Subject: Re: Location of authentication agent

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 23 Apr 2002 15:25:33 -0700

> > The first question is why does the user need to know?
> > A reasonable answer is that the user wants to know
> > what he/she are paying for. But this depends on
> > the charging model. So if they're charge by time,
> > there can be a default idle time, after which the
> > PaC logs the user out. In this case the use might
> > get some indication from a GUI (just like a modem
> > logs a user out after a set idle time). This
> > is the same issue for modems operating in countries
> > where a phone call is charged by time, or when
> > using a mobile phone for a dialup connection.
>
> I think I stated this before. Let me try again.
> *Unless* you are going to ban/forbid/outlaw billing based on "connect
time"
> the approach taken MUST provide a mechanism by which the user is certain
> that it has "disconnected" from the service that uses such billing.
>
> Thus the complexity of wanting to support some things being free and
> other things not being free means that there needs to be an approach for
> how to handle this. Note that this doesn't mean that any protocol is
needed -
> but the approach to solving the problem needs to take this into
> account.
>
> So as long as the PANA usage scenarios document talk about this
> case and it remains (significant) motivation for a requirement
> that the PAA be separable from the access control enforcement point,
> then I think we need to continue to explore this space until there is
> an answer.

Hesham, in addition to showing how this would work with separation,
we still need to see how it doesn't work with co-location.

Furthermore, we also need to understand how important of a problem
this is to solve.

If this can be solved by locating PAA one hop away from
the PaC, then no problem (already covered). When on the same
link as PaC, if we still need to separate PAA from EP, this is still OK,
and we'd like to keep the additional transport between two outside
the scope of PANA (see the FAQ).

The goal is to define the minimum scope for PANA that
is useful and can solve important/essential problems.

alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 23 Apr 2002 19:38:58 -0400

I agree on the revised scope as long as it still leaves possibilities
anyway for locating PAA one hop away from the PaC and separating PAA
from EP within the same link as PaC.  Although 
those two things are not the main focus in the revised scope, 
I personally think that they are worth being described in the 
usage scenario draft for the following reasons:

Locating PAA one hop away from the PaC might be useful for 
3GPP/802.11 interworking scenario based on the recent comment from 
Lionel Morand.  Separating PAA from EP within the same link as PaC 
might be useful for load sharing among multiple access routers 
from the viewpoint of implementation cost of the access routers.

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Wed, 24 Apr 2002 01:09:42 -0700

Sorry, Yoshi, but if this is considered in scope, then I believe it is
incumbent on the working group to explore the implications of this
radical change in the NAS architecture, including security. I would
prefer if the WG focused on the simple task first, and that this was
excised from the scenarios draft.

            jak

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "Alper E. YEGIN" <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>; "Hesham Soliman (ERA)"
<[email-masked]>; <[email-masked]>
Sent: Tuesday, April 23, 2002 4:38 PM
Subject: Re: Location of authentication agent

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 24 Apr 2002 08:28:39 -0700

Per minimum scope, PANA still leaves the possibility
that PAA can be separated from EP, but PANA doesn't
suggest or take extra actions to enable this feature. 
This separation can be done for some advanced features or 
optimizations, which are not what PANA is aiming to provide.

If we have this scenario in the draft, we should clearly state
that the additional transport and the possible security issues
of this separation is outside the scope of PANA. And for that
matter, I don't think this is a good/typical scenario to list in the
draft. This is not the fundamental problem PANA is aiming
to solve.

I think it is sufficient to see that PANA doesn't prevent this scenario, 
for those who are interested in using PANA in such an architecure.

The usage scenarios and the requirements draft will have to be 
updated based on the re-defined charter anyways..

alper

---

From: Reinaldo Penno <[email-masked]>
Date: Wed, 24 Apr 2002 12:55:03 -0700 (PDT)

I agree with Alper that this is the best course of
action this time.

Reinaldo

--- "Alper E. YEGIN" <[email-masked]> wrote:
> > > > link as PaC, if we still need to separate PAA
> from EP, this is still
> > OK,

__________________________________________________
Do You Yahoo!?
Yahoo! Games - play chess, backgammon, pool and more
http://games.yahoo.com/

---

From: subir Das <[email-masked]>
Date: Thu, 25 Apr 2002 10:32:05 -0400

Alper,

> updated based on the re-defined charter anyways..

  We will update the usage scenario draft according to minimally
  scoped PANA.

  Subir