Subject: [Dime] NEW REQUIREMENT -- WGLC for draft-ietf-mext-aaa-ha-goals-00.txt

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 19 Jan 2008 21:18:52 +0200

Hi all,

reading carefully through draft-ietf-mext-aaa-ha-goals-00.txt and I 
noticed a new requirement, namely

   G2.11  The AAAH server MUST be able to indicate to the HA whether the
      bearer traffic for the MN needs to receive IPsec ESP protection.

To me it appears that a solution for such a requirement requires a 
separate exchange between the HA and the AAAH to perform an 
authorization check.
This might require modifications to draft-ietf-dime-mip6-split-06.txt 
since authentication and authorization are currently done at the same time.

I am correctly understanding the requirement and the implications?

Feedback appreciated.

Ciao
Hannes

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 31 Jan 2008 09:46:14 +0200

Please give me feedback on this issue!

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 31 Jan 2008 09:12:06 -0600

Hi Hannes,

I am not sure why this needs to be done separately. Since the concept of
doing both authentication and authorization at the same time is
acceptable, I do not see any problem in applying the same on this
requirement.

As a requirement, I believe it is useful and should be addressed.

Regards,
Ahmad

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Thursday, January 31, 2008 1:46 AM
> To: [email-masked]
> Subject: Re: [Dime] NEW REQUIREMENT -- WGLC for 
> draft-ietf-mext-aaa-ha-goals-00.txt
> 
> > since authentication and authorization are currently done 
> at the same 
> > time.
> >

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Thu, 31 Jan 2008 16:17:50 +0100

Hi Ahmad, 

I might have initially misread it a bit. It seems that it is sufficient for the AAA server to indicate whether a subsequent CHILD SA exchange should be initiated with the MN. I have read it in a way that a susequent CHILD SA exchange would trigger an exchange with the AAA server asking for authorization. The latter approach would require us to change the document. 

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: ext Ahmad Muhanna [mailto:[email-masked]] 
> Gesendet: Donnerstag, 31. Januar 2008 17:12
> An: Hannes Tschofenig; [email-masked]
> Betreff: RE: [Dime] NEW REQUIREMENT --WGLC for 
> > > reading carefully through 
> draft-ietf-mext-aaa-ha-goals-00.txt and I

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Thu, 31 Jan 2008 07:37:35 -0800

Hi Hannes and Ahmad,

I agree with Hannes interpretation of the requirement. The requirement does not intend to point to any solution (separate message or not). Please let me know if there is anything in the requirement that seems to point to any solution; in that case it needs to be rephrased.

>From a solution perspective, I think what is needed is just that the AAA server sends to the HA an indication if ciphering is authorized for the MN. This step can be done during authentication and authorization. Then the HA may create a child SA or may wait for the MN to create it. What is important is that the HA knows that the MN is authorized to use this feature.

Gerardo

> From: Tschofenig, Hannes (NSN - FI/Espoo)
> [mailto:[email-masked]]
> Sent: Thursday, January 31, 2008 7:18 AM
> To: ext Ahmad Muhanna; Hannes Tschofenig; [email-masked]
> Subject: AW: [Dime] NEW REQUIREMENT--WGLC for draft-ietf-mext-aaa-ha-
> goals-00.txt
> 
> Hi Ahmad,
> 
> I might have initially misread it a bit. It seems that it is sufficient
> for the AAA server to indicate whether a subsequent CHILD SA exchange
> should be initiated with the MN. I have read it in a way that a susequent
> CHILD SA exchange would trigger an exchange with the AAA server asking for
> authorization. The latter approach would require us to change the document.
> 
> Ciao
> Hannes
>

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 31 Jan 2008 09:40:44 -0600

Sounds good.

Regards,
Ahmad

> From: Giaretta, Gerardo [mailto:[email-masked]] 
> Sent: Thursday, January 31, 2008 9:38 AM
> To: Tschofenig, Hannes (NSN - FI/Espoo); Muhanna, Ahmad 
> (RICH1:2H10); Hannes Tschofenig; [email-masked]
> Subject: RE: [Dime] NEW REQUIREMENT--WGLC for 
> I agree with Hannes interpretation of the requirement. The 
> requirement does not intend to point to any solution 
> (separate message or not). Please let me know if there is 
> anything in the requirement that seems to point to any 
> solution; in that case it needs to be rephrased.
> 
> From a solution perspective, I think what is needed is just 
> that the AAA server sends to the HA an indication if 
> ciphering is authorized for the MN. This step can be done 
> during authentication and authorization. Then the HA may 
> create a child SA or may wait for the MN to create it. What 
> is important is that the HA knows that the MN is authorized 
> to use this feature.
> 
> Gerardo
> 
> > I might have initially misread it a bit. It seems that it is 
> > sufficient for the AAA server to indicate whether a 
> subsequent CHILD 
> > SA exchange should be initiated with the MN. I have read it 
> in a way 
> > that a susequent CHILD SA exchange would trigger an 
> exchange with the 
> > AAA server asking for authorization. The latter approach 
> would require us to change the document.
> > 
> > Ciao
> > Hannes
> > 
> > > I am not sure why this needs to be done separately. Since the 
> > > concept of doing both authentication and authorization at 
> the same 
> > > time is acceptable, I do not see any problem in applying 
> the same on 
> > > this requirement.
> > >

---

From: <[email-masked]>
Date: Thu, 31 Jan 2008 16:45:40 +0100

Hi,

As for the signaling, we got the MIP6-Feature-Vector for
such purposes. So we can address the HA-AAAH additions easily.

For the rest regarding the G2.11, when the MIP6 bootstrapping
takes place, IKEv2 creates implicitly the first CHILD_SA that
can be used for subsequent control/user plane traffic protection.
So the MIP6-Feature-Vector negotiation result would then apply
to all CHILD_SA creations, whether confidentially protection
is allowed in general. However, there would an issue here.
We do not have a way to indicate from the HA to the UE whether
it can use the first CHILD_SA for user plane protection or
not.. right?

Current practices e.g. in 3GPP IKEv2 usage is that creation
of subsequent CHILD_SAs is a local configuration to the
IKEv2 gw.

JOuni

> Sent: 31. tammikuuta 2008 17:18
> Subject: AW: [Dime] NEW REQUIREMENT--WGLC for 
> subsequent CHILD SA exchange should be initiated with the MN. 
> I have read it in a way that a susequent CHILD SA exchange 
> would trigger an exchange with the AAA server asking for 
> > I am not sure why this needs to be done separately. Since 
> the concept 
> > of doing both authentication and authorization at the same time is

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 01 Feb 2008 09:09:19 +0200

Thanks for explaining the requirement better.

Giaretta, Gerardo wrote:
>>> concept of
>>>>>   G2.11  The AAAH server MUST be able to indicate to the HA
>>>>>           
>>>> whether the
>>>>         
>>>>>      bearer traffic for the MN needs to receive IPsec ESP
>>>>>           
>>>> protection.
>>>>         
>>>>> To me it appears that a solution for such a requirement
>>>>>           
>>> requires a
>>>       
>>>>> This might require modifications to
>>>>>           
>>>> draft-ietf-dime-mip6-split-06.txt
>>>>         

_______________________________________________
DiME mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/dime