Subject: [Dime] Diameter ERP

From: Sebastien Decugis <[email-masked]>
Date: Thu, 15 Oct 2009 15:34:20 +0900

Hello DIME members,

FYI, draft-ietf-dime-erp-02.txt has been published. It is a small update
from previous version, and does not contain new ideas.

As a reminder, some issues are still pending on this document and your
comments would be appreciated. See section 10 of the document for more
details on the following issues:

- do we use Diameter ERP (alone) to support re-authentication of the
peer after a handover, or do we mandate the use of a mobility
application (such as MIP6) in that case -- this mobility application
could use Diameter ERP as an optimization.

- in case the home domain contains several EAP servers, how does ERP
mechanism find the one that possess the EMSK for a given peer ?

We are looking forward to your comments...

Best regards,
Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: Qin Wu <[email-masked]>
Date: Fri, 16 Oct 2009 10:10:58 +0800

Hi, Sebastien and all:
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, October 15, 2009 2:34 PM
Subject: [Dime] Diameter ERP

> could use Diameter ERP as an optimization.

[Qin]:  In my understanding, Diameter ERP is not mobility protocol but can reuse the similar mechanism specified in  the mobility application, e.g., Diameter user session mangement ,as described in the section 4.1 of RFC4004, the different sessions can be correlated with the Acct-Multi-Session-Id AVP like. 

Therefore the similar mechanism(i.e.,user Session correlation) can also be adopted, i.e., each time the peer  moves to the new NAS, the session-Id created from the new NAS will be  correlated with the user name or Acct-Multi-Session-Id corresponding to this given peer.
 
> mechanism find the one that possess the EMSK for a given peer ?

[Qin]: Isn't EMSKname used to distinguish different EAP servers in the same home domain?
If EMSKname can not be used to do this, I think ERP/DER messages can be advertised to all the EAP 
servers in the home domain, the first EAP server who responds will be viewed as the EAP server that
 possess the EMSK for a given peer. Is it right?

> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

---

From: Julien Bournelle <[email-masked]>
Date: Fri, 16 Oct 2009 04:15:13 +0200

Hello,

> could use Diameter ERP as an optimization.

What do you mean by a Mobility Application ?

 Regards,

 Julien

---

From: Sebastien Decugis <[email-masked]>
Date: Fri, 16 Oct 2009 11:23:49 +0900

Hi Julien,

> What do you mean by a Mobility Application ?
You are right, sorry for the lack of explanation. I mean an application
that was *designed* for supporting peers attaching to different NAS
during the lifetime of a session, and therefore already provides
mechanisms for accounting records correlation, monitoring of the
location of the peer at any time (for reachability by the home server),
and this kind of mechanisms. In case we opt for the alternative choice,
i.e. managing the handovers with Diameter ERP alone, we will have to
provide this kind of mechanisms.

Hope this clarifies,
Best regards,
Sebastien.

>     NICT (nict.go.jp <http://nict.go.jp>)
>
>     [email-masked] <mailto:[email-masked]>

---

From: Sebastien Decugis <[email-masked]>
Date: Fri, 16 Oct 2009 12:10:05 +0900

Hi Qin, all,

Thank you for your comments. Please see my answers inline.

> Therefore the similar mechanism(i.e.,user Session correlation) can also be adopted, i.e., each time the peer  moves to the new NAS, the session-Id created from the new NAS will be  correlated with…
Ok, so you are suggesting that we should "copy" the mechanism from
RFC4004 in Diameter ERP, is that right ? In that case are we assuming
that the (mobile) peer is not using a mobility protocol, and just
achieving re-authentication but apart from this it is equivalent to a
plain EAP authentication? What happens if the peer is using a mobility
protocol (which seems reasonable for a mobile peer) ? Is there no
conflict or at least duplicates between the ERP and the MIP applications
in that case?

> [Qin]: Isn't EMSKname used to distinguish different EAP servers in the same home domain?
Not that I know of... The EMSKname is made of a plain hashed value (no
indication of server) and the domain name. If we want to use the
EMSKname for routing, I think we would need a central entity that
collects all EMSK (at least EMSKnames) from all EAP servers in the
realm, and routes the messages to the correct servers.

>  possess the EMSK for a given peer. Is it right?
There is no broadcast mechanism in Diameter (afaik), and going through
all the servers in sequence seems not efficient to me.

I believe a solution is to store the information about the server (that
is known during the initial EAP exchange) and then use this information
when ERP is started. But I am not sure in which location the information
should be stored, NAS or ER server...

Thank you for proposing a solution anyway :) I hope other people can
also suggest different approaches, or at least comment on the already
proposed ones.

Best regards,
Sebastien.

---

From: w52006 <[email-masked]>
Date: Fri, 16 Oct 2009 14:56:04 +0800

Hello all

It seems the issue is involved in Diameter ERP application only. I don't
think it needs to be expanded to other application or new application. 
As we know, in ERP framework,  the re-authentication session terminated by
the ER server is de-coupled from the authentication session terminated by
the home server. Do you want to re-couple them implicitly with the Diameter
ERP application and 'new mobility application'?
In my mind, the issue can be resolved by the Diameter enities for the
Diameter ERP application. That's, the on-path Diameter peer collocated with
the ER server may be possible to do these works instead of the home server,
e.g. accounting records correlation, monitoring of the location of the peer.
For implementation, i.e., it could establish the association between the
authentication session and the re-authentication session which are oriented
from the home server and the up-to-date NAS respectively. 

B.R.
Yungui

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Sebastien Decugis
> Sent: Friday, October 16, 2009 10:24 AM
> To: Julien Bournelle
> Cc: [email-masked]
> Subject: Re: [Dime] Diameter ERP
> 
> Hi Julien,
>

---

From: Qin Wu <[email-masked]>
Date: Wed, 21 Oct 2009 17:11:05 +0800

Hi, Sebastien:
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: "Qin Wu" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, October 16, 2009 11:10 AM
Subject: Re: [Dime] Diameter ERP

> conflict or at least duplicates between the ERP and the MIP applications

[Qin]: In the RFC4004, the Diameter user session and the Layer 3 mobility session associated 
with MIP application are not the same thing,  and ERP may borrow the similar mechanism as  
user session management described in the RFC 4004, therefore there is no conflict between ERP 
and the MIP application.

> realm, and routes the messages to the correct servers.

[Qin]: It seems not efficient way for message routing. How about Redirection mechanism, i.e.,
one EAP server possessing no EMSK can redirect the message to the EAP server possessing EMSK.
It seems more efficient than the way you suggest.

> all the servers in sequence seems not efficient to me.

[Qin]: I agree.

> should be stored, NAS or ER server...

[Qin]: What I prefer is the information can be downloaded at the NAS. And then
the peer can obtain this information directly or indirectly from the NAS.

---

From: Sebastien Decugis <[email-masked]>
Date: Wed, 21 Oct 2009 18:40:51 +0900

Hi Qin, all,

> user session management described in the RFC 4004, therefore there is no conflict between ERP 
As I told before, I am not familiar with Diameter mobility applications,
so I don't know what we can/cannot do in Diameter ERP and which
conflicts we are exposing. I will have to read in depth the RFC4004
before I can really answer on this topic. In the meantime, it would be
interesting to hear from others who are familiar with Diameter MIP6 for
example ^^.

> It seems more efficient than the way you suggest.
Agreed, but how does this server that does not have the EMSK learn which
server has it, to give the correct redirect indication ?

> the peer can obtain this information directly or indirectly from the NAS.
The peer does not need this information, only the NAS does. I agree that
keeping the information in the NAS is the easy and efficient solution,
but it does not work if we plan to support handovers :-) Hence the issue...

Best regards,
Sebastien.