Diameter Maintenance and J. Korhonen Extensions (DIME) Nokia Siemens Networks Internet-Draft June 10, 2009 Intended status: Informational Expires: December 12, 2009 Diameter MIP6 Feature Vector Additional Bit Allocations draft-korhonen-dime-mip6-feature-bits-01.txt Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on December 12, 2009. Copyright Notice Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Abstract During the Mobile IPv6 Split Scenario bootstrapping the Mobile IPv6 Home Agent and the Authentication, Authorization, and Accounting Korhonen Expires December 12, 2009 [Page 1] Internet-Draft Diameter MIP6 Feature Vector Bits June 2009 server may exchange a set of authorized mobility capabilities. This document defines new mobility capability flags that are used to authorize per Mobile Node route optimization, Multiple Care-of Address and user plane traffic encryption support. Furthermore, this document also defines a capability flag of indicating whether the Home Agent is authorized to act as a stand alone Virtual Private Network gateway. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Flag definitions for the MIP6-Feature-Vector AVP . . . . . . . 3 3.1. Route Optimization Support . . . . . . . . . . . . . . . . 3 3.2. Multiple Care-of Addresses Support . . . . . . . . . . . . 3 3.3. User Traffic Encryption Support . . . . . . . . . . . . . . 4 3.4. VPN Gateway Mode Support . . . . . . . . . . . . . . . . . 4 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4 5. Security Considerations . . . . . . . . . . . . . . . . . . . . 4 6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 5 6.1. Normative References . . . . . . . . . . . . . . . . . . . 5 6.2. Informative References . . . . . . . . . . . . . . . . . . 5 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 5 Korhonen Expires December 12, 2009 [Page 2] Internet-Draft Diameter MIP6 Feature Vector Bits June 2009 1. Introduction During the Mobile IPv6 [RFC3775] Split Scenario bootstrapping [RFC5026] the Mobile IPv6 Home Agent (HA) and the Authentication, Authorization, and Accounting (AAA) server MAY exchange a set of capabilities as defined in [I-D.ietf-dime-mip6-split]. This document defines additional capability flag bits that are used to authorize per Mobile Node (MN) route optimization, Multiple Care-of Address (MCoA) [I-D.ietf-monami6-multiplecoa] and user plane traffic encryption support. Furthermore, this document also defines a capability flag bit of indicating whether the HA is authorized to act as a stand alone IPsec Virtual Private Network (VPN) gateway for remote VPN clients. These new capability flag bits allow Mobility Service Provider (MSP) to control the supported services on the HA. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 3. Flag definitions for the MIP6-Feature-Vector AVP The MIP6-Feature-Vector AVP is defined in [RFC5447]. The new capability bits defined in this document are intended to be used between the HA and the AAA server during the Mobile IPv6 Split Scenario bootstrapping Diameter interactions [I-D.ietf-dime-mip6-split]. However, the defined flag bits MAY also be used in other scenarios and deployments outside the Mobile IPv6 Split Scenario. 3.1. Route Optimization Support Route optimization support is indicated by using the RO_SUPPORTED (value 0x0000000200000000) capability flag bit. When the HA sets this bit, it indicates support for the route optimization. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize route optimization for the MN. 3.2. Multiple Care-of Addresses Support Multiple Care-of Addresses (MCoA) [I-D.ietf-monami6-multiplecoa] support is indicated by using the MCOA_SUPPORTED (value 0x0000001000000000) capability flag bit. When the HA sets this bit, it indicates support for the MCoA. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize Korhonen Expires December 12, 2009 [Page 3] Internet-Draft Diameter MIP6 Feature Vector Bits June 2009 the use of MCoA for the MN. 3.3. User Traffic Encryption Support User plane traffic encryption support is indicated by using the USER_TRAFFIC_ENCRYPTION (value 0x0000000400000000) capability flag bit. When the HA sets this bit, it indicates support for the user plane traffic encryption between the MN and the HA. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize user plane traffic encryption because of subscription or operator policy. 3.4. VPN Gateway Mode Support The HA MAY act as a IPsec VPN gateway for the user and the support is indicated by the VPN_GW_MODE (value 0x0000000800000000) capability flag bit. When the HA sets this bit, it indicates support for acting as a standalone IPsec VPN gateway. If this bit is unset in the returned MIP6-Feature-Vector AVP, the AAA server does not authorize the HA to act as a standalone IPsec VPN gateway for the MN because of subscription or operator policy. 4. IANA Considerations This document defines new values to the "Mobility Capability" registry (see [RFC5447]) for use with the MIP6-Feature-Vector AVP: Token | Value | Description ---------------------------------+----------------------+------------ RO_SUPPORTED | 0x0000000200000000 | RFC TBD USER_TRAFFIC_ENCRYPTION | 0x0000000400000000 | RFC TBD VPN_GW_MODE | 0x0000000800000000 | RFC TBD MCOA_SUPPORTED | 0x0000001000000000 | RFC TBD 5. Security Considerations This document has no additional security consideration to those already described for the Mobile IPv6 Integrated Scenario Diameter interactions [RFC5447] and Mobile IPv6 Split Scenario Diameter interactions [I-D.ietf-dime-mip6-split]. 6. References Korhonen Expires December 12, 2009 [Page 4] Internet-Draft Diameter MIP6 Feature Vector Bits June 2009 6.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC5447] Korhonen, J., Bournelle, J., Tschofenig, H., Perkins, C., and K. Chowdhury, "Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction", RFC 5447, February 2009. 6.2. Informative References [I-D.ietf-dime-mip6-split] Korhonen, J., Tschofenig, H., Bournelle, J., Giaretta, G., and M. Nakhjiri, "Diameter Mobile IPv6: Support for Home Agent to Diameter Server Interaction", draft-ietf-dime-mip6-split-17 (work in progress), April 2009. [I-D.ietf-monami6-multiplecoa] Wakikawa, R., Devarapalli, V., Tsirtsis, G., Ernst, T., and K. Nagami, "Multiple Care-of Addresses Registration", draft-ietf-monami6-multiplecoa-14 (work in progress), May 2009. [RFC3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in IPv6", RFC 3775, June 2004. [RFC5026] Giaretta, G., Kempf, J., and V. Devarapalli, "Mobile IPv6 Bootstrapping in Split Scenario", RFC 5026, October 2007. Author's Address Jouni Korhonen Nokia Siemens Networks Linnoitustie 6 Espoo FIN-02600 Finland Email: jouni.nospam@gmail.com Korhonen Expires December 12, 2009 [Page 5]