Subject: [IPsec] IKEv2 Redirect based Authentication Offload and Proxy Session Resumption (draft-padmakumar-ikev2-redirect-and-auth-offload-02)

From: Padmakumar AV <[email-masked]>
Date: Mon, 21 Dec 2009 19:45:31 +0530

Hi,

We have published a new version of 'IKEv2 Redirect based Authentication
Offload and Proxy Session Resumption'
 (draft-padmakumar-ikev2-redirect-and-auth-offload-02).

The draft may be accessed at:
http://tools.ietf.org/html/draft-padmakumar-ikev2-redirect-and-auth-offload-02

Abstract:

   IKEv2 supports multiple authentication mechanisms like public key
   signatures, shared secrets and EAP.  EAP based authentication
   requires server to maintain information about the client until EAP
   completes.  Public key based authentication mechanisms are highly
   computational intensive and demands server CPU resources.

   Redirect Mechanism for IKEv2 proposes a mechanism for IKEv2 that
   enables a VPN gateway to redirect the VPN client to another VPN
   gateway, for example, based on the load condition.

   IKEv2 Session Resumption proposes an extension to IKEv2 that allows a
   client to re-establish an IKE SA with a gateway in a highly efficient
   manner, utilizing a previously established IKE SA.

   Redirect mechanism can also be used to redirect a client to another
   router (trust anchor) to do mutual authentication and an optional
   proxy session negotiation on behalf of the server.  This redirection
   happens during the IKE_SA_INIT and server does not maintain any
   information about the redirected client.  After mutual authentication
   and optional proxy session negotiation trust anchor redirects the
   client back to the server with an Access Token which can be used as a
   dynamic pre-shared key between the server and client for password
   based IKE_AUTH exchange.  Mechanism described here allows servers to
   compute the same pre-shared key dynamically, without contacting trust
   anchors, based on the information provided by the client during
   IKE_AUTH exchange.  Access Token based authentication permits IDr of
   the responder to be different from that specified in Ticket and
   permits client to reuse the proxy session (negotiated between client
   and trust anchor) between client and server.

   Such a mechanism is useful especially for low power devices like
   handsets.  For example, a mobile node can redirect a correspondent
   node to its home agent.  Home agent can form a proxy session with
   correspondent node and then redirect it back to mobile node.

We appreciate your thoughts and comments.

Thanks & regards

Pratima, Manik & Padmakumar