Subject: RE: PAA-EP protocol requirements

From: <[email-masked]>
Date: Thu, 31 Oct 2002 11:07:53 +0200

Hi,

Do we need to support the case where these two happen at the same time (serial)? First the L2 and then possibly the L3 (walled garden) or even L4. The situation can be seen as two independent PANA use scenarios or a combination of them. Or does it become too complicated.

With walled gardens the PaC may not know, if PANA is needed or not. For example free WLAN access to the local network on the airports and non-free access to the Internet (different subnets) through that WLAN.

- Dan

> -----Original Message-----
> From: ext Yoshihiro Ohba [mailto:[email-masked]]
> Sent: 30 October, 2002 17:29
> To: Reinaldo Penno
> Cc: Yoshihiro Ohba; Alper E. YEGIN; Pana (E-mail)
> Subject: Re: PAA-EP protocol requirements
> 
> 
> 
> I think it might be useful to view authentication 
> from the following two aspects:
> 
> o Which is the initiator of authentication, client initiated or
>   authenticator initiated?
> 
> o What is the trigger, traffic driven or connectivity driven, 
> or other?
>   (In the case of traffic driven trigger, authentication is triggered
>    when data traffic is generated at a particular layer. In the csae
>    connectivity driven trigger, authentication is triggered when
>    connectivity is established at a particular layer.)
> 
> I think those two aspects are orthogonal, thus there are at least 4
> combinations.
> 
> For example, 802.1X is classified as client initiated, L2 connectivity
> driven authentication.  Web-based authentication is classified as
> authenticator initiated, L4 traffic driven authentication.  At least
> these two combinations (client-connectivity and authenticator-traffic)
> need to be supported in PANA to give flexibility in authentication for
> different usage scenarios, and it would be better to support all
> combinations to give maximum flexibility, IMHO.
> 
> Yoshihiro Ohba
> 
> 
> On Tue, Oct 29, 2002 at 07:26:33PM -0800, Reinaldo Penno wrote:
> > I saw your point, but I think I didn't convey my
> > question right...
> > 
> > the more basic question is: should we provide for this
> > case where the EP notifies the PAA explicitly in the
> > PAA<->EP protocol? If yes, do we still need discovery?
> > 
> > Should we assume that the PAC will always be able to
> > discover who the PAA is, so in a sense most of the
> > time (except when PAA and EP are co-located) the PAC
> > is the one initiating authentication?
> > 
> > If this is not the case, do we still need discovery,
> > given the models listed in the requiremetns draft?
> > Looking at those models it seems to me all packets
> > reach an EP first, which can always ask the PAA to
> > initiate authentication?
> > 
> > any thoughts?
> > 
> > 
> > 
> > --- Yoshihiro Ohba <[email-masked]> wrote:
> > > On Tue, Oct 29, 2002 at 05:10:03PM -0800, Reinaldo
> > > Penno wrote:
> > > > Hello Yoshi, 
> > > > 
> > > > Isn't this a discovery problem? why try to fix it
> > > at
> > > > the EP<->PAA communication?
> > > 
> > > No, it is not a part of a discovery problem, since
> > > the discovery is
> > > used for PaC to discover the PAA.
> > > 
> > > > 
> > > > Shouldn't the PAC discover the PAA or the EP send
> > > some
> > > > ICMP or whatever back to the PAC so that he tries
> > > to
> > > > contact the PAA?
> > > 
> > > Both two cases just cover PANA authentication
> > > initiated by PaC.  ICMP
> > > is just a trigger for PANA authentication initiated
> > > by PaC, I think.
> > > 
> > > What I'm mentioning here is about a trigger for PANA
> > > authentication
> > > initiated by PAA.
> > > 
> > > Yoshihiro Ohba
> > > 
> > 
> > 
> > __________________________________________________
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> > 
> > 
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 31 Oct 2002 10:07:45 -0500

On Thu, Oct 31, 2002 at 11:07:53AM +0200, [email-masked] wrote:
> Hi,
> 
> Do we need to support the case where these two happen at the same time (serial)? 

> First the L2 and then possibly the L3 (walled garden) or even L4. 

That should not matter since PANA and L2 authentication can be
completely independent.  On the other hand, some consideration would
be necessary for PANA (regardless of the type of L2 authentication)
for the case in which different modes may be used between PaC and PAA.

For example, PaC may be oprating in client initiated, connectivity
driven mode while PAA is operating in authenticator initiated, traffic
driven mode.  If this happens, PAA can just start PANA authentication
initiated by a PaC before seeing any data traffic from the PaC device.

On the other hand, if PaC is operating in authenticator initiated,
traffic driven mode and PAA is operating in client initiated,
connectivity driven mode, PAA can just start PANA authentication when
it sees data traffic from the PaC device before authentication is
initiated from the PaC.

The bottom line is that PAA should not assume a specific operational
mode for PaC.

>The situation can be seen as two independent PANA use scenarios or a combination of them. Or does it become too complicated.
> 

Yes, the PaC may not know if PANA is needed or not, and PAA should 
not assume that authentication is always initiated from PaC.

Yoshihiro Ohba

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 31 Oct 2002 18:37:53 -0800 (PST)

Can we summarize the EP<->PAA requirements?

1 - All the security truckload
    Default...
2 - Push and Pull methods
    Here we can use the text on EP and/or PAA crashing

    and coming up again. "in sync" message desirable 
    There was also some text on pros and cons on PAA-
    >EP (push) notification and EP<-PAA (pull)
methods.
3 - Event notification.
    here we can use the text on the recent thread on 
    PAA initiated authentication as a application. 
4 - Keepalive between PAA<->EP 
    Kind of straightforward. The additional 
    operational requirements would be to flush any 
    state if a timeout happens

did I miss anything? This is just the summary, we can
expand the text later.

regards,

Reinaldo

--- Yoshihiro Ohba <[email-masked]> wrote:
> >The situation can be seen as two independent PANA
> use scenarios or a combination of them. Or does it
> become too complicated.
> > 
> > With walled gardens the PaC may not know, if PANA
> is needed or not. For example free WLAN access to
> the local network on the airports and non-free
> access to the Internet (different subnets) through
> that WLAN.
> 
=== message truncated ===