RFC 6611
Mobile IPv6 (MIPv6) Bootstrapping for the Integrated Scenario
Mobile IPv6 (MIPv6) Bootstrapping for the Integrated Scenario 🎀
Okay bestie, this one is RFC 6611 🦋 It's a Standards Track document from the IETF, published May 2012 (ISSN 2070-1721). K. Chowdhury (editor) from Radio Mobile Access, Inc. and A. Yegin from Samsung wrote it. The title block doesn't list any Obsoletes or Updates entries, so it doesn't replace or change anything else. Part 1 covers the abstract, the status and copyright stuff, the TOC, and sections 1 through 3, then we get to the solution overview 🌸
Abstract 💅
Mobile IPv6 bootstrapping comes in two main flavors: the split scenario and the integrated scenario. In the split scenario, the mobile node's mobility service gets authorized by a different service authorizer than the one handling its network access. In the integrated scenario, the same service authorizer handles both the mobility service and the network access service, which is giving simplicity 😌 This document defines a method for home agent information discovery in the integrated scenario.
Status of This Memo 📜
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.
Info about the current status of this document, any errata, and how to send feedback can be found at http://www.rfc-editor.org/info/rfc6611 ✨
Copyright Notice 🔐
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please read these carefully, because they spell out your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people controlling the copyright in some of this material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The only exceptions are formatting it for publication as an RFC or translating it into languages other than English 🌈
Table of Contents 🗂️
1. Introduction and Scope ..........................................2
2. Terminology .....................................................3
3. Assumptions and Conformance .....................................4
4. Solution Overview ...............................................5
4.1. Logical View of the Integrated Scenario ....................5
4.2. Bootstrapping Message Sequence .............................6
4.2.1. Home Agent Allocation in the MSP ....................7
4.2.2. Home Agent Allocation in the ASP ....................9
4.3. Bootstrapping Message Sequence: Fallback Case .............10
4.4. HoA and IKEv2 SA Bootstrapping in the Integrated
Scenario ..................................................10
5. Security Considerations ........................................10
6. Acknowledgements ...............................................11
7. Contributors ...................................................11
8. References .....................................................11
8.1. Normative References ......................................11
8.2. Informative References ....................................121. Introduction and Scope 🧚
Okay so the Mobile IPv6 protocol [RFC6275] needs the mobile node to have three things:
- the Home Address (HoA),
- the home agent address, and
- the cryptographic materials for setting up an IPsec security association with the home agent.
The cryptographic materials have to be set up before the registration process starts. The way the mobile node gets this info is called "Mobile IPv6 bootstrapping" 🫶 To allow a flexible deployment model for Mobile IPv6, it's really useful to have a bootstrapping mechanism where the mobile node can grab these parameters dynamically. [RFC4640] describes the problem statement for Mobile IPv6 bootstrapping, and it also defines the bootstrapping scenarios. Those are based on the relationship between the entity that authenticates and authorizes the mobile node for network access (the Access Service Authorizer, ASA) and the entity that authenticates and authorizes the mobile node for mobility service (the Mobility Service Authorizer, MSA). When the ASA is not the MSA, that's the "split" scenario, and its bootstrapping solution is defined in [RFC5026]. When the ASA is also the MSA, that's the "integrated" scenario, and this document is the one that defines a bootstrapping solution for it 💖
[RFC5026] breaks the bootstrapping problem into four components: home agent address discovery, HoA assignment, IPsec Security Association [RFC4301] setup, and Authentication and Authorization with the MSA. This document only defines a mechanism for home agent address discovery. The other components of bootstrapping work as per [RFC5026].
In the integrated scenario, you can get the home agent information through DHCPv6. This document defines the MIPv6 bootstrapping procedures for the integrated scenario. It makes home agent assignment possible in the integrated scenario by using DHCP and Authentication, Authorization, and Accounting (AAA) protocols. The spec uses DHCP and AAA options and attribute-value pairs (AVPs) that are defined in [RFC6610] and [RFC5447]. It also lays out how the Mobile Node (MN), Network Access Server (NAS), DHCP, and AAA entities work together during the bootstrapping procedure in the integrated scenario 🌸
2. Terminology 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
General mobility terminology lives in [RFC3753]. These extra terms, from [RFC4640], are also used in this document:
Access Service Authorizer (ASA): A network operator that authenticates a mobile node and establishes the mobile node's authorization to receive Internet service.
Access Service Provider (ASP): A network operator that provides direct IP packet forwarding to and from the mobile node.
Mobility Service Authorizer (MSA): A service provider that authorizes Mobile IPv6 service.
Mobility Service Provider (MSP): A service provider that provides Mobile IPv6 service. An MSP is called a "home MSP" when MSP == MSA. In this document, the term MSP means a Mobility Service Provider that has a roaming relationship with the MSA but is not the MSA itself 🍓
Split Scenario: A scenario where the mobility service and the network access service are authorized by different entities.
Integrated Scenario: A scenario where the mobility service and the network access service are authorized by the same entity.
3. Assumptions and Conformance 🎀
The following assumptions are made in this document:
(a) MSA == ASA.
(b) MSA and MSP have a roaming relationship.
(c) DHCP relay and NAS are either co-located or there is a mechanism to transfer received AAA information from the NAS to the DHCP relay.
Note: If assignment of a home agent in the home MSP is not required by a deployment, co-location of the NAS and the DHCP relay functions or a mechanism to transfer received AAA information from the NAS to the DHCP relay won't be necessary. In such a case, only the implementation of the options and procedures defined in [RFC6610] should suffice.
(d) The NAS SHALL support MIPv6-specific AAA attributes as specified in [RFC5447].
(e) The AAA server in the home domain (AAAH) used for network access authentication (ASA) has access to the same database as the AAAH used for the mobility service authentication (MSA).
If home agent assignment is required only in the ASP by the deployment, a minimal implementation of this specification MAY only support the delivery of information from the DHCP server to the DHCP client through [RFC6610]. However, if home agent assignment in the MSP is required by the deployment, an implementation conforming to this specification SHALL be able to transfer the information received from the AAA server to the NAS, and from the NAS to the DHCP relay function. This can be achieved either by co-locating the NAS and the DHCP relay functions or via an interface between these functions. The details of this interface are out of the scope of this specification 🦋
4. Solution Overview ✨
4.1. Logical View of the Integrated Scenario ✨
okay so in the integrated scenario, the mobile node (MN) uses the network access authentication process to bootstrap Mobile IPv6 🦋 the access service authorizer is assumed to be mobility service aware, which is what lets Mobile IPv6 bootstrapping happen right when access authentication and authorization happen 💅 this mechanism also needs the NAS to support MIP6-specific AAA attributes, plus a co-located DHCP relay agent 🫶
Figure 1 is the whole setup: an AAA client (NAS), an AAA proxy in the visited network (AAAV), and an AAA server in the home network (AAAH) 🌸
|
ASP(/MSP) | ASA/MSA(/MSP)
|
|
+-------+ | +-------+
| | | | |
|AAAV |-----------|--------|AAAH |
| | | | |
+-------+ | +-------+
| |
| |
| |
| |
+-----+ +------+ |
+----+ | NAS/| |DHCP | |
| MN |------|DHCP |----|Server| |
+----+ |Relay| | | |
+-----+ +------+ |
|
|
+--------+ | +--------+
| HA | | | HA |
| in ASP | | |in MSP |
+--------+ | +--------+Figure 1: Integrated Scenario, Network Diagram with DHCP Server 🎀
The user's home network authorizes the mobile node for both network access and mobility services 👑 also, the home agent for the mobile node might be picked in the access service provider's network, or in the mobility service provider's network. your call, bestie 🧚
The MSP can be co-located with the ASP, or with the ASA/MSA, or be totally independent of both 🍓
After network access authentication, the mobile node talks to the DHCP server through the relay agent as part of its configuration procedure 💜
4.2. Bootstrapping Message Sequence 🌈
so in this case, the mobile node can get the home agent address through a DHCPv6 query 🙈 in the integrated scenario, the ASA and the MSA are literally the same thing, so it's totally safe to assume that the AAAH used for network access authentication (ASA) can see the same database as the AAAH used for mobility service authentication (MSA) 🧚 which means one AAAH can authorize the mobile node for network access and mobility service at the same time 🔥 when the MN does its Mobile IPv6 registration, the AAAH makes sure the MN is hitting the home agent that was assigned to it for that MSP 💅
Figure 2 shows the message sequence for home agent allocation in both scenarios: HA in the ASP (which is co-located with the MSP), or HA in an MSP that's separate from the ASP and maybe separate from the ASA/MSA too ✨
|
--------------ASP------>|<--ASA+MSA--
|
+----+ +------+ +-------+ +-----+
| | | | | | | |
| MN/| |NAS/ | | DHCP | |AAAH |
|User| |DHCP | | Server| | |
| | |relay | | | | |
+----+ +------+ +-------+ +-----+
| | | |
| 1 | 1 | |
|<------------->|<---------------------->|
| | | |
| | | |
| 2 | | |
|-------------->| | |
| | | |
| | 3 | |
| |------------>| |
| | | |
| | 4 | |
| |<------------| |
| | | |
| 5 | | |
|<--------------| | |
| | | |Figure 2: Message Sequence for Home Agent Allocation 🦋
4.2.1. Home Agent Allocation in the MSP 💖
this one is for when the home agent gets allocated in the mobile node's MSP network(s), and those aren't co-located with the ASP 🌸 to tell the mobile node about the home agent it was given, the AAAH passes that info to the NAS over a AAA protocol, like [RFC5447] 💅
Figure 2 shows the message sequence for home agent allocation. For HA in the MSP, here's the tea:
- The mobile node runs the network access authentication procedure (for example, IEEE 802.11i/802.1X) and talks to the NAS 🫶 the NAS is in the ASP and talks to the AAAH (which lives in the ASA/MSA) to authenticate the mobile node. while authorizing the mobile node, the AAAH checks the AAA profile to see if the mobile node is allowed to use the Mobile IPv6 service ✨ the AAAH assigns a home agent in the home MSP, assigns one or more home agents in other authorized MSPs, and sends all of that back to the NAS 💜 the NAS can hold onto that info for a configurable amount of time, or keep it for as long as the MN is connected to the NAS 🎀
- The mobile node sends a DHCPv6 Information-request message [RFC3315] to the All_DHCP_Relay_Agents_and_Servers multicast address 🧚 in this message, the mobile node (DHCP client) SHALL include the following:
- the Option Code for the Visited Home Network Information option [RFC6610] in the OPTION_ORO.
- Client Home Network ID FQDN option identifying the MSP.
- the OPTION_CLIENTID to identify itself to the DHCP server.
- The relay agent intercepts the Information Request from the mobile node and forwards it to the DHCP server 🍓 the relay agent also puts the home agent info it got from the AAAH into the Relay-Supplied Options option [RFC6610] 🌈 if a NAS implementation doesn't store the received info for as long as the MN's session stays in the ASP, and the MN waits a while before sending a DHCP request, then the NAS/DHCP relay does NOT include the Relay-Supplied Options option in the Relay Forward message 🙈
- The DHCP server does a few things 💅
- it identifies the client by looking at the DHCP Unique Identifier (DUID) for the client in the OPTION_CLIENTID.
- it figures out that the mobile node wants home agent info in the MSP by checking the Home Network ID FQDN option.
- it figures out that the home agent was allocated by the AAAH by checking the Relay-Supplied Options option.
- it pulls the allocated home agent info out of the Relay-Supplied Options option and puts it in the Identified Home Network Information option [RFC6610] in the Reply Message. if the requested info isn't available on the DHCP server, it follows the behavior described in [RFC6610] 🔥
- The relay agent relays the Reply Message from the DHCP server to the mobile node 👑 at this point, the mobile node has the home agent info it asked for, iconic 🦋
4.2.2. Home Agent Allocation in the ASP 🌸
this section covers when the mobile node asks for a home agent allocation in the ASP, by setting the id-type field to zero in the Home Network Identifier Option [RFC6610] in the DHCPv6 request message 💜 in this setup, the ASP becomes the MSP for the length of the network access authentication session 🧚
Figure 2 shows the message sequence for home agent allocation. For HA in the ASP, the details go like this:
- The mobile node runs the network access authentication procedure (for example, IEEE 802.11i/802.1X) and talks to the NAS 🫶 the NAS is in the ASP and talks to the AAAH (in the ASA/MSA) to authenticate the mobile node. while authorizing the mobile node, the AAAH checks the AAA profile to see if the mobile node is allowed to use the Mobile IPv6 services ✨ the AAAH assigns a home agent in the home MSP, assigns one or more home agents in other authorized MSPs, and sends that info back to the NAS 💅 heads up, the AAAH doesn't know the mobile node prefers a home agent allocation in the ASP 🙈 so the assigned home agent might not get used by the mobile node 🍓 this leaves the decision about where the mobility anchor point goes up to the mobile node 🫶
- The mobile node sends a DHCPv6 Information Request message [RFC3315] to the All_DHCP_Relay_Agents_and_Servers multicast address 🧚 in this message, the mobile node (DHCP client) SHALL include the following:
- the Option Code for the Home Network Identifier Option [RFC6610] in the OPTION_ORO.
- the OPTION_CLIENTID to identify itself to the DHCP server.
- The relay agent (which is the NAS) intercepts the Information Request from the mobile node and forwards it to the DHCP server 💖 the relay agent also puts the received AAA AVP from the AAAH into the Relay-Supplied Options option [RFC6610] 🌈
- The DHCP server identifies the client by looking at the DUID for the client in the OPTION_CLIENTID 🔥 the DHCP server also figures out that the mobile node wants home agent info in the ASP by checking the Visited Home Network Information option 💅 if it's set up to do that, the DHCP server allocates a home agent from its configured list of home agents and puts it in the Visited Home Network Information Option [RFC6610] in the Reply Message 👑 note that in this case, the DHCP server does NOT use the info in the Relay-Supplied Options option 🦋
- The relay agent relays the Reply Message from the DHCP server to the mobile node 🌸 at this point, the mobile node has the home agent info it requested, slay 💜
4.2.2 Wait, that heading is already used
(Ignore the line above. The 4.2.2 section above is the correct one. Sorry, bestie 🙈)
4.3. Bootstrapping Message Sequence: Fallback Case 🧚
in the fallback case, the mobile node can't get the home agent info through DHCPv6 😭 the mobile node MAY do DNS queries to find the home agent address, as defined in [RFC5026] 🌈 to do DNS-based home agent discovery, the mobile node needs to know the DNS server address 💅 how the MN gets configured with the DNS server address is outside the scope of this document 🫶
4.4. HoA and IKEv2 SA Bootstrapping in the Integrated Scenario 👑
in the integrated scenario, the HoA, the IPsec Security Association setup, and the Authentication and Authorization with the MSA all get bootstrapped through the same mechanism described in the bootstrapping solution for the split scenario [RFC5026] 💖 it's giving efficiency, periodt ✨
5. Security Considerations 🔐
okay bestie, this section is lowkey short but it's SERIOUS 😭 The info that gets handed from the AAA server down to the AAA client (the NAS) is only allowed to be integrity protected, using standard Diameter or other AAA protocol security stuff. 🫶 Nothing extra is added by this doc. The security mechanisms in [RFC3588] are the ones that apply here. And this doc does not introduce any new security issues to Mobile IPv6. Periodt 💅✨
6. Acknowledgements 🎀
the authors wanna give a big thank you to Kilian Weniger, Vidya Narayanan, and George Tsirtsis for reviewing and commenting 🫶 And a special shoutout to Alfred Hoenes for a super thorough review and tips that made the doc way more readable 💖
7. Contributors 🌈
this was a joint glow-up by the bootstrapping solution design team of the MEXT WG 👑 The contributors are Jari Arkko, Julien Bournelle, Kuntal Chowdhury, Vijay Devarapalli, Gopal Dommety, Gerardo Giaretta, Junghoon Jee, James Kempf, Alpesh Patel, Basavaraj Patil, Hannes Tschofenig, and Alper Yegin 🦋
The design team can be reached at these email addresses:
Jari Arkko jari.arkko@kolumbus.fi
Julien Bournelle julien.bournelle@orange-ftgroup.com
Kuntal Chowdhury kc@radiomobiles.com
Vijay Devarapalli Vijay.Devarapalli@AzaireNet.com
Gopal Dommety dommety@yahoo.com
Gerardo Giaretta gerardog@qualcomm.com
Junghoon Jee jhjee@etri.re.kr
James Kempf kempf@docomolabs-usa.com
Alpesh Patel alpesh@cisco.com
Basavaraj Patil basavaraj.patil@nsn.com
Hannes Tschofenig hannes.tschofenig@nsn.com
Alper Yegin alper.yegin@yegin.org8. References 📚
8.1. Normative References 💜
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and M. Carney, "Dynamic Host Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, July 2003.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
[RFC5026] Giaretta, G., Kempf, J., and V. Devarapalli, "Mobile IPv6
Bootstrapping in Split Scenario", RFC 5026, October 2007.
[RFC5447] Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C.,
and K. Chowdhury, "Diameter Mobile IPv6: Support for
Network Access Server to Diameter Server Interaction",
RFC 5447, February 2009.
[RFC6275] Perkins, C., Johnson, D., and J. Arkko, "Mobility Support
in IPv6", RFC 6275, July 2011.
[RFC6610] Jang, H., Yegin, A., Chowdhury, K., Choi, J., and T.
Lemon, "DHCP Option for Home Agent Discovery in Mobile
IPv6 (MIPv6)", RFC 6610, May 2012.8.2. Informative References 🦋
[RFC3753] Manner, J. and M. Kojo, "Mobility Related Terminology",
RFC 3753, June 2004.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, December 2005.
[RFC4640] Patel, A. and G. Giaretta, "Problem Statement for
bootstrapping Mobile IPv6 (MIPv6)", RFC 4640,
September 2006.Authors' Addresses 🎀
Kuntal Chowdhury (editor)
Radio Mobile Access, Inc.
100 Ames Pond Dr.
Tewksbury MA 01876
EMail: kc@radiomobiles.com
Alper Yegin
Samsung
Istanbul
Turkey
EMail: alper.yegin@yegin.org📦 where this page comes from
- ietf: rfc6611 2012-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms