Subject: [Pana] pana-preauth Issue 243 (proposed text)

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 27 Feb 2006 17:00:01 -0500

Sasikanth and all,

Here is proposed text for Issue 243
(http://danforsberg.info:8080/pana-issues/issue243):

[1] In Section 3,

change:

"
   At some point after establishing the pre-authentication SA, the PaC
   moves to the access network of the r-PAA.  Then the PaC initiates a
   PANA-Update exchange to inform the PAA of the IP address change.  In
   this PANA-Update exchange, the P-bit is unset.  On successful
   completion of the PANA-Update exchange and post-authorization
   procedure, the pre-authentication SA becomes the active SA.  The
   active SA between the PaC and l-PAA may stay active for a while to
   deal with the case in which the PaC immediately switches back to the
   previous access network.
"

to:

"
   At some point after establishing the pre-authentication SA, the PaC
   may move to the access network of the r-PAA.  The r-PAA may be found
   by running PAA discovery or immediately when the PaC attaches a
   link-layer device that is acting as an EP whose device identifier
   was contained in the list of EP device identifiers advertised by
   the r-PAA in the pre-authentication procedure.  If the r-PAA is
   found, the PaC initiates a PANA-Update exchange to inform the PAA
   of the IP address change.  In this PANA-Update exchange, the P-bit
   is unset.  On successful completion of the PANA-Update exchange and
   post-authorization procedure, the pre-authentication SA becomes the
   active SA.  The active SA between the PaC and l-PAA may stay active
   for a while to deal with the case in which the PaC immediately
   switches back to the previous access network.  

   If no such an r-PAA is found but other PAA(s) in the new access
   network, a full PANA authentication or PANA mobility optimization
   may be performed between the PaC and one of those PAA(s) based on
   the procedures described in [I-D.ietf-pana-pana] and
   [I-D.ietf-pana-cxtp].
"

[2] In Section 5,

change:

"
   A pre-authorization and a post-authorization for the PaC may have
   different authorization policies.  For example, the pre-authorization
   policy may not allow the PaC to sent or receive packets through the
   EP(s) under control of the preparing PAA, while both the pre-
   authorization and post-authorization policies may allow installing
   credentials to the EP(s), where the credentials are used for
   establishing a security association for per-packet cryptographic
   filtering.
"

to:

"
   A pre-authorization and a post-authorization for the PaC may have
   different authorization policies.  For example, the pre-authorization
   policy may not allow the PaC to sent or receive packets through the
   EP(s) under control of the preparing PAA, while both the pre-
   authorization and post-authorization policies may allow installing
   credentials to the EP(s), where the credentials are used for
   establishing a security association for per-packet cryptographic
   filtering.  Different PANA session lifetimes may be
   used for pre-authorization and post-authorization.
"

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Sasikanth Bharadwaj <[email-masked]>
Date: Tue, 28 Feb 2006 10:43:20 +0530

Hi Yoshi

comments inline

>    the r-PAA in the pre-authentication procedure."
>
Running PAA discovery in the new network will not be straight forward
because
that would involve significant modifications to the PaC statemachine wrt PSR
processing. Also, the PDI might result in a new session being created at the
new PAA, which has to timeout after retransmission of the PSR. It would be
better if the draft explicitly states that the new EP address is available
through some other means and is out of scope of this document. That way, a
PaC can make use of other means such as service discovery or information
service as you mentioned in your earlier mail.

> If the r-PAA is found, the PaC initiates a PANA-Update exchange to inform
the > PAA of the IP address change.  In this PANA-Update exchange, the P-bit
> is unset

If the PaC has pre-auth sessions established with multiple PAAs, does it
have to send PUR to all the other PAAs with P bit set?

>    used for pre-authorization and post-authorization.
It would be better if something is mentioned explicitly about
reauthentication.

Regards

Sasikanth

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 28 Feb 2006 13:10:35 -0500

Hi Sasikanth, 

On Tue, Feb 28, 2006 at 10:43:20AM +0530, Sasikanth Bharadwaj wrote:
> processing. 

I agree that the PaC statemachine would need to be modified for this,
but the modification can be simple, e.g., the PaC can create a
separate session from the existing pre-authentication session to send
a PDI.  If it receives a PSR from a r-PAA, the created sesssion is
deleted immediately and an event is created for the pre-authentication
session to send PUR.

> Also, the PDI might result in a new session being created at the

We should design the solution to be standalone as much as possible.
(The only non-standalone part would be the method to find a remote PAA
from a local access network.)

Also, even if we rely on some other means to find r-PAA after
handover, the PAA may still send a PSR for unsolicited PAA discovery
and the outcome is not different.  So it seems to make sense to allow
the PaC to send PDI to discover r-PAA.

> It would be better if something is mentioned explicitly about

OK.

Yoshihiro Ohba