Diameter Support for Proxy Mobile IPv6 Localized Routing
Extracted elements (15)
Localized routing allows packets to be routed directly between an MN's MAG and the MAG of its Correspondent Node without involving any LMA, optimizing media delivery and reducing unnecessary tunneling through the LMA.
Localized Routing Service Authorization can happen during the network access authentication procedure before localized routing is initialized, allowing preauthorized pairs of LMA/prefix sets to be downloaded to PMIPv6 entities in advance. Localized routing can then be initiated once a destination matches a received prefix.
The document addresses three distinct scenarios: A11 (MN and CN on same MAG, same LMA), A12 (MN and CN on same MAG, different LMAs), and A21 (MN and CN on different MAGs, same LMA), each requiring different authorization flows. This scoping is based on the problem statement in RFC 6279.
When the INTER_MAG_ROUTING_SUPPORTED flag is cleared, either in request or response, it indicates that the procedures related to authorization of localized routing between MNs anchored to different MAGs is not supported or not authorized.
MAG and LMA compliant to this specification MUST support the INTER_MAG_ROUTING_SUPPORTED policy feature on a per-MN and per-subscription basis.
The MIP6-Feature-Vector AVP contains a 64-bit flags field used to indicate supported capabilities to the AAA server. This document defines a new flag bit INTER_MAG_ROUTING_SUPPORTED (0x0002000000000000) indicating support or authorization of direct routing of IP packets between MNs anchored to different MAGs without involving any LMA.
The MIP6-Home-Link-Prefix AVP (AVP Code 125) is used to carry the Mobile Node's home network prefix (MN-HNP) in the Diameter AA-Request sent to the AAA server.
The PMIP6-IPv4-Home-Address AVP (AVP Code 505) is used to carry the Mobile Node's IPv4 home address (IPv4-MN-HoA) in the Diameter AA-Request message sent to the AAA server.
The User-Name AVP (AVP Code 1) carries the Mobile Node identifier (MN-Identifier) in Diameter AA-Request messages sent to the AAA server for localized routing authorization. Two instances may be included to identify both MN1 and MN2.
When INTER_MAG_ROUTING_SUPPORTED is set by the MAG or LMA in the MIP6-Feature-Vector AVP in a request, it indicates to the HAAA that inter-MAG direct routing may be provided to the identified mobile node. When set in the response by the HAAA, it indicates that direct routing is authorized.
This specification defines a new value INTER_MAG_ROUTING_SUPPORTED (0x0002000000000000) in the IANA 'Mobility Capability Registry' (RFC 5447) for use with the MIP6-Feature-Vector AVP to indicate support for direct routing between MNs anchored to different MAGs.
An authorized MAG could track the movement of participating mobile nodes at the level of the MAG to which they are anchored. If such a MAG were compromised or under control of a bad actor, this could represent a privacy breach; monitoring for excessive queries from MAGs is recommended as a mitigation.
The security considerations for Diameter NASREQ (RFC 7155) and Diameter Proxy Mobile IPv6 (RFC 5779) applications are applicable to this document. The service authorization relies upon the existing trust relationship between the MAG/LMA and the AAA server.
In the LMA-Initiated LR authorization flow (scenario A11): LMA1 detects data packet, sends AA-Request with LOCAL_MAG_ROUTING_SUPPORTED bit set and two MN identifiers, receives AA-Answer, then initiates LRI/LRA with MAG1. On LRA_WAIT_TIME expiration, LMA1 re-requests authorization before retransmitting LRI up to LRI_RETRIES.
In the MAG-Initiated LR authorization flow (scenario A12): MAG1 detects data packet from MN1 to MN2, sends AA-Request with MFV and MN identifiers, receives AA-Answer authorizing localized routing, then sends LRI to both LMAs and awaits LRA responses. On LRA_WAIT_TIME expiration, MAG1 re-requests authorization before retransmitting LRI up to LRI_RETRIES.