Subject: [AAA-WG]: Proposed additions to diameter Mobile IP draft

From: [email-masked]
Date: Fri, 25 May 2001 16:37:02 +0300

Hi all,

I'd like to propose the following two additions to 
draft-ietf-aaa-diameter-mobileip.

Regards,
Henry

Issue 1:

Some authentication mechanisms may take more than one 
roundtrip to authenticate and authorize the user. An example
of such a mechanism is draft-haverinen-mobileip-gsmsim-02.txt.

Solution proposal:

These mechanisms can easily be supported in the Diameter Mobile IP
draft if an unsuccessful AMA message can be used to convey authentication 
data to the MN in a key distribution extension. So please
include the following text in Section 2.2:

   An unsuccessful AMA message MAY include mobile node registration 
   key AVPs (Section 7.1) such as the MIP-MN-to-FA-Key AVP and 
   the MIP-MN-to-HA-Key AVP. If such an AVP is present in the AMA message, 
   then the foreign agent MUST include the corresponding Mobile IP key 
   distribution extension in the Registration Reply it sends to 
   the mobile node. This is to support multi-roundtrip authentication
   mechanisms.

In addition, please include MIP-MN-to-FA-Key AVP in the 
AA-Mobile-Node-Answer message format definition.

----------------------------

Issue 2:

The AAAL may not be able to reach the home agent the mobile 
node is using even if it was able to reach the AAAH. This may occur 
for example if the home agent was allocated from a previously visited 
network, or if the mobile node is authenticated and authorized using
a local gateway to a back end AAA server (see draft-haverinen-
mobileip-gsmsim-02.txt for an example). In these cases, the foreign 
agent needs to forward the Registration Request to the home agent itself.

Solution proposal:

Section 2.2 currently says: "A successful AMA message MUST include 
the MIP-Home-Agent-Address, MIP-Home-Mobile-Node-Address AVP and 
MIP-Reg-Reply AVPs." Please remove the MIP-Reg-Reply AVP from the list.
In addition, please include the following text in Section 2.2:

   The AAAL may not always be able to reach the home agent even if was able
   to authenticate and authorize the mobile node. Therefore, if a successful

   AMA message does not include the MIP-Reg-Reply AVP, then then the foreign

   agent MUST relay the Registration Request in question to the home agent 
   itself. An AMA message can only be successful and not include
   the MIP-Reg-Reply AVP if the Registration Request includes a Home Agent
   address and a Mobile-Home Authentication Extension. As required in
   [MIPv4 base document], the foreign agent must remove any Extensions 
   following the Mobile-Home Authentication Extension before relaying
   the Request to the home agent.