Washinton D.C., November 2004 IETF 61 st – mip6 WG MIPv6 authorization and configuration based on EAP (draft-giaretta-mip6-authorization-eap-02) Gerardo Giaretta Ivano Guardini Elena Demaria Telecom Italia Lab (TILab) Julien Bournelle Maryline Laurent-Maknavicius GET/INT

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 2 Overview Solution for bootstrapping Mobile IPv6 relying on a AAA infrastructure Bootstrapping is performed during the authentication phase for network access –the basic assumption is that network access and mobility services are provided by the same entity (i.e. Integrated ASP) –re-use of network access credentials The interaction between the MN and the Home AAA server is realized using EAP –exploits the capability of several EAP methods to carry arbitrary parameters together with authentication data

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 3 Protocol architecture Mobile Node Router or Access Point (pass through) AAA Server AAA Client Home Agent AAA-HA Protocol Configuration Data EAP Exchange EAP Lower Layer AAA Protocol (Diameter/RADIUS) Authentication for network access MIPv6 Authorization and Configuration

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 4 Advantages No changes needed on access equipment –easier deployment (in roaming scenarios) –works with existing equipment (e.g. IEEE 802.1X APs) –works with any EAP lower layer (e.g X, PANA) Both RADIUS and Diameter can be used between NAS and AAA infrastructure MN-HA IPsec SA can be setup from the keying material exported by the EAP method –see draft-giaretta-mip6-amsk-00

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 5 Advantages (cont.) The solution can be easily extended to bootstrap non-IPsec SAs –see draft-ietf-mip6-auth-protocol-00 Bootstrapping can be performed also from IPv4 networks supporting EAP –using draft-soliman-v4v6-mipv4-01 for subsequent Mobile IPv6 protocol operations The same approach could be used also for MIPv4 bootstrapping

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 6 Transport of bootstrapping data MIPv6 Authorization TLV MIPv6 Authorization TLV MIPv6 Authorization AVP MIPv6 Authorization IKEv2 Payload PEAPv2 EAP-FAST EAP-SIM EAP-AKA EAP-TTLSEAP-IKEv2 MIPv6 bootstrapping data are encoded in TLVs carried by a generic MIPv6-Authorization container Only the container needs to be adapted to the actual message format of the employed EAP method MIPv6 bootstrapping TLVs

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 7 Message flow AAA Server Home Agent MIPv6-Authorization-TLV (Service-Status, [Service-Options]) MIPv6-Authorization-TLV (Service-Selection, [Service-Options], [Home-Agent-Address], [Home-Address], [Interface-Identifier], [IKE-Authentication-Options]) AAA-HA protocol MIPv6-Authorization-TLV (Home-Agent-Address, Home-Address, IKE-Bootstrap-Info, Authorization Lifetime) MIPv6-Authorization-TLV (Negotiation-Result) HA selection MIPv6 state installation

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 8 Message flow: step 1 AAA Server Home Agent MIPv6-Authorization-TLV (Service-Status, [Service-Options]) Service-Status-TLV to communicate the availability (or unavailability) of MIPv6 service Service-Options-TLV (optional) to specify other service options the MN can ask for –HA in the visited domain (not specified yet) –other service options may be added in the future

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap-02 9 Message flow: step 2 AAA Server Home Agent MIPv6-Authorization-TLV (Service-Selection, [Service-Options], [Home-Agent-Address], [Home-Address], [Interface-Identifier], [IKE-Authentication-Options]) Service-Selection-TLV to specify if the MN wants to activate MIPv6 protocol operation Configuration hints (optional) –Home Agent Address, Home Address, Interface Identifier IKE-Authentication-Options-TLV (optional) to specify the IKE peer authentication methods supported by the MN

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap Message flow: step 3 AAA Server Home Agent AAA-HA protocol HA selection MIPv6 state installation AAAH selects a suitable Home Agent and the peer authentication method to be used in IKE phase 1 AAAH interacts with the HA to dynamically configure the MIPv6 state –authorization lifetime of the MIPv6 service granted to the MN –security parameters (e.g. pre-shared key) –SNMPv3 or a new Diameter Application could be used for this purpose

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap Message flow: step 4 AAA Server Home Agent MIPv6-Authorization-TLV (Home-Agent-Address, Home-Address, IKE-Bootstrap-Info, Authorization Lifetime) AAAH continues the EAP session sending all MIPv6 configuration data to the MN –Home-Address-TLV –Home-Agent-Address-TLV –IKE-Bootstrap-Information-TLV specifies selected IKE phase 1 peer authentication method and associated cryptographic material –Authorization-Lifetime-TLV

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap Message flow: step 5 AAA Server Home Agent MIPv6-Authorization-TLV (Negotiation-Result) MN sends a Negotiation-Result-TLV –allows the MN to refuse the proposed configuration –may be useful in case the AAAH cannot provide some of the options previosly requested by the MN (e.g. a specific HA)

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap Open issues (from mip6 mailing-list) Negotiation of dynamic home address assignment using IKEv2 –should we consider also IKEv1? Should MN and AAAH negotiate also the IKE version to be used between MN and HA?

November, 2004 IETF 61 st – mip6 WG draft-giaretta-mip6-authorization-eap Next steps Feedback from EAP WG? WG item?