Subject: Reminder! [Dime] Expert Reviewers Nominated

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 10 Dec 2006 14:39:20 +0100

Ahmad Muhanna has already sent his expert review to the mailing list.
We are still missing Glen's and Lionel's review.

Ciao
Hannes

Hannes Tschofenig wrote:
> Hi all,
>
> during the DIME meeting we selected expert reviewers for the HA<->AAAH 
> document 
> (http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-01.txt):
>
> * Glen Zorn
> * Lionel Morand
> * Ahmad Muhanna
>
> Since a number of issues have been raised during the meeting I would 
> suggest to also jump into the discussions. I will send a separate mail 
> with a description of the raised aspects.
>
> Ciao
> Hannes
>
>
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Julien Bournelle" <[email-masked]>
Date: Thu, 14 Dec 2006 19:04:38 +0100

Hi Ahmad,

 Thanks for your review.

 Comments inline..

On 11/22/06, Ahmad Muhanna <[email-masked]> wrote:
>
> Hi all,
> Please find below my technical comments after reviewing this draft.
>
> The following is the type of comments I have:
>
> 1. Editorial comments
>
> 1.1. Comment 1:
> Abstract
>
>    .................................  This document also specifies the
>    role of the Home Agent as part of the AAA infrastructure supporting
>    the Diameter Mobile IPv6 Authorization Application.
>
> I am not sure what we mean by the HA part of the AAA infrastructure. May
> be we can say "..... The Home Agent as a Diameter MIP6 Authorization
> client."

 ok.

>
> 1.2. Comment 2:
> Introduction
> "
>    With the Mobile IPv6 protocol [1], a Mobile Node (MN) is assigned a
>    Home Agent which is in charge of relaying IPv6 packets destined to
>    MN's Home Address to the MN's current address.
> "
> Can we reword this sentence as follows:
>
> "A Mobile Node (MN) that support Mobile IPv6 protocol [1] is assigned a
> Home Agent to register its Mobile IPv6 session in order facilitate its
> reachability and mobility at all time when it is a way from home."

 ok

>
> 1.3. Comment 3:
>    "
>    ....................For this reason, it is important for the Home
>    Agent to act as part of the service provider's AAA infrastructure."
>
> Can we replace it with the following:
>
> "....................For this reason, it is important for the Home
>    Agent to act as Diameter MIP6 Authorization client."

 yes

>
>
> 1.4. Comment 4:
> Under section 3.0,
> "When the verification of user authorization to receive Mobile IPv6
>  service is complete, the Home Agent..............................."
>
> Can we replace it with the following:
>
> "When the user Mobile IPv6 service authorization process is successful,
> the Home Agent..............................."

 yes

>
>
> 1.5. Comment 5:
> Under section 4:
>    "...................................................... As EAP is
>    considered as a strong choice in performing authentication, this
>    document explains the use of Diameter EAP application in cases where
>    the prior authentication between MN and HA is done through use of
>    EAP. Therefore, the HA performs AAA operations for Mobile IPv6 by
>    using two Diameter Applications, namely: Diameter EAP[6] and Diameter
>    Mobile IPv6 (specified by this document)."
>
> Can we reword this one, may be as follows:
>
>   "...................................................... As EAP is
>    very possibly the choice for performing user authentication, this

 I would prefer "considered as a strong choice"

>    document explains the use of Diameter EAP application when the MN
>    and HA use it for their authentication. Therefore HA performs user
>    authentication using Diameter EAP [6] and Mobile IPv6 service
>    authorization using Diameter Mobile IPv6 as specified in this
> document"

 ok
>
>
>
> 2. Non Completed sections comments
>
> All non completed section need to be updated and completed.

 we'll do our best :)

>
> 3. Proposed New functionality comments
>
> Under section 4.3 Accounting, it reads:
> "  ........................................................ However, due
>    to routing optimization techniques introduced with Mobile IPv6 the HA
>    does not see the entire traffic exchanged between the MN and the CN."
>
> Proposed Functionality:
> I would propose that it become part of this application the
> authorization for
> the user route optimization. This means that AAAH-MIP6 server will
> indicate
> to the HA if route optimization is allowed for this user or not using an
> AVP, like:
> MIP6-Route-Optimization-Capabilities. This will give the MSA more power
> over the
> their billing modulation and offering. This probably requires some
> change to allow the HA to communicate to MN that route optimization
> authorization status.

 i agree with you. We planned to add this in the MAA message.

 I guess how the HA communicates to the MN is however out of scope of
our document.

>
>
> 4. The main technical issue, AAAH-EAP and AAAH-MIP6 servers are
> Different.
> (IMO) this needs to be addressed depending on the bootstrapping and
> authentication Model, as described below:
>
> 4.1. Integrated Bootstrapping
> In this case, I do not see any need for the AAAH-EAP and AAAH-MIP6 to be
> the same. Both the Diameter Client and Diameter server belong to the
> same operator and there SHOULD be an existing trust relationship. In
> this case, the Diameter server AAAH-MIP6 does not need to verify or know
> that the user has been authenticated or NOT. It ONLY needs to verify if
> the user is authorized to receive Mobile IPv6 service or not. (Also the
> proposed idea below can be adopted here)

 I tend to agree. As I said to madjid, it would be good to get
opinions from others.
 I'll start a new thread on this.

>
> 4.2. Split Bootstrapping:
> In this case, I believe there are two different scenarios: (4.2.1. HA in
> the Home Network, 4.2.2. HA in the visited network)
>
> 4.2.1. HA in the Home Network
> This case is similar to 4.1.
>
> 4.2.2. HA in the Visited Network
> Although communication to the AAAH-EAP and AAAH-MIP6 servers is through
> some kind of SLA, there is still a need for the AAAH-MIP6 to be assured
> that the authorization request is for an authenticated user. Please see
> some thoughts about a possible idea for a solution below.

 Even if the HA is in the Visited Network, AAAH-EAP and AAAH-MIP6
belongs to the MSA. I don't see how it is different.

>
> 4.3. Using RFC4285
> I think this RFC should be considered for this Diameter MIP6
> Authorization application.

 I'll start another thread on this.

 Thanks again, I'll incorporate your review and will provide an
intermediate draft ASAP.

 Julien

>
>
> Proposed solutions:
> I will use the other thread for it.
>
> Many Thanks.
>
> Regards,
> Ahmad
>
>
> > -----Original Message-----
> > From: Hannes Tschofenig [mailto:[email-masked]]
> > Sent: Friday, November 10, 2006 6:13 PM
> > To: [email-masked]
> > Cc: [email-masked]; [email-masked];
> > Glen Zorn (gwz)
> > Subject: [Dime] Expert Reviewers Nominated
> >
> > Hi all,
> >
> > during the DIME meeting we selected expert reviewers for the
> > HA<->AAAH document
> >
> > Since a number of issues have been raised during the meeting
> > I would suggest to also jump into the discussions. I will
> > send a separate mail with a description of the raised aspects.
> >
> > Ciao
> > Hannes
> >
> >

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 14 Dec 2006 14:23:29 -0600

Hi Julien, please see comments inline.

Regards,
Ahmad

> Subject: Re: [Dime] Expert Reviewers Nominated
> 

>  I would prefer "considered as a strong choice"

[Ahmad]
That's fine.

> > authorization for the user route optimization. This means that 
> > AAAH-MIP6 server will indicate to the HA if route optimization is 
> > allowed for this user or not using an AVP, like:
> > MIP6-Route-Optimization-Capabilities. This will give the MSA more 
> > power over the their billing modulation and offering. This probably 
> > requires some change to allow the HA to communicate to MN 
> that route 
> > optimization authorization status.
> 
>  I guess how the HA communicates to the MN is however out of 
> scope of our document.

[Ahmad]
Agree.

> > In this case, I believe there are two different scenarios: 
> (4.2.1. HA 
> > in the Home Network, 4.2.2. HA in the visited network)
> >
> > Although communication to the AAAH-EAP and AAAH-MIP6 servers is 
> > through some kind of SLA, there is still a need for the 
> AAAH-MIP6 to 
> > be assured that the authorization request is for an authenticated 
> > user. Please see some thoughts about a possible idea for a 
> solution below.
> 
>  Even if the HA is in the Visited Network, AAAH-EAP and 
> AAAH-MIP6 belongs to the MSA. I don't see how it is different.

[Ahmad]
Since HA and AAAH-MIP6 belong to two different operators, in case the HA
is compromised or acting inappropriately, MSA always will have a record
that the MIP service which was offered to a specific session was always
delivered to an authenticated user based on information directly
received from the Home Agent itself. i.e. Since we are talking about
separate servers for authentication and authorization, HA always
certifies that the user was properly authenticated. I hope I am making
sense here.