Subject: [Pana] Section 3 (Issue 219)

From: "Alper Yegin" <[email-masked]>
Date: Mon, 6 Feb 2006 14:50:23 +0200

Revised Section 3 based on AD review is below. "CHANGE" marks where a change
was made, and must be omitted in the final text.

3.  Protocol Overview

   The PANA protocol is run between a client (PaC) and a server (PAA) in
   order to perform authentication and authorization for the network
   access service.

CHANGE: Next paragraph has two minor editorial changes.

   The protocol messaging consists of a series of request and responses,
   some of which may be initiated by either end.  Each message can
   carry zero or more AVPs within the payload.  The main payload of PANA is 
   EAP which performs authentication.  PANA helps the PaC and PAA establish
   an EAP session.

   PANA is a UDP-based protocol.  It has its own retransmission
   mechanism to reliably deliver messages.

   PANA messages are sent between the PaC and PAA as part of a PANA
   session.  A PANA session consists of distinct phases:

   o  Discovery and handshake phase: This is the phase that initiates a
      new PANA session.  The PaC discovers the PAA(s) by either
      explicitly soliciting advertisements for them or receiving
      unsolicited advertisements.  The PaC's answer sent in response to
      an advertisement starts a new session.

   o  Authentication and authorization phase: Immediately following the
      discovery and handshake phase is the EAP execution between the PAA
      and PaC.  The EAP payload (which carry an EAP method inside) is
      what is used for authentication.  The PAA conveys the result of
      authentication and authorization to the PaC at the end of this
      phase.  This phase may involve execution of two EAP sessions back-
      to-back, one for the NAP and one for the ISP.

CHANGE: Next paragraph has a clarification change. Handles issue 219.

   o  Access phase: After a successful authentication and authorization
      the host gains access to the network and can send and receive IP
      data traffic through the EP(s).  At any time during this phase,
      the PaC and PAA may optionally send PANA ping messages to test
liveness of the PANA session on the peer.

   o  Re-authentication phase: During the access phase, the PAA must
      initiate re-authentication before the PANA session lifetime
      expires.  EAP is carried by PANA to perform authentication.  This
      phase may be optionally triggered by both the PaC and the PAA
      without any respect to the session lifetime.  The session moves to
      this phase from the access phase, and returns back there upon
      successful re-authentication.

   o  Termination phase: The PaC or PAA may choose to discontinue the
      access service at any time.  An explicit disconnect message can be
      sent by either end.  If either the PaC or the PAA disconnects
      without engaging in termination messaging, it is expected that
      either the expiration of a finite session lifetime or failed
      liveness tests would clean up the session at the other end.

     PaC  PAA    Message
   -----------------------------------------------------
   // Discovery and handshake phase
      ----->     PANA-PAA-Discover
      <-----     PANA-Start-Request
      ----->     PANA-Start-Answer

   // Authentication and authorization phase
      <-----     PANA-Auth-Request /* EAP Request */
      ----->     PANA-Auth-Answer
      ----->     PANA-Auth-Request /* EAP Response */
      <-----     PANA-Auth-Answer
      <-----     PANA-Bind-Request /* EAP Success */
      ----->     PANA-Bind-Answer

   // Access phase (IP data traffic allowed)
      <-----     PANA-Ping-Request
      ----->     PANA-Ping-Answer

   // Termination phase
      ----->     PANA-Termination-Request
      <-----     PANA-Termination-Answer

           Figure 1: Illustration of PANA messages in a session

CHANGE: Next paragraph has changed for handling issue 219.

   Note that depending on the environment and deployment the protocol
   flow depicted in Figure 1 can be abbreviated (An unsolicited
   PANA-Start-Request can be sent without a triggering PANA-PAA-Discover, 
   EAP responses can be piggybacked on the PANA-Auth-Answers, and PANA-Ping
   and PANA-Termination usage is optional).

CHANGE: Next paragraph has a minor editorial change.
    
   Cryptographic protection of messages between the PaC and PAA is
   possible as soon as EAP in conjunction with the EAP method exports a
   shared key.  That shared key is used to create a PANA SA.  The PANA
   SA helps generate per-message authentication codes that provide
   integrity protection and authentication.

   Throughout the lifetime of a session, various problems found with the
   incoming messages can generate a PANA error message sent in response.

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana