Subject: RE: multiple devices or multiple users ?

From: "Wang, Cliff" <[email-masked]>
Date: Mon, 7 Jan 2002 01:39:51 -0000

My 2 cents:

The existing charter says:
"- A device (on behalf of a user) to authenticate to an agent in the local
network. The agent might be non-local, but at the boundary of
some AAA-equivalent function. The agent is called PANA Authentication Agent
(PAA) in this charter. "

So user should not be in the picture unless we modify the charter again. The
device has an identity, whether a device ID or something else, and a
corresponding credential. Both the device identity and the credential are
presented to the PAA for authentication. The user is out of the picture here
since PAA is unaware of it. 

However, it happens that when the device has a single user(owner), the
device authentication is equivalent to the user authentication given the
one-to-one binding. (Actually the device may use/borrow the user identity
and credential to authenticate to PAA).

When a device has multiple users, the device authentication should be just
for itself.  The local authentication of multiple users on the device is
outside the scope of PANA. Or under the multiple user scenario, is it still
possible that we still use/borrow one user's ID and credential to
authenticate to PAA?

-----Original Message-----
From: Paal Engelstad [mailto:[email-masked]] 
Sent: Saturday, January 05, 2002 5:14 PM
To: Hesham Soliman "ERA"; 'Yoshihiro Ohba'; Reinaldo Penno; Patil Basavaraj
"NET/Dallas"; 'PANA'; David Spence
Subject: Re: multiple devices or multiple users ?

Hesham, Yoshihiro Ohba,

These are not the only scenarios of the end system. I can at least see 8
possible scenarios: (1 user, many users) X (1 device, many devices) X (user
is authenticated, device is authenticated). 

Hopefully PANA will not have to come up with a protocol for that is designed
for a number of specific scenarios of how the end-system is organized.
Instead, I think we can abstract away from these details. From the top of my
head:

1) First of all, an ID identifies the user, an IP-address the device, and
KEYS and a security CONTEXT addresses the security of the authentication.
And there must be a binding between these identifiers. So the PAA only need
to deal with a number of:

(ID, IP-address, KEYS, optionally some context)

that is associated with the end-system.

 a) What hides behind an ID (e.g. a user, many users, a device, a software
module, etc) is system specific. I propose that this is out of scope of PAA.

 b) What hides behind an IP-address (e.g. a device, many devices, etc) is
also system specific. I propose that also this is out of scope of PAA. 

 c) What hides behind a key (e.g. one or many software modules for strong
encryption or one or many users for a password, or a combination) is also
system specific. I propose also that is out of scope of PAA.

 d) Since the PAA authenticates an ID, at an IP-address, with some KEYS of
an end-system CONTEXT information should only be concerned with HOW THE END
SYSTEM LOOKS FROM OUTSIDE, i.e. from PAA's perspective. 

Examples of contexts include:
-Home realm of user-ID, or information about Authentication Authority that
issued or administers the ID.
- Through which ARs does the end-system connect to the Access Domain
- How long are authentication-timeouts (e.g. long for passwords over fixed
lines, and short for device-assisted strong key security over wireless
links, etc.) 
- The end-system might want to bind its security association with the Access
Domain to its own set of interface IDs ???
- ...etc...

The same analysis can be done in the reverse direction where it is the
end-system that authenticates the PAA.

2) With this in mind, PAA should not be concerned with the internal
structure of the end system. PAA delivers the IP-packet (e.g. containing the
EAP-over-IP challenge, for example as in
http://search.ietf.org/internet-drafts/draft-engelstad-pana-eap-over-ip-00.t
xt) to the end system, and from then on delivering the packet to the right
place is the system's own problem. It's IP!!! If the packet arrives in the
end-system by a router, a host, a relay agent, or whatever... it is beyond
concern of the PAA and definitely beyond the scope of the PANA WG.

I don't say that my proposals above are the best. What I am saying is that
we can hopefully abstract away from the discussions in this thread in a
similar way as I have outlined above.

Paal

> 
> Fra: "Hesham Soliman (ERA)" <[email-masked]>
> Dato: 2002/01/05 Sat PM 02:33:29 CET
> Til: "'Yoshihiro Ohba'" <[email-masked]>, 
>    Reinaldo Penno
> 	 <[email-masked]>, 
>    "Patil Basavaraj (NET/Dallas)"
> 	 <[email-masked]>,
>    "'PANA'" <[email-masked]>,
>    David Spence <[email-masked]>
> Tema: multiple devices or multiple users ?
> 
> Obviously there is a difference between this
> issue and the service-related discussion
> so I changed the thread. 
> 
> So, I think we can have several scenarios
> and I'll just mention a couple below:
> 
> 1. One device attached to the network and on
>    the other side of it, several devices are attached.
>    This is similar to the DSL case or the mobile 
>    networks case (monet). The devices on the other
>    side of the router can belong to the same user
>    or several.
> 
> 2. One devices with several users.
> 
> 
> In case (1), there was a discussion on this list
> many months ago between Erik and I, in which Erik
> suggested that it should be the responsibility
> of the router (mobile router or DSL router) to
> authenticate the users attached to it, and that
> the ISP simply bills the owner of that router
> (DSL or mobile). I think this makes a lot of
> sense. 
> 
> The alternative to that was to have some token
> that is authenticated and consequently authorised
> by the ISP's router to allow access. The idea
> was to allow each user to have his/her own
> token. In this case the charging can be done per
> user. 
> 
> Protocol wise this would mean something like
> IP in IP tunnelling between the devices and
> the default router. I'm not sure how realistic
> that would be. 
> 
> So, for case (2) basically, the only solution
> I can see is the token per user. So it is
> possible to do, without separating the port
> number space, but I haven't looked at that
> in detail yet. 
> 
> Hesham
> 
> 
> 
> 
>   > -----Original Message-----
>   > From: Yoshihiro Ohba [mailto:[email-masked]]
>   > Sent: Friday, January 04, 2002 10:06 PM
>   > To: Reinaldo Penno; Patil Basavaraj (NET/Dallas); 'PANA'; 
>   > David Spence
>   > Subject: Re: DSL Scenario
>   > 
>   > 
>   > On Fri, Jan 04, 2002 at 03:50:48PM -0500, Yoshihiro Ohba wrote:
>   > > On Fri, Jan 04, 2002 at 10:42:22AM -0800, Reinaldo Penno wrote:
>   > > > Hello,
>   > > > 
>   > > > This goes back to the discussion on the meeting if
>   > > > PANA is directed to devices or users (real users). 
>   > > > 
>   > > > It seems that PANA is going to fit properly in a
>   > > > mobile world where you carry your device around and
>   > > > usually do not share it with anyone, but will have a
>   > > > hard time in broadband access if the model assume is
>   > > > 1:1 (one device, one user).
>   > > 
>   > > If my understanding is correct, the most flexible PANA 
>   > model assumes
>   > > m:1 (one or more devices, one user at the same time), but does not
>   > > assume 1:m (one device, one or more users at the same time). The
>   > 
>   > Correction: 1:m (one device, multiple users at the same time)
>   > 
>   > Yoshihiro Ohba
>   > 
>   > > reason for not assuming 1:m was discussed about six month 
>   > ago .  See
>   > > the following (BURP was the old name for PANA) which can 
>   > be also find
>   > > in http://www.toshiba.com/tari/issues.txt.
>   > > 
>   > > 
>   > --------------------------------------------------------------------
>   > > Issue #7: Is it possible to use BURP for sharing a single 
>   > IP address 
>   > >           but separating accounts among multiple users?
>   > > 
>   > > It is difficult for the following reason.  To support such a
>   > > capability, partitioning TCP/UDP source port numbers based on user
>   > > identity would be necessary.  However, this would impose 
>   > significant
>   > > modification in existing OS and application software to 
>   > support that,
>   > > which seems unacceptable.  So in the current requirement 
>   > this should
>   > > be avoided unless we see strong arguments or compelling need.
>   > > 
>   > --------------------------------------------------------------------
>   > > 
>   > > > 
>   > > > The DSL scenario described is very true today and
>   > > > applies to other access methods like cable, Ethernet,
>   > > > etc. In one household people have different needs. You
>   > > > can have for instance content filtering to the kids
>   > > > and not to the parents, and this is tied to the
>   > > > authentication/authorization. Same goes for other
>   > > > services.
>   > > 
>   > > If the above mentioned scenario is possible by using the 
>   > m:1 model, 
>   > > we can add the scenario to the draft.
>   > > 
>   > > > 
>   > > > Although PANA is directed to devices (on behalf of
>   > > > users), we should not assume that a device is owned by
>   > > > a single person. Since the PANA protocol is used for
>   > > > conveying information about the user, and not the
>   > > > device, it doesn't make sense to make a protocol tied
>   > > > to the device since different people using the same
>   > > > device can have very distinct rights and services.
>   > > 
>   > > 
>   > > It depends on the meaning of "different people using the same
>   > > device".  If it means that different people using the same
>   > > device *at the same time*, it is diffucult for PANA to support 
>   > > the model since it is 1:m model.
>   > > 
>   > > On the other hand, it would be easier for multiple users 
>   > to use the
>   > > same device at different times, which is m:1 model 
>   > instead of 1:m, and
>   > > PANA should work with those models.
>   > > 
>   > > 
>   > > Yoshihiro Ohba
>   > > 
>   > > 
>   > > 
>   >
> 
>

---

From: "Woojune Kim" <[email-masked]>
Date: Mon, 7 Jan 2002 08:59:03 -0500

Agreed. 
	 
	But wasn't the original problem raised because we were
considering cases where we could have multiple devices hidden behind
another device. Do we just authenticate the device at the front (the
mobile router ?) or try to authenticate the devices behind it ?
	 
	Here we are trying to define granulatiry at which we are trying
to allow AAA actions to be carried out ?
	 
	This is I think different from the concept of whether we try to
authenticate users or devices as stated normally. (e.g.. phones and
their users)
	 
	my 2 cents 

	-----Original Message----- 
	From: John Schnizlein 
	Sent: Mon 07/01/2002 07:46 
	To: George Tsirtsis 
	Cc: 'PANA' 
	Subject: RE: multiple devices or multiple users ?

	Not missing anything.
	
	I think this is the same point that Bernard Aboba made (maybe in
a
	different WG session) when he said that you only get trouble if
you
	try to specify authentication any more precisely than what/who
RADIUS
	authenticates.
	
	Maybe including too much.
	
	I thought the consensus was that PANA would not deal with key
distribution.
	
	John
	
	At 07:29 AM 1/7/2002, George Tsirtsis wrote:
	
	>I do not think the distinction between users and devices in the
context of
	>PANA is useful.
	>
	>Authentication/security protocols tend to run between
*elements* that
	>identify themselves according to the requirements of the
protocol in
	>question. Users, devices, IP stacks are all *elements* that can
use a given
	>security protocol. Think of IPSEC. Does IPSEC run between
devices or between
	>users? Does it mater? Isn't that an implementation detail and a
function of
	>who or what *element* owns the keys? Why should PANA be
different?
	>
	>Say for PANA we use NAIs and Keys to identify end points
(elements) We can
	>give these NAIs and Keys to both users and devices and indeed
we can require
	>a device to do PANA on boot up, to get initial access to the
network, as
	>well as require any user of that device to do PANA again to
access the
	>network properly.
	>Am I missing something?

---

From: MORAND Lionel FTRD/DAC/ISS <[email-masked]>
Date: Mon, 7 Jan 2002 18:49:15 +0100

Hi,

As I said during the meeting, I think that a real added-value for the PANA
protocol would be to be able to differentiate the user from the device
during the attach procedure. One of the ultimate goal of PANA is to provide
a way for the user to move from various access networks (with heterogeneous
L2 technologies) using the same access procedure. Of course, the simplest
scenario is to have one user using a multi-mode terminal. But a more
concrete one will be to have the same user using a specific terminal per
access (at least for the short term). So it is important
1) to be able to use the same user ID from one device to another,
2) to use this user ID for authorizing the access to the network.

Moreover, the same device could be used by multiple users, having different
service profiles, QoS offerings, security parameters, etc., for the same
access network link. Tying the authentication phase to the lone device makes
impossible the differentiation in the service offering in the access
network, and leads to a non-optimized default mode.

For instance, in the DSL case, when the access network operator and the ISP
are different, it is not possible to provide a differentiated service
offering because there is no way for the AN operator to identify clearly the
user. One counter-example is the GPRS case: any user is able to use any GPRS
terminal, experiencing the same level of service.

Maybe I was redundant with other comments but I thought it was important to
enforce it ;)

Cheers,
Lionel Morand.

-----Message d'origine-----
De : Hesham Soliman (ERA) [mailto:[email-masked]]
Envoyé : lundi 7 janvier 2002 16:21
À : 'George Tsirtsis'; 'Paal Engelstad'; Hesham Soliman (ERA);
'Yoshihiro Ohba'; Reinaldo Penno; Patil Basavaraj "NET/Dallas"; 'PANA';
David Spence
Objet : RE: multiple devices or multiple users ?

I'm not going to argue for changing the charter ...again !
Apparently the distinction between user and device
authentication was removed, I was off the list back then
and didn't get a chance to express my opinion. But 
for the record, I disagree. Reasons are below.

  > I do not think the distinction between users and devices in 
  > the context of
  > PANA is useful. 

=> Let me answer you by asking this question: Why does 
and ISP want to run AAA? IMHO for 2 reasons:

- Making sure USERS will pay. Devices don't have bank
accounts :)

- Making sure Bad Guys stay out of the network, by 
identifying them during the authentication process. 
Again Bad Devices do not exist...Bad People do !

  > identify themselves according to the requirements of the protocol in
  > question. Users, devices, IP stacks are all *elements* that 
  > can use a given
  > users? 

=> Devices.

Does it mater? 

=> YES !

Isn't that an implementation detail 

=> Absolutely not. Think of a GSM phone. If I give you
my phone (only the device not the SIM card) and 
you start using it with your SIM card, will the operator
still think it's me using the phone ? 
Who does the operator authenticate now ? The SIM card 
is a _subscriber_ identifier. The operator couldn't care
less about the device you're using.

What is an implementation issue, however, is how you
represent this user identity: pice of plastic, password, 
....etc

  > and a function of
  > who or what *element* owns the keys? 
Why should PANA be different? 

=> Again response by asking a question: SIP manages USER mobility, 
why should MIP be different ?? 
Do you see why this logic is not right ? They_do_different_ 
things.

Cheers,
Hesham 

PS: As IU said I will not argue for the charter 
change of course, but this lack of distinction
makes no sense to me.

---

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Mon, 7 Jan 2002 16:28:38 -0600

John Vollbrecht [mailto:[email-masked]] wrote:
> I am a bit confused I think.   I agree that the distinction 
> between users and devices is not useful.
> Something, (and element) a user or a device, proves it knows 
> something - say an id and pw.  The authenticator
> signals that combination is "ok".
> 
> My confusion is - who does the authenticator signal?  What 
> form does the signal take (e.g. and EAP success or RADIUS Access
> Accept, or a Kerberos service ticket).
> 

The thinking so far has been that there would be a network agent
termed PANA Authentication Agent (PAA) within the access network. Now
whether this agent would be on the first hop access point (eg. 802.11b
access point or NAS) or on the first hop router or elsewhere in the
access network is yet undetermined. We need to arrive at some
conclusions on what would be the best choice for this agent. 
The authenticator (user or device) would signal this agent. 

> Normally I would think of an authentication as "binding" a 
> known user (or device) to a port on an access device, or to a SSL
session, 
> or to a WEP key or to a "ticket".  With the PANA discussion I am
> confused about this "binding".  I get the idea that the purpose is
> to authenticate access to the net, but it is
> not clear where the control (permit/deny) of the access will 
> take place.

The purpose of PANA is to only signal. Access control itself is a
derivative function of the access authentication. Access control may
be implemented at the access point or the first hop router(FHR). The PAA
would possibly download access control filters to the AP/NAS/FHR via
COPS (for example) and thereby achieve access control. But please
note that the PANA WG will not specify how access control is
achieved. PANA merely facilitates the signaling of credentials/auth
info between the user/device and the PAA (in the access network).

Permit/deny for network access may occur in some back end
RADIUS/Diameter/Proprietary server or at the PAA itself. Based on the
results of the access request authentication, access control is
implemented at some node.

> 
> My impression is that the goal here is to create a generic 
> way to authenticate access to the network.  A model that includes a
> description of the "generic players" in this would help me to think
> about the issues.  Is there such a model?
> 

Do you have some examples of what you mean by "generic players"?

> -- John

Not sure if I answered your question. If you are still unsure about
PANAs goals,
we can discuss further.

-Basavaraj

---

From: George Tsirtsis <[email-masked]>
Date: Tue, 8 Jan 2002 04:56:41 -0500

-----Original Message-----
From: Patil Basavaraj (NET/Dallas) [mailto:[email-masked]]
Sent: Monday, January 07, 2002 10:29 PM
To: 'ext John Vollbrecht'; George Tsirtsis
Cc: Paal Engelstad; Hesham Soliman ""ERA"; Yoshihiro Ohba; Reinaldo
Penno; PANA; David Spence
Subject: RE: multiple devices or multiple users ?

GT> I was hoping to support both models. Both drafts by myself (EAP over
ICMP) and Paal (EAP over IP) can have the authenticator in the Access Router
or in a server behind it.

session, 

GT> Exactly! PANA is the protocol between the end node and the Authenticator
(Access Router or server behind it). How the authenticator communicates with
back-end servers (etc AAA, Kerberos etc) is out of scope since there are
already protocols for that. People remember that IETF builds *protocols* not
systems! i.e.: we are trying to build a piece that is missing so that the
industry can put pieces together to build a system.

George

---

From: [email-masked]
Date: Tue, 8 Jan 2002 13:44:36 +0200

Hello,

I think this discussion about multiple users or multiple devices needs
more arguments. Why couldn't multiple users _simultaneously_ use the
same device (mobile router for example), if they can use it separately.
What is The thing behind this?

The device id alone can't be trusted. MAC and IP addresses can be
changed, thus making the device "change". On the other hand a device may
have multiple interfaces with different characteristics. Whatever goes
through a network, wireless or wired, can be changed. The result depends
on how the data integrity is protected.

- Dan Forsberg

> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 7. tammikuuta 2002 21:28
> To: Wang, Cliff
> Cc: Yoshihiro Ohba; Hesham Soliman (ERA); George Tsirtsis; Paal
> Engelstad; Reinaldo Penno; Patil Basavaraj (NET/Dallas); PANA; David
> Spence
> On Mon, Jan 07, 2002 at 05:30:21PM -0000, Wang, Cliff wrote:
> > Does that mean a device is always owned/used by a single 
> user, or a device
> > is used by a single user at a time but more than one user 
> can use it? I am
> > trying to understand the concensus on the statement "the device is
> > authenticated on behalf of the user".
> 
> I mean the latter.  The former is too restrictive.
> 
> Yoshihiro Ohba
> 
> > 
> > Sent: Monday, January 07, 2002 11:45 AM
> > To: Hesham Soliman (ERA)
> > Cc: 'George Tsirtsis'; 'Paal Engelstad'; 'Yoshihiro Ohba'; 
> Reinaldo Penno;
> > Patil Basavaraj NET/Dallas; 'PANA'; David Spence
> > My understanding is as follows.
> > 
> > Basically, the user is authentciated.  However, when we are 
> talking about
> > the protocol entity used for PANA, we can also say that the 
> device is
> > authenticated on behalf of the user,
> > 
> > Yoshihiro Ohba
> > 
> > On Mon, Jan 07, 2002 at 04:21:00PM +0100, Hesham Soliman 
> (ERA) wrote:
> > > 
> > > 
> > > I'm not going to argue for changing the charter ...again 
> ! Apparently 
> > > the distinction between user and device authentication 
> was removed, I 
> > > was off the list back then and didn't get a chance to express my 
> > > opinion. But for the record, I disagree. Reasons are below.
> > > 
> > > - Making sure USERS will pay. Devices don't have bank accounts :)
> > > 
> represent this 
> > > user identity: pice of plastic, password, ....etc
> > > 
> > >   > and a function of

---

From: George Tsirtsis <[email-masked]>
Date: Tue, 8 Jan 2002 07:01:35 -0500

I sent this hours ago and did not appear...sorry if you get multiple
copies...

-----Original Message-----
From: George Tsirtsis 
Sent: Tuesday, January 08, 2002 9:57 AM
To: 'Patil Basavaraj (NET/Dallas)'
Cc: PANA
Subject: RE: multiple devices or multiple users ?

-----Original Message-----
From: Patil Basavaraj (NET/Dallas) [mailto:[email-masked]]
Sent: Monday, January 07, 2002 10:29 PM
To: 'ext John Vollbrecht'; George Tsirtsis
Cc: Paal Engelstad; Hesham Soliman ""ERA"; Yoshihiro Ohba; Reinaldo

session, 

George

---

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Tue, 8 Jan 2002 10:28:52 -0600

>What is The thing behind this?

You may be misunderstanding some of the dialogue. There is nothing to
stop you from having "n" number of users connected to your
mobilerouter/mobilestation. However what or who is authenticated by
the access network is the MRtr/MStn and is also the entity that may be
billed. 

-Basavaraj