1. Minneapolis, March 2005 IETF 62 nd – mip6 WG Goals for AAA-HA interface (draft-giaretta-mip6-aaa-ha-goals-00) Gerardo Giaretta Ivano Guardini Elena Demaria Telecom Italia Lab (TILab) Julien Bournelle GET/INT Rafa Marin Lopez University of Murcia

2. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 2 Current Scope of the I-D Draft about the design goals/requirements of the AAA-HA interface –interface between the AAA infrastructure of MSP/MSA and HA Description of 4 scenarios/frameworks –2 related to dynamic bootstrapping –2 related to static bootstrapping List of goals/requirements for the design of such an interface –some related to bootstrapping solutions and others more general (e.g. accounting) –matching between goals and frameworks

3. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 3 Current Scope of the I-D (cont.) Home Agent AAA-MSP Server AAA-MSA Server Mobility Service Authorizer Mobility Service Provider Home Agent AAA-MSP Server Mobility Service Provider and Authorizer Covered by this I-D Should be covered by this I-D X Notrealistic

4. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 4 AAA-HA interface capabilities Core capabilities –Mobile IPv6 service authorization and maintenance (e.g. asynchronous service termination in case of credit exhaustion) –exchange of accounting data (e.g. time of creation and removal of binding cache entries) Dynamic bootstrapping capabilities –mobile node authentication (e.g. EAP-based) –delivery of configuration parameters to the HA (e.g. PSK for peer authentication in IKE phase 1)

5. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 5 Usage scenario n.1 Bootstrapping directly with the HA –using IKEv2 (draft-ietf-mip6-ikev2-01, draft-chakrabarti-mip6-bmip-01) –or using PANA multi-hop (draft-tschofenig-mip6-bootstrapping-pana- 00) AAA-MSA Server Home Agent NAS EAP (IKEv2, PANA multi-hop) AAA-HA protocol User authentication and authorization (EAP transport) AAA-MSP Server

6. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 6 Usage scenario n.2 Bootstrapping during network access –using EAP (draft-giaretta-mip6-authorization-eap-02) –using RADIUS or Diameter AVPs (draft-ohba-mip6-boot-arch-dhcp- 00, draft-jee-mip6-bootstrap-pana-00, etc.) AAA-MSP Server Home Agent NAS AAA-HA protocol Piggybacking of MIPv6 data within EAP AAA-HA protocol MIPv6 RADIUS or Diameter AVPs PANA, L2 or DHCP specific extensions A) B) MIPv6 state set-up

7. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 7 Usage scenarios n.3 and n.4 AAA-MSP Server Home Agent NAS IKEv1/IKEv2 AAA-HA protocol MN is statically provisioned with bootstrapping data (HoA, HA address, etc.) –also the IPsec SA can be statically configured Explicit authorization of MIPv6 –service may not be authorized if MN's credit is going to exhaust BU AAA-HA protocol BA Binding Authorization MIPv6 Authorization n.3 n.4

8. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 8 Goals Security Service Authorization Accounting Mobile node authentication  Mutual authentication  Integrity protection  Replay protection  Confidentiality  Inactive peer detection  NAI to identify the MN  HA must be able to query AAA- MSP to verify MN authorization  AAA-MSP should be able to enforce auth. restrictions of HA .......  Transfer of accounting records (e.g. bytes transferred in bi- directional tunneling) Delivery of config. data  MN authentication with HA as NAS and AAA-MSP as backend authentication server (e.g. EAP) .......  AAA-MSP should be able to poll HA for the allocation of a HoA  AAA-MSP should be able to send security data to HA (e.g. PSK) ........ Common goals Scenario n.1 Scenario n.2

9. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 9 Suggested changes from mip6 ML More text about scenarios/frameworks –some text from Alper's draft Split usage scenarios 2 in two A.using network access AAA to deliver MIPv6 configuration parameters from the AAA server to the MN B.using network access AAA to deliver MIPv6 configuration parameters from the AAA server to the NAS note that the goals for the AAA-HA interface are the same for these two scenarios

10. March, 2005 IETF 62 nd – mip6 WG draft-giaretta-mip6-aaa-ha-goals-00 10 Discussion on how to proceed Scope of the I-D? –keep focused to AAA-HA interface and cover other interfaces in separate I-Ds –extend the draft to encompass all AAA requirements for MIPv6 and consider other networks elements (e.g. NAS) Scenarios/Frameworks description –current purpose is to highlight that different frameworks have some common goals (and some different ones) and match goals with frameworks –should we instead select a framework and then list goals for it? –coordination with MIPv6 bootstrapping solution DT needed WG item?