Subject: [MOBILE-IP] The use of existing authorization infrastructures with Mobile IP/ AAA

From: Henry Haverinen <[email-masked]>
Date: Wed, 4 Oct 2000 15:31:05 +0300

Hi all,

In summary, I propose the following additions to
draft-calhoun-diameter-mobileip-10.txt in this mail.

1. Two new rules for FA behavior when receiving the AMA
   Command in response to the AMR Command:

   a) If the AMA Command doesn't contain a MIP-Reg-Reply AVP,
      the FA must forward the Reg.Request in question
      to the HA itself.
   b) If the AMA Command includes the Result-Code AVP
      set to an error, the FA sends the MN a Reg.Reply with an
      error code but nevertheless includes any AAA or key
      distribution extensions from the AMA Command.

2. One new rule for HA behaviour:

   If the HA receives a Registration Request that contains
   the MN-AAA Authentication extension, either relayed by a
   FA or directly from a MN that is registering a co-located
   care-of address, the HA may issue the AMR Command in order
   to authorize the Reg.Request. The AMR Command includes some
   new flag which tells the AAA server that it does not have to
   contact the home agent, and that the request came directly
   from the home agent.

---

The draft draft-haverinen-mobileip-gsmsim-00.txt describes how the
existing GSM authorization infrastructure can be leveraged to achieve
mobile user authorization for Mobile IP. The idea is not to use the
GSM radio access technology, but to show how GSM SIM authorization
could be used for Mobile IP authorization over any link layer, for
example on WLAN hot spots. I'm writing a new revision of the draft
which will fix the issues discussed on this mailing list and make the
protocol to use the Mobile IP AAA extensions, so that the mobility
agents don't need to be GSM SIM aware.

The general model of leveraging an existing large scale
authorization/charging infrastructure is very important because
building new authorization infrastructures from scratch is hard:
getting the necessary contracts and agreements in place takes effort
and time. GSM authorization infrastructure is just one example of
an existing large scale authorization infrastructure.  Another such
global infrastructure is the credit-card infra: e.g., consider
the following scenario: I travel to a new location, pay the local
ISP using my credit card, and continue to use Mobile IP with an HA
in my home ISP.

In my opinion, any MIP/AAA proposal should be able to easily support
use of existing authorization infrastructures because it will greatly
speed up deployment of Mobile IP. However, the current MIP/AAA drafts
(e.g., draft-calhoun-diameter-mobileip-10.txt) have a couple of
assumptions that do not support such authorization. The important
aspect is that when existing authorization infrastructures are used,
HA and AAAH are not necessarily under the same administrative control,
and are not co-located. They are probably not even close to each
other.

Let's use the term AAAH to denote the AAA server that can authorize
the user, and probably charge/bill the user where necessary. In the
GSM SIM case, the AAAH is the Authentication Centre (AuC) which
resides deep inside the GSM network.

The foreign domain may have a local AAA network which includes a AAA
server that has an interface to the GSM network. In this case, the
local AAA network is able to reach the AAAH but the AAA network isn't
able to reach the home agent, as the current MIP/AAA drafts assume.
Suppose that a FA issues the DIAMETER AA-Mobile-Node-Request (AMR)
Command to authorize a Registration Request that uses GSM SIM. The
current view is that the the response from AAA (AA-Mobile-Node-Answer,
AMA Command) includes the Registration Reply from the HA in a
MIP-Reg-Reply AVP, which isn't possible in this case.

One way to support such authorization would be to add a new rule to
the operation of the FA: if the response from the AAA doesn't contain
the Registration Reply, the FA must forward the request to the HA
itself.

Besides the reachability of the HA through the AAA network, the GSM SIM
authorization breaks another assumption. A mobile node that
is using GSM SIM is not able to provide the visited domain with
complete yet unforgeable credentials without ever having been in touch
with its home domain, as required in draft-ietf-mobileip-aaa-reqs-04.txt.
This is because GSM SIM requires true challenge/response authentication
where AAAH generates the challenge. In other words, it takes two round
trips to authorize the MN. The AAA response in the first round trip
contains the challenge. The result code in the response indicates that
the user was not authorized.

True challenge/response could be supported by adding another
new rule to the operation of the FA: if the AAA responds to the
FA's authorization request with an error, the FA sends the MN a
Reg.Reply with an error code but nevertheless includes any AAA or key
distribution extensions from the AAA response. These extensions contain
the challenge. The MN is now able to send another Reg.Request for which
the authorization will be successful.

The same approach can also be used to for authorization in the home
domain. Both HA and FA can use the same AAAH (located elsewhere) for
authorizing the mobile user.

The HA may receive a Reg.Request (from a co-located MN or a FA) that
contains the MN-AAA Authentication extension. The HA could then pass
the request to the AAA network, for example with the DIAMETER AMR
Command, and the AAA network would respond with the AMA command, using
the AAAH on the GSM network. Here we probably need a new flag in the AAA
request that tells the AAA server that it does not have to contact the
home agent, and that the request came directly from the home agent.

Regards,
Henry

P.S. I'd like to acknowledge that Asokan ([email-masked])
has contributed a lot in these ideas and in this mail. Many thanks!