Subject: [Pana] pana-multihop and L2/L3 handovers

From: Julien Bournelle <[email-masked]>
Date: Fri, 24 Jun 2005 14:58:08 +0200

Hi all,

 considering pana-multihop we can now envision new deployment
 scenarios.

 As an example, we can have the following architecture:

 PaC ------- pEP(AP) ------- AR ---------PAA
                                          |
                                          |
             nEP(AP)---------AR ----------+

 So, when the PaC moves to the nEP, it is detected and nEP
 triggers an authentication by sending a message to PAA.

   PaC   nEP      PAA    Message(sequence number)[AVPs]
   ------------------------------------------------------
    ---->o              (Data packet arrival or L2 trigger)
          ------>       PAA-to-EP protocol, or another mechanism
    <------------       PANA-Start-Request(x)[Cookie]

 At this point, if PaC uses pana-mobopts, it can send a PSA containg
 current Session-ID and signs the messages using PANA-MAC-Key.

 If PAA also supports pana-mobopts, it will see that it knows this 
 client since the Session-ID contain its own identity.

 In pana-mobopts, the nPAA recovers the context from pPAA, assign
 a new session-id and computes a new AAA-Key based on Nonces exchanged
 during PSR/PSA and based on AAA-Key-int.

 In this scenario, it is the same PAA, thus we can think that it is 
 not necessary to assign a new session-id. 

 However, as Nonces are exchanged, one can think to derive a new 
 PANA_MAC_Key and sign the PBR/PBA with it.

 Before going into details with L2/L3 security management in this kind
 of scenario, I was wondering if we should consider this type of scenario in
 pana-mobopts and if yes, how do we handle session-id assignement and
 PANA-MAC-Key.

 regards,
-- 
julien.bournelle at int-evry.fr

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 24 Jun 2005 11:01:31 -0400

Julien,

In the described scenario, when the nEP detects the presence of PaC
and report it to the PAA, the PAA can ignore it if there is a PANA
session associated with the same device identifier (DI) as the
reported one.  If the PAA does not ignore it or if there is no PANA
session corresponding to the reported DI (this is the case where an IP
address is used as DI), then the PAA will send a PSR, but the PaC
ignores the PSR because it has an established PANA session for the
PAA, according to draft-ietf-pana-statemachine.  In this case, the PaC
will send a PUR message to the PAA to update the IP address.  In any
case, pana-mobopts is not needed as long as the PaC stays in the realm
of the same PAA.

Yoshihiro Ohba

---

From: Julien Bournelle <[email-masked]>
Date: Mon, 27 Jun 2005 12:16:17 +0200

Hi yoshi,

> PAA, according to draft-ietf-pana-statemachine.  In this case, the PaC

 but the PSR does not contain session-id. So, do we assume in this case
 that the PaC identify the PAA by its IP address ?

 thanks,

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 27 Jun 2005 08:46:45 -0400

>  that the PaC identify the PAA by its IP address ?

Yes.

Yoshihiro Ohba