Subject: COPS-PR for PAA-EP interface

From: [email-masked]
Date: Mon, 10 Mar 2003 11:50:53 +0100

hi folks,

this proposal considers the applicability of existing COPS-PR protocol
for the PAA-EP communication:
http://www.ietf.org/internet-drafts/draft-yacine-pana-cops-ep-00.txt

below is a summary of how COPS-PR meets the PAA-EP protocol
identified requirements. I'll do an update as soon as these requirements 
are finalized.

--- security
the PAA-EP protocol needs to guaranty identity, confidentiality and
integrity

[COPS]: provides message level security for authentication, replay
protection, and message integrity. COPS can make use of existing
protocols for security such as IPSEC or TLS to authenticate and secure
the channel between the PEP(EP) and the PDP(PAA).

--- keep-alives
protocol used between PAA and EP should be able to detect inactive
peer within an appropiate time period and delete the related states.

[COPS]: KA messages are sent with a time-period set by the PDP(PAA)
at session startup.

--- event notification
architecture needs to allow PaC and PAA initiated authentication

[COPS]: COPS-PR can also be used following the outsourcing (pull) model.
For example, in a very similar context, 3GPP does it this way for PCF to
control GGSN (Go interface).

--- pull method
have a mechanism for a newly introduced EP to learn the policies
currently in effect on that access network.

[COPS]: the initial configuration request/decision can do this.

--- push method
PAA should be able to notify an EP for allowing/disallowing access
for a particular client. This should happen without EP sending a request
to the PAA.

[COPS]: the successive configuration decisions do this.

thanks,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Wed, 12 Mar 2003 23:01:06 -0800

Hello Yacine,

Thanks for the draft analizing COPS-PR. One question/comment:

   In the context of PANA, the access control information provisioned by
   the PAA to the EP consists are DI-based filters. Depending on the
   access technology, DIs might contain any of IP address, link-layer
   address, switch port number, etc. of a device.

In some scenarios, some keying material will be passed along with the DI to
the EPs. Would new data types necessary for this, or does COPS-PR already
handle this?

Thanks.

alper

---

From: [email-masked]
Date: Thu, 13 Mar 2003 11:05:29 +0100

Hi Alper,

>    address, switch port number, etc. of a device.

btw, I did not notice any list the different DI objects 
supported/carried by the PANA protocol in the recent draft.
does the working group plan to establish a list ?

> the EPs. Would new data types necessary for this, or does COPS-PR already

the IPSP wg has designed an IPSec PIB for that, see:
http://www.ietf.org/internet-drafts/draft-ietf-ipsp-ipsecpib-07.txt

No new data types needed.

> alper

thank you,
yacine

---

From: Alper Yegin <[email-masked]>
Date: Thu, 13 Mar 2003 12:34:00 -0800

Hello Yacine,

> does the working group plan to establish a list ?

4.7. Device ID choice
...
   Either an IP address or link-layer address should be used as device
   DI at any time.

This is the current types of DI we have considered in the draft. Other types
require more discussion.

alper