Re: [Secauth] secauth use case - What is next?

[Rafa Marin Lopez <[e-mail]>]

Hi Hosnieh:

I think the slides reflect the use case better. 

I agree with Alan's points here. The usage of EAP/AAA is important because typical access points already provide that feature. Also AAA is used for cross-domain authentication. As University we are used to the case where students coming from other Universities can access our APs with his credentials in their home institution. Eduroam and AAA-based federation make this possible.

Having said that, regarding the problem statement, if we want the user to access ISP1 and ISP2 , then there must be at some point some source of common trust (e.g. some IdP or entity that ISP1 and ISP2 both trust). For example, ISP1 and ISP2 may belong to a federation though they do not have direct SLAs.  	

In fact, what I understand from slide 5 is that, somehow, that trust is defined above southbound API with relationships that allow a user moving from Hotel A to Hotel B.

Best Regards.


El 03/12/2014, a las 19:44, Alan DeKok <[e-mail]> escribió:

> On Dec 3, 2014, at 11:59 AM, Hosnieh Rafiee <[e-mail]> wrote:
> 
>> Folks,
>> I have created some slides to explain where secauth can work in this specific scenario that is hotspot entities' authentication and authorization. 
>> I reviewed all previous comments. 
> 
> They explain the situation well.
> 
>> @Paul:
>>> Other forums are working on the problem:  https://www.wi-fi.org/passpoint-release-2-operator-best-practices-for-aaa-interface-deployment-v200
>> I have checked it. This is true that they want to have similar function, but their main actor is end user. I am thinking about fully transparency for end-user and also Hotels or hotspot domain admins. 
> 
> I’ve spent time working at a WiFi inter-connect provider.  Interconnections are *hard*.  They require human involvement.  The protocols are easy.  RADIUS, IPSec, etc.  The hard part is that everyone’s business methods, billing, etc. are different.  The interconnect providers do significant work to mangle each packet to / from disparate ISPs.
> 
>> Is there any operators in this group to share the opinions from operators' point of view? Telekom? O2? Vodafone? I only can discuss this from industrial point of view. 
> 
> The operators tend to not be involved in the IETF.  I spend a fair amount of time talking to them, though.
> 
>> Where secauth can work: 
>> 1- If more than one industries, communication between SDN controllers.(interoperability of two different SDN providers)
>> 2- The whole process for interdomain and cross domain authentication & probably authorization (if any specific policy should be applied in new network) including considering shared resources (for tokens and policies, etc.). Current standards like RADIUS, etc. cannot provide cross domain authentication.
> 
> I have no idea what that means.  RADIUS is *widely* used on cross-domain authentication.  I can say without exaggeration that outside of 3G, it’s the *only* protocol used for cross-domain authentication.
> 
> Eduroam is widely used.  IETF WGs like Abfab are standardizing cross-domain authentication, where the domains require no previous coordination to communicate.  They only require a common CA, which shows that both domains are part of the same roaming consortium.
> 
>> 3- seamless authentication and authorization (this is especially true for sensors or small devices without keyboard to set the authentication)
> 
> These scenarios are widely deployed today.  e.g. medical devices which send telemetry data back to a central monitoring system.  The devices use EAP for authentication, and RADIUS for cross-domain authentication.
> 
> Alan DeKok.
> 
> _______________________________________________
> Secauth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secauth

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: [phone] Fax: [phone] e-mail: [e-mail]
-------------------------------------------------------