Introduction Service providers are seeking new ways to accommodate the surge in mobile data traffic and the variety of smart, portable devices coming onto their networks. Fixed and mobile operators are therefore looking at both licensed and unlicensed (Wi-Fi) technologies to meet this demand and to expand their customer footprint. Trusted Wi-Fi hotspots can be integrated into the SP’s existing policy and accounting infrastructure allowing the SP to maintain subscriber accountability. At the same time, traffic from these trusted Wi-Fi hotspots can be integrated into the SP’s existing packet core using standard Proxy Mobile IPv6 (s2a-PMIPv6) interface in order to provide IP mobility across Wi-Fi and 4G networks to enhance subscriber experience.      This document is an attempt to explain in high level about PMIPv6 . Proxy Mobile IPv6 (or PMIPv6, or PMIP) is a network-based mobility management protocol standardized by IETF and is specified in RFC 5213. It is a protocol for building a common and access technology independent of mobile core networks, accommodating various access technologies such as WiMAX, 3GPP, 3GPP2 and WLAN based access architectures. Proxy Mobile IPv6 is the only network-based mobility management protocol standardized by IETF. Contrary to Mobile IP approach, this functionality is implemented by the network, which is responsible for tracking the movements of the host and initiating the required mobility signalling on its behalf. However in case the mobility involves different network interfaces, the host needs modifications similar to Mobile IP in order to maintain the same IP address across different interfaces. Network-based mobility management enables IP mobility for a host without requiring its participation in any mobility-related signaling.  The network is responsible for managing IP mobility on behalf of the host.  The mobility entities in the network are responsible for tracking the movements of the host and initiating the required mobility signaling on its behalf.  This specification describes a network-based mobility management protocol and is referred to as Proxy Mobile IPv6. A proxy mobility agent in the network performs the signaling with the home agent and does the mobility management on behalf of the mobile node attached to the network.  Because of the use and extension of Mobile IPv6 signaling and home agent functionality, this protocol is referred to as Proxy Mobile IPv6 (PMIPv6). PMIPv6 vs  Mobile IP MIP (Mobile IP, originally RFC2002) is an early approach to get mobility in the Internet.As mentioned earlier , PMIPv6 does network based mobility  . Mobile IPv6 MIPv6 Home Agent is the Mobility Anchor Care of Address is acquired by MN in the foreign network PMIPv6 LMA is the Mobility Anchor Care of Address is that of MAG Some of the other challenges seen with Mobile IP : 1. Clients must implement MIP in the kernel (MIP mobility is host-based).     difficult to implement kernel changes     difficult to deploy (clients need software upgrade to get MIP support) [ The main advantage of PMIPv6 is that it needs no additional modifications on the MN (kernel and user space software), therefore it is transparent to the user devices. PMIPv6 is an access technology independent solution, so it can be used with WLAN, WiMAX, 3G UMTS, LTE, LTE-A or any other technology in the future]. 2. Large delay in  hand off . [ PMIPv6  provides fast handovers according to its localized nature, which means that the PMIPv6 has a well-defined domain area (Local Mobility Domain, LMD) where exchanging signaling messages is quite fast ]. 3. Security concerns (MIP support in the kernel provides an additional attack vector). Where can PMIPv6 be deployed? PMIPv6 is primarily targeted at the following networks: 1. WLAN-based campus-style networks:     PMIPv6 provides transparent hand off for mobile nodes in campus networks. 2. Advanced 3G/4G networks     Replace GTP (GPRS tunneling protocol) by PMIP, thus reduce the costs and management in the network . PMIPv6 Terminologies Note - There are two new nodes defined in PMIPv6 : (1) The Local Mobility Anchor (LMA) and (2) The Mobile Access Gateway (MAG).  Proxy Mobile IPv6 Domain: A network where the mobility management of a mobile node is handled using the Proxy Mobile IPv6 protocol. The domain consists of network entities like MAG & LMA between which Proxy Binding can be maintained on behalf of the mobile nodes. Local Mobility Anchor (LMA): LMA is the home agent for the mobile node in a PMIPv6 domain.  It is the topological anchor point for the mobile node's home network prefix and is the entity that manages the mobile node's binding state. Mobile Access Gateway (MAG): MAG is a function on an access router that manages the mobility-related signaling for a mobile node that is attached to its access link.  It is responsible for tracking the mobile node's movements to and from the access link Mobile Node (MN): An IP host, mobile node or router whose mobility is managed by the network. The MN may be an IPv4-only node, IPv6-only node, or a dual-stack node and is not required to participate in any IP mobility related signaling for achieving mobility for an IP address that is obtained in that PMIPv6 domain. Correspondent Node (CN): The device that the mobile node (MN) is communicating with such as a web server. A correspondent node may be either mobile (e.g. another MN) or stationary (e.g. server). Network Access Identifier (NAI): NAI is the user identity submitted by the client during network access authentication.  In roaming, the purpose of the NAI is to identify the user as well as to assist in the routing of the authentication request. The standard syntax is "user@realm" or as defined in rfc 4282. Mobile Node Identifier: The identity of a mobile node in the PMIPv6 domain. This is the stable identifier and is typically an identifier such as a Network Access Identifier (NAI) or other identifier such as a Media Access Control (MAC) address. Proxy Binding Update (PBU): A request message sent by MAG to LMA for establishing a binding between the MN's home network prefix and the MAG to which MN is attached Proxy Binding Acknowledgement (PBA): A reply message from LMA in response to a PBU message from MAG. Wi-Fi Mobility Lets look at different types of Wifi PMIPv6 deployments . WiFi Aggregation with Standalone LMA This deployment scenario is termed as “standalone” since there is no requirement of integrating LMA with the Evolved Packet Core.In this model, PMIPv6 facilitates IP mobility to a client less mobile node while roaming across Wi-Fi access network.   WiFi Aggregation with Mobile Packet Core (MPC) In this model, PMIPv6 facilitates IP mobility to a clientless mobile node not only while roaming across Wi-Fi access network but also while roaming across Wi-Fi and 4G/LTE infrastructure, since the subscriber session is anchored at the Packet Gateway or Evolved Packet Core.   WiFi Aggregation with Multiple Mobile Network Operator (MNO) This deployment model is an extension of the previous model and targeted for deploying Wi-Fi access as a Layer-2 wholesale service. Layer-2 wholesale allows a wireline or wireless service provider deploying Wi-Fi access network to partner with retail service providers, MNOs or MVNOs for use of their Wi-Fi infrastructure. The retail SP/MNO/MVNO has the direct business relationship (accounting, billing, policy etc.) with the end subscribers while having service level agreement with the Wi-Fi wholesale access provider. Useful Show Commands The following show commands can be used to verify the PMIPv6 client connectivity show pmipv6 domain This command displays summary information of a PMIPv6 domain > show pmipv6 domain <domain_name> profile <profile_name> NAI: @vodfone.com APN: VodafoneLMA: Vodafonelma NAI: *APN: ciscoapn LMA: ciscolma Note: Note that the domain name and the profile name can be up to 127 case-sensitive  alphanumeric characters. show pmipv6 mag bindings To display the binding information of a mobile access gateway (MAG), use this command. > show pmipv6 mag binding [Binding][MN]: Domain: D1, Nai: MN1@xyz.com         [Binding][MN]: State: ACTIVE       [Binding][MN]: Interface: Management        [Binding][MN]: Hoa: 0xE0E0E02, att: 3, llid: aabb.cc00.c800        [Binding][MN][LMA]: Id: LMA1       [Binding][MN][LMA]: lifetime: 3600        Binding][MN][GREKEY]: Upstream: 100, Downstream: 1 show pmipv6 mag globals This command displays the global PMIPv6 parameters of a Mobile Access Gateway. > show pmipv6 mag globals Domain  : D1 MAG Identifier  : M1         MAG Interface                   : Management         Max Bindings                    : 10000         Registration Lifetime           : 3600 (sec)         BRI Init-delay time             : 1000 (msec)         BRI Max-delay time              : 2000 (msec)         BRI Max retries                 : 1         Refresh time                    : 300 (sec)         Refresh RetxInit time           : 1000 (msec)         Refresh RetxMax time            : 32000 (msec)         Timestamp option                : Enabled         Validity Window                 : 7         Peer#1:                 LMA Name: AN-LMA-5K      LMA IP: 209.105.210.10         Peer#2:                 LMA Name: AN-LMA         LMA IP: 209.105.210.4         Peer#3:                 LMA Name: AN-LMA         LMA IP: 209.105.210.4 show pmipv6 mag stats In order to display the statistics of the Mobile Access Gateway (MAG), use this command. > show pmipv6 mag stats    [M1]: Total Bindings    : 1 [M1]: PBU Sent          : 7 [M1]: PBA Rcvd          : 4 [M1]: PBRI Sent         : 0 [M1]: PBRI Rcvd         : 0 [M1]: PBRA Sent         : 0 [M1]: PBRA Rcvd         : 0 [M1]: No Of handoff     : 0 show pmipv6 profile summary Using this command, you can verify the summary of the PMIPv6 profiles. > show pmipv6 profile summary     Profile Name     WLAN IDS (Mapped) ------------    -----------------   Group1            6 Note: To debug various PMIPv6 related events messages use the command   debug proxy-mobility.   To see the PMIPv6 configuration details, use the following show commands To see the details of a profile of a PMIPv6 domain, enter this command: show pmipv6 domain domain-name profile profile-name To see a summary of all the PMIPv6 profiles, enter this command: s how pmipv6 profile summary To see the global information about the PMIPv6 for a MAG, enter this command: show pmipv6 mag globals To see information about the MAG bindings for LMA or NAI, enter this command: show pmipv6 mag bindings {lma lma-name | nai nai-name} To see statistical information about MAG, enter this command: show pmipv6 mag stats domain domain-name peer peer-name To see information about PMIPv6 for all clients, enter this command: show client summary To see information about PMIPv6 for a client, enter this command: show client details client-mac-address To see information about PMIPv6 for a WLAN, enter this command: show wlan wlan-id Related Information Cisco Wireless Proxy Mobile IPv6 Configuration Guide Cisco Wireless LAN Controller Configuration Guide, Release 7.3 Cisco 5500 Series Wireless Controllers Cisco Wireless LAN Controller Configuration Guide, Release 7.4 - Configuring Proxy Mobile IPv6 PMIPv6: A Network-Based Localized Mobility Management Solution Configuring Proxy Mobile IPv6 ... View more

  Introduction The number of wireless devices for voice or data is projected to surpass the number of fixed devices. Mobile data communication will likely emerge as the technology supporting most communication including voice and video. More Information Mobile data communication will be pervasive in cellular systems such as 3G and in wireless LAN such as 802.11, and will extend into satellite communication. For communications devices, users expect mobility to be more than just the ability to move. The goal of communications mobility is for a device to be fully operable while it is moving. Mobile telephony has set a standard that mobile computing devices need to live up to. These devices need to be fully functional whenever and wherever they are operated. Mobile IP (or MIP) This document is an attempt  to explain in high level about Mobile IP . Mobile IP (or MIP) is an Internet Engineering Task Force (IETF) standard communications protocol that is designed to allow mobile device users to move from one network to another while maintaining a permanent IP address A standard that allows users with mobile devices whose IP addresses are associated with one network to stay connected when moving to a network with a different IP address. Mobility functions of Mobile IP are performed at the network layer rather than the physical layer and hence  the mobile device can span different types of wireless and wire line networks while maintaining connections and ongoing applications . Lets first look at the difference between Simple IP and Mobile IP . For simple IP protocol, a wireless device must obtain a new IP address (and lose existing connections) every time it changes its point of attachment. That is, moving from the coverage area of one PDSN to another PDSN constitutes a change in packet data session because a new IP address is assigned by the new PDSN. A packet data session and a PPP session are concurrent in simple IP, that is, the existence of the packet data session is dependent upon a PPP session. However , For mobile IP protocol, a wireless device is allowed to maintain the same IP address as it moves from link to link (network to network) and preserve existing connections during moves. That is, the packet data session can exist through several changes of the PPP session. The mobile IP allows the PPP session to be terminated and reestablished without the termination of the packet data session. A packet data session can span several PDSNs as long as the user continuously maintains mobility bindings at the Home Agent (the IP address is persistent).   Lets understand the same with an  analogy of  Postal Service. Topology  Mail was  sent to you by placing a letter (the packet payload) in an envelope addressed to you (IP header). The letter arrives at your local post office and is routed to you at your Home Address, . Now when you relocate to a new address , you tell the local post office (Home Agent) to forward packets all the letters to your new location (Care-of Address [CoA]). Now, when a letter addressed to your Home Address arrives at your local post office, it can now be readdressed (tunneled) to your new location (CoA). The letter then arrives at the post office that services your new location (Foreign Agent [FA]) and is delivered to you at your new location (CoA). This mail delivery is done with no effort (and usually even knowledge) by the original sender of the letter (Correspondent Node [CN]). Mobility and OSI At the bottom  of OSI is the access technology, where many existing mobility protocols  currently reside . The layers at the top are usually controlled by software applications, where no standard mobility protocol exists. For ex : Instant-messaging clients , Email clients . In the middle, the network or IP layer is rapidly proving itself to be the ideal place for link- and application-independent services like mobility. Layer 3 ( the network layer) / IP are ideal candidates for supporting full mobility protocols.As you know IP is supported on a wide range of wired and wireless links, and is supported by many applications. IP mobility allows all IP-enabled applications, whether they use Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or any other transport protocol, to seamlessly inherit full mobility across a diverse range of access link types. Users can roam from fixed Ethernet to wireless Ethernet to cellular, only noticing the degradation in speed and latency. The user does not need to restart applications, interrupt sessions, or reboot .   Mobile IP: Components Mobile Node (MN) A host or router that changes its point of attachment from one network or subnetwork to another . Mobility Node can be any IP device running a Mobile IP client stack; Mobile Nodes can be anything from smart phones to PDAs and laptops to network devices like routers . It does its own move detection and thus must be able to detect logical movement and learn its current location. Logical movement is not simply the change in the access device, but a change in the subnet associated with the access link. When a Mobile Node decides to hand over, it must signal this change to the Home Agent, typically through a Foreign Agent . Home Address Mobile Node's IP address can be called as its Home Address. The Home Address is allocated out of the Home Network, which is attached to the Home Agent. The Home Address is either statically assigned or dynamically allocated during the Mobile IP registration process. Home Agent (HA) The Home Agent is a router capable of processing Mobile IP routing updates, called registrations, and forwarding traffic to the Mobile Node through dynamically created tunnels. Care-of Address (COA) The CoA is the new IP address which is valid and routable at the Mobile Node's current point of attachment in the Foreign Network . The Mobile Node informs the Home Agent of this CoA during the Mobile IP registration process . Foreign Agent  (FA) FA stores information about mobile nodes visiting its network. Foreign agents also advertise care-of addresses, which are used by Mobile IP. If there is no foreign agent in the host network, the mobile device has to take care of getting an address and advertising that address by its own means. The FA acts as a router on a Mobile Nodes  visited network which provides routing services to the MN while registered. Protocol Concepts There are four basic requirements for a mobility : Location discovery We saw that two types of networks/location exist: the Home Network and the Foreign (Visited) Network. The type of network to which the Mobile Node is attached is central to the protocol, because each protocol results in a different type of Mobile IP handover and requires different Mobile IP signaling. The location is determined by examining Mobile IP agent advertisements, if one is received, or by examining the allocated Colocated CoA. Move detection Mobile Nodes are constantly on move and hence are always engaged in process of move detection which the act of monitoring changes in paths available into the network  .Whenever movement is detected, Mobile IP uses its Mobile IP handover policy algorithm to evaluate all available candidate routes and determine whether a change in routing is necessary ( Mobile IP handover) . Update signaling If Mobile IP handover has been initiated, the Mobile Node determines the type of Mobile IP signaling necessary based on its previous and new location type. This is in the  form of a Registration Request (RRQ) or a Deregistration Request. Path (re)establishment For successful Mobile IP registrations, a tunnel is established between the CoA and Home Agent .At this point, the Mobile Node cycles back to the move detection state, and the process begins again.     Changes in IPv6 for Mobile IPv6     A set of mobility options to include in mobility messages     A new Home Address option for the Destination Options header     A new Type 2 Routing header     New Internet Control Message Protocol for IPv6 (ICMPv6) messages to discover the set of home agents and to obtain the prefix of the home link     Changes to router discovery messages and options and additional Neighbor Discovery options     Foreign Agents are no longer needed . In the next article we will discuss the basics of PMIPv6 . Question Q. What  type of Dynamic Tunnel is created between  FA and HA , FA and COA? Why GTP based Tunnel  mechanism which is used in PMIPV6 (Network based Mobility) cannot be used in this  L3 - MIP Network  roaming scenario? A. The default tunnel mode is IP Encapsulation within IP Encapsulation. Optionally, GRE and minimal encapsulation within IP may be used. https://www.ietf.org/rfc/rfc2002.txt  (Refer to - Registration Lifetime ). I believe GTP and PMIPv6 tunneling was meant for 3GPP networks and didn't work well with non 3GPP networks . Reference IP Tunneling - Introduction to Mobile IP ... View more

  Introduction EAP-SIM is an Extensible Authentication Protocol (EAP) [RFC3748] mechanism for authentication and session key distribution using the Global System for Mobile communications (GSM) Subscriber Identity Module (SIM). [Hence the name !] . EAP Authentication As you all know EAP is an authentication framework which supports multiple authentication methods. EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802 .   GSM cellular networks use a subscriber identity module (SIM) card to  carry out user authentication.. EAP-SIM uses a SIM authentication algorithm between the client and an Authentication, Authorization and Accounting (AAA) server providing mutual authentication between the client and the network.   In EAP-SIM the communication between the SIM card and the  Authentication Centre (AuC) replaces the need for a pre-established  password between the client and the AAA server. Note - GSM is a second generation mobile network standard. Second  generation mobile networks and third generation mobile networks use different authentication and key agreement mechanisms.                   EAP-AKA specifies an EAP method that is based on the Authentication and  Key Agreement (AKA) mechanism used in 3rd generation mobile networks  Universal Mobile Telecommunications System (UMTS) and CDMA2000. Advantages of EAP - AKA The use of the AKA also as a secure PPP authentication method in devices that already contain an identity module. The use of the 3rd generation mobile network authentication infrastructure in the context of wireless LANs Relying on AKA and the existing infrastructure in a seamless way with any other technology that can use EAP. Requirements    To run an EAP-SIM/AKA authentication, a client as wpa_supplicant, which has access to a (U)SIM, is needed. The WLAN access point on the network has to support EAP (which is often transcribed as WPA(2)-RADIUS or WPA(2)-ENTERPRISE). The WLAN AP/Controller has to have access to a RADIUS server, which handles the authentication and session key generation. The RADIUS server in a productive environment needs for EAP-SIM/AKA access to the home location register (HLR) of the MNO where the (U)SIMs are registered . Diagram This is explained in the diagram below     EAP SIM is based on the authentication and encryption algorithms stored on the Global System for Mobile Communications (GSM) SIM. Its based on a challenge-response mechanism and employs a shared secret key, Ki, which is stored on the SIM and otherwise known only to the GSM operator's Authentication Center (AuC). When a GSM SIM is given a 128-bit random number (RAND) as a challenge, it calculates a 32-bit response (SRES) and a 64-bit encryption key (Kc) EAP SIM also enhances the basic GSM authentication mechanism by providing for mutual authentication between the client and the AAA server Secure keyed hashing algorithm, HMAC-SHA1 (one way hashing) .   Sample call flow  - EAP SIM   Call flows are exactly same as EAP-SIM with the type AKA. The USIM security algorithms are used in this case.     Abbreviations GSM - Global System for Mobile communications. IMS - International Mobile Subscriber Identifier, used in GSM to identify subscribers. MAC - Message Authentication Code . HLR - Home Location Register . NAI - Network Access Identifier . RAND is a 128-bit random challenge issued from the base station to the mobile. SRES - The authentication result parameter in GSM, corresponds to the RES parameter in 3G AKA, 32 bits. USIM - UMTS Subscriber Identity Module.  USIM is an application that is resident on devices such as smart cards distributed by UMTS operators.    ... View more

    Introduction Mobile network traffic is growing exponentially, and service providers must manage their networks efficiently to meet consumer demand. The technology evolution of radio access networks is limited by the laws of physics, and significant growth in radio frequency (RF) efficiency can no longer be expected. Long-Term Evolution (LTE) radio access is reaching the limits of Shannon's law, the spectrum available for mobile data applications is limited, and the only solution for increasing overall mobile network capacity is to increase the carrier-to-interference ratio while decreasing cell size and deploying small cell technologies. The most efficient way to use small cells is to position them in locations where significant amounts of data are generated (shopping malls, stadiums, university campuses, public transportation hubs, etc.) and where subscribers spend most of their time and therefore consume significant amounts of data (homes, offices, etc.). In this context we will discuss about the latest AAA protocol being deployed by SP's Worldwide for managing mobile traffic in both licensed and unlicensed spectrums . DIAMETER is a new framework in the Internet Engineering Task Force (IETF) for the next-generation AAA server. New RFC-6733 (Diameter Base Protocol) The Diameter base protocol is intended to provide an Authentication,Authorization and Accounting (AAA) framework for applications such asnetwork access or IP mobility. Diameter is also intended to work in both local Authentication, Authorization & Accounting and roaming situations It evolved from and replaces the much less capable RADIUS protocol that preceded it. Diameter is a message based protocol, where AAA nodes exchange messages and receive Positive or Negative acknowledgment for each message exchanged between nodes . The name is a play on words, derived from the RADIUS protocol, which is the predecessor (a diameter is twice the radius). Diameter is not directly backwards compatible but provides an upgrade path for RADIUS . Diameter is Message (Packet) based protocol. There are two types of messages Request Messages and Answer Messages. And the Message structure is of following sort. . Lets quickly go through few major difference betweens RADIUS and DIAMETER in a nutshell . Feature RADIUS DIAMETER Communications Ports 1812- UDP ,1813- Accounting 3686 for base protocol Error reporting scheme Not supported Supported Transport method UDP SCTP or TCP and optionally also use UDP Maximum size of attributes 255 Bytes 16MB Scalability Poor Good Reliability Not reliable Acknowledgement for packets , Discarding of packets . Packets that do not contain the expected information, or that have errors, are silently discarded. Server can notify the client of problem by sending an error message Benefits of DIAMETER In this section we will discuss some the benefits of DIAMETER based on various characteristics required in AAA operations . Characteristic DIAMETER Support Failover Mechanism RADIUS does not have any kind of failover mechanism, even it can't have failover mechanism because it is UDP based .DIAMETER defines the Application layer acknowledgements and failover methods which we will define later. Transmission Layer Security RADIUS does not provide per packet confidentiality. RFC-3162 provide IPsec but it is not mandatory, while in diameter it is mandatory to apply per packet confidentiality with the help of IPSec (IP Security) and TLS (Transport Layer Security). Peer-to-peer bidirectional Framework enables push and pull application models or architectures (RADIUS is unidirectional) Agent Support RADIUS does not provide for explicit support for agents,including Proxies, Redirects and Relays . Diameter defines agent behavior explicitly i.e. which agent will alter which part of Diameter message. For example Redirect agent will not alter any part of diameter message/ packet. Each agents behaviour is defined later. Server-initiated messages Server-initiated messages implies; the messages that server initiates him self for the client. For ex :-If the established connection or session between server and client is disconnected due to some undesirable event, server sends a message to client for reconnect or reauthenticate himself. RADIUS server-initiated messages are defined in [DYNAUTH] Auditability RADIUS does not define data-object security mechanisms, and as a result, untrusted proxies may modify attributes or even packet headers without being detected. Combined with lack of support for capabilities negotiation, this makes it very difficult to determine what occurred in the event of a dispute. In DIAMETER the implementation of data object security is not mandatory but supported . Transition support Diameter does not share a common protocol data unit (PDU) with RADIUS,considerable But currently it can be deployed in same network as RADIUS Capability negotiation . RADIUS does not support error messages, capability negotiation, or a mandatory/non-mandatory flag for attributes. Two diameter peers exchange their identity and its capabilities (such as protocol version number, supported diameter applications, security mechanism etc.). Peer discovery and Configuration RADIUS deployment requires that the name or address of servers or clients be manually configured, along with the corresponding shared secrets. Through DNS, SRV and NAPTR Diameter enables dynamic discovery of peers . Roaming Support To improve scalability, the concept of proxy chaining is used via an intermediate server, facilitating roaming between providers .RADIUS does not provide explicit support for proxies, and lacks auditability and transmission-level security . Diameter deals with this problem by providing secure and scalable roaming. Very efficient Can support 32-bit VSAs which translates to efficiency (RADIUS = 8 bits) Handles many more pending AAA requests . 32-bit alignment takes advantage of new hardware processor technologies . Secure Authentication replay attack prevention through encryption DIAMETER AVP Structure Diameter AVPs are the basic unit inside the Diameter message that carries the Data(Authentication Data , Security Data , Data pertaining to Application etc). There must be at least one AVP inside Diameter message. The AVP Code, combined with the Vendor-Id field, identifies the attribute uniquely. AVP numbers 1 through 255 are reserved for backward compatibility with RADIUS, without setting the Vendor-Id field. AVP numbers 256 and above are used for Diameter, which are allocated by IANA . -All data is delivered in the form of AVP's . -Some of these AVP values are used by the Diameter protocol itself, while others deliver data -Ability to add new commands and AVP's . -AVP"s have mandatory/non-mandatory bit . -Supports for vendor spefici Attribute-Value-Pairs(AVP's) and commands . Reference http://en.wikipedia.org/wiki/Diameter_%28protocol%29 http://tools.ietf.org/html/rfc6733 ... View more