Mobile IPv6 (MIPv6) Bootstrapping for the Integrated Scenario
Extracted elements (17)
Because the ASA and MSA are the same in the integrated scenario, the AAAH used for network access authentication has access to the same database as the AAAH used for mobility service authentication, allowing a single AAAH to authorize both network access and mobility service simultaneously.
In the HA-in-ASP scenario, the AAAH is unaware that the MN prefers a home agent in the ASP, so it assigns HA information that the MN may not use. This intentionally leaves the mobility anchor point decision to the mobile node, accommodating flexible deployment choices.
The integrated scenario is one where the Access Service Authorizer (ASA) and the Mobility Service Authorizer (MSA) are the same entity, enabling MIPv6 bootstrapping to occur at the time of network access authentication. This contrasts with the split scenario (RFC 5026) where they are different entities.
The NAS and DHCP relay are required to be either co-located or connected via an interface to transfer AAA-provided home agent information into the DHCP Relay-Supplied Options. Co-location is not required when HA assignment in the home MSP is not needed by the deployment, in which case RFC 6610 alone suffices.
HoA assignment, IPsec Security Association setup, and Authentication and Authorization with the MSA in the integrated scenario are bootstrapped via the same mechanism as defined in the split scenario solution (RFC 5026). This document only defines the home agent address discovery component.
If the NAS does not store the received AAA home agent information for the duration of the MN's session and the MN delays its DHCPv6 request, the NAS/DHCP relay will not include the Relay-Supplied Options in the Relay Forward message, causing the DHCP server to fall back to RFC 6610 defined behavior.
If assignment of a home agent is required only in the ASP, a minimal implementation MAY only support the delivery of home agent information from the DHCP server to the DHCP client through RFC 6610, without needing the NAS-to-DHCP-relay transfer mechanism.
If home agent assignment in the MSP is required by the deployment, an implementation conforming to this specification SHALL be able to transfer the information received from the AAA server to the NAS, and from the NAS to the DHCP relay function, either by co-locating these functions or via an interface between them.
In the fallback case where the mobile node cannot acquire home agent information via DHCPv6, the mobile node MAY perform DNS queries to discover the home agent address as defined in RFC 5026.
The NAS shall support MIPv6-specific AAA attributes as specified in RFC 5447, which carry home agent assignment information from the AAAH back to the NAS.
When requesting home agent allocation in the ASP, the mobile node's DHCPv6 Information-request SHALL include: the Option Code for the Home Network Identifier Option (RFC 6610) in OPTION_ORO, and OPTION_CLIENTID to identify itself to the DHCP server.
When requesting home agent information in the MSP, the mobile node's DHCPv6 Information-request SHALL include: the Option Code for the Visited Home Network Information option (RFC 6610) in OPTION_ORO, a Client Home Network ID FQDN option identifying the MSP, and OPTION_CLIENTID.
In the HA-in-ASP scenario, the mobile node sets the id-type field to zero in the Home Network Identifier Option (RFC 6610) in its DHCPv6 request to signal that it wants home agent allocation in the ASP. The ASP then acts as the MSP for the duration of the network access authentication session.
In the HA-in-MSP scenario, the bootstrapping proceeds in five steps: (1) MN authenticates via IEEE 802.11i/802.1X and AAAH assigns HA and returns info to NAS; (2) MN sends DHCPv6 Information-request; (3) NAS/DHCP relay forwards request with AAA-provided HA info in Relay-Supplied Options; (4) DHCP server extracts and includes HA info in Reply; (5) relay delivers Reply to MN.
MIPv6 bootstrapping requires the mobile node to obtain three pieces of information: the Home Address (HoA), the home agent address, and the cryptographic materials for establishing an IPsec security association with the home agent. Cryptographic materials must be established before initiating the registration process.
The bootstrapping architecture in the integrated scenario consists of a mobile node, NAS/DHCP relay (co-located), DHCP server, and AAAH. The AAAH conveys assigned home agent information to the NAS via AAA protocol (e.g., Diameter per RFC 5447), which the NAS relays to the DHCP server via Relay-Supplied Options.
The transport of assigned home agent information via the AAA infrastructure from AAA server to AAA client (NAS) is only integrity protected per standard Diameter or other AAA protocol security mechanisms (RFC 3588). No additional security considerations are imposed, and this document does not introduce any new security issues to Mobile IPv6.