Subject: [HOKEY] Meaning of "AAA domain"

From: Tom Taylor <[email-masked]>
Date: Tue, 06 Jul 2010 11:17:29 -0400

It's a bit late, but I'm gathering "to do" items for the HOKEY architecture 
document. My sources are:

-- IETF 77 minutes and my memory of proceedings
-- reviews by Qin Wu, Mark Jones, and Zhen Cao (thank you all!)

One preliminary issue: Qin has stated that the architecture draft does not 
address inter-AAA-domain handover. But we have the concept of home and visited 
domain, so I don't quite understand this.

Bottom line: could we have a definition of "AAA domain" and an explanation of 
why the architecture draft does not cover inter-AAA-domain transfers?

Tom Taylor

---

From: Qin Wu <[email-masked]>
Date: Wed, 07 Jul 2010 09:48:11 +0800

Hi, Tom:
Thank for raising such issue. If my memory is correct, 
What I am saying during the last IETF meeting is 
In the Early authentication problem statement described in RFC5836, we point out Early authentication should address
intra-domain handover, inter-domain handover and inter-technology handover. Comparing with ERP, Early authentication is more
appropirate for inter-domain handover.

However ERP/AAK described in draft-ietf-hokey-erp-aak is limited to intra-AAA-domain handover case and does not address
inter-AAA-domain handover. This is becos AAK just extends ERP to support Early authentication.
And ERP described in RFC5296 is more appropriate for intra-AAA-domain handover.When we use ERP for inter-domain handover,
ERP may depend on normal EAP authentication to derive new EMSK. That is to say, ERP is not recommended during inter-domain handover.

So I believe one more new work item in the future is required to address how to do early authentication for inter-domain handover. Maybe this work item
is part of draft-ietf-hokey-erp-aak. May be a separated work. Contribution to this work should be invited.

As regarding my last comment on Hokey architecture document, I am not saying  Hokey architecture draft should exclude inter-domain handover case.
On the contrary, Hokey architecture can  cover inter-domain handover case if Early authentication for inter-domain handover case can be fixed by future contribution. 
So maybe it is early to say that Early re-auth only focuses on intra-domain handover.

Regarding "AAA domain", I blieve AAA domain is equivalent to "AAA realm". Inter-realm handover and intra-real handover have their defintion in the RFC5836.

Regards!
-Qin

---

From: Tom Taylor <[email-masked]>
Date: Tue, 06 Jul 2010 22:07:31 -0400

OK, 5836 says that:

"  AAA realm
       The set of access networks within the scope of a specific AAA
       server.  Thus, if a mobile device moves from one attachment point
       to another within the same AAA realm, it continues to be served by
       the same AAA server."

So we are talking about all domains that have a business arrangement with the 
home network that allows them to go to the home AAA server for AAA.

Frankly, I would expect that if the Mobile Host wandered out of that scope, it 
would need a new set of credentials in any event. So ERP most definitely does 
not apply to inter-AAA-realm handover, but early authentication might be possible.

> Hi, Tom:
...>
> Regarding "AAA domain", I blieve AAA domain is equivalent to "AAA realm".
> Inter-realm handover and intra-real handover have their defintion in the
> RFC5836.
> 
> Regards! -Qin
...

---

From: Qin Wu <[email-masked]>
Date: Wed, 07 Jul 2010 10:32:38 +0800

----- Original Message ----- 
From: "Tom Taylor" <[email-masked]>
To: "Qin Wu" <[email-masked]>; <[email-masked]>
Sent: Wednesday, July 07, 2010 10:07 AM
Subject: Re: Meaning of "AAA domain"

> home network that allows them to go to the home AAA server for AAA.

[Qin]:  Yes, I believe the business agreement between domains is required before inter-domain handover
happen. 

> not apply to inter-AAA-realm handover, but early authentication might be possible.

[Qin]: Yes.

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 7 Jul 2010 11:42:27 +0700

Tom Taylor [mailto://[email-masked]]

> home network that allows them to go to the home AAA server for AAA.

I don't think so; it sounds like what you're talking about is this (from RFC
2607):

   Roaming relationships
      Roaming relationships include relationships between companies and
      ISPs, relationships among peer ISPs within a roaming association,
      and relationships between an ISP and a roaming consortia.
      Together, the set of relationships forming a path between a local
      ISP's authentication proxy and the home authentication server is
      known as the roaming relationship path.

The definition from RFC 5836 is correct as far as it goes, but leaves out
the customer relationship that distinguishes the home realm from visited
realms.

...