
              Mghazli, Y. and J. Bournelle, "MPA using IKEv2 and
              MOBIKE", draft-yacine-preauth-ipsec-00 IETF.














Dutta (Ed.), et al.     Expires February 17, 2008              [Page 57]


Internet-Draft                MPA Framework                  August 2007


Authors' Addresses

   Ashutosh Dutta
   Telcordia Technologies
   1 Telcordia Drive
   Piscataway, NJ  08854
   USA

   Phone: +1 732 699 3130
   Email: adutta@research.telcordia.com


   Victor Fajardo
   Toshiba America Research, Inc.
   1 Telcordia Drive
   Piscataway, NJ  08854
   USA

   Phone: +1 732 699 5368
   Email: vfajardo@tari.toshiba.com


   Yoshihiro Ohba
   Toshiba America Research, Inc.
   1 Telcordia Drive
   Piscataway, NJ  08854
   USA

   Phone: +1 732 699 5305
   Email: yohba@tari.toshiba.com


   Kenichi Taniuchi
   Toshiba America Research, Inc.
   1 Telcordia Drive
   Piscataway, NJ  08854
   USA

   Phone: +1 732 699 5308
   Email: ktaniuchi@tari.toshiba.com











Dutta (Ed.), et al.     Expires February 17, 2008              [Page 58]


Internet-Draft                MPA Framework                  August 2007


   Henning Schulzrinne
   Columbia University
   Department of Computer Science
   450 Computer Science Building
   New York, NY  10027
   USA

   Phone: +1 212 939 7004
   Email: hgs@cs.columbia.edu










































Dutta (Ed.), et al.     Expires February 17, 2008              [Page 59]


Internet-Draft                MPA Framework                  August 2007


Full Copyright Statement

   Copyright (C) The IETF Trust (2007).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.


Acknowledgment

   Funding for the RFC Editor function is provided by the IETF
   Administrative Support Activity (IASA).





Dutta (Ed.), et al.     Expires February 17, 2008              [Page 60]