Re: [Dime] DiME ERP - Getting the message flows right

[Sebastien Decugis <sdecugis at nict.go.jp>]

Hi again,

After trying to capture the new mechanism (based on a new application
id) in a document, I have encountered an issue and I am not sure what is
the proper way to solve it.

When the local ER server (aka HOKEY server in the visited domain) needs
to retrieve the rDSRK material (i.e. it was not bootstrapped already)
this material can not be provided directly by the Home ER server,
because of the key hierarchy:

EMSK (in Home EAP server)
|
+- rRK (in Home ERP server)
|
+- DSRK (in Home EAP server or a local server)
    |
   +- rDSRK (in local ERP server)

There are two ways to get this material:
- through the home ERP server (in this case the home ER server receives
visited domain specific keying material, which may not be good)
- directly with an exchange between local ERP server and home EAP server.

This second option would be shown as follow ( exchange (c) ):

>   Diameter EAP +-------------+   Diameter EAP   +-------------+
>                |             |                  |             |
>  <------------>| Local       |<---------------->| Home        |
>                | Diameter    |                  | Diameter    |
>                | EAP Proxy   |                  | EAP Server  |
>                |             |            ----->|             |
>                +-------------+           /      +-------------+
>                       ^                 /              ^
>                    (a)| proprietary   (c)  proprietary |(b)
>                       v               /                v
>                +-------------+ <-----/          +-------------+
>   Diameter ERP |             |                  |             |
>                | Local       |    Diameter ERP  |  Home       |
>  <------------>| Diameter    |<---------------->|  Diameter   |
>                | ERP Server  |                  |  ERP Server |
>                |             |                  |             |
>                +-------------+                  +-------------+
>   

Note that the exchange (b) is needed anyway for the case when the peer
is in its home domain.


Does anybody have some comments on this?

Thank you,
Sebastien.


-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)