Subject: RE: EP's role

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 6 May 2003 13:12:09 -0700

Yoshihiro,

> 
> PaC-to-PaC traffic can be enforced at EP only when the traffic passes
> through the EP.  If this is not the case, i.e., the traffic sent from
> a PaC can directly reach the other PaC without passing through any EP
> (this can happen at least in wireless access networks), it might be
> the responsibility of PaC to do its own access control for such direct
> traffic.
> 
> If the access network is operating in an infrastructure mode in which
> all traffic needs to pass through an access point, the access control 
> at PaC might be fairly easy, by using per-packet protection between 
> the PaC and access point and accepting protected traffic only.
> 
Yes.

> If the access network is operating in an ad-hoc mode, the access
> control at PaC might need per-packet protection between the
> communicating PaCs, which might require a security association between

Who is the PAA in this case ?

> the PaCs.  If pre-established SA is assumed between the PaCs, just use
> it for deriving the required per-packet protection keys.  If this is
> not the case, Kerberos could be used for establising an SA between the
> PaCs (like KINK does).  But Kerberos requires an authentication server
> as a trusted 3rd party to the PaCs.  In roaming environments, it might
> be difficult to assume pre-established security association between
> the Kerberos authentication server and the PaCs.  In this case, PANA
> could be used for bootstraping Kerberos in the access network (I'm not
> recommending it, I'm just mentioning possibility).
> 
Do we really envision PANA for ad-hoc usage ? At least none of the usage
scenarios fit in this last time i read it.

> The above categorization in terms of modes of operation (i.e.,
> infrastructure or ad-hoc) might be for layer-2 security only.  When we
> consider layer-3 security aspect of PaC-to-PaC traffic, the "ad-hoc
> mode" discussion in the above would always apply to layer-3.
> 
> So, my unswer would be that it does not really care about traffic sent
> between the PaCs.
> 
Ok. Do you think there is a need where it will be useful to control the
traffic sent between PaCs i.e what do you lose by not controlling or gain
by controlling the traffic between PaCs ? 

The definition of EP just talks about such an entity exists for doing
access control. Should it be specified about what it is controlling ? or
leave the details unspecified and leave it to the network operator/
mechanism used to protect the link etc. ?

thanks
mohan

> Yoshihiro Ohba
> 
> 
> 
> 
> On Fri, May 02, 2003 at 06:40:21PM -0700, Mohan Parthasarathy wrote:
> > Hello,
> > 
> > 
> >      Enforcement Point (EP)
> > 
> >         A node on the access network where per-packet
> >         enforcement policies (i.e., filters) are applied on 
> the inbound
> >         and outbound traffic of client devices. Information 
> such as DI
> >         and (optionally) cryptographic keys are provided by PAA per
> >         client for constructing filters on the EP.
> > 
> > EP's role is to prevent service theft i.e it wants to prevent
> > unauthorized
> > access  and also prevent one node spoofing as another and 
> getting free
> > service.
> >  
> > Does this mean whether EP is used to protect the traffic 
> sent between
> > PaCs ? From the definition, it looks like each and every 
> packet sent out
> > by the PaC is looked at by the EP. Does it really care about traffic
> > sent
> > between the PaCs i.e local traffic ?
> > 
> > thanks
> > mohan
> > 
> > 
>

---

From: Alper Yegin <[email-masked]>
Date: Tue, 06 May 2003 18:12:54 -0700

> mechanism used to protect the link etc. ?

I think a well secured access network should prevent unauthorized clients
sending and receiving IP packets. Hence, the EP should be placed where it
can police the traffic sent between clients. This way the network resources
are well protected, and the legitimate clients have less vulnerability
against malicious nodes.

There may be networks where EP cannot really enforce anything on the
inter-client traffic, but I think this would not be an intentional choice of
the operator. I cannot think of why one would prefer this unless there are
some deployment difficulties with placing EP between clients.

Alper