Subject: [Mip6] RE:DHCP-Diameter application for MIPv6bootstrapping

From: "Upadhyaya Saumya-a20369" <[email-masked]>
Date: Fri, 11 Aug 2006 21:03:31 +0800

Hi Kuntal,

Thanks for your pointers.
I understand your point about Model-1 being discussed already. But I
guess what I am suggesting is:

1. In draft-ohba-mip6-boot-arch-dhcp-00.txt, section 4, there is a
statement which says - 
"There are several protocols that can be used for carrying Mobile IPv6
   bootstrap information and a DHCP delayed authentication key from the
   NAS to the DHCP server.  SNMP is one such protocol."
I am proposing a Diameter based application messaging for that (instead
of a SNMP based one). 
I understand that the draft-ram-dhc-dhcpv6-diam-app-00 as it is, with
its focus on authentication of DHCP client sounds/looks closer to
Model-1. May be it will need a few changes to fit into the role quoted
above. May be I will make another attempt.

Before you say "the solution" is
draft-ietf-mip6-bootstrapping-integrated-dhc-01.txt, please read the
next 2 points too.

2. This discussion thread started after I suggested that
draft-ram-dhc-dhcpv6-diam-app-00 could be used as the north side for
draft-jang-mip6-hiopt-00.txt. In draft-jang-mip6-hiopt-00.txt, there is
statement which says " It is assumed that the DHCP server has access to
home network information for its clients for this option to be useful.".
I am proposing a Diameter application messaging for that. Now, I
understand (again) your point about double auth (once in NAS and another
in DHCP Server). But please note that the Diameter message which we are
proposing could be routed to NAS! In which case there would be
effectively only one authentication & the Bootstrapping params could be
transferred using draft-ram-dhc-dhcpv6-diam-app-00 to DHCP Server from
NAS.

3. This approach (as opposed to colocating a DHCP relay with NAS,
followed by pushing the params to DHCP Server), has some advantages: As
you see from the above paras, the DHCP Server & its implementation need
minimal changes (in the form of a AAA client). The AAA Client will
figure out to go to NAS (incase draft-ietf-dime-mip6-integrated-00.txt
is in effect), AAAF or AAAH (incase draft-jang-mip6-hiopt-00.txt) is in
effect.

Please comment. 

- Saumya

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Friday, August 11, 2006 9:51 AM
To: Upadhyaya Saumya-a20369; [email-masked]
Subject: [Mip6] RE: [internal] DHCP-Diameter application for
MIPv6bootstrapping

Saumya,

The solution for integrated scenario does not require another round of
authentication at the DHCP server. The authentication at the NAS
suffices. It also does not require second round of AAA transaction
(first between NAS-AAA, second between DHCP Server-AAA).

BTW, as I mentioned earlier, your proposed way is similar to Model 1 in
the following I-D which was submitted and discussed in IETF:

http://www.join.uni-muenster.de/Dokumente/drafts/draft-ohba-mip6-boot-ar
ch-dhcp-00.txt

FYI, there was no interest to define a scheme based on Model 1. 

-Kuntal

> -----Original Message-----
> From: Upadhyaya Saumya-a20369 [mailto:[email-masked]]
> Sent: Thursday, August 10, 2006 10:57 PM
> To: Chowdhury, Kuntal; [email-masked]
> Subject: RE: [internal] DHCP-Diameter application for MIPv6
bootstrapping
> 
> Kuntal,
> 
> I'm highlighting the salient points of our approach:
> 
> - The DHCP Client is authenticated at the home network using a
security
> association between the
> home AAA and DHCP client.
> - In the process, the DHCP Client obtains authorized configuration 
> parameters (say, the bootstrapping info) and security associations 
> (for message authentication) for the DHCP service from the home 
> network.
> - The bootstrapping information transferred to the DHCP client is
secure
> from modification as a result of
>   this message authentication using the dynamically established SA.
> 
> Saumya
> 
> -----Original Message-----
> From: Chowdhury, Kuntal [mailto:[email-masked]]
> Sent: Wednesday, August 09, 2006 11:39 PM
> To: Upadhyaya Saumya-a20369; [email-masked]
> Subject: RE: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping
> 
> Saumya,
> 
> Please see inline...
> 
> > -----Original Message-----
> > From: Upadhyaya Saumya-a20369 [mailto:[email-masked]]
> > Sent: Wednesday, August 09, 2006 7:04 AM
> > To: [email-masked]
> > Subject: RE: [Mip6] DHCP-Diameter application for MIPv6
bootstrapping
> >
> > Kuntal,
> >
> > In our approach, the MN is authenticated in the home domain.
> 
> Isn't that always the case? The HAAA is in the home domain of the MN, 
> right?
> 
> > We mainly discuss DHCP authentication. This can be done in addition 
> > to the authentication done at the NAS.
> >
> 
> I am not sure about the use case where the MN will be required to 
> authenticate twice to get access and obtain DHCP info. Someone may 
> find such use case, but I have not seen one yet. If the authentication

> function at the NAS does not exist and the DHCP server is exposed to 
> the public internet, may be such scheme is desirable.
> 
> > In addition, we discuss the establishment of a security association 
> > Dynamically between the DHCP Server and Client. The DHCP options 
> > required for establishing this security association are discussed in
> >
http://www.ietf.org/internet-drafts/draft-ram-dhc-dhcpv6-aakey-00.txt
> >
> 
> This means yet another SA setup requirement for the MN. Normally the
MN
> gets authenticated at the NAS (PDSN, GGSN, ASN-GW) in most of the 
> wireless data networks today.
> 
> > - Saumya
> >
> >
> >
> >
> >
> > -----Original Message-----
> > From: Chowdhury, Kuntal [mailto:[email-masked]]
> > Sent: Monday, August 07, 2006 8:33 PM
> > To: Upadhyaya Saumya-a20369; [email-masked]
> > Subject: RE: [Mip6] DHCP-Diameter application for MIPv6
bootstrapping
> >
> > Saumya,
> >
> > In your proposal, do you envision any kind of authentication at the 
> > DHCP server for the MN prior to assigning the MN HA, HoA info? What 
> > is the likelihood that operators will authenticate the MN at the 
> > DHCP server instead of or in addition to the NAS 
> > (EAP-authenticator)?
> >
> > There was a proposal a while back to use DHCP delayed authentication

> > scheme to perform MIP6 bootstrapping. Here is the link of the 
> > expired
> > I-D:
> >
> > http://www.join.uni-muenster.de/Dokumente/drafts/draft-ohba-mi
> > p6-boot-ar
> > ch-dhcp-00.txt
> >
> > Have you looked at this one?
> >
> > -Kuntal
> >
> > > -----Original Message-----
> > > From: Upadhyaya Saumya-a20369 [mailto:[email-masked]]
> > > Sent: Monday, August 07, 2006 8:23 AM
> > > To: [email-masked]
> > > Subject: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping
> > >
> > > Hi Vijay,
> > >
> > > We have gone over the listed drafts.
> > >
> > > In our approach, we propose that the DHCP server contains a
> > AAA client
> > > which can thereby obtain the messages from either a local
> > entity (say,
> > > the AAAF/Local Diameter Proxy/NAS) or a home entity (say, the
> > AAAH/Home
> > > Diameter Server). This is in contrast to 
> > > draft-ietf-dime-mip6-integrated-00 which proposes to obtain the 
> > > bootstrapping parameters till the NAS using Diameter-EAP
> > and proposes
> > > that the NAS behave as a DHCP Relay. In our approach, the NAS can
> > remain
> > > independent of DHCP and need not perform any operations on the
DHCP
> > > packets that it relays.
> > >
> > > In our approach, we propose that the MN makes use of DHCP to
obtain
> > the
> > > bootstrapping parameters irrespective of the network architecture 
> > > (split/integrated).
> > >
> > > In the draft [draft-ram-dhc-dhcpv6-diam-app-00], we define
> > a Diameter
> > > DHCP Application which could be used to obtain the MIPv6
> > bootstrapping
> > > parameters from the MSA.
> > >
> > > Regards,
> > > Saumya
> > >
> > > Date: Fri, 4 Aug 2006 08:08:42 -0700
> > > From: "Vijay Devarapalli" <[email-masked]>
> > > Subject: RE: [Mip6] Recommendation for bootstrapping using DHCPv6
> > > To: "Upadhyaya Saumya-a20369" <[email-masked]>,
> > <[email-masked]>
> > > Message-ID:
> > >
> > > <[email-masked]>
> > > Content-Type: text/plain;	charset="iso-8859-1"
> > >
> > > Hi Saumya,
> > >
> > > the work on this is being done in the DIME WG. take a look at
> > >
> > http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-integ
> > rated-00.t
> > > xt
> > >
> >
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-00.txt
> > >
> > > Vijay
> > >
> > >
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> >
> >
> > "This email message and any attachments are confidential information

> > of Starent Networks, Corp. The information transmitted may not be 
> > used to create or change any contractual obligations of Starent 
> > Networks, Corp. Any review, retransmission, dissemination or other 
> > use of, or taking of any action in reliance upon this e-mail and its

> > attachments by persons or entities other than the intended recipient

> > is prohibited. If you are not the intended recipient, please notify 
> > the sender immediately -- by replying to this message or by sending 
> > an email to [email-masked] -- and destroy all copies

> > of this message and any attachments without reading or
> > disclosing their contents. Thank you."
> >
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> >

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6