Subject: RE: WG Last Call: draft-ietf-pana-usage-scenarios-04.txt

From: <[email-masked]>
Date: Thu, 27 Mar 2003 14:48:43 -0600

> 
> > => The Access Point Name (APN) is a concept introduced
> > for GPRS. It is hard to give a concrete definition because
> > it is not consistent for all use cases. But examples of APNs
> > are : "IMS", which means that the device wishes to use the 
> > IP multimedia system, "Internet access" means: just give 
> > me open internet access, "company.com" means I want
> > access to my corporate network ....etc (there are no standard
> > names for APNs, these are just examples I made up).
> > The APN can cause the network to allocate addresses from
> > different address pools (e.g. company.com has its own address
> > pool that should be used by the GGSN). Clearly this concept
> > implies some filtering on outbound traffic based on both
> > the source and dst addresses. Also, the charging is tied to
> > that particular APN, e.g. time-based or flat rate ...etc.
> 
> I assume that in GPRS there is an access control decision
> to verify that the authenticated principal can in fact use a 
> particular APN.
> Thus the "profile" for the principal needs to list which APNs it is
> allowed to use, right?

Correct. The decision is made by the SGSN.
In GPRS the MN sends the request to the SGSN which includes the APN.
The APN is a logical name. The SGSN validates whether the user is
allowed access to an APN from the subscriber profile data that the
SGSN has obtained previously (during the ATTACH procedure). 

However I think the point is that with PANA you could authenticate 
a user for access to some service that may be available only as a 
result of authenticating the user. There are many ways to do this
today, but PANA could also be used for this. 
So while PANA does not do anything to get network access in GPRS,
it may be useful for getting authorized to access a video streaming 
service connected to the GPRS network. So this goes beyond the scope
of authentication for network access only concept.

>   Erik

-Basavaraj

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 28 Mar 2003 11:05:11 +0100 (CET)

> SGSN has obtained previously (during the ATTACH procedure). 

Thanks for the info.

> of authentication for network access only concept.

If the IETF wants to go down this path it might also make sense to view
it as a separate modular piece that after authentication allows the 
authenticated entity to switch between different "profiles/filters/services"
(yes, all those terms are overloaded :-(  the same way the APN allows
specifying the "profile/filter/service" at the time of GPRS authentication.

  Erik

---

From: Alper Yegin <[email-masked]>
Date: Fri, 28 Mar 2003 14:52:20 -0800

Here is an I-D on EAP-based authorizations:

draft-grayson-eap-authorisation-01.txt

FYI....

alper