Subject: RE: session-id

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 17 Apr 2003 15:59:59 -0700

Yoshihiro,

> Per Alper's suggestion, I try to open up a new thread for session-id.
> 
> In pana-00 draft, a PANA session is identified by using 
> device identifier, which is either an IP address or a MAC 
> address.  I have the following scenario which might be 
> difficult to support in the current draft:
> 
>    A PaC starts PANA with using unspecified IP address.  After the PaC
>    is succesfully authenticated, it configures an IP address via DHCP.
>    Before the PaC obtains an IP address, the MAC address is used as
>    the device identifier.  Suppose that the network forces all PaCs to
>    use L3 ciphers, the PaC needs to perform IKE in order to establish
>    an IPsec tunnel between the PaC and EP after the PaC obtains an IP
>    address.
> 
>    The IKE credential is to be derived from EAP Master Key established
>    between the PaC and PAA as a result of successful PANA
>    authentication (I presume an Informational RFC describes a
>    mechanism for the credential derivation).
> 
>    In order for IKE to succeed, the EP needs to know the IKE
>    credential and IP address of the PaC.  This means that IP address
>    should also be a device identifier even when the MAC
>    address is initially used as the device identifier.  Note that the
>    MAC address may still be used as a device identifier even after the
>    PaC configures an IP address, in order to secure future DHCP
>    re-configuration.
I have a basic question here. Who decides what device identifier the
client
uses ? Assume the client wants to use the MAC address as the device
identifier,
and the network wants to use Ipsec for preventing service theft, does
PAA fail
the device identifier exchange ? 

> 
>    The IP address can be a link-local address, however, if additional
>    packet filtering is applied at EP to inner IP headers based on the 
>    PaC's global IP address, then such a global IP address would need
>    to be registered to the EP as a device identifier.
> 
> This scenario might affect PANA design as follows:
> 
> -  Both MAC address and IP address might need to be used as device
>    identifier at one time.
> 
> -  Multiple IP addresses might need to be used as device identifier at
>    one time.
> 
> These observation might boil down to the following functionalities for
> PANA:
> 
> -  Ability to update device identifier, perhaps based on add/delete
>    operation.
> 
> -  Ability to identify a PANA session based on a session identifier, 
>    which is more stable identifier than device identifier.
> 
I think it would make sense to separate these two identifiers. Device
identifier is used for access control and it should just be that. As
there could be multiple of them in use at the same time, it might make
sense to use a separate identifier for session.

-mohan

> Comments?
> Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 17 Apr 2003 20:39:29 -0400

Hi Mohan,

> the device identifier exchange ? 

I think PAA should always specify what types of device identifier it
can support.  In the current draft it is done by including Device-Id
AVP of a specific type that is required by the network in PANA_success
message sent by the PAA.  I think we can naturally extend this by just
allowing one or more Device-Id AVP(s) carried in PANA_success.

For example, if PAA supports both MAC address and IP address as device
identifier, it can send a PANA_success message containing two
Device-Id AVPs in PANA_success, indicating that the PaC needs to send
the same set of Device-Id AVPs in PANA_success_ack.  If the PaC does
not have an IP address yet, then it can include two Device-Id AVPs,
one containing its MAC address and the other containing an unspecified
(i.e., all-0's) IP address.  As soon as the PaC obtains an IP address,
the PaC should inform the updated IP address via PANA_reauth message 
exchange.  I'm not sure which entity should initiate PANA_reauth message 
exchange in this case, PaC or PAA?

> sense to use a separate identifier for session.

Are there any other scenarios where session-id is useful?

Yoshihiro Ohba