Subject: [Dime] ERP: about notification of handovers to the home domain

From: Sebastien Decugis <[email-masked]>
Date: Mon, 10 May 2010 11:00:55 +0900

Hello,

During the Hiroshima and Anaheim meetings, the following question was
discussed at length: should a peer moving locally in a foreign domain be
notified to the home domain?

I believe these discussions made the following conclusion clear:
different people have different needs with this respect. As such, it
seems obvious that the Diameter ERP protocol must be able to accommodate
both situations. One possibility of achieving this is by having the home
domain notify the foreign domain in advance of its policy with regards
to this matter, at the time where the DSRK key is delivered. This can be
achieved by including a new AVP in the message that contains the DSRK.
This new AVP (name TBD) can have the following values:
- HOME_AUTH_REQUIRED: for each local handover in the foreign domain, the
re-authentication is achieved with the local ERP server. However, an
authorization request is sent to the home domain when the authentication
step is completed successfully. This allows the home domain to be always
aware of the current point of attachment of the peer, almost in real time.
- NO_HOME_AUTH_REQUIRED: After a local handover, the new network access
server can be granted the same authorization attributes as the previous
point of attachment, with the natural adjustments (decreased lifetimes,
...). This requires the local Diameter ERP server to cache these
attributes. It also means that the home domain may not know the exact
point of attachment of the peer, but only the realm, depending on how
accounting is performed.

I would like to gather the feedback of the group on this issue -- in
particular, what should be the default behavior -- and reach a consensus
to update the document.

Thank you for reading,
Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: Qin Wu <[email-masked]>
Date: Tue, 11 May 2010 15:43:27 +0800

Hi, Sebastien:
If my understanding is correct, your proposal is:
a) Negotiate between local ER server and home server on whether to hide point of attachment  from the home server using new AVP.
b) This new AVP is only carried during ERP bootstrapping,i.e.,at the time when the DSRK is delivered from the home server to the local ER server.
c) This new AVP is only for authorization.
If in this case, I think this proposal sounds one reasonable choice to me.
Following up this proposal, I have several comments or questions:
1). It is not clear that two values for the new AVP is used for authorization only or authentication only? 
If the new AVP is used for authorization only, then it is better to change HOME_AUTH_REQUIED into HOME_AUTHZ_REQUIED.
2). Since authorization is separated from authentication, is it the only possiblity to use Diameter ERP message to transport this new AVP?
3). Which Diameter message will be used to transport authorization attribute after the value in the new AVP is set? 
4) Which of the existing AVP will be used to send point of attachment to the home realm?
5). How the ERP session is managed during handoff?
Hope to get clarified.

Regards!
-Qin
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: <[email-masked]>
Sent: Monday, May 10, 2010 10:00 AM
Subject: [Dime] ERP: about notification of handovers to the home domain

> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime