Subject: [Pana] Issue 58 and issue 74: proposed text

From: Alper Yegin <[email-masked]>
Date: Sun, 21 Mar 2004 22:10:55 -0800

Here is an attempt to resolve issues 58 and 74.

Outline of the changes:
- pointing deployment considerations for this optimization as analyzed
in the EAP keying framework document.
- previous PAA is determined based on the new session-ID AVP format.
- PANA-reauth exchange is replaced by PANA-Bind exchange.
- Computation of context transferred AAA-key is included in the draft.
It can be removed if and when the EAP keying framework document
incorporates it. (note: that draft already describes how this is done
for proactive optimizations, but not the ones based on context
transfers)

Here we go....

New text for section 4.9:

4.9 Mobility Handling

   Upon changing its point of attachment, a PaC that wants to quickly
resume 
   its ongoing PANA session without running EAP MAY send the unexpired
   PANA session identifier in its PANA-Start-Answer message. This will 
   signal PaC's desire to perform the mobility optimization. In the
absence 
   of a Session-Id AVP in this message, PANA session takes its usual
course 
   (i.e., EAP-based authentication is performed).

   If PAA receives a session identifier in the PANA-Start-Answer
   message, and it is configured to enable fast re-authentication, it
   SHOULD retrieve the PANA session attributes from the previous PAA of
   the PaC. Current PAA determines the identity of the previous PAA by
   looking at the DiameterIdentity part of the PANA session identifier.
   The mechanism required to retrieve the session attributes from the 
   previous PAA is outside the scope of this protocol. Seamoby Context 
   Transfer Protocol [I-D.ietf-seamoby-ctp] might be useful for this
purpose.

   When the previous or current PAA is not configured to enable fast 
   re-authentication, the current PAA can not retrieve the PANA session 
   attributes, or the PANA session has already expired (i.e., session 
   lifetime is zero), the PAA MUST send the PANA-Auth-Request message
with 
   the new session identifier and let the PANA exchange take its usual 
   course. This action will engage EAP-based authentication and create a

   fresh PANA session from scratch.

   In case the current PAA can retrieve the on-going PANA session
attributes
   from the previous PAA, the PANA session continues with a PANA-Bind
   exchange.  

   The required AAA-Key is provided by the previous PAA to the current
   PAA. PAA and PaC perform the following computation for generating the
new
   AAA-Key: 

   AAA-Key-new = The first N bits of 
                 HMAC-SHA1(EMSK(0,63), 
                           AAA-Key | DiameterIdentity | Session-ID)

   The value of N depends on the integrity protection algorithm in
   use, i.e., N=160 for HMAC-SHA1. EMSK and AAA-Key are the EAP-based
   keys that were made available to previous PAA and PaC as a result of
   the earlier EAP authentication. Due to the reliance on EMSK, this 
   optimization only works when PaC has performed an EAP-based 
   authentication on the previous PAA. DiameterIdentity is the
identifier of
   the current PAA. Session-ID is the identifier of the PaC's PANA 
   session with the previous PAA. New PANA_MAC_Key is computed based on
   the algorithm described in section 4.1.5, by using the new AAA-Key
and 
   the new Session-ID assigned by the current PAA. 
  
   The MAC AVP contained in the PANA-Bind messages MUST be
   generated and verified by using the new PANA_MAC_Key.
   Session-ID AVP MUST include a new session identifier assigned
   by the current PAA. A new PANA session is created upon successful 
   completion of this exchange. 

   Note that correct operation of this optimization relies on many
factors,
   including applicability of authorization state from one network 
   attachment to another. [I-D.ietf-eap-keying] identifies this
operation as 
   "fast handoff" and provides deployment considerations. Operators are 
   recommended to take those guidelines into account when using this 
   optimization in their networks. 

Change section 9.3.7 from:

9.3.7 PANA-Bind-Request (PBR)

   PANA-Bind-Request (PBR) is sent by the PAA to the PaC.

         PANA-Bind-Request ::= < PANA-Header: 4, REQ >
                       < Session-Id >
                       < Device-Id >
                       { EAP-Payload }
                       { Result-Code }
                       [ Session-Lifetime ]
                       [ Protection-Capability ]
                       [ Key-Id ]
                    *  [ EP-Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >

to:

9.3.7 PANA-Bind-Request (PBR)

   PANA-Bind-Request (PBR) is sent by the PAA to the PaC.

         PANA-Bind-Request ::= < PANA-Header: 4, REQ >
                       < Session-Id >
                       < Device-Id >
                       [ EAP-Payload ]                    
                       { Result-Code }
                       [ Session-Lifetime ]
                       [ Protection-Capability ]
                       [ Key-Id ]
                    *  [ EP-Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >

Update the AVP occurrence table from:

                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  0  |  0  |
      Session-Id          |  0  |  0  |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  |  1  |  0  |  0  |

To:

                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  0  |  0  |
      Session-Id          |  0  |  0  |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  | 0-1 |  0  |  0  |

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana