Subject: [Dime] [Fwd: Diameter Split]

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 12 Feb 2008 10:11:34 +0200

Hi all,

Alejandro worked in an EU funded project, called ENABLE, and implemented the
Diameter Mobile IPv6 split scenario. In his implementation he made a few 
enhancements;
the description can be found below:

-------------------------------------------------------------------------

Here you have a description of how we perform the split scenario:

The MN starts the IKEv2 exchanges with the HA. When the HA receives the
IKE_AUTH request message without EAP, it starts the Diameter-EAP
application with the AAA server in order to AUTHENTICATE the MN. After a
successful authentication, the MN sends the first BU to the HA. After
receiving the BU, the HA starts the Diameter Mobile IPv6 application
sending an AA-Request Command, in order to AUTHORISE the MN. If the MN
is authorised to use the MIP6 service, then a BA is sent back and the
mobility service can be used.

Note that we use two different applications, Diameter-EAP as defined in
the original RFC (without the MIP6 AVPs) and the Diameter Mobile IPv6
(as defined in your draft for Certificate or PSK authentication).

So, we have two different processes, AUTHENTICATION and AUTHORIZATION.

My comments are:
      * If you want to perform both processes together when using IKEv2
        and EAP, you need to add the Authorization-Lifetime and related
        AVPs to the command description, because reader may become
        confused (how and where they are sent? Are they included in the
        "..." AVPs?).
      * How re-authorization is performed without execute again an EAP
        authentication?

Best regards,
Alejandro

------------------------------------------------------------------------

Feedback to his comments and thoughts are obviously encouraged.

I think it would be useful to justify in the security consideration section
of the draft why we decided to combined authentication and authorization
together in one step.

Ciao
Hannes

_______________________________________________
DiME mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/dime