A New Internet-Draft is available from the on-line Internet-Drafts directories.
Title : IKEv2 Redirect based Authentication Offload and Proxy Session Resumption
Author(s) : A. Padmakumar, et al.
Filename : draft-padmakumar-ikev2-redirect-and-auth-offload-02.txt
Pages : 19
Date : 2009-12-21
IKEv2 supports multiple authentication mechanisms like public key
signatures, shared secrets and EAP. EAP based authentication
requires server to maintain information about the client until EAP
completes. Public key based authentication mechanisms are highly
computational intensive and demands server CPU resources.
Redirect Mechanism for IKEv2 proposes a mechanism for IKEv2 that
enables a VPN gateway to redirect the VPN client to another VPN
gateway, for example, based on the load condition.
IKEv2 Session Resumption proposes an extension to IKEv2 that allows a
client to re-establish an IKE SA with a gateway in a highly efficient
manner, utilizing a previously established IKE SA.
Redirect mechanism can also be used to redirect a client to another
router (trust anchor) to do mutual authentication and an optional
proxy session negotiation on behalf of the server. This redirection
happens during the IKE_SA_INIT and server does not maintain any
information about the redirected client. After mutual authentication
and optional proxy session negotiation trust anchor redirects the
client back to the server with an Access Token which can be used as a
dynamic pre-shared key between the server and client for password
based IKE_AUTH exchange. Mechanism described here allows servers to
compute the same pre-shared key dynamically, without contacting trust
anchors, based on the information provided by the client during
IKE_AUTH exchange. Access Token based authentication permits IDr of
the responder to be different from that specified in Ticket and
permits client to reuse the proxy session (negotiated between client
and trust anchor) between client and server.
Such a mechanism is useful especially for low power devices like
handsets. For example, a mobile node can redirect a correspondent
node to its home agent. Home agent can form a proxy session with
correspondent node and then redirect it back to mobile node.
Status of this Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on June 24, 2010.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the BSD License.
A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-padmakumar-ikev2-redirect-and-auth-offload-02.txt
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
- <ftp://ftp.ietf.org/internet-drafts/draft-padmakumar-ikev2-redirect-and-auth-offload-02.txt>
-
_______________________________________________
I-D-Announce mailing list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
