RFC 5447
Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction
RFC 5447: Diameter Mobile IPv6 bestie drop 💖🎀
okay so this one is the Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction doc, and it's giving serious standards-track energy ✨. It's from the Network Working Group and it's a Standards Track document, dated February 2009. The editor is J. Korhonen (Nokia Siemens Networks), with J. Bournelle (Orange Labs), H. Tschofenig (Nokia Siemens Networks), C. Perkins (WiChorus), and K. Chowdhury (Starent Networks) as co-authors 🫶. It doesn't obsolete or update any other RFC, so it's a whole fresh vibe 🌸.
Status of This Memo ✨
okay this part is the official "what kind of doc is this" bit 💅. It's an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🙈. For the current standardization state and status, check the "Internet Official Protocol Standards" (STD 1) list, and distribution of this memo is unlimited 🦋.
Copyright Notice
the legal bit, but make it cute 🎀. Copyright (c) 2009 IETF Trust and the persons identified as the document authors, all rights reserved. This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the date of publication. Please read them carefully, bestie, because they explain your rights and restrictions for this document 📜.
Abstract
so the big picture is that a Mobile IPv6 node needs a home agent address, a home address, and a security association with its home agent before it can start using Mobile IPv6 🌈. RFC 3775 says some or all of those have to be statically configured, but the MIPv6 bootstrapping work wants that info to be dynamically available to the mobile node, which is so much better 🧚. A major goal is interworking with existing Authentication, Authorization, and Accounting (AAA) infrastructures 💜. This doc describes MIPv6 bootstrapping using the Diameter Network Access Server to home AAA server interface 🔥.
Table of Contents ✨
okay the TOC is basically the map of the whole doc, so I'm keeping it exactly as it is 🗺️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology and Abbreviations . . . . . . . . . . . . . . . . 3
3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Commands, Attribute-Value Pairs, and Advertising
Application Support . . . . . . . . . . . . . . . . . . . . . 6
4.1. Advertising Application Support . . . . . . . . . . . . . 6
4.2. Attribute-Value Pair Definitions . . . . . . . . . . . . . 6
4.2.1. MIP6-Agent-Info AVP . . . . . . . . . . . . . . . . . 6
4.2.2. MIP-Home-Agent-Address AVP . . . . . . . . . . . . . . 7
4.2.3. MIP-Home-Agent-Host AVP . . . . . . . . . . . . . . . 7
4.2.4. MIP6-Home-Link-Prefix AVP . . . . . . . . . . . . . . 8
4.2.5. MIP6-Feature-Vector AVP . . . . . . . . . . . . . . . 8
5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.1. Home Agent Assignment by the NAS . . . . . . . . . . . . . 10
5.2. Home Agent Assignment by the Diameter Server . . . . . . . 11
5.3. Home Agent Assignment by the NAS or Diameter Server . . . 11
6. Attribute-Value Pair Occurrence Tables . . . . . . . . . . . . 12
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
7.1. Registration of New AVPs . . . . . . . . . . . . . . . . . 13
7.2. New Registry: Mobility Capability . . . . . . . . . . . . 13
8. Security Considerations . . . . . . . . . . . . . . . . . . . 14
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 14
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
10.1. Normative References . . . . . . . . . . . . . . . . . . . 15
10.2. Informative References . . . . . . . . . . . . . . . . . . 151. Introduction 🌸
so the Mobile IPv6 (MIPv6) spec [RFC3775] says a mobile node (MN) has to register with a home agent (HA) and tell it about where it currently is, meaning its care-of address 📍. The HA then creates and maintains the binding between the MN's home address and its care-of address 🔗.
to register with an HA, the MN needs to know stuff like the home link prefix, the HA address, the home address(es), the home link prefix length, and the security-association-related info 🧠.
all that info can be statically configured, but honestly static provisioning is a whole admin burden for operators 😭. It also doesn't handle load balancing, failover, opportunistic home link assignment, or picking local HAs close to the MN 🙈. And it's pretty bad at reacting to sudden environmental or topological changes 💀. So static provisioning may not be desirable, given all those limitations 🙅♀️.
dynamic assignment of MIPv6 home registration info is way more desirable for easier deployment and network maintenance ✨. The AAA infrastructure is already used for access authentication, so it can be leveraged to assign some or all of the necessary parameters 🔥. The Diameter server in the Access Service Provider's (ASP's) or Mobility Service Provider's (MSP's) network may return these parameters to the AAA client 🎀. For the bootstrapping procedures, the AAA client might be either the Network Access Server, in the integrated scenario, or the HA, in the split scenario [RFC5026] 🦋. The terms "integrated" and "split" are explained in the terminology section that follows and were introduced in [RFC4640] and [AAA] 💅.
2. Terminology and Abbreviations 💜
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖. These are the official requirement words, so yes, they matter 🫡.
General mobility terminology lives in [RFC3753] 🌈. The following extra terms are either borrowed from [RFC4640] or [RFC5026], or introduced in this document 🧚:
Access Service Authorizer (ASA): A network operator that authenticates an MN and establishes the MN's authorization to receive Internet service 🔐.
Access Service Provider (ASP): A network operator that provides direct IP packet-forwarding to and from the MN 📦.
Mobility Service Authorizer (MSA): A service provider that authorizes MIPv6 service 🪪.
Mobility Service Provider (MSP): A service provider that provides MIPv6 service. To get that service, the MN must be authenticated and authorized to do so 🎟️.
Split Scenario: A scenario where the mobility service and the network access service are authorized by different entities 🙃.
Integrated Scenario: A scenario where the mobility service and the network access service are authorized by the same entity 🥰.
Network Access Server (NAS): A device that provides an access service for a user to a network 🛜.
Home AAA (HAAA): An Authentication, Authorization, and Accounting server located in the user's home network, i.e., in the home realm 🏠.
Local AAA (LAAA): An Authentication, Authorization, and Accounting proxy located in the local (ASP) network 📍.
Visited AAA (VAAA): An Authentication, Authorization, and Accounting proxy located in a visited network, i.e., in the visited realm. In a roaming case, the local Diameter proxy has the VAAA role (see Figure 1) ✈️.
3. Overview 🧭
this section is about the AAA functionality needed for the MIPv6 bootstrapping solutions outlined in [RFC4640], and it zooms in on the Diameter-based AAA functionality for NAS-to-HAAA (home AAA) server communication 💖.
in the integrated scenario, MIPv6 bootstrapping happens as part of the network access authentication procedure 🫶. Here's the cast of characters in Figure 1 👑:
+---------------------------+ +-----------------+
|Access Service Provider | |ASA/MSA/(MSP) |
|(Mobility Service Provider)| | |
| | | |
| +--------+ | | +--------+ |
| |Local | Diameter | | |Home | |
| |Diameter|<---------------------->|Diameter| |
| |Proxy | (*) | | |Server | |
| +--------+ | | +--------+ |
| ^ ^ | | ^ |
| | | | | |(+) |
| | | | | | |
| Diameter | | v |
| | |(+) +-------+ | | +-------+ |
| | | |Home | | | |Home | |
| | +-------->|Agent | | | |Agent | |
| (*)| |in ASP | | | |in MSP | |
| v +-------+ | | +-------+ |
+-------+ IEEE | +-----------+ +-------+ | +-----------------+
|Mobile | 802.1X | |NAS/Relay | |DHCPv6 | |
|Node |------------|Diameter |---|Server | |
| | PANA, | |Client |(+)| | |
+-------+ IKEv2, | +-----------+ +-------+ |
DHCP,... +---------------------------+
(+)
Legend:
(*): Functionality in scope of this specification.
(+): Extensions described in other documents.
Figure 1: Mobile IPv6 Bootstrapping in the Integrated Scenarioso in a typical MIPv6 access scenario, an MN is attached to an ASP's network 🛰️. While the network attachment is happening, the MN talks to the NAS/Diameter client, and then that client talks to the Diameter server over the NAS-to-HAAA interface 💬.
when the Diameter server handles authentication and authorization for network access, it also figures out whether the user is authorized for MIPv6 service 🕵️♀️. Based on that MIPv6 service authorization and the user's policy profile, the Diameter server may send several MIPv6 bootstrapping-related parameters back to the NAS 🎁. The NAS-to-HAAA interface in this doc is not tied to the Dynamic Host Configuration Protocol for IPv6 (DHCPv6) as the only way to pass MIPv6-related config from the NAS/Diameter client to the mobile node 🙌.
this spec covers bootstrapping the MIPv6 HA info and possibly assigning the home link prefix, but it does NOT cover how the Security Association (SA) between the MN and the HA gets created 🚫. That SA creation or use happens after the procedures in this spec, so it's out of scope, bestie 💀.
4. Commands, Attribute-Value Pairs, and Advertising Application Support 🎀
4.1. Advertising Application Support 🎀
okay so this doc doesn't create a brand new application 🙅♀️ BUT it does define a bunch of attribute-value pairs (AVPs) used on the interface between the NAS and the HAAA for the integrated MIPv6 bootstrapping scenario 🦋. these AVPs can be used with any present and future Diameter applications, where permitted by the command ABNF ✨. the examples in the following sections that use existing applications and their commands are purely for info 💅. the examples in this doc reuse the Extensible Authentication Protocol (EAP) [RFC4072] application and its commands 🫶
4.2. Attribute-Value Pair Definitions 💖
4.2.1. MIP6-Agent-Info AVP 🔥
bestie, the MIP6-Agent-Info AVP (AVP code 486) is Grouped type 🍓 and holds everything needed to assign an HA to the MN 🧚. when it shows up in a message, it MUST contain either the MIP-Home-Agent-Address AVP, the MIP-Home-Agent-Host AVP, or both 💜. the grouped AVP has this modified ABNF (as defined in [RFC3588]):
MIP6-Agent-Info ::= < AVP-Header: 486 >
*2[ MIP-Home-Agent-Address ]
[ MIP-Home-Agent-Host ]
[ MIP6-Home-Link-Prefix ]
* [ AVP ]so if both the MIP-Home-Agent-Address and MIP-Home-Agent-Host AVPs are in the MIP6-Agent-Info, the MIP-Home-Agent-Address SHOULD have a precedence over the MIP-Home-Agent-Host 👑. the reason is that the address points to one specific home agent, whereas the host can point to a whole group of HAs living in the same realm 🌸. a Diameter client or agent may use the MIP-Home-Agent-Host AVP, for instance, to find out which realm the HA is in 🗺️
the ABNF lets you return up to two MIPv6 HA addresses 🦋. this is super useful when the HA has both IPv6 and IPv4 addresses, especially for Dual Stack Mobile IPv6 (DSMIPv6) deployment scenarios [DSMIPv6] ✨
the MIP6-Agent-Info AVP MAY also be attached by the NAS or by the intermediating Diameter proxies in a request message when sent to the Diameter server, as a hint of a locally assigned HA 💅. it MAY also be attached by the intermediating Diameter proxies in a reply message from the Diameter server, if locally assigned HAs are authorized by the Diameter server 🫶. there MAY be multiple instances of the MIP6-Agent-Info AVP in Diameter messages, for example when the NAS gets HA info from an MN's home network AND locally allocated HA info from the visited network 🌈. see Section 4.2.5 for further discussion on possible scenarios 🧚
4.2.2. MIP-Home-Agent-Address AVP 🏠
the MIP-Home-Agent-Address AVP (AVP Code 334 [RFC4004]) is Address type and holds the IPv6 or IPv4 address of the MIPv6 HA 📍. the Diameter server MAY decide to assign an HA to the MN that's close to the point of attachment (for example, determined by the NAS-Identifier AVP) 🗺️. there may be other reasons for dynamically assigning HAs to the MN, for example, to share the traffic load 🚦
4.2.3. MIP-Home-Agent-Host AVP 🍓
the MIP-Home-Agent-Host AVP (AVP Code 348 [RFC4004]) is Grouped type and holds the identity of the assigned MIPv6 HA 🪪. both the Destination-Realm and the Destination-Host AVPs of the HA are included in the grouped AVP. using it is equivalent to the MIP-Home-Agent-Address AVP, but it adds an extra level of indirection by using the DNS infrastructure 🌐. the Destination-Host AVP is used to identify an HA, and the Destination-Realm AVP is used to identify the realm where the HA is located 💜
depending on the actual deployment and DNS configuration, the Destination-Host AVP MAY represent one or more home agents 🧁. It is RECOMMENDED that the Destination-Host AVP identifies exactly one HA 💖
It is RECOMMENDED that the MIP-Home-Agent-Host AVP is always included in the MIP6-Agent-Info AVP 🫶. that way, the HA can be associated with the corresponding realm of the Diameter entity that added the MIP6-Agent-Info AVP, using the Destination-Realm AVP, which is included in the MIP-Home-Agent-Host AVP 🌸
4.2.4. MIP6-Home-Link-Prefix AVP 🌷
the MIP6-Home-Link-Prefix AVP (AVP Code 125) is OctetString type and holds the Mobile IPv6 home network prefix information in network byte order 🔢. the home network prefix MUST be encoded as the 8-bit prefix length information (one octet), followed by the 128-bit field (16 octets) for the available home network prefix. the trailing bits of the IPv6 prefix after the prefix length bits MUST be set to zero (e.g., if the prefix length is 60, then the remaining 68 bits MUST be set to zero) 🙈
the HAAA MAY act as a central entity managing prefixes for MNs 👑. in this case, the HAAA returns the prefix allocated to the MN to the NAS. the NAS/ASP then delivers the home link prefix to the MN using, e.g., mechanisms described in [INTEGRATED] 📬. the NAS/ASP MAY propose to the HAAA a specific prefix to allocate to the MN by including the MIP6-Home-Link-Prefix AVP in the request message 💡. however, the HAAA MAY override the prefix allocation hint proposed by the NAS/ASP and return a different prefix in the response message 🙃
4.2.5. MIP6-Feature-Vector AVP 🎯
the MIP6-Feature-Vector AVP (AVP Code 124) is Unsigned64 type and holds a 64-bit flags field of supported capabilities of the NAS/ASP ✨. sending and receiving the MIP6-Feature-Vector AVP with value 0 MUST be supported, although that doesn't tell you much about the specific needs of bootstrapping 🥱
the NAS MAY include this AVP to indicate capabilities of the NAS/ASP to the Diameter server 🧩. for example, the NAS may indicate that a local HA can be provided. similarly, the Diameter server MAY include this AVP to inform the NAS/ASP about which of the NAS/ASP indicated capabilities are supported or authorized by the ASA/MSA(/MSP) 🫶
the following capabilities are defined in this document 🌈
MIP6_INTEGRATED (0x0000000000000001)
when this flag is set by the NAS, it means the Mobile IPv6 integrated scenario bootstrapping functionality is supported by the NAS. when this flag is set by the Diameter server, the Mobile IPv6 integrated scenario bootstrapping is supported by the Diameter server 💖
LOCAL_HOME_AGENT_ASSIGNMENT (0x0000000000000002)
when this flag is set in the request message, a local home agent outside the home realm is requested and may be assigned to the MN 🏡. when this flag is set by the Diameter server in the answer message, the assignment of local HAs is authorized by the Diameter server ✅
a local HA may be assigned by the NAS, LAAA, or VAAA, depending on the network architecture and the deployment 🏗️
the following examples show how the LOCAL_HOME_AGENT_ASSIGNMENT capability (referred to as LOCAL-bit in the examples) and the MIP-Agent-Info AVP (referred to as HA-Info in the examples) are used to assign HAs, either a local HA (L-HA) or a home network HA (H-HA). below are examples of request message combinations as seen by the HAAA 🔍
LOCAL-bit HA-Info Meaning
0 - ASP or [LV]AAA is not able to assign an L-HA.
0 L-HA Same as above. HA-Info must be ignored.
1 - ASP or [LV]AAA can/wishes to assign an L-HA.
1 L-HA Same as above but the ASP or [LV]AAA also
provides a hint of the assigned L-HA.the same as above, but for answer message combinations as seen by the NAS 💅
LOCAL-bit HA-Info Meaning
0 - No HA assignment allowed for HAAA or [LV]AAA.
0 H-HA L-HA is not allowed. HAAA assigns an H-HA.
1 - L-HA is allowed. No HAAA- or [LV]AAA-assigned HA.
1 L-HA L-HA is allowed. [LV]AAA also assigns an L-HA.
1 H-HA L-HA is allowed. HAAA also assigns an HA.
1 H-HA L-HA is allowed. HAAA assigns an H-HA and
+ L-HA [LV]AAA also assigns an L-HA.an NAS should expect to receive multiple MIP6-Agent-Info AVPs 📨
5. Examples 🎬
5.1. Home Agent Assignment by the NAS 🏠
in this scenario, we look at the case where the NAS wants to allocate a local HA to the MN 🙌. the NAS will also let the Diameter server know about the HA address it has assigned to the visiting MN (e.g., 2001:db8:1:c020::1). so the Diameter-EAP-Request message has the MIP6-Feature-Vector with the LOCAL_HOME_AGENT_ASSIGNMENT and the MIP6_INTEGRATED flags set. the MIP6-Agent-Info AVP contains the MIP-Home-Agent-Address AVP with the address of the proposed HA 🧚
Diameter
NAS/VAAA Server
| |
| Diameter-EAP-Request |
| MIP6-Feature-Vector=(LOCAL_HOME_AGENT_ASSIGNMENT |
| | MIP6_INTEGRATED) |
| MIP6-Agent-Info{ |
| MIP-Home-Agent-Address(2001:db8:1:c020::1)} |
| } |
| Auth-Request-Type=AUTHORIZE_AUTHENTICATE |
| EAP-Payload(EAP Start) |
|---------------------------------------------------------------->|
| |
| |
: ...more EAP Request/Response pairs... :
| |
| |
| Diameter-EAP-Answer |
| MIP6-Feature-Vector=(LOCAL_HOME_AGENT_ASSIGNMENT |
| | MIP6_INTEGRATED) |
| Result-Code=DIAMETER_SUCCESS |
| EAP-Payload(EAP Success) |
| EAP-Master-Session-Key |
| (authorization AVPs) |
| ... |
|<----------------------------------------------------------------|
| |Figure 2: Home Agent Assignment by the NAS 📊
depending on the Diameter server's configuration and the user's subscription profile, the Diameter server either accepts or rejects the local HA allocated by the NAS 🤔. in our example, the Diameter server accepts the proposal, so the MIP6-Feature-Vector AVP with the LOCAL_HOME_AGENT_ASSIGNMENT flag (together with the MIP6_INTEGRATED flag) is set and returned to the NAS 🎉
5.2. Home Agent Assignment by the Diameter Server 🌸
okay so in this scenario, the NAS supports the Diameter MIPv6 integrated scenario from this document, but it does not offer local HA assignment 🙅♀️ so the MIP6-Feature-Vector AVP only has the MIP6_INTEGRATED flag set. The Diameter server gives the mobile node an HA and sends the address back in the MIP-Home-Agent-Address AVP, which is wrapped up inside the MIP6-Agent-Info AVP. On top of that, the MIP6-Feature-Vector AVP has the MIP6_INTEGRATED flag set too ✨
Diameter
NAS Server
| |
| Diameter-EAP-Request |
| MIP6-Feature-Vector=(MIP6_INTEGRATED) |
| Auth-Request-Type=AUTHORIZE_AUTHENTICATE |
| EAP-Payload(EAP Start) |
|---------------------------------------------------------------->|
| |
| |
: ...more EAP Request/Response pairs... :
| |
| |
| Diameter-EAP-Answer |
| MIP6-Agent-Info{ |
| MIP-Home-Agent-Address(2001:db8:6000:302::1) |
| } |
| MIP6-Feature-Vector=(MIP6_INTEGRATED) |
| Result-Code=DIAMETER_SUCCESS |
| EAP-Payload(EAP Success) |
| EAP-Master-Session-Key |
| (authorization AVPs) |
| ... |
|<----------------------------------------------------------------|
| |
Figure 3: Home Agent Assignment by the Diameter Server5.3. Home Agent Assignment by the NAS or Diameter Server 🦋
this section shows a different message flow for the MIPv6 integrated scenario bootstrapping 💫 here the NAS tells the Diameter server that it's able to locally assign an HA to the MN. The Diameter server can give the MN an HA too, but it also authorizes the local HA assignment. Then the Diameter server replies to the NAS with HA-related bootstrapping information.
In this example, whether the NAS/ASP offers the locally assigned HA or the Diameter-server-assigned HA to the MN is based on the local ASP policy. It's giving local policy decides 🫶
Diameter
NAS/VAAA Server
| |
| Diameter-EAP-Request |
| MIP6-Feature-Vector=(LOCAL_HOME_AGENT_ASSIGNMENT |
| | MIP6_INTEGRATED) |
| MIP6-Agent-Info{ |
| MIP-Home-Agent-Address(2001:db8:1:c020::1)} |
| } |
| Auth-Request-Type=AUTHORIZE_AUTHENTICATE |
| EAP-Payload(EAP Start) |
|---------------------------------------------------------------->|
| |
| |
: ...more EAP Request/Response pairs... :
| |
| |
| Diameter-EAP-Answer |
| MIP6-Agent-Info{ |
| MIP-Home-Agent-Address(2001:db8:6000:302::1)} |
| MIP6-Feature-Vector=(LOCAL_HOME_AGENT_ASSIGNMENT |
| | MIP6_INTEGRATED) |
| Result-Code=DIAMETER_SUCCESS |
| EAP-Payload(EAP Success) |
| EAP-Master-Session-Key |
| (authorization AVPs) |
| ... |
|<----------------------------------------------------------------|
| |
Figure 4: Home Agent Assignment by the NAS or Diameter ServerIf the Diameter server doesn't let the MN use a locally assigned HA, it sends the MN back the MIP6-Feature-Vector AVP with the LOCAL_HOME_AGENT_ASSIGNMENT bit unset, plus the HA address it allocated 🎀 bestie, that's the plot twist 😭
6. Attribute-Value Pair Occurrence Tables 📋
Figure 5 is the cheat sheet 🍓 It lists the MIPv6 bootstrapping NAS-to-HAAA interface AVPs, along with how many of each new AVP can show up in a Diameter command. They may be present in any Diameter application request and answer commands, as long as the command ABNF allows it.
+-----------+
| Command |
|-----+-----+
Attribute Name | Req | Ans |
-------------------------------|-----+-----|
MIP6-Agent-Info | 0+ | 0+ |
MIP6-Feature-Vector | 0-1 | 0-1 |
+-----+-----+
Figure 5: Generic Request and Answer Commands AVP Table7. IANA Considerations 🧚
7.1. Registration of New AVPs 💜
this spec defines the following AVPs, which get allocated from a normal Diameter AVP Code space (values >= 256):
MIP6-Agent-Info is set to 486The following new AVPs are going to be allocated from the RADIUS Attribute Type space [RFC2865], so they're RADIUS backward-compatible (AVP Code values between 0-255) 🥹
MIP6-Feature-Vector is set to 124
MIP6-Home-Link-Prefix is set to 1257.2. New Registry: Mobility Capability 🌈
IANA has made a new registry for the Mobility Capability, as described in Section 4.2.5. Here's what's in it right now:
Token | Value | Description
----------------------------------+---------------------+------------
MIP6_INTEGRATED | 0x0000000000000001 | [RFC5447]
LOCAL_HOME_AGENT_ASSIGNMENT | 0x0000000000000002 | [RFC5447]
Available for Assignment via IANA | 2^x |Allocation rule: only numeric values that are 2^x (power of two, where x >= 2) are allowed, based on the allocation policy described below. Main character energy, the rules are strict 💅
Following the example policies described in [RFC5226], new values for the Mobility Capability Registry get assigned based on the "Specification Required" policy. No mechanism to mark entries as "deprecated" is envisioned, so nothing gets quietly retired 👀
8. Security Considerations 🔐
The security considerations for the Diameter interaction needed to pull off the integrated scenario are described in [INTEGRATED]. On top of that, the security considerations for the Diameter base protocol [RFC3588], the Diameter NASREQ application [RFC4005], and the Diameter EAP application (with respect to network access authentication and the transport of keying material) [RFC4072] all apply to this document. Developers should insure that special attention is paid to configuring the security associations that protect the messages enabling the global positioning and allocation of home agents, for instance, as outlined in Section 5. This part is serious, bestie 😭⚠️
Furthermore, the Diameter messages may be transported between the NAS and the Diameter server via one or more AAA brokers or Diameter agents (such as proxies). In this case, the AAA communication from the NAS to the Diameter server relies on the security properties of the intermediate AAA brokers and Diameter agents. So the trust chain is only as strong as its weakest broker 💀
9. Acknowledgments 💖
This document is heavily based on the ongoing work for RADIUS MIPv6 interaction, so credit goes to the respective authors for their work with "RADIUS Mobile IPv6 Support" (November 2008). The authors of this document also want to thank the authors of "Diameter Mobile IPv6 Application" (November 2004) -- Franck Le, Basavaraj Patil, Charles E. Perkins, and Stefano Faccin -- for their work in the context of MIPv6 Diameter interworking. Their work influenced this document 🙌 Jouni Korhonen would like to thank the Academy of Finland and TEKES MERCoNe Project for providing funding to work on this document while he was with TeliaSonera. Julien Bournelle would like to thank GET/INT, since he began to work on this document while he was in their employ. The authors would also like to acknowledge Raymond Hsu for his valuable feedback on local HA assignment and Wolfgang Fritsche for his thorough review. Additionally, we would like to thank Domagoj Premec for his review comments.
Finally, we would like to thank Alper Yegin, Robert Marks, and David Frascone for their comments at the second WG Last Call 🫶✨
10. References 📚
10.1. Normative References 🔗
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and
J. Arkko, "Diameter Base Protocol", RFC 3588,
September 2003.
[RFC3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility
Support in IPv6", RFC 3775, June 2004.
[RFC4004] Calhoun, P., Johansson, T., Perkins, C., Hiller, T.,
and P. McCann, "Diameter Mobile IPv4 Application",
RFC 4004, August 2005.
[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
"Diameter Network Access Server Application", RFC 4005,
August 2005.
[RFC4072] Eronen, P., Hiller, T., and G. Zorn, "Diameter
Extensible Authentication Protocol (EAP) Application",
RFC 4072, August 2005.10.2. Informative References ✨
okay so these are the informative refs, meaning the extra reading that backs up the spec but doesn't set any rules 📚 some of these are still works in progress, which is very much a vibe, and the rest are the official RFCs that define the terms and the setup. no cap, they're all worth a look 💖
[AAA] Giaretta, G., Guardini, I., Demaria, E., Bournelle, J.,
and R. Lopez, "AAA Goals for Mobile IPv6", Work
in Progress, May 2008.
[DSMIPv6] Solimand, H., "Mobile IPv6 Support for Dual Stack Hosts
and Routers (DSMIPv6)", Work in Progress,
December 2008.
[INTEGRATED] Chowdhury, K. and A. Yegin, "MIP6-bootstrapping for the
Integrated Scenario", Work in Progress, April 2008.
[RFC3753] Manner, J. and M. Kojo, "Mobility Related Terminology",
RFC 3753, June 2004.
[RFC4640] Patel, A. and G. Giaretta, "Problem Statement for
bootstrapping Mobile IPv6 (MIPv6)", RFC 4640,
September 2006.
[RFC5026] Giaretta, G., Kempf, J., and V. Devarapalli, "Mobile
IPv6 Bootstrapping in Split Scenario", RFC 5026,
October 2007.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing
an IANA Considerations Section in RFCs", BCP 26,
RFC 5226, May 2008.Authors' Addresses 🫶
okay and here's who made this whole thing happen, the people behind the spec! 🎀 contact details are below, bestie, so you can reach out 💌
Jouni Korhonen (editor)
Nokia Siemens Networks
Linnoitustie 6
Espoo FIN-02600
Finland
EMail: jouni.nospam@gmail.com
Julien Bournelle
Orange Labs
38-4O rue du general Leclerc
Issy-Les-Moulineaux 92794
France
EMail: julien.bournelle@orange-ftgroup.com
Hannes Tschofenig
Nokia Siemens Networks
Linnoitustie 6
Espoo 02600
Finland
EMail: Hannes.Tschofenig@nsn.com
URI: http://www.tschofenig.priv.at
Charles E. Perkins
WiChorus Inc.
3590 North First St., Suite 300
San Jose, CA 95134
US
EMail: charliep@wichorus.com
Kuntal Chowdhury
Starent Networks
30 International Place
Tewksbury, MA 01876
US
EMail: kchowdhury@starentnetworks.comthat's the whole doc, babe!! 💖✨🦋
📦 where this page comes from
- ietf: rfc5447 2009-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms