RADIUS Extensions for Network-Assisted
Multipath TCP (MPTCP)OrangeRennes35000Francemohamed.boucadair@orange.comOrangeRennesFrancechristian.jacquenet@orange.comOne of the promising deployment scenarios for Multipath TCP (MPTCP)
is to enable a Customer Premises Equipment (CPE) that is connected to
multiple networks (e.g., DSL, LTE, WLAN) to optimize the usage of its
network attachments. Because of the lack of MPTCP support at the server
side, some service providers consider a network-assisted model that
relies upon the activation of a dedicated function called: MPTCP
concentrator.This document specifies a new Remote Authentication Dial-In User
Service (RADIUS) attributes that carry the IP addresses that allow CPE
devices to reach one or multiple MPTCP concentrators.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.One of the promising deployment scenarios for Multipath TCP (MPTCP,
) is to enable a Customer Premises
Equipment (CPE) that is connected to multiple networks (e.g., DSL, LTE,
WLAN) to optimize the usage of such resources, see for example . Network-assisted MPTCP deployment models are designed to facilitate
the adoption of MPTCP for the establishment of multi-path communications
without making any assumption about the support of MPTCP by the
communicating peers. This deployment scenario relies on MPTCP proxies
located on both the CPE and network sides ().
MPTCP proxies are responsible for establishing multi-path communications
on behalf of endpoints, thereby taking advantage of MPTCP capabilities
to optimize resource usage to achieve different goals that include (but
are not limited to) bandwidth aggregation, primary/backup communication
paths, and traffic offload management.Within this document, an MPTCP concentrator (or concentrator) refers
to a functional element that is responsible for aggregating the traffic
originated by a group of CPEs. This element is located in the network.
One or multiple concentrators can be deployed in the network to assist
MPTCP-enabled CPEs to establish MPTCP connections via their available
network attachments. On the uplink path, the concentrator terminates the
MPTCP connections received from its customer-facing interfaces and
transforms these connections into legacy TCP connections towards upstream servers. On the downlink path,
the concentrator turns the legacy server's TCP connection into MPTCP
connections towards its customer-facing interfaces.This document specifies two new Remote Authentication Dial-In User
Service (RADIUS, ) attributes that carry
the MPTCP concentrator IP address list (). In
order to accommodate both IPv4 and IPv6 deployment contexts, and given
the constraints in Section 3.4 of , two
attributes are specified. Note that one or multiple IPv4 and/or IPv6
addresses may be returned to a requesting CPE. A sample use case is
described in .This document assumes that the MPTCP concentrator(s) reachability
information can be stored in Authentication, Authorization, and
Accounting (AAA) servers while the CPE configuration is usually provided
by means of DHCP ().This specification assumes an MPTCP concentrator is reachable through
one or multiple IP addresses. As such, a list of IP addresses can be
communicated via RADIUS. Also, it assumes the various network
attachments provided to an MPTCP-enabled CPE are managed by the same
administrative entity.This document adheres to for defining the new
attributes.DescriptionThe RADIUS MPTCP-Concentrator-IPv4 attribute contains the IPv4
address of an MPTCP concentrator that is assigned to a CPE.
Because multiple MPTCP concentrator IP
addresses may be provisioned to an authorised CPE (that is a CPE
entitled to solicit the resources of a concentrator to establish
MPTCP connections), multiple instances of the
MPTCP-Concentrator-IPv4 attribute MAY be included; each instance
of the attribute carries a distinct IP address. Both MPTCP-Concentrator-IPv4 and
MPTCP-Concentrator-IPv6 attributes MAY be present in a RADIUS
message.The MPTCP-Concentrator-IPv4 Attribute MAY appear in a RADIUS
Access-Accept packet. It MAY also appear in a RADIUS
Access-Request packet as a hint to the RADIUS server to indicate a
preference, although the server is not required to honor such a
hint.The MPTCP-Concentrator-IPv4 Attribute MAY appear in a
CoA-Request packet.The MPTCP-Concentrator-IPv4 Attribute MAY appear in a RADIUS
Accounting-Request packet.The MPTCP-Concentrator-IPv4 Attribute MUST NOT appear in any
other RADIUS packet.TypeTBA (see ).Length6Data TypeThe attribute MPTCP-Concentrator-IPv4 is of type ip4addr
(Section 3.3 of ).ValueThis field includes an IPv4 address (32 bits) of the MPTCP
concentrator. The MPTCP-Concentrator-IPv4
attribute MUST NOT include multicast and host loopback addresses
. Anycast addresses are allowed to
be included in an MPTCP-Concentrator-IPv4 attribute.DescriptionThe RADIUS MPTCP-Concentrator-IPv6 attribute contains the IPv6
address of an MPTCP concentrator that is assigned to a CPE.
Because multiple MPTCP concentrator IP
addresses may be provisioned to an authorised CPE (that is a CPE
entitled to solicit the resources of a concentrator to establish
MPTCP connections), multiple instances of the
MPTCP-Concentrator-IPv6 attribute MAY be included; each instance
of the attribute carries a distinct IP address. Both MPTCP-Concentrator-IPv4 and
MPTCP-Concentrator-IPv6 attributes MAY be present in a RADIUS
message.The MPTCP-Concentrator-IPv6 Attribute MAY appear in a RADIUS
Access-Accept packet. It MAY also appear in a RADIUS
Access-Request packet as a hint to the RADIUS server to indicate a
preference, although the server is not required to honor such a
hint.The MPTCP-Concentrator-IPv6 Attribute MAY appear in a
CoA-Request packet.The MPTCP-Concentrator-IPv6 Attribute MAY appear in a RADIUS
Accounting-Request packet.The MPTCP-Concentrator-IPv6 Attribute MUST NOT appear in any
other RADIUS packet.TypeTBA (see ).Length18Data TypeThe attribute MPTCP-Concentrator-IPv6 is of type ip6addr
(Section 3.9 of ).ValueThis field includes an IPv6 address (128 bits) of the MPTCP
concentrator. The MPTCP-Concentrator-IPv6
attribute MUST NOT include multicast and host loopback addresses
. Anycast addresses are allowed to
be included in an MPTCP-Concentrator-IPv6 attribute.This section does not aim to provide an exhaustive list of deployment
scenarios where the use of the RADIUS MPTCP-Concentrator-IPv6 and
MPTCP-Concentrator-IPv4 attributes can be helpful. Typical deployment
scenarios are described, for instance, in . shows an example where a CPE is assigned an
MPTCP concentrator. This example assumes that the Network Access Server
(NAS) embeds both RADIUS client and DHCPv6 server capabilities.Upon receipt of the DHCPv6 Solicit message from a CPE, the NAS sends
a RADIUS Access-Request message to the AAA server. Once the AAA server
receives the request, it replies with an Access-Accept message (possibly
after having sent a RADIUS Access-Challenge message and assuming the CPE
is entitled to connect to the network) that carries a list of parameters
to be used for this session, and which include MPTCP concentrator
reachability information (namely a list of IP addresses).The content of the MPTCP-Concentrator-IPv6 attribute is then used by
the NAS to complete the DHCPv6 procedure that the CPE initiated to
retrieve information about the MPTCP concentrator it has been
assigned.Upon change of the MPTCP concentrator assigned to a CPE, the RADIUS
server sends a RADIUS CoA message that
carries the RADIUS MPTCP-Concentrator-IPv6 attribute to the NAS. Once
that message is accepted by the NAS, it replies with a RADIUS CoA ACK
message. The NAS replaces the old MPTCP concentrator with the new
one. shows another example where a CPE is
assigned an MPTCP concentrator, but the CPE uses DHCPv6 to retrieve a
list of IP addresses of an MPTCP concentrator.Some deployments may rely on the mechanisms defined in or , which allows
a NAS to pass attributes obtained from a RADIUS server to a DHCP
server.RADIUS-related security considerations are discussed in .MPTCP-related security considerations are discussed in and .Traffic theft is a risk if an illegitimate concentrator is inserted
in the path. Indeed, inserting an illegitimate concentrator in the
forwarding path allows to intercept traffic and can therefore provide
access to sensitive data issued by or destined to a host. To mitigate
this threat, secure means to discover a concentrator should be
enabled.The following table provides a guide as what type of RADIUS packets
that may contain these attributes, and in what quantity.The following table defines the meaning of the above table
entries:IANA is requested to assign two new RADIUS attribute types from the
IANA registry "Radius Attribute Types" located at
http://www.iana.org/assignments/radius-types:MPTCP-Concentrator-IPv4 (TBA)MPTCP-Concentrator-IPv6 (TBA)Thanks to Alan DeKok for the comments.