Diameter Support for Proxy Mobile IPv6 Localized Routing

Proxy Mobile IPv6 (PMIPv6) allows the Mobility Access Gateway (MAG) to optimize media delivery by locally routing packets from a Mobile Node to a Correspondent Node that is locally attached to an access link connected to the same Mobile Access Gateway, avoiding tunneling them to the Mobile Node's Local Mobility Anchor (LMA). This is referred to as "local routing" in RFC 5213. However, this mechanism is not applicable to the typical scenarios in which the MN and CN are connected to different MAGs and are registered to the same LMA or different LMAs. takes those typical scenarios into account and defines the problem statement for PMIPv6 localized routing. specifies the PMIPv6 localized routing protocol based on the scenarios A11, A12, and A21 , which is used to establish a localized routing path between two Mobile Access Gateways in a PMIPv6 domain. However, there is no relevant work discussing how AAA-based mechanisms can be used to provide authorization to the Mobile Node's MAG or LMA for enabling localized routing between MAGs. This document describes Diameter support for the authorization of PMIPv6 mobility entities in case of A11,A12,A21 during localized routing.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

This document addresses how to provide authorization to the Mobile Node's MAG or LMA for enabling localized routing and resolve the destination MN’s MAG by means of interaction between the LMA and the AAA server. shows the reference architecture for Localized Routing Service Authorization. This reference architecture assumes that If MN and CN belong to different LMAs, MN and CN should share the same MAG (i.e.,A12 described in [RFC6279]), e.g., MN1 and CN2 in are attached to the same MAG1 and belong to LMA1 and LMA2 respectively. Note that LMA1 and LMA2 in are in the same provider domain (as described in ). If MN and CN are attached to the different MAGs, MN and CN should belong to the same LMA (i.e.,A21 described in [RFC6279]), e.g., MN1 and CN3 in the are attached to the MAG1 and MAG3 respectively but belong to LMA1. MN and CN may belong to the same LMA and are attached to the same MAG(i.e.,A11 described in [RFC6279]), e.g.,MN1 and CN1 in the are both attached to the MAG1 and belong to LMA1. The MAG and LMA support Diameter client functionality.

+---------+ +---------------------->| AAA & | | +------>| Policy | | | | Profile | | Diameter +---------+ | | | +--V-+ +----+ | +------->|LMA1| |LMA2| | | +---++ +----+ | | | | | Diameter | | +-------+--------- | | | | | | PMIP | | \\ | | // // \\ | | // // \\ | | // // \\ | | | | | | +---->+---------------+ +----+ | | MAG1 | |MAG3| +-------->+---------------+ +----+ : : : : +---+ +---+ +---+ +---+ |MN1| |CN1| |CN2| |CN3| +---+ +---+ +---+ +---+ The interaction of the MAG and LMA with the AAA server according to the extension specified in this document is used to authorize the localized routing service.

This section describes Attribute Value Pairs (AVPs) defined by this specification or re-used from existing specifications in a PMIPv6-specific way.

The User-Name AVP (AVP Code 1) is defined in . This AVP is used to carry the MN-Identifier (Mobile Node identifier) in the AA-Request (AAR) message .

The PMIP6-IPv4-Home-Address AVP (AVP Code 505) is defined in . This AVP is used to carry the IPv4-MN-HoA (Mobile Node's IPv4 home address) in the AA-Request (AAR) message .

The MIP6-Home-Link-Prefix AVP (AVP Code 125) is defined in . This AVP is used to carry the MN-HNP (Mobile Node's home network prefix) in the AAR.

The MIP6-Feature-Vector AVP is defined in . This document allocates a new capability flag bit according to the IANA rules in RFC 5447. INTER_MAG_ROUTING_SUPPORTED (TBD) Direct routing of IP packets between MNs anchored to different MAGs without involving any LMA is supported. This bit is used with MN-Identifier. When a MAG or LMA sets this bit in the MIP6- Feature-Vector and MN-Identifier corresponding to the Mobile Node is carried with this bit, it indicates to the home AAA server (HAAA) that the Mobile Node associated with this LMA is allowed to use localized routing.If this bit is cleared and MN-Identifier corresponding to the Mobile Node is carried with this bit, it indicates to the home AAA server (HAAA) that the Mobile Node associated with this LMA is not allowed to use localized routing. When a MAG or LMA sets this bit in the MIP6-Feature-Vector and MN- Identifiers corresponding to the Mobile Node and Correspondent Node are both carried with this bit, it indicates to the HAAA that localized routing of IP packets between Mobile Node and Correspondent Node anchored to different MAGs is supported. If this bit is cleared and MN- Identifiers corresponding to the Mobile Node and Correspondent Node are both carried with this bit to HAAA, it indicates to the HAAA that localized routing of IP packets between Mobile Node and Correspondent Node anchored to different MAGs is not supported. If this bit is cleared in the returned MIP6-Feature-Vector AVP, the HAAA does not authorize direct routing of packets between MNs anchored to the different MAG. The MAG and LMA MUST support this policy feature on a per-MN and per-subscription basis.

Localized Routing Service Authorization can happen during the network access authentication procedure before localized routing is initialized. In this case, the preauthorized pairs of LMA/prefix sets can be downloaded to Proxy Mobile IPv6 entities during the RFC 5779 procedure. Localized routing can be initiated once the destination of a received packet matches one or more of the prefixes received during the RFC 5779 procedure. shows an example scenario in which MAG1 acts as a Diameter client, processing the data packet from MN1 to MN2 and requesting authorization of localized routing (i.e.,MAG-Initiated LR authorization). In this example scenario, MN1 and MN2 are attached to the same MAG and anchored to the different LMAs (i.e.,A12 described in ). In this case, MAG1 knows that MN2 belongs to a different LMA (which can be determined by looking up the binding cache entries corresponding to MN1 and MN2 and comparing the addresses of LMA1 and LMA2). In order to setup a localized routing path with MAG2, MAG1 acts as Diameter client and sends an AAR message to the Diameter server. The message contains an instance of the MIP6-Feature-Vector (MFV) AVP (, Section 4.2.5) with the LOCAL_MAG_ROUTING_SUPPORTED bit (,Section 5.5 ) set,two instances of the User-Name AVP (, Section 8.14)containing MN1-Identifier and MN2-Identifier. In addition, the message may contain either an instance of the MIP6-Home-Link-Prefix AVP (, Section 5.3) or an instance of the PMIP6-IPv4- Home-Address AVP (, Section 5.2) containing the IP address/ HNP of MN1. The Diameter server authorizes localized routing service by checking if MN1 and MN2 are allowed to use localized routing. If so, the Diameter server responds with an AAA message encapsulating an instance of the MIP6-Feature-Vector (MFV) AVP (, Section 4.2.5) with the the LOCAL_MAG_ROUTING_SUPPORTED bit (,Section 5.5) set indicating direct routing of IP packets between MNs anchored to the same MAG is supported. MAG1 then knows the localized routing between MN1 and MN2 is allowed. Then MAG1 sends the Request messages respectively to LMA1 and LMA2. The request message is the Localized Routing Initialization (LRI) message in Figure 2 and belongs to the Initial phase of the localized routing. LMA1 and LMA2 responds to MAG1 using the Localized Routing Acknowledge message (LRA in ) in accordance with . In case of LRA_WAIT_TIME expiration ,MAG1 should ask for authorization of localized routing again according to the procedure described above before LRI is retransmitted up to a maximum of LRI_RETRIES.

+---+ +---+ +----+ +----+ +---+ +----+ |MN2| |MN1| |MAG1| |LMA1| |AAA| |LMA2| +-|-+ +-+-+ +-+--+ +-+--+ +-+-+ +-+--+ | | Anchored | | | o---------------------------------------------o | | Anchored | | | | o------------------o | | | Data[MN1->MN2] | | | | |------->| | | | | | | AAR(MFV, MN1,MN2) | | | | |------------------->| | | | | AAA(MFV) | | | | |<-------------------| | | | | LRI | | | | | |-------->| | | | | | | LRI | | | | |--------------------------->| | | | LRA | | | | | |<--------| | | | | | | LRA | | | | |<---------------------------| shows the second example scenario, in which LMA1 acts as a Diameter client, processing the data packet from MN2 to MN1 and requesting the authorization of localized routing. In this scenario, MN1 and MN2 are attached to the different MAG and anchored to the same LMA (i.e., A21 described in [RFC6279] ), LMA knows that MN1 and MN2 belong to the same LMA (which can be determined by looking up the binding cache entries corresponding to MN1 and MN2 and comparing the addresses of LMA corresponding to MN1 and LMA corresponding to MN2). In contrast with the signaling flow shown in , it is LMA1 instead of MAG1 which initiates the setup of the localized routing path. The Diameter client in LMA1 sends an AA-Request message to the Diameter server. The message contains an instance of the MIP6- Feature-Vector (MFV) AVP (, Section 4.2.5) with the INTER_MAG_ROUTING_SUPPORTED bit (Section 4.5) set indicating direct routing of IP packets between MNs anchored to different MAGs is supported and two instances of the User-Name AVP (, Section 8.14)containing MN1-Identifier and MN2-Identifier. The Diameter server authorizes the localized routing service by checking if MN1 and MN2 are allowed to use localized routing. If so, the Diameter server responds with an AA-Answer message encapsulating an instance of the MIP6-Feature-Vector (MFV) AVP (, Section 4.2.5) with the INTER_MAG_ROUTING_SUPPORTED bit (Section 4.5) set indicating direct routing of IP packets between MNs anchored to different MAGs is supported. LMA1 then knows the localized routing is allowed. In success case, LMA1 responds to MAG1 in accordance with . In case of LRA_WAIT_TIME expiration ,LMA1 should ask for authorization of localized routing again according to the procedure described above before LRI is retransmitted up to a maximum of LRI_RETRIES.

+---+ +----+ +----+ +---+ +----+ +---+ |MN1| |MAG1| |LMA1| |AAA| |MAG2| |MN2| +-+-+ +-+--+ +-+--+ +-+-+ +-+--+ +-+-+ | | | Anchored | | | Anchored o-------------------+--------o o--------+-------o Data[MN2->MN1] | | | | |<----- | | | | | |AAR(MFV,MN1,MN2) | | | | |--------->| | | | | | AAA(MFV) | | | | | LRI |<---------| | | | |<------| LRI | | | | LRA |------------------>| | | |------>| LRA | | | | |<------------------| | shows another example scenario, in which LMA1 acts as a Diameter client, processing the data packet from MN2 to MN1 and requesting the authorization of localized routing. In this scenario, MN1 and MN2 are attached to the same MAG and anchored to the same LMA (i.e., A11 described in ), LMA knows that MN1 and MN2 belong to the same LMA (which can be determined by looking up the binding cache entries corresponding to MN1 and MN2 and comparing the addresses of LMA corresponding to MN1 and LMA corresponding to MN2). The Diameter client in LMA1 sends an AA-Request message to the Diameter server. The message contains an instance of the MIP6- Feature-Vector AVP (, Section 4.2.5) with the LOCAL_MAG_ROUTING_SUPPORTED bit set and two instances of the User- Name AVP (, Section 8.14)containing MN1- Identifier and MN2-Identifier. The Diameter server authorizes the localized routing service by checking if MN1 and MN2 are allowed to use localized routing. If so, the Diameter server responds with an AA- Answer message encapsulating an instance of the MIP6-Feature-Vector (MFV) AVP (, Section 4.2.5) with the LOCAL_MAG_ROUTING_SUPPORTED bit (,Section 5.5) set indicating direct routing of IP packets between MNs anchored to the same MAG is supported. LMA1 then knows the localized routing is allowed and responds to MAG1 for localized routing in accordance with .In case of LRA_WAIT_TIME expiration , LMA1 should ask for authorization of localized routing again according to the procedure described above before LRI is retransmitted up to a maximum of LRI_RETRIES.

+---+ +---+ +----+ +----+ +---+ |MN2| |MN1| |MAG1| |LMA1| |AAA| +-+-+ +-+-+ +-+--+ +-+--+ +-|-+ | | Anchored | | o-----------------------o | | | Anchored | | | o--------+-------o Data[MN2->MN1] | | | |<----- | | | | |AAR(MFV,MN1,MN2) | | | |--------->| | | | | AAA(MFV) | | | | LRI |<---------| | | |<------| | | | | LRA | | | | |------>| |

The security considerations for the Diameter NASREQ and Diameter Proxy Mobile IPv6 applications are also applicable to this document. The service authorization solicited by the MAG or the LMA relies upon the existing trust relationship between the MAG/LMA and the AAA server. An authorised MAG could in principle track the movement of any participating CNs at the level of the MAG to which they are anchored. If such a MAG were compromised, or under the control of a bad-actor, then such tracking could represent a privacy breach for the set of tracked CNs. In such a case, the traffic pattern from the compromised MAG might be notable so monitoring for e.g. excessive queries from MAGs might be worthwhile.

This specification defines a new value in the Mobility Capability registry for use with the MIP6-Feature-Vector AVP: INTER_MAG_ROUTING_SUPPORTED (see ).

Paulo Loureiro, Jinwei Xia and Yungui Wang all contributed to early versions of this document.

The authors would like to thank Marco Liebsch, Carlos Jesus Bernardos Cano, Dan Romascanu, Elwyn Davies, Basavaraj Patil, Ralph Droms, Stephen Farrel,Robert Sparks, Benoit Claise and Abhay Roy for their valuable comments and suggestions on this document.