Subject: RE: multiple devices or multiple users ?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 7 Jan 2002 16:07:18 +0100

> --- "Hesham Soliman (ERA)"
  > <[email-masked]> wrote:
  > > Obviously there is a difference between this 
  > > issue and the service-related discussion
  > > so I changed the thread. 
  > > 
  > > So, I think we can have several scenarios
  > > and I'll just mention a couple below:
  > > 
  > > 1. One device attached to the network and on
  > >    the other side of it, several devices are
  > > attached.
  > >    This is similar to the DSL case or the mobile 
  > >    networks case (monet). The devices on the other
  > >    side of the router can belong to the same user
  > >    or several. 
  > 
  > > 
  > > 2. One devices with several users.
  > > 
  > > 
  > > In case (1), there was a discussion on this list
  > > many months ago between Erik and I, in which Erik
  > > suggested that it should be the responsibility
  > > of the router (mobile router or DSL router) to
  > > authenticate the users attached to it, and that
  > > the ISP simply bills the owner of that router
  > > (DSL or mobile). I think this makes a lot of 
  > > sense.
  > 
  > Hello Hesham,
  > 
  > well, this is not how it works today for broadband
  > access. Authentication is done on the ISP. 

=> I'm not sure which part of the message you're
answering to, but most of the message was not 
referring to an existing scenario. 

  > 
  > Actually this model (the carrier bills the router)
  > does not work at all in an open access environment
  > where the carrier does not own the user and each user
  > has a choice of several ISPs to connect at one time
  > (and on some advanced deployments at the same time).

=> So what model do you suggest for the case where 
you have a DSL link at home and people come to visit
you and start using your DSL connection ? Who bills
who ?

Regards,
Hesham
  > 
  > regards,
  > 
  > Reinaldo
  > 
  > 
  > 
  > 
  > 
  > 
  >  
  > > 
  > > The alternative to that was to have some token
  > > that is authenticated and consequently authorised
  > > by the ISP's router to allow access. The idea
  > > was to allow each user to have his/her own 
  > > token. In this case the charging can be done per
  > > user. 
  > > 
  > > Protocol wise this would mean something like
  > > IP in IP tunnelling between the devices and 
  > > the default router. I'm not sure how realistic
  > > that would be. 
  > > 
  > > So, for case (2) basically, the only solution
  > > I can see is the token per user. So it is
  > > possible to do, without separating the port
  > > number space, but I haven't looked at that 
  > > in detail yet. 
  > > 
  > > Hesham
  > > 
  > > 
  > > 
  > > 
  > >   > -----Original Message-----
  > >   > From: Yoshihiro Ohba
  > > [mailto:[email-masked]]
  > >   > Sent: Friday, January 04, 2002 10:06 PM
  > >   > To: Reinaldo Penno; Patil Basavaraj
  > > (NET/Dallas); 'PANA'; 
  > >   > David Spence
  > >   > Subject: Re: DSL Scenario
  > >   > 
  > >   > 
  > >   > On Fri, Jan 04, 2002 at 03:50:48PM -0500,
  > > Yoshihiro Ohba wrote:
  > >   > > On Fri, Jan 04, 2002 at 10:42:22AM -0800,
  > > Reinaldo Penno wrote:
  > >   > > > Hello,
  > >   > > > 
  > >   > > > This goes back to the discussion on the
  > > meeting if
  > >   > > > PANA is directed to devices or users (real
  > > users). 
  > >   > > > 
  > >   > > > It seems that PANA is going to fit properly
  > > in a
  > >   > > > mobile world where you carry your device
  > > around and
  > >   > > > usually do not share it with anyone, but
  > > will have a
  > >   > > > hard time in broadband access if the model
  > > assume is
  > >   > > > 1:1 (one device, one user).
  > >   > > 
  > >   > > If my understanding is correct, the most
  > > flexible PANA 
  > >   > model assumes
  > >   > > m:1 (one or more devices, one user at the same
  > > time), but does not
  > >   > > assume 1:m (one device, one or more users at
  > > the same time). The
  > >   > 
  > >   > Correction: 1:m (one device, multiple users at
  > > the same time)
  > >   > 
  > >   > Yoshihiro Ohba
  > >   > 
  > >   > > reason for not assuming 1:m was discussed
  > > about six month 
  > >   > ago .  See
  > >   > > the following (BURP was the old name for PANA)
  > > which can 
  > >   > be also find
  > >   > > in http://www.toshiba.com/tari/issues.txt.
  > >   > > 
  > >   > > 
  > >   >
  > >
  > --------------------------------------------------------------------
  > >   > > Issue #7: Is it possible to use BURP for
  > > sharing a single 
  > >   > IP address 
  > >   > >           but separating accounts among
  > > multiple users?
  > >   > > 
  > >   > > It is difficult for the following reason.  To
  > > support such a
  > >   > > capability, partitioning TCP/UDP source port
  > > numbers based on user
  > >   > > identity would be necessary.  However, this
  > > would impose 
  > >   > significant
  > >   > > modification in existing OS and application
  > > software to 
  > >   > support that,
  > >   > > which seems unacceptable.  So in the current
  > > requirement 
  > >   > this should
  > >   > > be avoided unless we see strong arguments or
  > > compelling need.
  > >   > > 
  > >   >
  > >
  > --------------------------------------------------------------------
  > >   > > 
  > >   > > > 
  > >   > > > The DSL scenario described is very true
  > > today and
  > >   > > > applies to other access methods like cable,
  > > Ethernet,
  > >   > > > etc. In one household people have different
  > > needs. You
  > >   > > > can have for instance content filtering to
  > > the kids
  > >   > > > and not to the parents, and this is tied to
  > > the
  > >   > > > authentication/authorization. Same goes for
  > > other
  > >   > > > services.
  > >   > > 
  > >   > > If the above mentioned scenario is possible by
  > > using the 
  > >   > m:1 model, 
  > >   > > we can add the scenario to the draft.
  > >   > > 
  > >   > > > 
  > >   > > > Although PANA is directed to devices (on
  > > behalf of
  > >   > > > users), we should not assume that a device
  > > is owned by
  > >   > > > a single person. Since the PANA protocol is
  > > used for
  > >   > > > conveying information about the user, and
  > > not the
  > >   > > > device, it doesn't make sense to make a
  > > protocol tied
  > >   > > > to the device since different people using
  > > the same
  > >   > > > device can have very distinct rights and
  > > services.
  > >   > > 
  > >   > > 
  > >   > > It depends on the meaning of "different people
  > > using the same
  > >   > > device".  If it means that different people
  > > using the same
  > >   > > device *at the same time*, it is diffucult for
  > > PANA to support 
  > >   > > the model since it is 1:m model.
  > >   > > 
  > >   > > On the other hand, it would be easier for
  > > multiple users 
  > >   > to use the
  > >   > > same device at different times, which is m:1
  > > model 
  > >   > instead of 1:m, and
  > >   > > PANA should work with those models.
  > >   > > 
  > >   > > 
  > >   > > Yoshihiro Ohba
  > >   > > 
  > >   > > 
  > >   > > 
  > >   > 
  > 
  > 
  > 
  > __________________________________________________
  > Do You Yahoo!?
  > Send FREE video emails in Yahoo! Mail!
  > http://promo.yahoo.com/videomail/
  >

---

From: Reinaldo Penno <[email-masked]>
Date: Mon, 7 Jan 2002 07:26:48 -0800 (PST)

> referring to an existing scenario. 

I was answering the statement above. I'm not dwelling
if it makes sense or not. I'm just saying that today
authentication is on the ISP even when there are
several devices behind it. 

> you and start using your DSL connection ? Who bills

This is a very good question. If the ISP/Carrier uses
PPPoE/oA/L2TP/etc, you just go to your frieds/parents
house, put your username and password, connect and
presto. You are logged in with your profile, services
and rights (although on a different location). So, you
are the one being billed.

If the Carrier/ISP uses DHCP, there is no way to
differentiate user A from B since there is no concept
of session. So what some Carriers/ISP provide is web
login, where you go (or is captured) to a startup page
where you put own username and password. This web page
is usually tied to a Radius client backend which based
on your current IP address provides you with your
profile services and rights (although on a different
location). So, you are the one being billed.

If there is no way to differentiate you from your
fired, your friend is going to be billed (assuming
it's not flat rate billing and/or you are using
premium services)

Actually there are some carries that charge premium
for "profile mobility", i.e., the ability to go to
another location ans use your personal services.

I wrote something about this some time ago

User Identification on the Internet 

http://search.ietf.org/internet-drafts/draft-penno-uid-02.txt

ISP Selection in Open Access Networks                 

http://search.ietf.org/internet-drafts/draft-penno-isp-selection-00.txt

regards,

Reinaldo