Subject: RE: [AAA-WG]: Re: Call for Interest

From: <[email-masked]>
Date: Fri, 16 May 2003 11:55:23 +0300

Hi Bernard,

> Yes. I would like to understand the deployment scenarios for Diameter EAP,
> and whether keys really need to pass through intermediaries, before
> doing work to protect keys from intermediaries.

I'd probably have to dig through the proposals better, but I think the initial
3GPP scenario is something along the following:

 +-------+          +---------+        +---------+	+----------+
 |	   |		  |		|	   |		 | 	|          | 
 | NAS   |		  | visited	|	   |	home	 |    |  profile |    
 |	   |----------|   AAA	|--------|	 AAA	 |....|          |
 |	   |		  | server	|	   | server	 |	|  server  |
 +-------+          +---------+        +---------+	+----------+

My guess is that all of the connections will be secured. The profile
server (probably HLR) can be considered a database where subscriber
profiles reside.

John

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 16 May 2003 04:46:32 -0700 (PDT)

In the scenario above there are no untrusted proxies.  If the NAS in the
diagram is running RADIUS, then there is no way for the visited AAA server
to avoid possessing the keys, since it needs to function as a
Diameter/RADIUS gateway.  CMS would not add any security in such a
scenario.