[Secauth] My Summary of the December Conference Call

[Hannes Tschofenig <[e-mail]>]

Hi all,

in December we had a conference call and it clarified many aspects for
me. I wanted to post a short summary of what I understood (in an attempt
to see whether others got the same impression at the call).

Hosnieh explained a model using OpenFlow where the AAA client is
actually moved into the cloud. Consequently, there is no need to use
RADIUS or Diameter in such a model since the network access
authentication messages are just forwarded from the access point to the
cloud infrastructure using some tunneling mechanism.

Now, there is still a problem with that model since at the end of the
protocol dance the access point (who was previously running the AAA
client) now has to be informed about the authorization decision. At a
minimum it has to get the keys for enabling link layer security. From
the discussions on the call I got the impression that this transfer of
authorization information from the cloud infrastructure to the access
point has not yet been standardized in an OpenFlow alike model. (Note
that OpenFlow just served as an example and similar technologies could
be used that aim to delegate the execution to some other nodes.)

Did others understood the problem description in the same way?

If "yes", then the question is

 * Is this a worthwhile problem to solve? In some sense this could be
seen as a competitor to RADIUS and Diameter.
 * Are we just moving problems around here and not really advancing the
state of the art (which might a general question with OpenFlow alike
technologies IMHO)?
 * Is there indeed a standardization gap (or are we just uninformed
about the state of the art)?
 * Is the IETF the right venue to do this type of standardization work?

Thoughts?

Ciao
Hannes