Subject: About the NAP/ISP distinction in the usage-scenarios draft...

From: "MORAND Lionel FTRD/DAC/ISS" <[email-masked]>
Date: Mon, 9 Dec 2002 14:59:42 +0100

Hi folks,
 
In the current version of the Usage-Scenario draft, in the section 3: Problem Statement, the distinction between NAP (Network Acces Provider) and ISP (Internet Service Provider) is pointing out.
 
[...An important aspect of an authentication protocol is the ability to provide dynamic service provider selection to the clients. Regardless of their network access provider (NAP), clients should be able to select an Internet access provider (ISP) of their choice. This is usually achieved by clients presenting an identifier which carries domain information during the authentication process. ]
 
This distinction is particularly true in the case of DSL networks where NAP and ISP are often two different players. Besides traditional "package" offer (access + Internet provided by the ISP), NAP are able to provide broadband access services directly to the user, regardless of the ISP selected by the user. Moreover, different access network configurations may be provide to an xDSL client, based on the access service subscribed to the NAP. We could also imagine the provision of some local services in the short/medium term.
 
In order to provide such a "customized" service, the NAP needs to identify/authenticate the user that logs on to the access network. This authentication is independent from the authentication achieved by the ISP and so not necessarily based on the same user credentials. This induces a requirement for two levels of authentication: one at the NAP level, one at the ISP level. I think that this requirement is not only restricted to xDSL network and be generalized on the contrary.
 
For the time being, if PPP is used to carry user information for ISP authentication, NAP identification is mainly based on information on the physical link used for the connection (phone line number, ATM link, etc.) and not according to the user using the connection. So it is not possible to distinguish two consecutive users using the same link and the network configuration is only based on the service subscribed for the access link.
 
and now I wonder:

*	How the PANA protocol could fulfil such a requirement on two authentication levels (NAP, ISP)?
*	What would be the consequences on the general PANA requirements?
*	Would it be useful to include/precise this scenario be in the current usage-scenarios draft?

Any comment/reaction from the mailing list?
 
Lionel.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 10 Dec 2002 10:55:41 -0500

This is an interesting issue.

As you pointed out, we might need different client identifiers for NAP
and ISP.  From the viewpoint of PANA, I think relationship between PaC
identifier and DI needs to be considered.

If different DIs are used for NAP access and ISP access, I think it is
possible to support the scenario in the current context of the usage
scenarios and requirements documents.

If the same DI is used for both levels of access, it might not satisfy
the definition of DI if multiple PaC identities are associated with
the DI on a PAA.  If different PAAs are used for each level of access, 
it might affect PAA discovery and need more discussion.

Yoshihiro Ohba

---

From: Reinaldo Penno <[email-masked]>
Date: Wed, 11 Dec 2002 07:08:37 -0800 (PST)

I've dealt with some deployments like this whenever
(some degree) of open access is used. This is very
common for DSL in USA and somewhat in Asia and the
rest of the americas. In Europe there are also some
carriers that use this model.  

I know also some wireless deployments that use this
model in south america.

Solutions used today:

1 - A double Radius Authentication. The NAP's Radius
authenticate the user and also proxy the request to
the Radius of the ISP. This happens because as pointed
out there might be different services offered by
different entities. And not to mention that in some
cases where the user receive separate bills, the user
can pay one but not the other.

2 - One Radius authentication and a captive portal for
the second level.

The first solution uses a Radius Request packet for
all its operations. So although the NAP and ISP might
look for different things in the packet all the
relevant information for both of them needs to be
there.

In the second one different kinds of information can
be supplied, one for each type of authentication.

regards,

Reinaldo

--- Yoshihiro Ohba <[email-masked]> wrote:
> > In the current version of the Usage-Scenario
> draft, in the section 3: Problem Statement, the
> distinction between NAP (Network Acces Provider) and
> ISP (Internet Service Provider) is pointing out.
> >  
> > [...An important aspect of an authentication
> protocol is the ability to provide dynamic service
> provider selection to the clients. Regardless of
> their network access provider (NAP), clients should
> be able to select an Internet access provider (ISP)
> of their choice. This is usually achieved by clients
> presenting an identifier which carries domain
> information during the authentication process. ]
> >  
> > This distinction is particularly true in the case
> of DSL networks where NAP and ISP are often two
> different players. Besides traditional "package"
> offer (access + Internet provided by the ISP), NAP
> are able to provide broadband access services
> directly to the user, regardless of the ISP selected
> by the user. Moreover, different access network
> configurations may be provide to an xDSL client,
> based on the access service subscribed to the NAP.
> We could also imagine the provision of some local
> services in the short/medium term.
> >  
> > In order to provide such a "customized" service,
> the NAP needs to identify/authenticate the user that
> logs on to the access network. This authentication
> is independent from the authentication achieved by
> the ISP and so not necessarily based on the same
> user credentials. This induces a requirement for two
> levels of authentication: one at the NAP level, one
> at the ISP level. I think that this requirement is
> not only restricted to xDSL network and be
> generalized on the contrary.
> >  
> > For the time being, if PPP is used to carry user
> information for ISP authentication, NAP
> identification is mainly based on information on the
> physical link used for the connection (phone line
> number, ATM link, etc.) and not according to the
> user using the connection. So it is not possible to
> distinguish two consecutive users using the same
> link and the network configuration is only based on
> the service subscribed for the access link.
> >  
> > and now I wonder:
> > 
> > *	How the PANA protocol could fulfil such a
> requirement on two authentication levels (NAP, ISP)?
> > *	Would it be useful to include/precise this
> scenario be in the current usage-scenarios draft?
> > 

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 11 Dec 2002 15:16:00 -0800

Hello Lionel,

Thanks for bringing this scenario up.

In the case both NAP and ISP requires their own independent
client authentication, I presume we can still envision both
using the same PAA on the BAS (broadband access server). Does this
makes sense?

For NAP authentication, PAA consults with AAA backend in NAP
network. For ISP authentication, PAA consults with AAA backend
in ISP network.

Somehow the client needs to know (or discover??) that it has
to go through the authentication twice. Discovery might be tricky
because something has to tell the client that the second one
is meant for the ISP, etc.... If the client knows it has to do both,
it can differentiate the authentication process by using different
client identifiers in each. Therefore PAA can demultiplex the
authentication request to the right backend.

So, running PANA twice between the PaC and the same PAA maybe one
approach. Each time PaC can use a different set of credentials. If the
same credentials are used, then we need something else in the process
to indicate which one is for NAP authentication vs for ISP authentication.

When two different set of credentials are used, if PaC uses the same
DI, this might be an issue. Normally they would appear as two separate
clients to the PAA, but since the network is aware of this
dual-authentication
scheme, and the requests are coming from the same circuit, maybe this
can be handled. And than, how will these DIs be used with service
provisioning, after each authentication? Is EP still co-located
with BAS here? How should the NAP authentication update EP, and ISP
authentication update EP? These are general questions about the model
you are describing..

alper

----- Original Message -----
From: MORAND Lionel FTRD/DAC/ISS
To: [email-masked] ; Yoshihiro Ohba ; [email-masked]
; Alper E. YEGIN
Sent: Monday, December 09, 2002 5:59 AM
Subject: About the NAP/ISP distinction in the usage-scenarios draft...

Hi folks,

In the current version of the Usage-Scenario draft, in the section 3:
Problem Statement, the distinction between NAP (Network Acces Provider) and
ISP (Internet Service Provider) is pointing out.

[...An important aspect of an authentication protocol is the ability to
provide dynamic service provider selection to the clients. Regardless of
their network access provider (NAP), clients should be able to select an
Internet access provider (ISP) of their choice. This is usually achieved by
clients presenting an identifier which carries domain information during the
authentication process. ]

This distinction is particularly true in the case of DSL networks where NAP
and ISP are often two different players. Besides traditional "package" offer
(access + Internet provided by the ISP), NAP are able to provide broadband
access services directly to the user, regardless of the ISP selected by the
user. Moreover, different access network configurations may be provide to an
xDSL client, based on the access service subscribed to the NAP. We could
also imagine the provision of some local services in the short/medium term.

In order to provide such a "customized" service, the NAP needs to
identify/authenticate the user that logs on to the access network. This
authentication is independent from the authentication achieved by the ISP
and so not necessarily based on the same user credentials. This induces a
requirement for two levels of authentication: one at the NAP level, one at
the ISP level. I think that this requirement is not only restricted to xDSL
network and be generalized on the contrary.

For the time being, if PPP is used to carry user information for ISP
authentication, NAP identification is mainly based on information on the
physical link used for the connection (phone line number, ATM link, etc.)
and not according to the user using the connection. So it is not possible to
distinguish two consecutive users using the same link and the network
configuration is only based on the service subscribed for the access link.

and now I wonder:
How the PANA protocol could fulfil such a requirement on two authentication
levels (NAP, ISP)?
What would be the consequences on the general PANA requirements?
Would it be useful to include/precise this scenario be in the current
usage-scenarios draft?
Any comment/reaction from the mailing list?

Lionel.