Subject: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping

From: "Upadhyaya Saumya-a20369" <[email-masked]>
Date: Mon, 7 Aug 2006 21:23:06 +0800

Hi Vijay,

We have gone over the listed drafts.

In our approach, we propose that the DHCP server contains a AAA client
which can thereby obtain the messages from either a local entity (say,
the AAAF/Local Diameter Proxy/NAS) or a home entity (say, the AAAH/Home
Diameter Server). This is in contrast to
draft-ietf-dime-mip6-integrated-00 which proposes to obtain the
bootstrapping parameters till the NAS using Diameter-EAP and proposes
that the NAS behave as a DHCP Relay. In our approach, the NAS can remain
independent of DHCP and need not perform any operations on the DHCP
packets that it relays.

In our approach, we propose that the MN makes use of DHCP to obtain the
bootstrapping parameters irrespective of the network architecture
(split/integrated).

In the draft [draft-ram-dhc-dhcpv6-diam-app-00], we define a Diameter
DHCP Application which could be used to obtain the MIPv6 bootstrapping
parameters from the MSA.

Regards,
Saumya

Date: Fri, 4 Aug 2006 08:08:42 -0700
From: "Vijay Devarapalli" <[email-masked]>
Subject: RE: [Mip6] Recommendation for bootstrapping using DHCPv6
To: "Upadhyaya Saumya-a20369" <[email-masked]>,	<[email-masked]>
Message-ID:
	
<[email-masked]>
Content-Type: text/plain;	charset="iso-8859-1"

Hi Saumya,

the work on this is being done in the DIME WG. take a look at 
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-integrated-00.t
xt 
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-00.txt

Vijay

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Mon, 7 Aug 2006 11:03:21 -0400

Saumya,

In your proposal, do you envision any kind of authentication at the DHCP
server for the MN prior to assigning the MN HA, HoA info? What is the
likelihood that operators will authenticate the MN at the DHCP server
instead of or in addition to the NAS (EAP-authenticator)?

There was a proposal a while back to use DHCP delayed authentication
scheme to perform MIP6 bootstrapping. Here is the link of the expired
I-D:

http://www.join.uni-muenster.de/Dokumente/drafts/draft-ohba-mip6-boot-ar
ch-dhcp-00.txt

Have you looked at this one? 

-Kuntal

> -----Original Message-----
> From: Upadhyaya Saumya-a20369 [mailto:[email-masked]]
> Sent: Monday, August 07, 2006 8:23 AM
> To: [email-masked]
> Subject: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping
> 
> Hi Vijay,
> 
> http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-00.txt

"This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [email-masked] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you."

---

From: "Upadhyaya Saumya-a20369" <[email-masked]>
Date: Wed, 9 Aug 2006 20:04:14 +0800

Kuntal,

In our approach, the MN is authenticated in the home domain. 
We mainly discuss DHCP authentication. This can be done in addition 
to the authentication done at the NAS.

In addition, we discuss the establishment of a security association 
Dynamically between the DHCP Server and Client. 
The DHCP options required for establishing this 
security association are discussed in 
http://www.ietf.org/internet-drafts/draft-ram-dhc-dhcpv6-aakey-00.txt

- Saumya

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Monday, August 07, 2006 8:33 PM
To: Upadhyaya Saumya-a20369; [email-masked]
Subject: RE: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping

Saumya,

-Kuntal

> http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-00.txt

"This email message and any attachments are confidential information of
Starent Networks, Corp. The information transmitted may not be used to
create or change any contractual obligations of Starent Networks, Corp.
Any review, retransmission, dissemination or other use of, or taking of
any action in reliance upon this e-mail and its attachments by persons
or entities other than the intended recipient is prohibited. If you are
not the intended recipient, please notify the sender immediately -- by
replying to this message or by sending an email to
[email-masked] -- and destroy all copies of this message
and any attachments without reading or disclosing their contents. Thank
you."

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 9 Aug 2006 14:08:46 -0400

Saumya,

Please see inline... 

> Sent: Wednesday, August 09, 2006 7:04 AM
> To: [email-masked]

Isn't that always the case? The HAAA is in the home domain of the MN,
right?

> We mainly discuss DHCP authentication. This can be done in 
> addition to the authentication done at the NAS.
> 

I am not sure about the use case where the MN will be required to
authenticate twice to get access and obtain DHCP info. 
Someone may find such use case, but I have not seen one yet. If the
authentication function at the NAS does not exist and the DHCP
server is exposed to the public internet, may be such scheme is
desirable.

> In addition, we discuss the establishment of a security 
> association Dynamically between the DHCP Server and Client. 
> The DHCP options required for establishing this security 
> association are discussed in 

This means yet another SA setup requirement for the MN. Normally the MN
gets authenticated at the NAS (PDSN, GGSN, ASN-GW) in most of the
wireless data networks today.

> In your proposal, do you envision any kind of authentication 
> at the DHCP server for the MN prior to assigning the MN HA, 
> HoA info? What is the likelihood that operators will 
> authenticate the MN at the DHCP server instead of or in 
> addition to the NAS (EAP-authenticator)?
> 
> There was a proposal a while back to use DHCP delayed 
> authentication scheme to perform MIP6 bootstrapping. Here is 
> the link of the expired
> I-D:
> 
> "This email message and any attachments are confidential 
> information of Starent Networks, Corp. The information 
> transmitted may not be used to create or change any 
> contractual obligations of Starent Networks, Corp.
> Any review, retransmission, dissemination or other use of, or 
> taking of any action in reliance upon this e-mail and its 
> attachments by persons or entities other than the intended 
> recipient is prohibited. If you are not the intended 
> recipient, please notify the sender immediately -- by 
> [email-masked] -- and destroy all copies of 
> this message and any attachments without reading or 
> disclosing their contents. Thank you."
>

---

From: "Upadhyaya Saumya-a20369" <[email-masked]>
Date: Fri, 11 Aug 2006 11:56:42 +0800

Kuntal,

I'm highlighting the salient points of our approach:

- The DHCP Client is authenticated at the home network using a security
association between the 
home AAA and DHCP client.
- In the process, the DHCP Client obtains authorized configuration
parameters (say, the bootstrapping info)
and security associations (for message authentication) for the DHCP
service from the home network. 
- The bootstrapping information transferred to the DHCP client is secure
from modification as a result of
  this message authentication using the dynamically established SA.

Saumya

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Wednesday, August 09, 2006 11:39 PM
To: Upadhyaya Saumya-a20369; [email-masked]
Subject: RE: [Mip6] DHCP-Diameter application for MIPv6 bootstrapping

Saumya,

Please see inline...

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 11 Aug 2006 00:20:56 -0400

Saumya,

The solution for integrated scenario does not require another round of
authentication at the DHCP server. The authentication at the NAS
suffices. It also does not require second round of AAA transaction
(first between NAS-AAA, second between DHCP Server-AAA).

BTW, as I mentioned earlier, your proposed way is similar to Model 1 in
the following I-D which was submitted and discussed in IETF:

FYI, there was no interest to define a scheme based on Model 1. 

-Kuntal

> Sent: Thursday, August 10, 2006 10:57 PM
> To: Chowdhury, Kuntal; [email-masked]
> Subject: RE: [internal] DHCP-Diameter application for MIPv6
bootstrapping
> > > In our approach, we propose that the MN makes use of DHCP to
obtain
> > the