Subject: [AAA-WG]: [issue] Session-Timeout vs Authorization-Lifetime vs MIP-Key-Lifetime

From: Johan Johansson <[email-masked]>
Date: Mon, 11 Mar 2002 20:49:32 +0000

Subject: [issue] Session-Timeout vs Authorization-Lifetime vs
MIP-Key-Lifetime

Submitter name: Johan Johansson
Submitter email address: [email-masked]
Date first submitted: March 11, 2002
Reference:
Document: Mobile IP
Comment type: T
Priority: 1
Section: 2.2, 2.3, 5.1, 8.1
Rationale/Explanation of issue:

If there is to be any hope for interoperability the use of
Session-Timeout must be defined in the MIP draft.

The base draft defines Session-Timeout as

8.13  Session-Timeout AVP

    The Session-Timeout AVP (AVP Code 27) [RADIUS] is of type Unsigned32
    and contains the maximum number of seconds of service to be provided
    to the user before termination of the session. When both the Session-
    Timeout and the Authorization-Lifetime AVPs are present in an answer
    message, the former MUST be equal to or greater than the value of the
    latter.

---

    A Session-Timeout AVP MAY be present in a re-authorization message,
    and contains the number of seconds from the beginning of the re-auth.

    A value of zero, or the absence of this AVP, means that this session
    has an unlimited number of seconds before termination.

Section 8.9 of the base draft has this to say about Authorization-Lifetime:

An Authorization-Lifetime AVP MAY be present in re-authorization
    messages, and contains the number of seconds the user is authorized
    to receive service from the time the re-auth answer message is
    received by the access device.

The MIP draft contains no references to Session-Timeout beyond the
occurence rules and the ABNFs and they are contradictory.

The occurence rules of the MIP draft states

                                  +-----------------------+
                                  |      Command-Code     |
                                  |-----+-----+-----+-----+
    Attribute Name                | AMR | AMA | HAR | HAA |
    ------------------------------|-----+-----+-----+-----+
    Session-Timeout               | 0   | 1   | 1   | 0   |

The ABNFs for AMA and HAR list it as optional. Looking solely at the
base draft the ABNF would seem to be correct.

But this still does not settle the issue of the semantics of its
presence. Section 5.1 of the mip draft states

    The Diameter Mobile IP application makes use of two timers - the
    Authorization-Lifetime AVP [DIAMBASE] and the MIP-Key-Lifetime AVP.

    The Authorization-Lifetime contains the number of seconds before the
    Mobile Node must issue a subsequent MIP registration request. The
    content of the Authorization-Lifetime AVP corresponds to the Lifetime
    field in the MIP header [MOBILEIP].

    The MIP-Key-Lifetime AVP contains the number of seconds before
    session keys destined for the Mobility Agents and the Mobile Node
    expire. A value of zero indicates infinity (no timeout). If not zero,
    the value of the MIP-Key-Lifetime AVP MUST be at least equal to the
    value in the Authorization Lifetime AVP.

If the application doesn't use Session-Timeout it should not be optional
or mandatory but banned. The section quoted above inevitably leads to
the the termination of the user session after at least
Authorization-Lifetime seconds and at most Authorization-Lifetime +
MIP-Key-Lifetime seconds.

Requested change:

Remove Session-Timeout from AMA and HAR.

Modify the first paragraph of section 5.1 to:

The Diameter Mobile IP application makes use of two timers - the
Authorization-Lifetime AVP [DIAMBASE] and the MIP-Key-Lifetime AVP. The
Session-Timeout AVP [DIAMBASE] does not apply to this application.

j

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 11 Mar 2002 20:34:28 -0800 (PST)

Assigned issue #306.

---

From: Tony Johansson <[email-masked]>
Date: Tue, 12 Mar 2002 11:15:46 -0800

All,

I would like to close this issue with the following changes:

Remove the Session-Timeout AVP form the occurrence rules table and from the
ABNFs in the AMA and HAR.

Comments / objections?

/Tony

---

From: Johan Johansson <[email-masked]>
Date: Wed, 13 Mar 2002 13:32:03 +0100

I would prefer if you also added an explicit note that Session-Timeout 
does not apply to the Diameter Mobile IP application, but if you really 
don't like it that's acceptable too since that information is implicit 
in the fact that the avp is disallowed in the messages. But why not be 
as clear as possible?

j

---

From: Sivasundar Ramamurthy <[email-masked]>
Date: Wed, 13 Mar 2002 15:20:52 -0800 (PST)

Hello,

This goes back to one of my previous emails (with a few corrections :-)

--------------------------------------------------------------------------
if the key lifetime is allowed to be greater than the authorization
lifetime (plus grace period), then the authorization at the (stateful)
AAA server will expire even as the MN is re-registering. This will
happen since the MN "knows" to use AAA only to request keys; it will
re-register (re-authenticate) directly with the HA during the time the
keys are alive.

Thus even while the MN is happily registered (authenticated), the
(stateful) AAA server will see that its authorization lifetime (plus
grace period) has expired and will terminate its session and
de-allocate the resources. Is'nt this a problem?

--------------------------------------------------------------------------

[ I am interpreting the "cleaning up resources of the session" in
section 8.10 as "terminating the session" ]

If I am correct, then do we make an exception for Mobile IP sessions
so that AAA servers will terminate sessions only when only when the
key-lifetime expires?

thanks!

Siva

---

From: Johan Johansson <[email-masked]>
Date: Thu, 14 Mar 2002 14:05:42 +0100

Alternatively you can say that the AAA server sends the "Diameter 
authorization lifetime" as the lifetime of the keys. There *is* a 
certain terminological mixing taking place here which is confusing, but 
as far as I've been able to conclude this is the intention:

Authorization-Lifetime: As you say, this would be the interval with 
which mobile ip reauthentications would take place and does not /should 
not involve Diameter

Mip-Key-Lifetime: The interval with which Diameter reauthorizations must 
be done to get valid keys to perform the next mobile ip authentication.

It would seem that in the Mobile IP application 
Authorization-Grace-Period should be added to the MIP-Key-Lifetime. 
Alternatively it could be added to the value in Authorization-Lifetime 
before it is processed by the Mobile IP machinery. The draft doesn't say 
which (avp only mentioned in ABNFs and occurence rules), but my vote is 
on the first alternative.

j

---

From: Tony Johansson <[email-masked]>
Date: Thu, 14 Mar 2002 17:29:55 -0800

> on the first alternative.

The MIP ONLY makes use of two timers the MIP-Key-Lifetime AVP and the
Authorization-Lifetime AVP, as stated in mip-09 section 5.1 Authorization
Lifetime vs. MIP Key Lifetime. Unfortunately, I missed to remove the
Session-Timeout AVP in the Authorization-Grace-Period from the draft when I
updated it.

I'm sorry for this confusion. If no objections, they will be removed in the
next version.

/Tony

---

From: Johan Johansson <[email-masked]>
Date: Fri, 15 Mar 2002 12:23:38 +0100

>I'm sorry for this confusion. If no objections, they will be removed in the
No, no, getting rid of the grace period sounds like a dream come true.

j