Subject: [MOBILE-IP] draft-calhoun-diameter-mobileip-10.txt and existing authorization infrastructures

From: Henry Haverinen <[email-masked]>
Date: Tue, 10 Oct 2000 16:03:58 +0300

Hi folks,

For those that are interested in MIP/AAA issues, please have
a look at the attached message, which I sent to this mailing
list a week ago. Any comments most welcome!

Regards,
Henry

> -----Original Message-----
> From: EXT Henry Haverinen [mailto:[email-masked]]
> Sent: 04. October 2000 15:31
> To: [email-masked]
> Subject: [MOBILE-IP] The use of existing authorization infrastructures
> with Mobile IP/ AAA
>
>
> Hi all,
>
> In summary, I propose the following additions to
> draft-calhoun-diameter-mobileip-10.txt in this mail.
>
> 1. Two new rules for FA behavior when receiving the AMA
>    Command in response to the AMR Command:
>
>    a) If the AMA Command doesn't contain a MIP-Reg-Reply AVP,
>       the FA must forward the Reg.Request in question
>       to the HA itself.
>    b) If the AMA Command includes the Result-Code AVP
>       set to an error, the FA sends the MN a Reg.Reply with an
>       error code but nevertheless includes any AAA or key
>       distribution extensions from the AMA Command.
>
> 2. One new rule for HA behaviour:
>
>    If the HA receives a Registration Request that contains
>    the MN-AAA Authentication extension, either relayed by a
>    FA or directly from a MN that is registering a co-located
>    care-of address, the HA may issue the AMR Command in order
>    to authorize the Reg.Request. The AMR Command includes some
>    new flag which tells the AAA server that it does not have to
>    contact the home agent, and that the request came directly
>    from the home agent.
>
> ---
>
> The draft draft-haverinen-mobileip-gsmsim-00.txt describes how the
> existing GSM authorization infrastructure can be leveraged to achieve
> mobile user authorization for Mobile IP. The idea is not to use the
> GSM radio access technology, but to show how GSM SIM authorization
> could be used for Mobile IP authorization over any link layer, for
> example on WLAN hot spots. I'm writing a new revision of the draft
> which will fix the issues discussed on this mailing list and make the
> protocol to use the Mobile IP AAA extensions, so that the mobility
> agents don't need to be GSM SIM aware.
>
> The general model of leveraging an existing large scale
> authorization/charging infrastructure is very important because
> building new authorization infrastructures from scratch is hard:
> getting the necessary contracts and agreements in place takes effort
> and time. GSM authorization infrastructure is just one example of
> an existing large scale authorization infrastructure.  Another such
> global infrastructure is the credit-card infra: e.g., consider
> the following scenario: I travel to a new location, pay the local
> ISP using my credit card, and continue to use Mobile IP with an HA
> in my home ISP.
>
> In my opinion, any MIP/AAA proposal should be able to easily support
> use of existing authorization infrastructures because it will greatly
> speed up deployment of Mobile IP. However, the current MIP/AAA drafts
> (e.g., draft-calhoun-diameter-mobileip-10.txt) have a couple of
> assumptions that do not support such authorization. The important
> aspect is that when existing authorization infrastructures are used,
> HA and AAAH are not necessarily under the same administrative control,
> and are not co-located. They are probably not even close to each
> other.
>
> Let's use the term AAAH to denote the AAA server that can authorize
> the user, and probably charge/bill the user where necessary. In the
> GSM SIM case, the AAAH is the Authentication Centre (AuC) which
> resides deep inside the GSM network.
>
> The foreign domain may have a local AAA network which includes a AAA
> server that has an interface to the GSM network. In this case, the
> local AAA network is able to reach the AAAH but the AAA network isn't
> able to reach the home agent, as the current MIP/AAA drafts assume.
> Suppose that a FA issues the DIAMETER AA-Mobile-Node-Request (AMR)
> Command to authorize a Registration Request that uses GSM SIM. The
> current view is that the the response from AAA (AA-Mobile-Node-Answer,
> AMA Command) includes the Registration Reply from the HA in a
> MIP-Reg-Reply AVP, which isn't possible in this case.
>
> One way to support such authorization would be to add a new rule to
> the operation of the FA: if the response from the AAA doesn't contain
> the Registration Reply, the FA must forward the request to the HA
> itself.
>
> Besides the reachability of the HA through the AAA network,
> the GSM SIM
> authorization breaks another assumption. A mobile node that
> is using GSM SIM is not able to provide the visited domain with
> complete yet unforgeable credentials without ever having been in touch
> with its home domain, as required in
> draft-ietf-mobileip-aaa-reqs-04.txt.
> This is because GSM SIM requires true challenge/response
> authentication
> where AAAH generates the challenge. In other words, it takes two round
> trips to authorize the MN. The AAA response in the first round trip
> contains the challenge. The result code in the response indicates that
> the user was not authorized.
>
> True challenge/response could be supported by adding another
> new rule to the operation of the FA: if the AAA responds to the
> FA's authorization request with an error, the FA sends the MN a
> Reg.Reply with an error code but nevertheless includes any AAA or key
> distribution extensions from the AAA response. These
> extensions contain
> the challenge. The MN is now able to send another Reg.Request
> for which
> the authorization will be successful.
>
> The same approach can also be used to for authorization in the home
> domain. Both HA and FA can use the same AAAH (located elsewhere) for
> authorizing the mobile user.
>
> The HA may receive a Reg.Request (from a co-located MN or a FA) that
> contains the MN-AAA Authentication extension. The HA could then pass
> the request to the AAA network, for example with the DIAMETER AMR
> Command, and the AAA network would respond with the AMA command, using
> the AAAH on the GSM network. Here we probably need a new flag
> in the AAA
> request that tells the AAA server that it does not have to contact the
> home agent, and that the request came directly from the home agent.
>
>
> Regards,
> Henry
>
> P.S. I'd like to acknowledge that Asokan ([email-masked])
> has contributed a lot in these ideas and in this mail. Many thanks!
>

---

From: Fredrik Johansson <[email-masked]>
Date: Wed, 11 Oct 2000 09:40:11 +0300

Henry,

see comments below,

/Fredrik

> From: IP Routing for Wireless/Mobile Hosts (mobile-ip)
> [mailto:[email-masked]]On Behalf Of Henry
> Haverinen
> Sent: den 10 oktober 2000 16:04
> Subject: [MOBILE-IP] draft-calhoun-diameter-mobileip-10.txt and existing
> authorization infrastructures
>
>
> Hi folks,
>

How will the foreign agent know the address of the home agent, MIP/AAA
enables dynamic assignment of home agent, thus the home agent field in the
registration request may be set to 0.0.0.0

> > home agent, and that the request came directly from the home agent.

Why not go through a local AAA which may provide the AAAH with the
Foreign-Home-Agent-Available AVP, the AAAH can then authenticate the user
and its a policy decision in the AAAH to allow the AAA in the local network
to provide a HA, thus no need for the AAAH to contact a HA. So the mechanism
is available today without any modifications to the draft.

Regards
/Fredrik