Subject: RE: multiple devices or multiple users ?

From: "Wang, Cliff" <[email-masked]>
Date: Mon, 7 Jan 2002 17:30:21 -0000

Does that mean a device is always owned/used by a single user, or a device
is used by a single user at a time but more than one user can use it? I am
trying to understand the concensus on the statement "the device is
authenticated on behalf of the user".

-----Original Message-----
From: Yoshihiro Ohba [mailto:[email-masked]] 
Sent: Monday, January 07, 2002 11:45 AM
To: Hesham Soliman (ERA)
Cc: 'George Tsirtsis'; 'Paal Engelstad'; 'Yoshihiro Ohba'; Reinaldo Penno;
Patil Basavaraj NET/Dallas; 'PANA'; David Spence
Subject: Re: multiple devices or multiple users ?

My understanding is as follows.

Basically, the user is authentciated.  However, when we are talking about
the protocol entity used for PANA, we can also say that the device is
authenticated on behalf of the user,

Yoshihiro Ohba

On Mon, Jan 07, 2002 at 04:21:00PM +0100, Hesham Soliman (ERA) wrote:
> 
> 
> I'm not going to argue for changing the charter ...again ! Apparently 
> the distinction between user and device authentication was removed, I 
> was off the list back then and didn't get a chance to express my 
> opinion. But for the record, I disagree. Reasons are below.
> 
>   > I do not think the distinction between users and devices in 
>   > the context of
>   > PANA is useful.
> 
> => Let me answer you by asking this question: Why does
> and ISP want to run AAA? IMHO for 2 reasons:
> 
> - Making sure USERS will pay. Devices don't have bank accounts :)
> 
> - Making sure Bad Guys stay out of the network, by
> identifying them during the authentication process. 
> Again Bad Devices do not exist...Bad People do !
> 
>   > 
>   > Authentication/security protocols tend to run between 
>   > *elements* that
>   > identify themselves according to the requirements of the protocol in
>   > question. Users, devices, IP stacks are all *elements* that 
>   > can use a given
>   > security protocol. Think of IPSEC. Does IPSEC run between 
>   > devices or between
>   > users?
> 
> => Devices.
> 
> Does it mater?
> 
> => YES !
> 
> Isn't that an implementation detail
> 
> => Absolutely not. Think of a GSM phone. If I give you
> my phone (only the device not the SIM card) and
> you start using it with your SIM card, will the operator
> still think it's me using the phone ? 
> Who does the operator authenticate now ? The SIM card 
> is a _subscriber_ identifier. The operator couldn't care
> less about the device you're using.
> 
> What is an implementation issue, however, is how you represent this 
> user identity: pice of plastic, password, ....etc
> 
>   > and a function of
>   > who or what *element* owns the keys?
> Why should PANA be different? 
> 
> => Again response by asking a question: SIP manages USER mobility,
> why should MIP be different ?? 
> Do you see why this logic is not right ? They_do_different_ 
> things.
> 
> Cheers,
> Hesham
> 
> PS: As IU said I will not argue for the charter
> change of course, but this lack of distinction
> makes no sense to me. 
>

---

From: "Xiaoning He" <[email-masked]>
Date: Mon, 7 Jan 2002 09:45:11 -0800

My understanding is that PANA is focusing on the protocol side. As a
result, the end user and his decides are regarded as a single entity. 

Multidevices at the user side, I think, is not a protocol issue. 

Xiaoning He, Ph.D
Research Engineer
Automous Commnication Lab
NTT DoCoMo USA Labs
408-451-4737

> From: Wang, Cliff [mailto:[email-masked]]
> Sent: Monday, January 07, 2002 9:30 AM
> To: 'Yoshihiro Ohba'; Hesham Soliman (ERA)
> Cc: 'George Tsirtsis'; 'Paal Engelstad'; Reinaldo Penno; Patil
Basavaraj
> NET/Dallas; 'PANA'; David Spence
> Subject: RE: multiple devices or multiple users ?
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 7 Jan 2002 14:28:03 -0500

> authenticated on behalf of the user".

I mean the latter.  The former is too restrictive.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 7 Jan 2002 14:46:23 -0500

> Multidevices at the user side, I think, is not a protocol issue. 

We still need to discuss whether multi-devices of a single user can be
regarded as a single entity or separate entities, but at least I can
say that it is definitely a protocol issue because that would heavily
affects the PANA protocol design.

Yoshihiro Ohba