Subject: MIP6-AAA high-level view (was RE: [Mip6] question about mip6-aaa frameworks)

From: Gerardo Giaretta <[email-masked]>
Date: Fri, 18 Feb 2005 14:20:14 +0100

John,

I follow this thread since I agree that we need a high-level view on
bootstrapping and AAA stuff, trying not to look at solution space, but
considering network elements involved and potential deployment models.

I think that the natural starting point for this analysis is the Problem
Statement draft, since several related concepts have been discussed by
the DT last year. Yesterday James sent a very interesting terminology
classification that should be included in the draft and that we should
consider as the reference terminology. I am posting it here for the sake
of clarity:

ASA - Access Service Authorizer. A network operator that authenticates a
mobile host and establishes the mobile host's authorization to receive
Internet service.
ASP - Access Service Provider. A network operator that provides direct
IP packet forwarding to and from the end host. 
MSA - Mobility Service Authorizer. A service provider that authorizes
Mobile IPv6 service.
MSP - Mobility Service Provider. A service provider that provides Mobile
IPv6 service. In order to obtain such service, the mobile host must be
authenticated and prove authorization to obtain the service.
IASP - Integrated Access Service Provider. A service provider that
provides both authorization for network access and also provides
mobility service.

>From this terminology it is clear that one of the fundamental design
assumption of the DT has been the decoupling between the access network
service and the mobility service. For this reason, I think the first
main classification we should consider is between frameworks that do not
involve the access network service and frameworks that do involve it.

1. frameworks (or scenarios) that do not involve the access network
service. The WG SHOULD standardize a solution for this. 

Deployment scenarios: 
a) MSA = MSP: the provider that authorizes the MN for mobility service
is the same entity that manages the HA 
b) MSA != MSP: the HA is managed by a third entity (this is the "Third
Party Scenario" in PS draft and it's analogous to roaming scenario for
network access) 

Network Elements involved: MN, HA, AAA-H, optionally AAA-F (AAA-H is the
AAA server of the MSA; AAA-F is the AAA server of the MSP)

MN <-------------> HA <---------> (AAA-F) <-------> AAA-H
     IKEv2(+EAP)           ?                  ?

The missing piece here is an investigation about the interface between
HA and AAA. We should investigate if current Diameter Applications (e.g.
EAP Diameter Application) are enough or if some new AVPs or applications
are needed.

2. frameworks (or scenarios) that involves the access network service.
The WG MAY standardize a solution for this.

Deployment scenarios (note that the following diagrams are not
suggesting any solutions but only showing the network elements involved
and the relationships among them):

a) MSA=ASA (I-ASP), MSP=MSA, ASP=ASA

MN <-----> NAS <-----------> AAA
                              ^
                              |
                              V
                              HA

b) MSA=ASA (I-ASP), MSP=MSA, ASP!=ASA

MN <-----> NAS <---------> AAA-ASP <------> AAA-MSP
                                               ^
                                               |
                                               V
                                               HA

c) MSA=ASA (I-ASP), MSP!=MSA, ASP!=ASA (allocation of the HA in the
local domain)

MN <-----> NAS <---------> AAA-ASP <------> AAA-MSP
                              ^
                              |
                              V
                              HA

First of all, we should understand if we, as MIP6 WG, want to
standardize an optimized solution for these scenarios. Note that a
solution for 1 is also applicable in this scenario, but it may require a
disoptimization (double EAP authentication). If an optimized solution
for these scenarios is within the WG interest, we should focus on
proposals, trying to identify some design principles that the solution
should fulfill. 

Comments?

--Gerardo

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of [email-masked]
> Sent: Thursday, February 17, 2005 8:00 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: [Mip6] question about mip6-aaa frameworks
> 
> 
> Hi all,
> 
> Starting a new thread as working though this thead is getting tough.
> 
> It seems that a high-level view on this is needed, not looking at
> specific solutions at the moment.  I think that this is somewhat
> of a complex mix of protocols, architectures and solutions which
> is making forward progress very difficult.
> 
> I think Alper's and Vijay's mails are showing that there is a need
> to look at the network elements (possibly) involved and the
> potential deployment models proposed.  It is clear that a 
> one-size-fits-all
> approach is bound to fail; and I assumed that the WG was interested
> in enabling existing deployments a way to provide 
> bootstrapping information
> to a mobile node.
> 
> Therefore, I'd like to propose that we look at a higher-level view
> as a way forward out of this.  I haven't been involved in any of the
> proposals, but I'd be happy to try to gather some thoughts about this,
> even though the submissions of new drafts is now closed.
> 
> John
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Fri, 18 Feb 2005 14:25:32 -0800

Gerardo,

>proposals, trying to identify some design principles that the solution

As I suggested in my response to Yoshi, there are ways that optimization can
be done.

For now, I think we need to get the architecture sorted out, and worry about
optimization later.

            jak