Subject: [Pana] Issue 103: "PANA session" needs more clarification

From: Alper Yegin <[email-masked]>
Date: Thu, 15 Jul 2004 15:30:03 -0700

Here is the proposed text update:

Change:

PANA Session:

      PANA session is defined as the exchange of messages between the
      PANA Client (PaC) and the PANA Authentication Agent (PAA) to
      authenticate a user (PaC) for network access.  If the
      authentication is unsuccessful, the session is terminated.  The
      session is considered as active until there is a disconnect
      indication by the PaC or the PAA terminates it.  A distinct PANA
      session is associated with a pair of device identifiers of PaC and
      PAA.  For example, if the PaC has two interfaces connected to the
      same IP link with different IP addresses and IP address is used as
      a device identifier, a distinct PANA session will be created per
      interface if both interfaces addresses need to be authorized for
      network access.

   Session Identifier:

      This identifier is used to uniquely identify a PANA session on the
      PAA and PaC.  It is included in PANA messages to bind the message
      to a specific PANA session.

To:

   PANA Session:

      A PANA session begins with an initial handshake between the PANA
      Client (PaC) and the PANA Authentication Agent (PAA), and
      terminates due to an authentication failure, a timeout, or an
      explicit termination message. A fixed session identifier is 
      maintained throughout a session. A session cannot be shared
      across multiple physical network interfaces, but a physical
      network interface can have multiple sessions at a time. 

   Session Identifier:

      This identifier is used to uniquely identify a PANA session on the
      PAA and PaC. It includes an identifier of the PAA, therefore it 
      cannot be shared across multiple PAAs. It is included in PANA
messages 
      to bind the message to a specific PANA session. This bidirectional

      identifier is allocated by the PAA during the initial handshake 
      and freed when the session terminates. 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Jul 2004 19:42:17 -0400

>       network interface can have multiple sessions at a time. 

According to this definition, it is possible for a PaC with a single
physical interface to have multiple sessions (with different client
identities) to the same PAA.  I don't think we should allow it, because
the following text of the pana-requirement draft explicitly prohibits
it:

"
4.1.1  Authentication of Client

   PANA MUST enable authentication of PaCs for network access.  A PaC's
   identity can be authenticated by verifying the credentials (e.g.,
   identifier, authenticator) supplied by one of the users of the device
   or the device itself.  PANA MUST only grant network access service to
   the device identified by the DI, rather than granting separate access
   to multiple simultaneous users of the device.  ...
"

I think the following sentence of the original PANA session definition 
should be in the definition:

"
A distinct PANA
PAA.  
"

>       and freed when the session terminates. 

Session-Id AVP is not contained in PSR.  So, I think "during the
initial handshake" is not accurate.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 15 Jul 2004 17:26:08 -0700

> session is associated with a pair of device identifiers of PaC and

OK.

   PANA Session:

      A PANA session begins with the initial handshake between the PANA
      Client (PaC) and the PANA Authentication Agent (PAA), and
      terminates by an authentication failure, a timeout, or an
      explicit termination message. A fixed session identifier is 
      maintained throughout a session. A session cannot be shared
      across multiple physical network interfaces. A distinct PANA
      session is associated with the device identifiers of PaC and
      PAA.

> initial handshake" is not accurate.

Right.

   Session Identifier:

      identifier is allocated by the PAA following the initial handshake

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 16 Jul 2004 15:16:10 -0400

The proposed text looks fine.

Yoshihiro Ohba