Subject: [Dime] MIPv4 Authentication Performance Using RADIUS and Diameter MIPv4

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 01 Aug 2007 11:05:47 +0200

Hi Ahmad,

you raised some interesting discussions during the DIME working group 
meeting. Unfortunately, there was not enough time to address all questions.

I would be great if you could
* summarize your presentation, and
* address some of the raised questions
on the mailing list.

Ciao
Hannes

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 1 Aug 2007 07:10:31 -0500

Hi Hannes,

Thanks a lot for giving me the chance. I really Appreciate it.

As far as the raised issues I can summarize them as follows and I will
have separate threads (probably end of day or early tomorrow) for each
one of them.

1. Is there any field data which support the use case that the draft is
trying to address. (Issue raised by: Madjid and Jouni)
2. Is there any security issue when the FA relay the retransmitted
initial RRQ without consulting AAA in the case of RADIUS-Mode. (Issue
raised by: Pete McCann)

Based on the discussion, I would like to update the draft and submit a
new revision and possibly discuss the next steps.

All,
Please, let me know if there is any issue that was raised and I missed.

Best Regards,
Ahmad

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Wednesday, August 01, 2007 4:06 AM
> To: [email-masked]
> Cc: Muhanna, Ahmad (RICH1:2H10)
> Subject: MIPv4 Authentication Performance Using RADIUS and 
> Diameter MIPv4
> 
> Hi Ahmad,
> 
> you raised some interesting discussions during the DIME 
> working group meeting. Unfortunately, there was not enough 
> time to address all questions.
>

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 1 Aug 2007 07:57:13 -0500

Hi Hannes,
Sorry, I forgot to summarize my presentation. Here is the summary:

The basic idea of this draft is the following:
==============================================
Since some SDO's is considering the full deployment of Diameter for MIP4
Authentication, Authorization, and possibly MSA allocation, the
following question presents itself:

What is the anticipated impact of Diameter Mobile IPv4 Application for
MIPv4 Authentication, Authorization, and possibly MSA dynamic allocation
on the MIPv4 session setup in comparison of RADIUS-Model MIPv4
Authentication and Authorization, etc.

High Level Summary of Diameter Mobile IPv4 Application:
=======================================================
1. The main functionality of the Diameter MIP4 Application is to
Authenticate, Authorize, and optionally allocate Mobility Security
Association of MN-HA and FA-HA.

2. In order for Diameter MIP4 Application to achieve step 1, Diameter
MIP4 Application uses the AAA infrastructure and Diameter protocol not
only to exchange Authentication and Authorization related parameters,
BUT it also, include the MIPv4 RRQ and RRP.

3. In other words, the Foreign Agent does not directly relay the RRQ
received from the MN to the Home Agent as per RFC3344, it includes the
RRQ in the Diameter message AMA and receives the RRP in the Diameter
message AMR.

Criteria used for Comparison:
=============================
1. RFC3344 mandates; when the MN uses timestamp for replay protection,
the MN must not retransmit a RRQ before 1 second.
2. In wireless networks, most MIPv4 clients sets the first retransmit
timer to 1 second. This is important in order to get the session setup
quickly and not waste air resources.
3. Then, what happens if due to some network condition the Mobile Node
does not receive MIPv4 RRP within 1 second?

How retransmitted initial MIPv4 RRQ message in handled in both models?
----------------------------------------------------------------------

RADIUS-Model MIP4 Auth Case:
============================-
1. In the case of RADIUS Model MIPv4 Authentication, AAA infrastructure
is used for Authentication, Authorization, etc. BUT NOT used for
exchanging MIP4 RRQ and RRP between FA and HA.

2. Only in one condition (FA state), RADIUS-model will reauthenticate
the MIPv4 user by contacting AAA server, it is the case when FA receives
a retransmitted initial RRQ while waiting for AAA response.

3. In all other states, waiting for RRP, Received RRP, or Relayed RRP,
the FA considers the user has been authenticated and relays the
retransmitted RRQ directly to the HA without going through AAA
infrastructure.

Diameter MIP4 Application Case:
===============================
1. In the case of Diameter MIPv4 Application,. AAA infrastructure is
used for Authentication, Authorization, etc. AND is USED for exchanging
MIP4 RRQ and RRP between FA and HA.

2. In all conditions (FA states), Diameter MIPv4 Application will
reauthenticate the MIPv4 user by contacting AAA server.

3. Let us also remember that re-authentication of the user in the case
of Diameter MIP4 Application is far more complicated and time consuming
than in the case of RADIUS-Model.

Conclusion:
===========
In case the network condition creates a situation that the Mobile Node
does not receive initial MIPv4 RRP within one second, Diameter MIPv4
Application will worsen the network condition by unnecessarily relaying
the retransmitted RRQ via AAA (Diameter) infrastructure and
re-authenticating the user instead of relaying the retransmitted RRQ
DIRECTLY to the Home Agent.

Best Regards,
Ahmad

> From: Muhanna, Ahmad (RICH1:2H10) 
> Sent: Wednesday, August 01, 2007 7:11 AM
> To: 'Hannes Tschofenig'; [email-masked]'
> Cc: 'Madjid Nakhjiri'; 'McCann Peter-A001034'; 
> [email-masked]'; Khalil, Mohamed 
> (RICH2:2S20); 'Avi Lior'
> Subject: RE: MIPv4 Authentication Performance Using RADIUS 
> and Diameter MIPv4
> 
> Hi Hannes,
> 
> As far as the raised issues I can summarize them as follows 
> and I will have separate threads (probably end of day or 
> early tomorrow) for each one of them.
> 
> 1. Is there any field data which support the use case that 
> the draft is trying to address. (Issue raised by: Madjid and 
> Jouni) 2. Is there any security issue when the FA relay the 
> retransmitted initial RRQ without consulting AAA in the case 
> of RADIUS-Mode. (Issue raised by: Pete McCann)
> 
> Based on the discussion, I would like to update the draft and 
> submit a new revision and possibly discuss the next steps.
> 
> All,
> > Subject: MIPv4 Authentication Performance Using RADIUS and Diameter 
> > MIPv4
> > 
> > Hi Ahmad,
> > 
> working group 
> > * address some of the raised questions on the mailing list.
> > 
> > Ciao
> > Hannes
> > 
> > 
>

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 1 Aug 2007 22:14:21 +0300

It always struck me as a bizarre protocol design how Diameter tunnels MIP4.
More so than the timer issue Ahmad describes, I'd be concerned about the
architectural misalignment of RADIUS and Diameter. Architectures that are
using RADIUS would have to jump some additional hoops to adapt to Diameter
when using MIP4. It does not have to be that way.

Alper 

> From: Ahmad Muhanna [mailto:[email-masked]]
> Sent: Wednesday, August 01, 2007 3:57 PM
> To: Hannes Tschofenig; [email-masked]
> Cc: Mohamed Khalil; McCann Peter-A001034
> Subject: [Dime] RE: MIPv4 Authentication Performance Using RADIUS
> andDiameter MIPv4
> 
> 
> Hi Hannes,

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 7 Aug 2007 10:34:06 -0500

Hi All,

During the DIME meeting at IETF-69, there was a question raised if there
is any field data which support the case that it may takes the MN more
than one second to receive the initial RRP message and the MN had to
retransmit the initial RRQ.

First of all, IMO, I would like to say that it is very possible and
realistic to assume that under certain conditions the initial MIPv4 RRP
message may take more than one second to arrive at the Mobile Node.

As far as getting the field data, I will continue to try to find some
real data on this. On the other hand, I really appreciate it if any of
the handset, AAA vendors or any of the operators can share or comment on
this field data record.

Regards,
Ahmad