IKEv2 Redirect based Authentication Offload and Proxy Session Resumption
draft-padmakumar-ikev2-redirect-and-auth-offload-02

Abstract

IKEv2 supports multiple authentication mechanisms like public key signatures, shared secrets and EAP. EAP based authentication requires server to maintain information about the client until EAP completes. Public key based authentication mechanisms are highly computational intensive and demands server CPU resources. Redirect Mechanism for IKEv2 proposes a mechanism for IKEv2 that enables a VPN gateway to redirect the VPN client to another VPN gateway, for example, based on the load condition. IKEv2 Session Resumption proposes an extension to IKEv2 that allows a client to re-establish an IKE SA with a gateway in a highly efficient manner, utilizing a previously established IKE SA. Redirect mechanism can also be used to redirect a client to another router (trust anchor) to do mutual authentication and an optional proxy session negotiation on behalf of the server. This redirection happens during the IKE_SA_INIT and server does not maintain any information about the redirected client. After mutual authentication and optional proxy session negotiation trust anchor redirects the client back to the server with an Access Token which can be used as a dynamic pre-shared key between the server and client for password based IKE_AUTH exchange. Mechanism described here allows servers to compute the same pre-shared key dynamically, without contacting trust anchors, based on the information provided by the client during IKE_AUTH exchange. Access Token based authentication permits IDr of the responder to be different from that specified in Ticket and permits client to reuse the proxy session (negotiated between client and trust anchor) between client and server. Such a mechanism is useful especially for low power devices like handsets. For example, a mobile node can redirect a correspondent node to its home agent. Home agent can form a proxy session with correspondent node and then redirect it back to mobile node. Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on June 24, 2010. Copyright Notice Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the BSD License.

Authors

A Padmakumar
Manikchand Bafna
Pratima Sethi

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)