Re: [Ideas] Comments on draft-ccm-ideas-identity-use-cases-02

[Uma Chunduri <[e-mail]>]

Tom,


	>Google Cloud for instance operates a huge multi-tenant network and I suspect they use LOAS to authenticate access to 

Context here is not where to deploy this but how to make a mapping system where it's applicable for multiple environments (enterprise, DC,  etc..)   with flexibility to work with existing ID/LOC protocols.

	>In my design for ILA, I'm fond of using TLS for communications which provides both security (encryption) and verifiable identity in certificates. The X.509 identity can be used to against ACLs to control read and write access. 

Couple of things:
1. ILA is one of the data planes and lot of issues you raised in this thread applicable there too, IMO. What we thoroughly looked into were the existing IETF approved ID/LOC technologies (HIP & LISP), where there are multiple  immediate use cases
2. I would note -  DC/VM with multi-tenant mobility is only one of the use cases for IDEAS - and AFAIK you contributed a lot from ILA pov.
3. On using TLS/X.509  - we are jumping way ahead of ourselves - we can come back on this if we have *a wg*
4. The above also depends on the type of the device in question too (for low power devices #3 may not be applicable).
5. We also ought to see & learn why EAP-AKA is all over and used for decades in other SDOs (including for non-3GPP access)  and continue to play a significant & expanded role in 5G.

	>If this is the same thing as identity being described in IDEAS then I guess we're on the same page..

After months of discussion on this list on this topic - the above individual pre-pre-wg document was put together to allow structured feedback and to evolve our thinking around what has to be done for various requirements.
Any further feedback is welcome...

--
Uma C.