Subject: RE: [AAA-WG]: [issue] Returning AAAF-Generated FA-HA Key to FA

From: Thomas Panagiotis-PTHOMAS1 <[email-masked]>
Date: Tue, 5 Feb 2002 12:45:28 -0600

Hi Tony,

Tony Johansson wrote:
> Therefore the AAAH MUST always copy the MIP-Originating-Foreign-AAA-AVP
> from the AMR message to the HAR message. In cases when another AAAF, which
> may not reside in the same domain, receives the HAR, ...

Could you please explain in which scenarios does an AAAF, that "does not
reside in the same domain", receive the HAR message? Isn't the Origin-Realm
in the received AMR set to the realm of the first AAAF? Why can't AAAH set
the HAR's Destination-Realm to the same value, thus routing the message
back to the same domain?

Thanks,

-Panos

> -----Original Message-----
> From: Tony Johansson [mailto:[email-masked]]
> Sent: Monday, February 04, 2002 4:53 PM
> To: [email-masked]
> Cc: Thomas Panagiotis-PTHOMAS1; Bob Kopacz; Mark Eklund
> Subject: Re: [AAA-WG]: [issue] Returning AAAF-Generated FA-HA 
> Key to FA
> 
> 
> All,
> 
> Here is proposed text for the handling of the FA-HA Key based 
> on the discussion
> last week.
> 
> 
> Comments, please...
> 
> Regards,
> 
> /Tony
> 
> --------------------------------------------------------------
> ---------------------
> 
>    * New text to section - 1.4 Allocation of Home Agent in 
> Foreign Network
> 
> "The Diameter Mobile IP application allows a Home Agent to be 
>   allocated in a
> foreign network, as required in [3, 16]. When a foreign agent 
> detects that the
> mobile node has a home agent address  equal to 0.0.0.0 or 
> 255.255.255.255 in
> the Registration Request  message, it MUST add a 
> MIP-Feature-Vector AVP with
> the Home-Agent- Requested flag set to one. If the home agent 
> address is equal
> to 255.255.255.255, then the foreign agent also MUST set the
> Home-Address-Allocatable-Only-in-Home-Realm flag equal to 
> one. If the home
> agent address is set to 0.0.0.0, the foreign agent MUST set the
> Home-Address-Allocatable-Only-in-Home-Realm flag equal to zero.
> 
> When the AAAF receives an AMR message with the 
> Home-Agent-Requested  flag set
> to one, and the Home-Address-Allocatable-Only-in-Home-Realm 
> flag equal to zero,
> the AAAF MAY set the Foreign-Home-Agent-Available flag in the
> MIP-Feature-Vector AVP to inform the AAAH that it is willing 
> and able to assign
> a Home Agent for the Mobile Node. When doing so, the AAAF 
> MUST include the
> MIP-Candidate-Home-Agent-Host AVP and the 
> MIP-Originating-Foreign-AAA-AVP. The
> MIP-Candidate-Home-Agent-Host AVP contains the identity of 
> the home agent that
> would be assigned to the mobile node and the 
> MIP-Originating-Foreign-AAA AVP
> contains the identity of the AAAF.
> 
> In the event that the mobile node requests a home agent in 
> the foreign network,
> and the AAAF authorizes its use, the AAAF MUST set the
> Home-Agent-In-Foreign-Network bit in the MIP-Feature-Vector 
> AVP. This could
> happen when the AAA request is sent to "extend" a mobile 
> node's current
> session.
> 
> When the AAAH receives an AMR message, it first checks the 
> authentication data
> supplied by the mobile node, according to the MIP-Reg-Request AVP and
> MIP-MN-AAA-Auth AVP, and determines whether to authorize the 
> mobile node.  If
> the AMR indicates that the AAAF has offered to allocate a 
> home agent for the
> mobile node, then the AAAH  must decide whether its local 
> policy would allow
> the user to have a Home Agent in the foreign network. If so, 
> and after checking
> authorization from the data in the AMR message, the AAAH 
> sends the HAR message
> to the AAAF that does not contain the MIP-Home-Agent-Address, 
> but includes the
> Destination-Host AVP set to the value of the AMR's
> MIP-Candidate-Home-Agent-Host AVP.
> 
> If the HA hasn't yet been allocated by the foreign domain, 
> the HAR sent by the
> AAAH back to the foreign realm will not necessarily be 
> received by the same
> AAAF which sent the AMR. Therefore the AAAH MUST always copy the
> MIP-Originating-Foreign-AAA-AVP from the AMR message to the 
> HAR message. In
> cases when another AAAF, which may not reside in the same 
> domain, receives the
> HAR, thus the new AAAF will use the 
> MIP-Originating-Foreign-AAA-AVP for policy
> decisions, such as determining if the FA-HA Key should be 
> encrypted or not."
> 
> 
>    * Section 2.1 and section 2.3, add  [ 
> MIP-Originating-Foreign-AAA ] to ABNF
> 
>    * Section 2.2 and 2.4, add [ MIP-Encrypted-FA-to-HA-Key ] to ABNF
> 
>    * Add MIP-Originating-Foreign-AAA in section 4 as:
> 
> "4.11 MIP-Originating-Foreign-AAA AVP
> 
>    The MIP-Originating-Foreign-AAA AVP (AVP Code ZZZ) if of type
>    Grouped, and contains the identity of the AAAF which issues the AMR
>    to the AAAH. The MIP- Originating-Foreign-AAA AVP MUST 
> only be used in
>    cases when the home agent is or may be allocated in a 
> foreign domain. If
> present
>    in the AMR, the AAAH MUST copy the MIP-Originating-Foreign-AAA AVP
>    into the HAR.
> 
>       MIP-Originating-Foreign-AAA ::= < AVP Header: ZZZ >
>                              { Origin-Realm }
>                              { Origin-Host }
>                            * [ AVP ]"
> 
> 
>    * New text to section - 5.4  Distributing the Foreign-Home 
> Session Key
> 
> " If the home agent is in the home realm, then the AAAH has 
> to generate the
> Foreign-Home session key. Otherwise, it is generated by AAAF.
> 
> In the cases when the AAAH generates the Foreign-Home session 
> key, the AAAH
> includes the session key in the MIP-HA-to-FA-Key AVP, and 
> includes the AVP as
> part of the HAR message sent to the home agent. The 
> corresponding session key
> that is to be sent to the foreign agent is cached in the AAAH 
> until the HAA is
> received.
> 
> Upon receipt of the HAR, the home agent recovers the 
> Foreign-Home session key,
> allocates an SPI to be used with the key. The allocated SPI 
> is included in the
> HAA's MIP-FA-to-HA SPI AVP.
> 
> Upon receipt of the HAA, the AAAH adds the MIP-FA-to-HA Key 
> AVP, using the SPI
> in the MIP-FA-to-HA-SPI, and includes the AVP in the AMA.
> 
> In the cases when the AAAF generates the Foreign-Home session 
> key (home agent
> in foreign domain), the AAAF will, upon receipt of the HAR 
> message, generate
> the Foreign-Home session key and include the session key in the
> MIP-HA-to-FA-Key AVP as part of the HAR message forwarded to 
> the home agent.
> The corresponding session key that is to be sent to the 
> foreign agent is cached
> in the AAAF until the HAA is received.
> 
> Upon receipt of the HAA, the AAAF creates the MIP-FA-to-HA 
> Key AVP, using the
> SPI in the MIP-FA-to-HA-SPI. The AAAF then checks if the 
> Foreign-Home session
> key destined for the foreign agent needs to be encrypted.
> 
> If the session key needs to be encrypted, the AAAF will include a
> MIP-Encrypted-FA-to-HA Key AVP, which will include the 
> MIP-FA-to-HA Key AVP,
> protected using the CMS application [9] with the AAAF as 
> originator and the
> recipient copied from the MIP-Originating-Foreign-AAA AVP. The
> MIP-Encrypted-FA-to-HA Key AVP MUST only be used if both the 
> originator and the
> recipient supports the CMS application.
> 
> Upon reception of the HAA, the AAAH will copy the 
> MIP-FA-to-HA Key AVP or the
> MIP-Encrypted-FA-to-HA Key AVP into the AMA.
> 
> If the MIP-Encrypted-FA-to-HA Key AVP was present in the AMA, 
> the AAAF MUST
> decrypt the AVP using the CMS application [9].
> 
> If a Foreign-Home session key was present in the AMA, the 
> foreign agent MUST
> include the Mobile-Foreign authentication extension in the 
> Registration Reply,
> using the newly distributed key. "
> 
> 
>    * Add MIP-Encrypted-FA-to-HA-Key AVP in section 6 as:
> 
> " 6.3  MIP-Encrypted-FA-to-HA-Key AVP
> 
>    The MIP-Encrypted-FA-to-HA-Key AVP (AVP Code YYY) is of 
> type Grouped,
>    and contains the Foreign Agent's session key encrypted in a CMS-
>    Encrypted-Data AVP [9]. Its Data field has the following ABNF
>    grammar:
> 
>       MIP-FA-to-HA-Key ::= < AVP Header: YYY >
>                            { CMS-Encrypted-Data }
>                          * [ AVP ] "
> 
> 
> 
> 
>

---

From: Tony Johansson <[email-masked]>
Date: Tue, 05 Feb 2002 11:14:38 -0800

Thomas,

> the HAR's Destination-Realm to the same value, thus routing the message

Please, look at section 1.4 and the text below and above Figure 7.......

/Tony