Subject: [Pana] Issue 62: PAA discovery triggered by data traffic

From: Alper Yegin <[email-masked]>
Date: Wed, 14 Apr 2004 14:50:38 -0700

Proposed text changes to handle issue 62.
http://danforsberg.info:8080/pana-issues/issue62

[1] Change text in 4.2 from:

   PaC may also choose to start sending packets before getting
   authenticated. In that case, the network should detect this and send
   an unsolicited PANA-Start-Request message to PaC. EP is the node that
   can detect such activity. If EP and PAA are co-located, then an
   internal mechanism (e.g. API) between the EP module and the PAA
   module on the same host can prompt PAA to start PANA. In case they
   are separate, there needs to be an explicit message to prompt PAA.
   Upon detecting the need to authenticate a client, EP can send a
   PANA-PAA-Discover message to the PAA on behalf of the PaC. This
   message carries a device identifier of the PaC in a Device-ID AVP. So
   that, the PAA can send the unsolicited PANA-Start-Request message
   directly to the PaC.  If the link between the EP and PAA is not
   secure, the PANA-PAA-Discover message sent from the EP to the PAA
   MUST be protected by using, e.g., IPsec.

To:

   PaC MAY also choose to start sending packets before getting
   authenticated. In that case, the network MAY detect this and send
   an unsolicited PANA-Start-Request message to PaC in addition to
   filtering the unauthorized traffic. EP is the node that can detect 
   such activity. PAA-to-EP protocol MAY be used for this purpose.

[2] Change from:

4.10 Event Notification

   Upon detecting the need to authenticate a client, EP can send a
   trigger message to the PAA on behalf of the PaC. This can be one of
   the messages provided by the PAA-to-EP protocol, or, in the absence
   of such a facility, PANA-PAA_Discover can be used as well. This
   message MUST carry the device identifier of the PaC. So that, the PAA
   can send the unsolicited PANA-Start-Request message directly to the
   PaC.  If the link between the EP and PAA is not physically secured,
   this message sent from EP to PAA MUST be cryptographically protected
   (e.g., by using IPsec).

4.11 Support for Separate EP

   PANA allows PAA and EP to be separate entities.  In this case, if
   data traffic protection needs to be initiated after successful PANA
   authentication phase, PaC needs to know the device identifier of
   EP(s) so that it is able to establish a security association with
   each EP to protect data traffic.

   To this end, when a Protection-Capability AVP with either
   L2_PROTECTION or IPSEC_PROTECTION in the AVP payload is carried in a
   PANA-Bind-Request message and if there is an EP that has a different
   device identifier than that of the PAA, one or more EP-Device-Id AVPs
   MUST also be carried in the PANA-Bind-Request message.  In this case,
   if one EP has the same device identifier as the PAA, an EP-Device-Id
   AVP that contains the device identifier of the EP (i.e., the PAA)
   MUST also be included in the PANA-Bind-Request.

To:

4.10 Support for Separate EP

   PANA allows PAA and EP to be separate entities.  In this case, if
   data traffic protection needs to be initiated after successful PANA
   authentication phase, PaC needs to know the device identifier of
   EP(s) so that it is able to establish a security association with
   each EP to protect data traffic.

   To this end, when a Protection-Capability AVP with either
   L2_PROTECTION or IPSEC_PROTECTION in the AVP payload is carried in a
   PANA-Bind-Request message and if there is an EP that has a different
   device identifier than that of the PAA, one or more EP-Device-Id AVPs
   MUST also be carried in the PANA-Bind-Request message.  In this case,
   if one EP has the same device identifier as the PAA, an EP-Device-Id
   AVP that contains the device identifier of the EP (i.e., the PAA)
   MUST also be included in the PANA-Bind-Request.

   Aside from provisioning EP, the same PAA-to-EP protocol MAY be used
for 
   triggering the PAA upon detecting the need to authenticate a new
client. 

[3] Remove the following text from the end of section 9.3:

   Additionally the EP can also send a PANA-PAA-Discover message to the
   PAA.

[4] Change from:

9.3.2 PANA-PAA-Discover (PDI)

   The PANA-PAA-Discover (PDI) message is used to discover the address
   of PAA(s). Both sequence numbers in this message are set to zero (0).
   If the EP detects a new PaC and sends the PANA-PAA-Discover to the
   PAA, it MUST include the Device-Id of the PaC.

         PANA-PAA-Discover ::= < PANA-Header: 1 >
                   0*1 < Device-Id >
                   0*1 < Session-Id >
                    *  [ AVP ]

To:

9.3.2 PANA-PAA-Discover (PDI)

   The PANA-PAA-Discover (PDI) message is used to discover the address
   of PAA(s). Both sequence numbers in this message are set to zero (0).

         PANA-PAA-Discover ::= < PANA-Header: 1 >
                   0*1 < Session-Id >
                    *  [ AVP ]

[5] Change Figure 10 from:

                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  0  |  0  |
      Session-Id          |  0  |  0  |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  |  1  |  0  |  0  |
      MAC                 |  0  |  0  | 0-1 | 0-1 | 0-1 | 0-1 |  0  |
      Device-Id           |  0  |  0  |  0  |  0  |  1+ |  1+ | 0-1 |

To:

                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  0  |  0  |
      Session-Id          |  0  |  0  |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  |  1  |  0  |  0  |
      MAC                 |  0  |  0  | 0-1 | 0-1 | 0-1 | 0-1 |  0  |
      Device-Id           |  0  |  0  |  0  |  0  |  1+ |  1+ |  0  |

Comments welcome.

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana