Subject: [Dime] Comments on Diameter Proxy Mobile IPv6 (draft-korhonen-dime-pmip6-02.txt).

From: "Jong-Hyouk Lee" <[email-masked]>
Date: Wed, 2 Jan 2008 22:36:46 +0900

Dear colleagues.
I'm happy to see that a document regarding Diameter supports for PMIPv6
appears in dime wg. Here are some comments.

Through the document, the authors describe that a mobile node performs an
access authentication procedure. However, the authors should describe that
the mobile node is performed the access authentication procedure by the
network entities. For instance, the mobile node is authenticated by the
mobile access gateway acting as a network access server.

In page 6, the authors mention about a dynamic security association between
the mobile access gateway and the local mobility anchor. Well, as you know,
according to the base document of PMIPv6, the signaling messages between the
mobility entities must be protected within the integrity and data origin
authentication manners. However, there is not only a dynamic security
association. We can use a static security association and others. Why are
you mentioning only for the dynamic method? In addition, the text ("Prior to
... is out of scope of this specification.") seems to be a superfluous text.

Cheers.

-- 
Internet Management Technology Lab, Sungkyunkwan University.
Jong-Hyouk Lee.

#email: jonghyouk (at) gmail (dot) com
#webpage: http://cv.hurryon.org
_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Jouni Korhonen <[email-masked]>
Date: Wed, 2 Jan 2008 22:40:46 +0200

Hi Jong-Hyouk,

Thank you for the review. I have included some initial comments.
See those inline.

On Jan 2, 2008, at 3:36 PM, Jong-Hyouk Lee wrote:

> Dear colleagues.
> I'm happy to see that a document regarding Diameter supports for  
> PMIPv6 appears in dime wg. Here are some comments.
>
> Through the document, the authors describe that a mobile node  
> performs an access authentication procedure. However, the authors  
> should describe that the mobile node is performed the access  
> authentication procedure by the network entities. For instance, the  
> mobile node is authenticated by the mobile access gateway acting as  
> a network access server.

There is definitely room for improving text here. E.g. in the case of  
EAP-based network
access  authentication the MAG acts as a pass-through authenticator,  
when AAA backend is
used. In this case the MAG is essentially a NAS but does not really  
authenticate the
mobile. Other authentication method could be different. Do you have  
any text to propose
that would address your concern?

>
> In page 6, the authors mention about a dynamic security association  
> between the mobile access gateway and the local mobility anchor.  
> Well, as you know, according to the base document of PMIPv6, the  
> signaling messages between the mobility entities must be protected  
> within the integrity and data origin authentication manners.

Section 6.3 is a bit more verbal on the MAG-LMA SA setup.

> However, there is not only a dynamic security association. We can  
> use a static security association and others. Why are you  
> mentioning only for the dynamic method? In addition, the text  
> ("Prior to ... is out of scope of

Section 6.3 mentions statically configured SAs. I still believe that  
most of the MAG-LMA
SA setup is out of scope of PMIP6 AAA documents.

> this specification.") seems to be a superfluous text.

We have been intentionally rather short on the MAG-LMA SA setup  
procedures. This is
mainly because PMIP6 has very little or nothing to do with this SA  
setup. If the
SA was manually configured, nothing is done AAA wise when the mobile  
roams into
the PMIP6 domain. If the SA is dynamically configured then the only  
relation
between the PMIP6 and the SAs setup is that the roaming mobile  
triggers the
creation of the SA. This holds for IKE/IPSec based SAs. And there are  
existing
AAA specs for those already. Of course there can be tighter coupling  
but that
then falls more into system specific solutions and imho are out of  
scope.

Cheers,
	Jouni