Subject: [HOKEY] HOKEY architecture draft -- summary of key changes

From: Tom Taylor <[email-masked]>
Date: Fri, 16 Jul 2010 10:08:29 -0400

I'm hoping the latest version of the architecture draft is good enough to become 
a Working Group draft. The key changes come in section 4, the functional 
analysis of the architecture. Here is the functional diagram, from the I-D:

    +------------------------------------------------------------+
    |   AAA Network Access Authentication and Authorization      |
    +---+-------------.----------------------------+-------------+
        |            /|\                           |
        |             |  Authentication subsystem  |
    +===|=============|============================|=============+
    |   |   +---------+----------+   +-------------V---------+   |
    |   |   |    Direct and      |   | EAP Re-authentication |   |
    |   |   |      Indirect      |   +--+------+-------------+   |
    |   |   | Pre-Authentication |     /      /                  |
    |   |   +--------------------+    /      /                   |
    |   |                            /      / +---------------+  |
    |   |                           /      |  | Authenticated |  |
    |   |                          /       |  | Anticipatory  |  |
    |   |                         /        |  | Keying (AAK)  |  |
    |   |                        /         |  +-------+-------+  |
    |   |                       /          |          |          |
    | +-V------------------+   / +---------V----------V--------+ |
    | | EAP Authentication |  |  |       ER Key Management     | |
    | +---------+----------+  |  |+------------+ +------------+| |
    |           |             |  ||Handover Key| |Handover Key|| |
    |           |             |  || Derivation | |Distribution|| |
    |           |             |  |+------------+ +------+-----+| |
    |           |             |  +----------------------|------+ |
    +===========|=============|=========================|========+
                |             |                         |
    +-----------V-------------V-------------------------V--------+
    |             AAA routing and secure transport               |
    +------------------------------------------------------------+

As you can see, the HOKEY components taken together are viewed as an 
"authentication subsystem" which is closely tied to AAA. The arrows show the 
direction of functional relationships. For instance, AAA authentication, 
triggered by attachment, invokes EAP authentication or EAP re-authentication 
depending on the context. On the other hand, pre-authentication can cause AAA 
authentication to be invoked at a candidate access point, and this in turn will 
invoke EAP authentication or EAP re-authentication.

At the bottom of the diagram, you can see that the authentication subsystem is 
related to AAA in another way: EAP authentication, EAP re-authentication, and 
handover key distribution all rely on AAA capabilities for routing and secure 
transport.

This diagram is missing various discovery capabilities which are listed in the 
I-D. These capabilities are now placed outside of the authentication subsystem, 
since we received a few remarks about them being available through other means.

Hope this is an useful introduction.

BTW good news, Katrin Hoeper's day job will allow her more time to participate 
in this work again.

Tom Taylor