Subject: EP's role

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 2 May 2003 18:40:21 -0700

Hello,

     Enforcement Point (EP)

        A node on the access network where per-packet
        enforcement policies (i.e., filters) are applied on the inbound
        and outbound traffic of client devices. Information such as DI
        and (optionally) cryptographic keys are provided by PAA per
        client for constructing filters on the EP.

EP's role is to prevent service theft i.e it wants to prevent
unauthorized
access  and also prevent one node spoofing as another and getting free
service.
 
Does this mean whether EP is used to protect the traffic sent between
PaCs ? From the definition, it looks like each and every packet sent out
by the PaC is looked at by the EP. Does it really care about traffic
sent
between the PaCs i.e local traffic ?

thanks
mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 6 May 2003 12:12:00 -0700

PaC-to-PaC traffic can be enforced at EP only when the traffic passes
through the EP.  If this is not the case, i.e., the traffic sent from
a PaC can directly reach the other PaC without passing through any EP
(this can happen at least in wireless access networks), it might be
the responsibility of PaC to do its own access control for such direct
traffic.

If the access network is operating in an infrastructure mode in which
all traffic needs to pass through an access point, the access control 
at PaC might be fairly easy, by using per-packet protection between 
the PaC and access point and accepting protected traffic only.

If the access network is operating in an ad-hoc mode, the access
control at PaC might need per-packet protection between the
communicating PaCs, which might require a security association between
the PaCs.  If pre-established SA is assumed between the PaCs, just use
it for deriving the required per-packet protection keys.  If this is
not the case, Kerberos could be used for establising an SA between the
PaCs (like KINK does).  But Kerberos requires an authentication server
as a trusted 3rd party to the PaCs.  In roaming environments, it might
be difficult to assume pre-established security association between
the Kerberos authentication server and the PaCs.  In this case, PANA
could be used for bootstraping Kerberos in the access network (I'm not
recommending it, I'm just mentioning possibility).

The above categorization in terms of modes of operation (i.e.,
infrastructure or ad-hoc) might be for layer-2 security only.  When we
consider layer-3 security aspect of PaC-to-PaC traffic, the "ad-hoc
mode" discussion in the above would always apply to layer-3.

So, my unswer would be that it does not really care about traffic sent
between the PaCs.

Yoshihiro Ohba

---

From: Francis Dupont <[email-masked]>
Date: Fri, 09 May 2003 10:28:45 +0200

In your previous mail you wrote:

=> PANA is about IP which is in the network layer. Wireless
infrastructure/ad-hoc modes are irrelevant.

   When we consider layer-3 security aspect of PaC-to-PaC traffic,

=> this should be always the case: the layer-2 doesn't belong to our scope.

   the "ad-hoc mode" discussion in the above would always apply to layer-3.
   
Regards

[email-masked]