Re: [Secauth] secauth use case - What is next?

[Alexandre Petrescu <[e-mail]>]

Le 03/12/2014 19:44, Alan DeKok a écrit :
> On Dec 3, 2014, at 11:59 AM, Hosnieh Rafiee
> <[e-mail]> wrote:
>
>> Folks, I have created some slides to explain where secauth can work
>> in this specific scenario that is hotspot entities' authentication
>> and authorization. I reviewed all previous comments.
>
> They explain the situation well.
>
>> @Paul:
>>> Other forums are working on the problem:
>>> https://www.wi-fi.org/passpoint-release-2-operator-best-practices-for-aaa-interface-deployment-v200
>>
>>>
I have checked it. This is true that they want to have similar function, 
but their main actor is end user. I am thinking about fully transparency 
for end-user and also Hotels or hotspot domain admins.
>
> I’ve spent time working at a WiFi inter-connect provider.
> Interconnections are *hard*.  They require human involvement.  The
> protocols are easy.  RADIUS, IPSec, etc.  The hard part is that
> everyone’s business methods, billing, etc. are different.  The
> interconnect providers do significant work to mangle each packet to /
> from disparate ISPs.
>
>> Is there any operators in this group to share the opinions from
>> operators' point of view? Telekom? O2? Vodafone? I only can discuss
>> this from industrial point of view.
>
> The operators tend to not be involved in the IETF.  I spend a fair
> amount of time talking to them, though.
>
>> Where secauth can work: 1- If more than one industries,
>> communication between SDN controllers.(interoperability of two
>> different SDN providers) 2- The whole process for interdomain and
>> cross domain authentication & probably authorization (if any
>> specific policy should be applied in new network) including
>> considering shared resources (for tokens and policies, etc.).
>> Current standards like RADIUS, etc. cannot provide cross domain
>> authentication.
>
> I have no idea what that means.  RADIUS is *widely* used on
> cross-domain authentication.  I can say without exaggeration that
> outside of 3G, it’s the *only* protocol used for cross-domain
> authentication.
>
> Eduroam is widely used.  IETF WGs like Abfab are standardizing
> cross-domain authentication, where the domains require no previous
> coordination to communicate.  They only require a common CA, which
> shows that both domains are part of the same roaming consortium.
>
>> 3- seamless authentication and authorization (this is especially
>> true for sensors or small devices without keyboard to set the
>> authentication)
>
> These scenarios are widely deployed today.  e.g. medical devices
> which send telemetry data back to a central monitoring system.  The
> devices use EAP for authentication, and RADIUS for cross-domain
> authentication.

Ok when EAP is used, but how about public hotspots managed by web portal 
where users need to fill in forms?

It may be easy to connect my laptop to that airport lounge hotspot, but 
I doubt my future watch will connect as easy.

Alex

>
> Alan DeKok.
>
> _______________________________________________ Secauth mailing list
> [e-mail] https://www.ietf.org/mailman/listinfo/secauth
>