Subject: Re: [Dime] Does the home AAA/EAP server must know the current NAS ?

From: Julien Bournelle <[email-masked]>
Date: Thu, 25 Jun 2009 05:32:23 +0200

Hello,

On Thu, Jun 25, 2009 at 4:21 AM, Sebastien Decugis <[email-masked]>wrote:

>
> > Let's make it simple:
> > The home AAA/EAP server must know to which NAS the UE is currently
> > attached. That's my issue.
>

> Do you mean at any time during the lifetime of the authentication? Why
> would it need to know this?

Because the AAA server may maintain a state for a UE. If it wants to
disconnect it for whatever reason, it must be able to send a STR to the
correct NAS.

Regards,

 Julien

>
>
> Sebastien.
>
> --
> Sebastien Decugis
> Research fellow
> Network Architecture Group
> NICT (nict.go.jp)
>
>

---

From: Sebastien Decugis <[email-masked]>
Date: Thu, 25 Jun 2009 13:01:03 +0900

Hi,

> disconnect it for whatever reason, it must be able to send a STR to
> the correct NAS.

I see. This must be added to the "to do" things on Diameter ERP then
(this also is not correlated to the app id choice anyway).

Any idea how to achieve this? (maybe some ideas can be borrowed from MIPv6?)

Sebastien.

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 26 Jun 2009 14:14:12 -0700 (PDT)

Hi Sebastien,
  On page 13, you asked:
    [[Editor16: How do we create / retrieve the Session-Id?]]

I think that Session-ID is first introduced in RFC 5247 which is not referenced in your draft.
Session-ID needs to be defined for each EAP Method separately.

My 2 cents.

Regards,

Behcet

---

From: Sebastien Decugis <[email-masked]>
Date: Mon, 29 Jun 2009 10:40:24 +0900

Dear Behcet,

Thank you for this information. I should definitely cite this RFC from
the draft.

Anyway, in the context of the draft, the Session-Id refers to the
definition given in RFC3588 (Diameter Base Protocol) section 8 (Diameter
User Sessions). It is not limited to EAP and authentication, but used
also for accounting for example. When the peer moves to a new
authenticator and uses ERP for authentication, we must figure a way for
accounting to work properly. I can see two possibilities here (there
might be others):
-> The new NAS learns by some mean the Session-Id that was used in the
previous NAS, and sends its accounting records using this Session-Id.
-> The NAS creates a new Session-Id, and the accounting server is able
to correlate the new Session-Id with the old one.

Both solutions are not trivial IMHO, and need to be discussed.

Best regards,
Sebastien.

---

From: Qin Wu <[email-masked]>
Date: Tue, 30 Jun 2009 10:00:52 +0800

Hi, Sebastien and all:
Some clarification.
I think Session-Id described in RFC5247 is applicable for EAP Session and used between EAP peer and EAP server. Mobile device can be one example of EAP peer. The Session-Id you mentioned is access authentication session and used between AAA client and AAA server. I wonder whether they are the same thing.
What am I missing?
In my opinion, each EAP authentication has a unique session-Id in relation to the EAP method used, the Session-Id can be created by the EAP peer or EAP server. Am I right?

Regards!
-Qin
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: "Behcet Sarikaya" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, June 29, 2009 9:40 AM
Subject: Re: [Dime] Session-ID in draft-sdecugis-dime-diameter-erp-01

Dear Behcet,

Best regards,
Sebastien.

_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime

---

From: Sebastien Decugis <[email-masked]>
Date: Tue, 30 Jun 2009 11:34:56 +0900

Hi Qin,

> I think Session-Id described in RFC5247 is applicable for EAP Session and used between EAP peer and EAP server. Mobile device can be one example of EAP peer. The Session-Id you mentioned is access…
No, in my opinion these are two different concepts. For example, even
when EAP is not used, a Session-Id AVP is created in Diameter.

> In my opinion, each EAP authentication has a unique session-Id in relation to the EAP method used, the Session-Id can be created by the EAP peer or EAP server. Am I right?
I was not aware that EAP methods also created a Session Id (or is it the
EMSK KeyName?). Anyway, AFAIK, usually Diameter Session-Id AVP are
created based on the User-Name, itself acquired from EAP Identity
Request/Response (in case of EAP authentication). This exchange is not
performed in the case of ERP (after a handover to a new NAS), so we
really need to define what the (Diameter) Session-Id AVP will be in this
case, and how it is created/retrieved. Session-Id AVP is mandatory in
most Diameter messages. That is what I tried to highlight in the draft.
I was not referring to the EAP Session Id, there.

I hope this clarifies,

Best regards,
Sebastien.

---

From: Qin Wu <[email-masked]>
Date: Tue, 30 Jun 2009 14:15:31 +0800

Hi, Sebastien:

----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: "Qin Wu" <[email-masked]>
Cc: "Behcet Sarikaya" <[email-masked]>; <[email-masked]>
Sent: Tuesday, June 30, 2009 10:34 AM
Subject: Re: [Dime] Session-ID in draft-sdecugis-dime-diameter-erp-01

> when EAP is not used, a Session-Id AVP is created in Diameter.

[Qin]: I agree,  In that sense, we need to define a generic session-Id in ERP which is used between Diameter Client and Server, am I right?

> I was not referring to the EAP Session Id, there.

[Qin]: Since ERP is method indpendent mechanism, In my opinion, we don't need to consider Session Id created by method, right?
Session Id created by method consist of Nonce or Rand which are used to generate key materials,e.g.,EMSK.
As regarding Diameter Session-Id, I have no objection to add it in ERP, However I am not quite sure why we need to define such Session-Id?
One obvious reason occured to me is used for accounting, am I right? is there any other reason?

---

From: Sebastien Decugis <[email-masked]>
Date: Tue, 30 Jun 2009 15:43:19 +0900

Hi again,

> [Qin]: I agree,  In that sense, we need to define a generic session-Id in ERP which is used between Diameter Client and Server, am I right?
We need this Session-Id in Diameter. I am not sure if the Id must be
retrieved from ERP and propagated to Diameter, or retrieved directly by
Diameter. At the time I wrote the draft, I was only thinking to the
second choice, but managing this Id in ERP (maybe as opaque data) might
simplify the process, and is worth investigation.

> Session Id created by method consist of Nonce or Rand which are used to generate key materials,e.g.,EMSK.
Yes, I think it is better that Diameter does not need to understand the
internals of EAP as much as possible :)

> As regarding Diameter Session-Id, I have no objection to add it in ERP, However I am not quite sure why we need to define such Session-Id?
As I answered to the first question in this mail, I was not considering
adding this Diameter Session-Id inside ERP so far. I was just pointing
out that we need the new NAS to "have" a Session-Id, for peers that are
using ERP to authenticate. This Session-Id is either new (then we need
correlation with the previous Session-Id in the accounting server or ER
server) or the same (then we need a mechanism to acquire this Session-Id
in the NAS).
> One obvious reason occured to me is used for accounting, am I right? is there any other reason?
I was also thinking about accounting, but there may be other uses.

At this point, I don't know what is the best way to proceed to correlate
the session information between previous and new authenticator, with
regards to accounting. It might be worth having a brainstorm on this
topic at Stockholm, if people are interested...

I guess the main "philosophical" question here is: From the Diameter
point of view, after handover and ERP re-authentication, are we
continuing the same session, or is it a new session?

Best regards,
Sebastien.

---

From: Qin Wu <[email-masked]>
Date: Tue, 30 Jun 2009 16:02:54 +0800

Hi, Sebastien:
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: "Qin Wu" <[email-masked]>
Cc: "Behcet Sarikaya" <[email-masked]>; <[email-masked]>
Sent: Tuesday, June 30, 2009 2:43 PM
Subject: Re: [Dime] Session-ID in draft-sdecugis-dime-diameter-erp-01

> simplify the process, and is worth investigation.
[Qin]: As decribed in the section 8.8 of RFC3588, 
"
 The Session-Id is created by the Diameter application initiating the
   session, which in most cases is done by the client.
"
That's to say, session-Id is relevant to the Diameter application. If we agree that we need a new application between NAS and Diameter AAA server,
I think Session-Id is apparently necessary.
On the other hand, Session-Id is used to distinguish  one authentication exchange from another run by the client, e.g., the mobile bootstrapping from one AAA domain and move within this AAA domain, the authentications happen twice, one is full EAP authentication, the other is Re-authentication, that is to say we need 
to define two different Session-ID to differentiate between them, Am I right?

> server) or the same (then we need a mechanism to acquire this Session-Id
[Qin]: So we have two choices:
1. ERP defines Session-Id
2. NASReq defines Session-Id
right?
> topic at Stockholm, if people are interested...

[Qin]: I agree with you. It is too complicated thing to correlate session between previous and new authenticator when inter-authenticator handover
frequently happens.

> continuing the same session, or is it a new session?

[Qin]: It is not necessary, the Session in relation to the Session-Id has nothing to do with mobility session, in my opinion.
The only role of Session-Id is used to differentiate one authentication exchange from another, So each time Re-authentication happens, 
there will be a new Session Id to be created, am I right?

---

From: Sebastien Decugis <[email-masked]>
Date: Tue, 30 Jun 2009 17:35:23 +0900

Hi again,

> That's to say, session-Id is relevant to the Diameter application. 
I don't think this is true. For example, the same Session-Id that is
created by NASREQ application is re-used in accounting (another Diameter
application). The Session-Id simply provides a way to correlate messages
that are linked together. I guess that this definition of "linked
together" really depends on the application(s) and the way they interface.

> If we agree that we need a new application between NAS and Diameter AAA server,
In any case, the NAS will need to know a Session-Id, for sending
accounting records for example.
> to define two different Session-ID to differentiate between them, Am I right?
On the NAS, the "life" of the Session-Id is greater than the
authentication alone. It is valid until a STA message is received for
the session (unless for stateless servers?) Anyway, on the servers, I
think it depends on how the application(s) are designed...

> 2. NASReq defines Session-Id
I think so, yes.

> [Qin]: I agree with you. It is too complicated thing to correlate session between previous and new authenticator when inter-authenticator handover
It is not necessarily complicated. The ER server may cache the session
information, and inform the NAS with the ERP response. Just a thought...

> there will be a new Session Id to be created, am I right?
That is an open issue. We may also choose to always re-use the same
Session-Id than created during the first full EAP authentication. I
don't know the pro & cons of each possibility yet.

Thanks,
Sebastien.

---

From: Qin Wu <[email-masked]>
Date: Tue, 30 Jun 2009 17:43:14 +0800

Hi, Sebastien:
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: "Qin Wu" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, June 30, 2009 4:35 PM
Subject: Re: [Dime] Session-ID in draft-sdecugis-dime-diameter-erp-01

> together" really depends on the application(s) and the way they interface.

[Qin]: So your point is Session-Id is independent of application and can be used by multiple applications.
Session-Id and Acct-Session-Id can be the identical, right?

> accounting records for example.

[Qin] Okay.

> think it depends on how the application(s) are designed...

[Qin] I don't catch your meaning here, can you give me more explanation?

> information, and inform the NAS with the ERP response. Just a thought...

[Qin]: Feasible.

> don't know the pro & cons of each possibility yet.

[Qin]: right. 
Maybe it is easy operated to use the same Session-Id for Accouting in the inter-authenticator handover scenario which does not need extra operations to update the session.

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 30 Jun 2009 09:26:09 -0700 (PDT)

Hi all,
  ERP is executed after a full EAP authentication which uses one of the EAP methods. I don't think in that sense ERP is EAP method indepedent.
I think that Session-Id here refers to the EAP method generated Session-ID. RFC 5247 requires each EAP method to export a Session-ID. Most EAP methods have defined their way of generating Session-Ids.

Regards,

Behcet

----- Original Message ----
> From: Qin Wu <[email-masked]>
> To: Sebastien Decugis <[email-masked]>
> Cc: Behcet Sarikaya <[email-masked]>; [email-masked]
> Sent: Tuesday, June 30, 2009 1:15:31 AM
> From: "Sebastien Decugis" 
> To: "Qin Wu" 
> Cc: "Behcet Sarikaya" ; 
> >> I think Session-Id described in RFC5247 is applicable for EAP Session and 
> used between EAP peer and EAP server. Mobile device can be one example of EAP 
> peer. The Session-Id you mentioned is access authentication session and used 
> between AAA client and AAA server. I wonder whether they are the same thing.
> >> What am I missing?
> >>  
> [Qin]: I agree,  In that sense, we need to define a generic session-Id in ERP 
> which is used between Diameter Client and Server, am I right?
> 
> >> In my opinion, each EAP authentication has a unique session-Id in relation to 
> the EAP method used, the Session-Id can be created by the EAP peer or EAP 
> server. Am I right?
> >>  
> [Qin]: Since ERP is method indpendent mechanism, In my opinion, we don't need to 
> consider Session Id created by method, right?
> As regarding Diameter Session-Id, I have no objection to add it in ERP, However 
> I am not quite sure why we need to define such Session-Id?

---

From: Qin Wu <[email-masked]>
Date: Wed, 01 Jul 2009 10:07:31 +0800

Hi, Behcet:
Full EAP authentication can be method specific and create EAP method specific session-Id, however, as described in RFC5296, ERP is a method independent protocol. Unless the ERP reuse the method specific Session-Id generated from Full EAP authentication, it seems difficult for ERP to create EAP method specific Session-Id. 
On the other hand, if ERP can create Session-Id that is independent of EAP, that's another case.

Regards!
-Qin
----- Original Message ----- 
From: "Behcet Sarikaya" <[email-masked]>
To: "Qin Wu" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, July 01, 2009 12:26 AM
Subject: Re: [Dime] Session-ID in draft-sdecugis-dime-diameter-erp-01

Hi all,

Regards,

Behcet

---

From: Sebastien Decugis <[email-masked]>
Date: Wed, 01 Jul 2009 11:10:18 +0900

Hi Qin,

> Session-Id and Acct-Session-Id can be the identical, right?
According to its definition, Acct-Session-Id is only used for
RADIUS/Diameter translation, not in pure Diameter deployments. I think
only Session-Id is needed in that case.

> [Qin] I don't catch your meaning here, can you give me more explanation?
Sorry it was not clear :) What I want to say is : the Session-Id (in
Diameter meaning) represents the provision of a service to a peer (a
session). All messages related to this session should contain the same
Session-Id. Anyway, which servers are involved in the process may change
during the lifetime of this session.

Best regards,
Sebastien.