Subject: RE: Separation of PAA and Access router (multi access router scenario)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 25 Sep 2002 16:25:26 -0700

>> 
>> But does this imply that the PaC performs authentication with 
>> every PAA? Or the PaC performs authentication with only one 
>> of the PAAs and the authorization to access is then 
>> distributed to all other PAAs on the link? 
>> 
>Could you clarify on why the authorization needs to be distributed 
>to all the PAAs ? Is it because the PaC may choose a different 
>PAA for disconnect notification ? 

>>That and:
>>1. Because the client may change the default router in which case the
>>  AR that does not have the authorization would block the packets
>>  to/from the client

>
>> I am of the opinion that it is simpler to have the *option* 
>> of keeping the PAA separated from the access router.  In such 
>> a case the PAA would be able to communicate with the multiple 
>> access routers (EP) to authorize access for a PaC. 
>> The implication here is that there needs to be a protocol 
>> defined that would allow the PAA and the ARs (EP) to 
>> communicate. The definition of this messaging would be a part 
>> of the PANA WG scope as well. 
>> 
>I assume that this includes the PAA -> PAAA for distributing 
>the authorization also as you mentioned above. 

>>Not sure what you mean here. 

If there are multiple access routers and mulitple PAAs, PaC initially
discovers the PAA. Depending on the discovery PaC might see one or
more of the PAA and may choose one among them for authentication.
Once it is done with authentication, PAA sends the access control
information to all the access routers (EP). In the future, if it
needs to reauthenticate, it might choose a different PAA. In that
case, the auth may be faster if the new PAA has the relevant
information.
One example could be the handoff case. Is distributing such information
outside the scope of PANA ?

-mohan

>
>> So we would like to modify the charter to allow the option of 
>> having the PAA separated from the AR. 
>> If you have comments on making such a change, please send 
>> them to the WG list. 
>> 
>> -Chairs 
>> 
>mohan 
>
>>

---

From: julien Bournelle <[email-masked]>
Date: Thu, 26 Sep 2002 10:36:02 +0200 (MEST)

Hi,

 I was wondering what is really an EP. I know that it stands for
Enforcement point but: Is it just an AR doing filtering ?
Could it be just a filter ? Can we consider it as a sort of PANA agent
(another one)?

Maybe it could be clearer to put a definition in the draft
draft-ietf-pana-usage-scenarios-02.txt

[email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 26 Sep 2002 12:50:16 -0400

Yes, that is missing.  When we give a definition of EP, it would make
sense if we describe the definition based on the relationship with
Device Identifier.  For example:

Enforcement Point (EP):

  A node that is able to filter packets by using Device Identifier 
  information indicated by a PAA.  An EP is typically co-located 
  with a PAA, but separation of an EP and a PAA is also possible.

This definition does not preclude a node that does not 
have IP packet forwarding functionality or a router 
that is located behind ARs to be an EP.

I don't think this definition of EP would open the can of worm.

Yoshihiro Ohba

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 26 Sep 2002 20:53:35 -0700 (PDT)

Hello Yoshi,

maybe we could use something out of the PEP definition
since the device identifier can be anything.  Also
given the recent thread I would take the last phrase
out.

regards,

Reinaldo

> > [email-masked]

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 27 Sep 2002 10:38:18 -0400

On Fri, Sep 27, 2002 at 02:41:15PM +0200, Erik Nordmark wrote:
> This reads like it will only filter based on some clear text field
> in a packet. There might be cases when one needs to have stronger
> security i.e. the ability to apply cryptographically strong methods
> to associate packets with the authenticated PaC.

OK.  Now it looks like (also reflecting Reinaldo's suggestion for 
removing the last phrase but still not using PEP definition):

Enforcement Point (EP):

  A node that is able to filter packets by using Device Identifier 
  information indicated by a PAA.  Additional cryptographically strong 
  method for per-packet protection may be used together with packet
  filtering.

Yoshihiro Ohba

---

From: Reinaldo Penno <[email-masked]>
Date: Sun, 29 Sep 2002 11:28:15 -0700 (PDT)

Hello Yoshi,

here it goes the PEP definition from RFC2753. Please
check if we can be use something from these
definitions so we do not confuse people with PEP vs.
EP. Maybe we could say that it's a PEP in which the
rules are solely based on DI information.

"-  Policy: The combination of rules and services
where rules define the criteria for resource access
and usage.

   -  Policy control: The application of rules to
determine whether or not access to a particular
resource should be granted.

   -  Policy Object:  Contains policy-related
information such as policy elements and is carried in
a request or response related to a resource allocation
decision.

   -  Policy Element: Subdivision of policy objects;
contains single units of information necessary for the
evaluation of policy rules. A single policy element
may carry an user or application identification
whereas another policy element may carry user    
credentials or credit card information.  The policy
elements themselves are expected to be independent of
which QoS signaling protocol is used.

   -  Policy Decision Point (PDP): The point where
policy decisions are made.

   -  Policy Enforcement Point (PEP): The point where
the policy decisions are actually enforced."

regards,

Reinaldo

---

From: julien Bournelle <[email-masked]>
Date: Mon, 30 Sep 2002 09:59:59 +0200 (CEST)

> > to associate packets with the authenticated PaC.

do you suggest that it could be necessary to set Security Association
(e.g. AH) between PaC and EP ?

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 30 Sep 2002 18:00:33 -0400

Hello Reinaldo,

Thanks for the information.

The "rules" defined in RFC2753 are high-level ones that define
policies.  But do we need such high-level rules to be passed from PAA
to EP?  or low-level rules, e.g., firewall MIB parameters or
IPFilterRule AVP in Diameter or just DIs are enough?  If the latter is
the case, borrowing PEP definition might not make much sense.

Yoshihiro Ohba