Diameter MIP6 Feature Vector Additional Bit Allocations
draft-korhonen-dime-mip6-feature-bits-01.txt

Status of this Memo

This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”

The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.

This Internet-Draft will expire on December 12, 2009.

Copyright Notice

Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document.

Abstract

During the Mobile IPv6 Split Scenario bootstrapping the Mobile IPv6 Home Agent and the Authentication, Authorization, and Accounting server may exchange a set of authorized mobility capabilities. This document defines new mobility capability flags that are used to authorize per Mobile Node route optimization, Multiple Care-of Address and user plane traffic encryption support. Furthermore, this document also defines a capability flag of indicating whether the Home Agent is authorized to act as a stand alone Virtual Private Network gateway.

Table of Contents

1.  Introduction
2.  Terminology
3.  Flag definitions for the MIP6-Feature-Vector AVP
    3.1.  Route Optimization Support
    3.2.  Multiple Care-of Addresses Support
    3.3.  User Traffic Encryption Support
    3.4.  VPN Gateway Mode Support
4.  IANA Considerations
5.  Security Considerations
6.  References
    6.1.  Normative References
    6.2.  Informative References
§  Author's Address

1.  Introduction

During the Mobile IPv6 [RFC3775] (Johnson, D., Perkins, C., and J. Arkko, “Mobility Support in IPv6,” June 2004.) Split Scenario bootstrapping [RFC5026] (Giaretta, G., Kempf, J., and V. Devarapalli, “Mobile IPv6 Bootstrapping in Split Scenario,” October 2007.) the Mobile IPv6 Home Agent (HA) and the Authentication, Authorization, and Accounting (AAA) server MAY exchange a set of capabilities as defined in [I‑D.ietf‑dime‑mip6‑split] (Korhonen, J., Tschofenig, H., Bournelle, J., Giaretta, G., and M. Nakhjiri, “Diameter Mobile IPv6: Support for Home Agent to Diameter Server Interaction,” April 2009.). This document defines additional capability flag bits that are used to authorize per Mobile Node (MN) route optimization, Multiple Care-of Address (MCoA) [I‑D.ietf‑monami6‑multiplecoa] (Wakikawa, R., Devarapalli, V., Tsirtsis, G., Ernst, T., and K. Nagami, “Multiple Care-of Addresses Registration,” May 2009.) and user plane traffic encryption support. Furthermore, this document also defines a capability flag bit of indicating whether the HA is authorized to act as a stand alone IPsec Virtual Private Network (VPN) gateway for remote VPN clients. These new capability flag bits allow Mobility Service Provider (MSP) to control the supported services on the HA.

2.  Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.).

3.  Flag definitions for the MIP6-Feature-Vector AVP

The MIP6-Feature-Vector AVP is defined in [RFC5447] (Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C., and K. Chowdhury, “Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction,” February 2009.). The new capability bits defined in this document are intended to be used between the HA and the AAA server during the Mobile IPv6 Split Scenario bootstrapping Diameter interactions [I‑D.ietf‑dime‑mip6‑split] (Korhonen, J., Tschofenig, H., Bournelle, J., Giaretta, G., and M. Nakhjiri, “Diameter Mobile IPv6: Support for Home Agent to Diameter Server Interaction,” April 2009.). However, the defined flag bits MAY also be used in other scenarios and deployments outside the Mobile IPv6 Split Scenario.

3.1.  Route Optimization Support

Route optimization support is indicated by using the RO_SUPPORTED (value 0x0000000200000000) capability flag bit. When the HA sets this bit, it indicates support for the route optimization. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize route optimization for the MN.

3.2.  Multiple Care-of Addresses Support

Multiple Care-of Addresses (MCoA) [I‑D.ietf‑monami6‑multiplecoa] (Wakikawa, R., Devarapalli, V., Tsirtsis, G., Ernst, T., and K. Nagami, “Multiple Care-of Addresses Registration,” May 2009.) support is indicated by using the MCOA_SUPPORTED (value 0x0000001000000000) capability flag bit. When the HA sets this bit, it indicates support for the MCoA. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize the use of MCoA for the MN.

3.3.  User Traffic Encryption Support

User plane traffic encryption support is indicated by using the USER_TRAFFIC_ENCRYPTION (value 0x0000000400000000) capability flag bit. When the HA sets this bit, it indicates support for the user plane traffic encryption between the MN and the HA. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize user plane traffic encryption because of subscription or operator policy.

3.4.  VPN Gateway Mode Support

The HA MAY act as a IPsec VPN gateway for the user and the support is indicated by the VPN_GW_MODE (value 0x0000000800000000) capability flag bit. When the HA sets this bit, it indicates support for acting as a standalone IPsec VPN gateway. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize the HA to act as a standalone IPsec VPN gateway for the MN because of subscription or operator policy.

4.  IANA Considerations

This document defines new values to the "Mobility Capability" registry (see [RFC5447] (Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C., and K. Chowdhury, “Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction,” February 2009.)) for use with the MIP6-Feature-Vector AVP:

Token                            | Value                | Description
---------------------------------+----------------------+------------
RO_SUPPORTED                     | 0x0000000200000000   | RFC TBD
USER_TRAFFIC_ENCRYPTION          | 0x0000000400000000   | RFC TBD
VPN_GW_MODE                      | 0x0000000800000000   | RFC TBD
MCOA_SUPPORTED                   | 0x0000001000000000   | RFC TBD

5.  Security Considerations

This document has no additional security consideration to those already described for the Mobile IPv6 Integrated Scenario Diameter interactions [RFC5447] (Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C., and K. Chowdhury, “Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction,” February 2009.) and Mobile IPv6 Split Scenario Diameter interactions [I‑D.ietf‑dime‑mip6‑split] (Korhonen, J., Tschofenig, H., Bournelle, J., Giaretta, G., and M. Nakhjiri, “Diameter Mobile IPv6: Support for Home Agent to Diameter Server Interaction,” April 2009.).

6.  References

6.1. Normative References

6.2. Informative References

Author's Address