Subject: multiple devices or multiple users ?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Sat, 5 Jan 2002 14:33:29 +0100

Obviously there is a difference between this 
issue and the service-related discussion
so I changed the thread. 

So, I think we can have several scenarios
and I'll just mention a couple below:

1. One device attached to the network and on
   the other side of it, several devices are attached.
   This is similar to the DSL case or the mobile 
   networks case (monet). The devices on the other
   side of the router can belong to the same user
   or several. 

2. One devices with several users.

In case (1), there was a discussion on this list
many months ago between Erik and I, in which Erik
suggested that it should be the responsibility
of the router (mobile router or DSL router) to
authenticate the users attached to it, and that
the ISP simply bills the owner of that router
(DSL or mobile). I think this makes a lot of 
sense. 

The alternative to that was to have some token
that is authenticated and consequently authorised
by the ISP's router to allow access. The idea
was to allow each user to have his/her own 
token. In this case the charging can be done per
user. 

Protocol wise this would mean something like
IP in IP tunnelling between the devices and 
the default router. I'm not sure how realistic
that would be. 

So, for case (2) basically, the only solution
I can see is the token per user. So it is
possible to do, without separating the port
number space, but I haven't looked at that 
in detail yet. 

Hesham

  > -----Original Message-----
  > From: Yoshihiro Ohba [mailto:[email-masked]]
  > Sent: Friday, January 04, 2002 10:06 PM
  > To: Reinaldo Penno; Patil Basavaraj (NET/Dallas); 'PANA'; 
  > David Spence
  > Subject: Re: DSL Scenario
  > 
  > 
  > On Fri, Jan 04, 2002 at 03:50:48PM -0500, Yoshihiro Ohba wrote:
  > > On Fri, Jan 04, 2002 at 10:42:22AM -0800, Reinaldo Penno wrote:
  > > > Hello,
  > > > 
  > > > This goes back to the discussion on the meeting if
  > > > PANA is directed to devices or users (real users). 
  > > > 
  > > > It seems that PANA is going to fit properly in a
  > > > mobile world where you carry your device around and
  > > > usually do not share it with anyone, but will have a
  > > > hard time in broadband access if the model assume is
  > > > 1:1 (one device, one user).
  > > 
  > > If my understanding is correct, the most flexible PANA 
  > model assumes
  > > m:1 (one or more devices, one user at the same time), but does not
  > > assume 1:m (one device, one or more users at the same time). The
  > 
  > Correction: 1:m (one device, multiple users at the same time)
  > 
  > Yoshihiro Ohba
  > 
  > > reason for not assuming 1:m was discussed about six month 
  > ago .  See
  > > the following (BURP was the old name for PANA) which can 
  > be also find
  > > in http://www.toshiba.com/tari/issues.txt.
  > > 
  > > 
  > --------------------------------------------------------------------
  > > Issue #7: Is it possible to use BURP for sharing a single 
  > IP address 
  > >           but separating accounts among multiple users?
  > > 
  > > It is difficult for the following reason.  To support such a
  > > capability, partitioning TCP/UDP source port numbers based on user
  > > identity would be necessary.  However, this would impose 
  > significant
  > > modification in existing OS and application software to 
  > support that,
  > > which seems unacceptable.  So in the current requirement 
  > this should
  > > be avoided unless we see strong arguments or compelling need.
  > > 
  > --------------------------------------------------------------------
  > > 
  > > > 
  > > > The DSL scenario described is very true today and
  > > > applies to other access methods like cable, Ethernet,
  > > > etc. In one household people have different needs. You
  > > > can have for instance content filtering to the kids
  > > > and not to the parents, and this is tied to the
  > > > authentication/authorization. Same goes for other
  > > > services.
  > > 
  > > If the above mentioned scenario is possible by using the 
  > m:1 model, 
  > > we can add the scenario to the draft.
  > > 
  > > > 
  > > > Although PANA is directed to devices (on behalf of
  > > > users), we should not assume that a device is owned by
  > > > a single person. Since the PANA protocol is used for
  > > > conveying information about the user, and not the
  > > > device, it doesn't make sense to make a protocol tied
  > > > to the device since different people using the same
  > > > device can have very distinct rights and services.
  > > 
  > > 
  > > It depends on the meaning of "different people using the same
  > > device".  If it means that different people using the same
  > > device *at the same time*, it is diffucult for PANA to support 
  > > the model since it is 1:m model.
  > > 
  > > On the other hand, it would be easier for multiple users 
  > to use the
  > > same device at different times, which is m:1 model 
  > instead of 1:m, and
  > > PANA should work with those models.
  > > 
  > > 
  > > Yoshihiro Ohba
  > > 
  > > 
  > > 
  >

---

From: Yoshihiro Ohba <[email-masked]>
Date: Sat, 5 Jan 2002 10:20:58 -0500

> number space, but I haven't looked at that 

Authorization token became out of the scope of PANA (basically because
it would be a slippy slope considering the maturity level on that
technology).  As a result, some usage scenarios on authorization token
described in draft-ohba-urp-usage-scenarios-00.txt, have been removed
from draft-ohba-pana-usage-scenarios-00.txt.  I think some other WG
such as nsis would be an appropriate place to discuss authorization
token.  Note that port number partitioning can be seen as a method of
realizing authorization token.

Yoshihiro Ohba

---

From: Reinaldo Penno <[email-masked]>
Date: Mon, 7 Jan 2002 06:32:39 -0800 (PST)

--- "Hesham Soliman (ERA)"

> (DSL or mobile). I think this makes a lot of 

Hello Hesham,

well, this is not how it works today for broadband
access. Authentication is done on the ISP. 

Actually this model (the carrier bills the router)
does not work at all in an open access environment
where the carrier does not own the user and each user
has a choice of several ISPs to connect at one time
(and on some advanced deployments at the same time).

regards,

Reinaldo

>   > > PANA should work with those models.

__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/

---

From: "James Kempf" <[email-masked]>
Date: Mon, 7 Jan 2002 11:05:35 -0800

Hesham,

I believe Erik's object to a token was how to avoid someone stealing it.
A
free-floating authenticator is difficult to protect. I had originally
proposed
something along these lines as a solution for quickly moving a device's
rights to access particular services (like QoS) when the device moved,
rather than having to do redo the authentication flows or context
transfer in the network. But the security problems seem difficult
to overcome.

            jak

----- Original Message -----
From: "Hesham Soliman (ERA)" <[email-masked]>
To: "'Yoshihiro Ohba'" <[email-masked]>; "Reinaldo Penno"
<[email-masked]>; "Patil Basavaraj (NET/Dallas)"
<[email-masked]>; "'PANA'" <[email-masked]>;
"David Spence" <[email-masked]>
Sent: Saturday, January 05, 2002 5:33 AM
Subject: multiple devices or multiple users ?