Subject: RE: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Server Split

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Tue, 14 Nov 2006 23:43:26 -0500

Hi Hannes,

IMHO, at the time of EAP authentication the MS needs to be authorized
for MIP6 service. This is because:

Regardless of whether EAP is used or some other auth method is used to
authenticate the MN, the entity that is authenticating the MN is the
MSA. The MSA by definition (Mobility Service Authorizer) needs to
Authenticate and Authorize the MN. For HoA bootstrapping, at the time of
IKEv2 transaction the HA needs to know whether the MN is authorized for
mobility service (MIP6 in this case) or not. Therefore, the AAA server
needs to either return an AVP along with EAP-Success to indicate to the
HA that the MN is authorized for MIP6 service or the AAA server can
return the address of another AAA server in the MSA that needs to be
contacted for MIP6 authorization for the MN. 

I think the former (MIP6 authorization AVP along with EAP success) is a
better option. In that case a single server for both auth and authz
should be suffice.

-Kuntal

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]]
> Sent: Friday, November 10, 2006 6:26 PM
> To: [email-masked]
> Subject: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Server Split
> 
> Hi all,
> 
> during the DIME meeting Glen raised an important question that impacts
> the design of the protocol, namely:
> "
> Do we need to support the scenario where the Diameter EAP
authentication
> and the Diameter MIPv6 authorization exchange terminate at different
> servers?
> "
> 
> Currently, we assume that these two exchanges could be terminated at
> different servers. As a  consequence, security concerns were raised
(see
> slide 5
> of http://www3.ietf.org/proceedings/06nov/slides/dime-4.ppt).
> 
> How do people think about restricting the Diameter MIPv6 HA-to-AAAH
> document to terminate the authentication and authorization exchange at
> the same server?
> 
> Ciao
> Hannes
> 
> PS: Glen also suggested to consider using the Diameter MIPv6 App-ID
for
> the Diameter EAP exchange if we decide that both exchanges terminate
at
> the same server. As a consequence the open issue described at slide 6
of
> http://www3.ietf.org/proceedings/06nov/slides/dime-4.ppt would also be
> resolved. The changes to the existing document would be minimal (about
2
> additional sentences).
> 
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Ram O V Vishnu-A14676" <[email-masked]>
Date: Wed, 15 Nov 2006 20:34:09 +0800

Hannes,

I think this "split-within-split" (if I may call it so) is hard to
understand. 

In slide-5, I don't see any interface between AAA-EAP Server and
AAA-MIP6 Server, but I definitely see that they are boxed together as an
MSA. Hence I conclude that there is no question of interoperability or
something between these. It's the MSA's job to authenticate & authorize
MIP. It could do it using 2 server, 3, 4 etc. It could do it using 2
processes, 2 tasks, 2 threads too. In either of these cases, since it
has taken up the responsibility of doing the auth & auth, it has to have
some mechanism of making sure no security hole exist. 

So, as it stands, in slide-5, the AAA-EAP server and AAA-MIP6 server
might as well be not shown. MSA could be shown as a black box.

If someone could shed some light on the motivation behind the split, any
other arrows/interfaces which might land on AAA-EAP Server or on
AAA-MIP6 Server, it would be interesting to discuss those.

Regards,
Vishnu.

Motorola
+91 9844178052
[] General
[*] Motorola Internal Use Only

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Wednesday, November 15, 2006 10:13 AM
To: Hannes Tschofenig; [email-masked]
Subject: RE: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Server
Split

Hi Hannes,

-Kuntal

> the design of the protocol, namely: "
authentication
> servers? "
(see

for
at
of

2

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Nov 2006 21:59:40 +0100

Hi Vishnu,

it is true that the figure in the slide set does not highlight the split 
between the entity that terminates the Diameter EAP application and the 
entity that performs the authorization decision is not clearly shown. 
The main reason for this is that the issue was brought to our attention 
during the working group meeting when Glen pointed specifically to the 
App-ID usage.

With the current document is it quite possible that the Diameter EAP 
application terminates at a different server than the subsequent 
Diameter MIP application since they use different App-IDs and the 
message routing can be different as well.

I also agree that the solution must not introduce new security holes.

With the feedback so far I can only assume that the split between the 
two servers is not so urgently desired. But let's wait for more feedback.

Ciao
Hannes

---

From: "Julien Bournelle" <[email-masked]>
Date: Fri, 17 Nov 2006 10:13:22 +0100

Hi,

> AAA-MIP6 Server, it would be interesting to discuss those.

 basically, as we will have 2 application-id (one for EAP and one for
mip6-Authorization/accounting), AAA messages may be routed to
different AAA servers. That's why we draw 2 different boxes.

 regards,

 Julien