Access Network Identifier Option in DHCP

Access network identification (ANI) of a network device has a range of applications. For example the local mobility anchor in a Proxy Mobile IPv6 domain is able to provide access network and access operator specific handling or policing of the mobile node traffic using information about the access network to which the mobile node is attached. This document specifies Dynamic Host Configuration Protocol for IPv4 (DHCPv4) and Dynamic Host Configuration Protocol for IPv6 (DHCPv6) options for access network identification that is added by Relay agent in the DHCPv4 or DHCPv6 messages towards the Server. The scope of applicability for this option is between a DHCP relay agent and a mobile access gateway where the same operator typically operates both these functions Dynamic Host Configuration Protocol (DHCP) relay agent aware of the access network and access operator add this information in the DHCP messages. This information can be used to provide differentiated services and policing of traffic based on the access network to which a client is attached. Examples of how this information can be used in mobile networks can be found in .

Proxy mobile IPv6 can be used for supporting network-based mobility management in various types of network deployments. The network architectures, such as Service provider Wi-Fi access aggregation or, WLAN integrated mobile packet core are examples where Proxy Mobile IPv6 is a component of the overall architecture. Some of these architectures require the ability of the local mobility anchor (LMA) to provide differentiated services and policing of traffic to the mobile nodes based on the access network to which they are attached. Policy systems in mobility architectures such as PCC and ANDSF in 3GPP system allow configuration of policy rules with conditions based on the access network information. For example, the service treatment for the mobile node's traffic may be different when they are attached to a access network owned by the home operator than when owned by a roaming partner. The service treatment can also be different based on the configured Service Set Identifiers (SSID) in case of IEEE 802.11 based access networks. Other examples of services include the operator's ability to apply tariff based on the location. The PMIPv6 extension as specified in defines PMIPv6 options to carry access network identifiers in PMIPv6 signaling from Mobile Access Gateway (MAG) to LMA. MAG can learn this information from DHCP options as inserted by DHCP Relay agent before MAG. If MAG relays DHCP messages to LMA as specified in this information can be inserted by MAG towards LMA in the forwarded DHCP messages. Figure 1, illustrates an example Proxy Mobile IPv6 deployment. In this example, the access network is IEEE 802.11 based access-network, the DHCP Relay Agent function is located on the access point (AP), and the DHCP Server function is located on the MAG. The MAG delivers the information elements related to the access network to the LMA over Proxy Mobile IPv6 signaling messages. The MAG obtains these information elements from the DHCP Relay Agent as per this specification. The informational elements related to the access network include the SSID of the used IEEE 802.11 network, the geo-location of the access-network to which the mobile node is attached, and the identity of the operator running the IEEE 802.11 access network infrastructure.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . All the DHCP related terms used in this document are to be interpreted as defined in the Dynamic Host Configuration Protocol (DHCPv4) and Dynamic Host Configuration Protocol for IPv6 (DHCPv6) specifications. DHCP message refers to both DHCPv4 and DHCPv6 messages throughout this document. All the mobility related terms used in this document are to be interpreted as defined in the Proxy Mobile IPv6 specifications and . Additionally, this document uses the following abbreviations: Service Set Identifier (SSID) Service Set Identifier (SSID) identifies the name of the IEEE 802.11 network. SSID differentiates from one network to the other. Operator-Identifier The Operator-Identifier is the Structure of Management Information (SMI) Network Management Private Enterprise Code of the IANA- maintained "Private Enterprise Numbers" registry . It identifies the operator running the access-network where the client is attached.

The Access Network Identifier carries information to identify the access network to which the client is attached. This information includes access technology type, network identifier, and access-network operator identifiers. Relay agents that include Access Network Identifier information include one or more sub-options (see Section 4.1) in the Relay Agent Information option .

The access network identifier information will be defined in multiple sub-options, allocated from the DHCP Relay Agent Sub-Option Codes. ANI Sub-options: The ANI Sub-options consists of a sequence of Sub-Option Code, Length, and Value tuples for each sub-option, encoded in the following manner:

The 1-octet code for the sub-options defined in the following sections. An unsigned 8-bit integer giving the length of the Sub-option Data field in this sub-option in octets. The data area for the sub-option. The initial assignment of DHCP access network identifier sub-options is as follows:

| Access Technology Type Sub-option | +=========================================================+ | | Access Network Name Sub-option | +=========================================================+ | | Access Point Name Sub-option | +=========================================================+ | | Access Point BSSID Sub-option | +=========================================================+ | | Operator-Identifier Sub-option | +=========================================================+ | | Operator-Realm Sub-option | +=========================================================+ ]]>

This sub-option is used for exchanging the type of the access technology of the network to which the client is attached. Its format is as follows:

<IANA-1>. 2. An 8-bit field that is unused for now. The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. An 8-bit field that specifies the access technology through which the client is connected to the access link from the IANA name space Access Technology Type Option type value registry defined in .

These sub-options are used for carrying the name of the access network (e.g., a SSID in case of IEEE 802.11 Access Network, or PLMN Identifier in case of 3GPP access) and Access Point name to which the client is attached. The format of these sub-options is defined the following sections. The Network-Identifier sub-options are only for the currently known access technology types.

<IANA-2>. The length of the Network Name field. The name of the access network to which the mobile node is attached. The encoding MUST be UTF-8 as described in . The type of the Network Name is dependent on the access technology to which the mobile node is attached. For IEEE 802.11 based networks, the network name will be the SSID of the network. For 3GPP access based it is the PLMN Identifier of the access network and for 3GPP2 access, the Network Name is the Access Network Identifier . When encoding the PLMN Identifier, both the Mobile Network Code (MNC) [TS23003] and Mobile Country Code (MCC) [TS23003] MUST be 3 digits. If the MNC in use only has 2 digits, then it MUST be preceded with a '0'.

<IANA-3>. The length of the Access-Point Name field. The name of the access point (physical device name) to which the mobile node is attached. This is the identifier that uniquely identifies the access point. While Network Name (e.g., SSID) identifies the operator's access network, Access-Point Name identifies a specific network device in the network to which the mobile node is attached. In some deployments, the Access-Point Name can be set to the string representation of the Media Access Control (MAC) address as specified in mac-address string type of the device or some unique identifier that can be used by the policy systems in the operator network to unambiguously identify the device. The encoding MUST be UTF-8 as described in .

<IANA-4>. 6. The 48-bit Basic Service Set Identification (BSSID) of the access point to which the mobile node is attached.

The Operator identifier sub-options can be used for carrying the operator identifiers of the access network to which the client is attached. The format of these sub-options is defined below.

<IANA-5>. 4. Operator-Identifier as a variable-length Private Enterprise Number (PEN) encoded in a network-byte order. Please refer to (section 3.1.3 of ) for additional details.

<IANA-6>. The length of the Operator Realm field. Realm of the operator (e.g., EXAMPLE.COM). Please refer to (section 3.1.3 of ) for additional details.

The Access Network Identifier options defined here may be added by the DHCPv6 Relay agent in Relay-forward messages.

| OPTION_ANI_ATT | +=========================================================+ | | OPTION_ANI_NETWORK_NAME | +=========================================================+ | | OPTION_ANI_AP_NAME | +=========================================================+ | | OPTION_ANI_AP_BSSID | +=========================================================+ | | OPTION_ANI_OPERATOR_ID | +=========================================================+ | | OPTION_ANI_OPERATOR_REALM | +=========================================================+ ]]>

This option is used for exchanging the type of the access technology the client is attached to the network. Its format is as follows:

OPTION_ANI_ATT (<IANA-7>). 2. An 8-bit field that is unused for now. The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. The contents of this field is the same as the ATT field described in .

These options can be used for carrying the name of the access network (e.g., a SSID in case of IEEE 802.11 Access Network, or PLMN Identifier in case of 3GPP access) and Access Point name to which the client is attached. The format of these options is defined below.

OPTION_ANI_NETWORK_NAME (<IANA-8>). The length of the Network Name field. The contents of this field is the same as the Network Name field described in .

OPTION_ANI_AP_NAME (<IANA-9>). The length of the Access-Point Name field. The contents of this field is the same as the Access-Point Name field described in .

OPTION_ANI_AP_BSSID (<IANA-10>). 6. The contents of this field is the same as the Access-Point BSSID field described in .

The Operator Identifier options can be used for carrying the operator identifier of the access network to which the client is attached. The format of these options is defined below.

OPTION_ANI_OPERATOR_ID (<IANA-11>). 4. The contents of this field is the same as the DHCPv4 Operator-Identifier Sub-option field described in .

OPTION_ANI_OPERATOR_REALM (<IANA-12>). The length of the Operator Realm field. The contents of this field is the same as the Operator-Realm field described in .

DHCPv4 Relay Agents MAY include sub-options defined in section 4.2 through 4.4 in the Relay Agent Information option as defined in for providing information about the access network over which DHCP messages from the client is received. The DHCPv4 Relay Agent when including any of these sub-options in the DHCP message, DHCPv4 Network Name Sub-option (), DHCPv4 Access-Point Name Sub-option (), DHCPv4 Access-Point BSSID Sub-option (), MUST include the DHCPv4 Access-Technology-Type Sub-option () DHCPv6 Relay Agents MAY include options defined in Section 5 in Relay-forward message when forwarding any DHCPv6 message type from clients to the servers to provide information about the access network over which DHCPv6 messages from the client is received. The DHCPv6 Relay Agent when including any of these options in the DHCP message, DHCPv6 Network Name Option (), DHCPv6 Access-Point Name Option (), DHCPv6 Access-Point BSSID Option (), MUST include the DHCPv6 Access-Technology-Type Option ()

DHCPv4 base specification requires that the DHCPv4 server ignore the DHCPv4 Access Network Identifier option if it does not understand the option. If the DHCPv4 server does not understand the received sub-option defined in sections 4.1 through 4.4 in the DHCPv4 Relay Agent Information option (82) it MUST ignore those sub-options only. If DHCPv4 Server is able to process the DHCPv4 Access Network Identifier sub-options defined in sections 4.1 through 4.4 received in DHCPv4 Relay Agent Information option, it MAY use this information obtained from the sub-option for address pool selection, or for policy decisions as per its configured policy. This information obtained from the sub-option SHOULD NOT be stored unless it is absolutely needed, However, if it is stored, the information MUST be deleted as quickly as possible to eliminate any possibility of the information getting exposed to an intruder. If the received DHCPv4 message does not include DHCPv4 Access-Technology-Type Sub-option (), but if it includes any one of these other options, DHCPv4 Network Name Sub-option (), DHCPv4 Access-Point Name Sub-option (), or DHCPv4 Access-Point BSSID Sub-option (), then the DHCPv4 server MUST ignore the received DHCPv4 Access-Network-Identifier option and process the rest of the message as per the base DHCPv4 specifications DHCPv6 base specification requires that the DHCPv6 server ignore the DHCPv6 Access-Network-Identifier option if it does not understand the option. If the DHCPv6 server receives the options defined in Section 5 and is configured to use the options defined in Section 5, it SHOULD look for the DHCPv6 Access Network identifier options in the Relay-forward message of the DHCPv6 relay agent(s) based on its configured policy. The server MAY use received ANI options for its address pool selection policy decisions as per its configured policy. This information obtained from the options SHOULD NOT be stored unless it is absolutely needed, However, if it is stored, the information MUST be deleted as quickly as possible to eliminate any possibility of the information getting exposed to an intruder. If the received DHCPv6 message does not include DHCPv6 Access-Technology-Type Option (), but it includes any one of these other options, DHCPv6 Network Name Option (), DHCPv6 Access-Point Name Option (), or DHCPv6 Access-Point BSSID Option (), then the DHCPv6 server MUST ignore the received DHCPv6 Access-Network-Identifier option and process the rest of the message as per the base DHCPv6 specifications.

IANA is requested to assign Sub-option codes for the following DHCPv4 Sub-options from the "DHCP Relay Agent Sub-Option Codes" registry, <http://www.iana.org/assignments/bootp-dhcp-parameters>:

| Access Technology Type Sub-option | +=========================================================+ | | Access Network Name Sub-option | +=========================================================+ | | Access Point Name Sub-option | +=========================================================+ | | Access Point BSSID Sub-option | +=========================================================+ | | Operator Identifier Sub-option | +=========================================================+ | | Operator Realm Sub-option | +=========================================================+ ]]> IANA is requested to assign option codes for the following DHCPv6 options from the "Option Codes registry for DHCPv6" registry <http://www.iana.org/assignments/dhcpv6-parameters>, as specified in :

Since there is no privacy protection for DHCP messages, an eavesdropper who can monitor the link between the DHCP server and relay agent can discover access network information. and describe many of the threats in using DHCP. and each provide a solution, the Authentication Option for DHCPv4 and DHCPv6 (respectively). However, neither of these options are in active use and therefore are not a viable mitigation option. DHCP itself is inherently insecure and thus link-layer confidentiality and integrity protection SHOULD be employed to reduce the risk of disclosure and tampering. It is possible for a rogue DHCP relay agent to insert or overwrite with incorrect access network identifier options for malicious purposes. A DHCP client can also pose as a rogue DHCP relay agent by sending incorrect access network identifier options. While the introduction of fraudulent DHCP relay agent information options can be prevented by a perimeter defense that blocks these options unless the DHCP relay agent is trusted, a deeper defense using the authentication sub-option for DHCPv4 relay agent information option SHOULD be deployed as well. Administrators SHOULD configure DHCP servers that use this option to communicate with their relay agents using IPsec, as described in Section 21.1 of . The information elements that this draft is exposing is the client’s access-network information. These pertain to the access network to which the client is attached, such as Access Technology Type (Ex: WLAN, Ethernet…etc), Access Point Identity (Name, BSSID), Operator Id/Realm. In deployments where this information cannot be secured using IPsec or other security protocols, administrators SHOULD disable the capability specified in this document on the DHCP entities.

The authors would like to thank Kim Kinnear, Ted Lemon, Gaurav Halwasia, Hidetoshi Yokota, Sheng Jiang and Francis Dupont for their valuable inputs. And, to Tomek Mrugalski for a thorough review of the document.