Binding Revocation for IPv6 Mobility
Extracted elements (30)
A single new Mobility Header type (16) with an inner sub-type field (Binding Revocation Type) was chosen rather than allocating separate MH types for BRI and BRA. This conserves the MH type numbering space and allows future revocation message subtypes to be added via the sub-type registry rather than requiring new MH allocations.
The LMA is explicitly permitted to delete the mobile node's IP tunnel immediately after sending the initial BRI, before receiving the BRA. This avoids holding tunnel resources during the round-trip acknowledgement delay, accepting a brief risk of forwarding disruption if the BRA later indicates failure.
The binding revocation mechanism applies uniformly to base MIPv6 (RFC 3775), DSMIPv6 (RFC 5555), Multiple Care-of Addresses (RFC 5648), and Proxy Mobile IPv6 (RFC 5213/RFC 5844), using the same MH Type 16 message format. The P bit distinguishes PMIPv6 bindings from MIPv6 bindings within the same message structure.
At any time, implementations MUST ensure there is no collision between the sequence numbers of all outstanding Binding Revocation Indication messages. The 16-bit Sequence Number enables the initiator to match a BRA to its corresponding BRI.
Binding Revocation Messages MUST be protected using the same security association (e.g., IPsec) used to protect the mobile node's Mobile IPv6 or PMIPv6 binding registration signaling. If IPsec is not used, the underlying security mechanism MUST provide protection against all threats identified in RFC 3775 and RFC 5213.
BRI retransmissions MUST use an exponential back-off process in which the timeout doubles upon each retransmission until a response is received or the timeout reaches MAX_BRACK_TIMEOUT. If no BRA is received after BRIMaxRetriesNumber retransmits, the initiator SHOULD clean up all resources associated with that mobile node binding.
For bulk Per-Peer global revocation from the MAG, the MAG MUST set both P and G bits, MUST set Revocation Trigger to 'Per-Peer Policy' (128), and MUST include the MAG identity in the MN-ID option. The LMA MUST verify the MAG is authorized for global revocation; if not, it MUST reject with status 'Global Revocation NOT Authorized' (130).
If Proxy Binding Update/Acknowledgement or Binding Update/Acknowledgement messages are sent using UDP encapsulation over IPv4 (per RFC 5844 or RFC 5555), Binding Revocation Messages MUST use the same UDP source/destination port numbers and IPv4 source/destination addresses as the most recently successfully processed PBU or BU message.
If the Source Address in the IPv6 header carrying the BRI does not contain a unicast address, the BRI MUST be silently discarded and no BRA sent.
The Home Agent MUST send the BRI to the mobile node using a Type 2 routing header containing the mobile node's registered IPv6 home address, with the care-of address as the IPv6 destination. If revoking only the IPv4 HoA binding, the HA MUST set the V bit and include the IPv4 Home Address option.
The initiator MUST silently discard a received BRA whose Sequence Number does not match any outstanding BRI (MAY log the event). If the BRA Status indicates success, the initiator MUST delete the retransmission timer and the mobile node binding(s) and all associated resources.
The mobile node MUST verify the IP address in the Type 2 routing header of a received BRI is its Home Address and that its Binding Update List contains an entry for that address; if either test fails it SHOULD silently discard the BRI. The mobile node MUST also verify the P bit is NOT set; if set, it MUST reject with status 'Proxy Binding Revocation NOT Supported' (135).
The responder MUST copy the Sequence Number from the BRI into the BRA and MUST mirror the P, G, and V bits. The responder MUST send a BRA for every accepted or rejected BRI; if the BRI is discarded (e.g., security check failed), no BRA is sent.
Upon receiving a Binding Revocation Message, the receiving entity MUST verify it was received protected by the same security association used for binding registration and revocation signaling between the two peers.
When the LMA sends a BRI for PMIPv6, it MUST set the P bit, MUST include the MN-ID option with the mobile node's NAI, and MUST use the proxy care-of address as the IPv6 destination. If IPsec is used and the mag_address differs from the proxy CoA, an Alternate Care-of Address option MUST be included.
The BRA Status field (8-bit) reports revocation outcome. Values below 128 indicate success: 0=success, 1=partial success. Values 128 and above indicate rejection: 128=Binding Does NOT Exist, 129=IPv4 Home Address Option Required, 130=Global Revocation NOT Authorized, 131=Revoked Mobile Nodes Identity Required, 132=Revocation Failed - MN is Attached, 133=Revocation Trigger NOT Supported, 134=Revocation Function NOT Supported, 135=Proxy Binding Revocation NOT Supported.
The Global (G) bit set in BRI/BRA indicates termination of all Per-Peer mobility bindings or multiple bindings sharing a common identifier. When G is set, the Revocation Trigger MUST use a Global Revocation Trigger value (128–249); the LMA must verify the requesting MAG is authorized before processing such a message.
The Proxy Binding (P) bit indicates the revoked binding is a PMIPv6 binding. The IPv4 HoA Binding Only (V) bit indicates only the IPv4 Home Address binding is being revoked while the IPv6 HoA/HNP binding to the current CoA is maintained. Both bits are mirrored from BRI to BRA.
The Revocation Trigger field (8-bit) indicates the reason the BRI was sent. Per-MN values (0–127): 0=Unspecified, 1=Administrative Reason, 2=Inter-MAG Handover same Access Type, 3=Inter-MAG Handover different Access Type, 4=Inter-MAG Handover Unknown, 5=User-Initiated Session(s) Termination, 6=Access Network Session(s) Termination, 7=Possible Out-of-Sync BCE State. Global values: 128=Per-Peer Policy, 129=Revoking Mobility Node Local Policy. Values 250–255 are reserved for testing.
A new 'Binding Revocation Acknowledgement Status Codes' registry is created with success values 0–1 and failure values 128–135. Future assignments require Standards Action or IESG Approval.
A new 'Binding Revocation Type' registry is created with values: 0=Reserved, 1=Binding Revocation Indication, 2=Binding Revocation Acknowledgement; all other values unassigned. Future assignments require Standards Action or IESG Approval.
A new 'Revocation Trigger' registry is created with Per-MN values 0–7, Global values 128–129, testing-reserved values 250–255, and all other values unassigned. Future assignments require Standards Action or IESG Approval.
IANA assigned Mobility Header Type value 16 for the new Binding Revocation Message, allocated from the existing Mobility Header types registry defined in RFC 3775.
A mobility node is only permitted to revoke mobility sessions currently registered with it; it is explicitly NOT allowed to revoke a mobile node's mobility session registered with a different mobility node. The binding revocation protocol inherits the same IPsec security association as the binding registration signaling, requiring no new SA.
For global revocation (G bit set with Revocation Trigger 'Per-Peer Policy'), the LMA MUST verify the requesting MAG is authorized to use global revocations. Unauthorized global revocation attempts MUST be rejected with status code 130 ('Global Revocation NOT Authorized') to prevent a MAG from bulk-terminating sessions it does not own.
During inter-MAG handover with Handoff Indicator 'Unknown (4)', the LMA SHOULD proactively send a BRI with Revocation Trigger 'Inter-MAG Handover - Unknown' to the previous MAG. On successful BRA or de-registration: update BCE as de-registered. On 'Revocation Failed - MN is Attached': create new BCE. On retransmission exhaustion: also create new BCE.
When an initiator sends a BRI, it sets a 'revocation in progress' flag in the mobile node's BCE and starts the InitMINDelayBRIs timer. The BCE stays in this state until a BRA is received or BRIMaxRetriesNumber is exhausted. In a race condition where a new Binding Update arrives while the flag is set, the entity resolves it per local policy, removing the flag if the BU is accepted.
The Binding Revocation Acknowledgement (BRA) message data contains: Binding Revocation Type (8-bit, value 2), Status (8-bit), Sequence Number (16-bit unsigned, copied from the BRI), flags P/V/G (1-bit each mirroring the BRI), Reserved bits, and variable-length Mobility Options. No options are required when Status is success.
The Binding Revocation Indication (BRI) message data contains: Binding Revocation Type (8-bit, value 1), Revocation Trigger (8-bit), Sequence Number (16-bit unsigned), flags P (Proxy Binding), V (IPv4 HoA Binding Only), G (Global) each 1-bit, Reserved bits, and variable-length TLV-encoded Mobility Options. If no options are present, 4 octets of padding are required and Header Len is set to 1.
The Binding Revocation Message uses Mobility Header Type 16. The outer format contains Payload Proto (8-bit), Header Len (8-bit, in units of 8 octets excluding first 8), MH Type (value 16), Reserved (8-bit, MUST be zero/ignored), Checksum (16-bit), and Binding Revocation Type (8-bit: 1=BRI, 2=BRA), followed by variable Binding Revocation Message Data.