AAA and Network Security for Mobile Access: Radius, Diameter, EAP, PKI and IP Mobility

9.2. PKI for Mobility Support

Now that we have covered the basic building blocks of PKIs and PKI management protocol, we can go over specific considerations when it comes to designing PKIs for networks that need to support mobile clients.

9.2.1. Identity Management for Mobile Clients: No IP Addresses!

By now, we know that the main purpose of a certificate is to tie a client identity to its public key. However, even though most clients would at most have a single public key pair, it is not so certain that they will always use the same form of identity in every interaction with the outside world. For instance, depending on the protocol stack layer the device is communicating with, it may use an IP address or a MAC address as an identifier. Cellular phones may use a phone number or similar forms of identity to connect to their networks. It is important that the identity listed on the face of the certificate is one that the client uses for identification and authentication signaling. Otherwise, presenting the certificate would be of no use. In Chapter 2 we explained why device and user authentication need to be separated. That means that the device and user need to be distinguishable from each other. The user must have an identity of a form that network devices can understand and verify. Furthermore, the user may have to use different devices to gain access to different networks. All this points to the fact that we need to distinguish between device and user certificates.

Until recently, ...