Subject: Re: [AAA-WG]: Re: Pending Issue about MIP-Key-Lifetime AVP (fwd)

From: Sivasundar Ramamurthy <[email-masked]>
Date: Mon, 11 Mar 2002 12:20:46 -0800 (PST)

On Mon, 25 Feb 2002, Tony Johansson wrote:

> New section:
> 
> "5.1 Authorization Lifetime vs. MIP Key Lifetime
> 
>    The Diameter Mobile IP application makes use of two timers the
>    Authorization-Lifetime AVP [DIAMBASE] and the MIP-Key-Lifetime AVP.
> 
>    The Authorization-Lifetime contains the number of seconds before the
>    Mobile Node must issue a subsequent MIP registration request. The
>    content of Authorization-Lifetime AVP corresponds to the Lifetime
>    field in the MIP header [MOBILEIP].
> 
>    The MIP-Key-Lifetime AVP contains the number of seconds before
>    session keys destined for the Home Agent and/or Foreign Agent expire.
> 
>    A value of zero indicates infinity (no timeout). The value of the
>    MIP-Key-Lifetime AVP MUST be at least equal to the value in the
>    Authorization Lifetime AVP. If the value is greater, it SHOULD be a
>    multiple of the value in the Authorization Lifetime AVP."
> 

if the key lifetime is allowed to be greater than the authorization
lifetime, then the authorization lifetime at the (stateful) AAA server
will expire even as the MN is re-registering. This will happen since
the MN "knows" to use AAA only to request keys; it will re-register
(re-authenticate) directly with the HA during the time the keys are
alive.

Thus even while the MN is happily registered (authenticated), the
(stateful) AAA server will see that its authorization lifetime has
expired and will terminate its session and de-allocate the resources.
Is'nt this a problem, considering that one of the resources allocated
could be a dynamic home address which could then be allocated to some
other MN?

thanks!

Siva

---

From: "Fredrik Johansson" <[email-masked]>
Date: Tue, 12 Mar 2002 10:34:08 +0100

I believe we need some clarifications on what timers are to be used.

I belive this can be done in two ways, using two or three of the lifetime
AVPs.

Alt 1.
Use Authorization-Lifetime to indicate the MIP tunnel lifetime (i.e the
value that goes into the mip registration reply packet) and the
MIP-Key-Lifetime is the time of the keys and the session. Thus to extend the
session and request new keys has to be done every MIP-Key-Lifetime seconds.
In this alternative, the Session will have the same lifetime as the keys.
I.e. the MN must make sure to request new keys some time before the actual
time expires.

Alt 2.
Use three AVPs, one for the session, one for the keys and one for the mip
tunnels. I.e. Let the session-lifetime AVP be the maximum lifetime of the
session, the mip-key-lifetime is the lifetime of the session keys, and the
authorization-lifetime avp is the length of the mip tunnel lifetime. This
will mean that the MN will reauthenticate periodically with the HA at
Authorization-Lifetime in order to update the tunnels, it will request new
keys at MIP-Key-Lifetime, the Session-Lifetime will indicate when the
diameter client/server will terminate the session. The Session lifetime MUST
be greater or equal to the MIP-Key-Lifetime (preferable greater to allow the
mobile some time to request new keys and extend the session).

/Fredrik

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Sivasundar Ramamurthy
>Sent: den 11 mars 2002 21:21
>To: AAA Working Group
>Subject: Re: [AAA-WG]: Re: Pending Issue about MIP-Key-Lifetime AVP
>(fwd)
>
>
>

---

From: Tony Johansson <[email-masked]>
Date: Tue, 12 Mar 2002 10:57:40 -0800

Hi Fredrik and All,

Alt 1 is the one we should use. Unfortunately, I missed to remove the
Session-Timeout AVP in the occurrence rules table and in the ABNFs. I will
clarify this on issue #306.

Regards,

/Tony