Re: [Secauth] secauth use case - What is next?

[Alan DeKok <[e-mail]>]

On Dec 3, 2014, at 11:59 AM, Hosnieh Rafiee <[e-mail]> wrote:

> Folks,
> I have created some slides to explain where secauth can work in this specific scenario that is hotspot entities' authentication and authorization. 
> I reviewed all previous comments. 

 They explain the situation well.

> @Paul:
>> Other forums are working on the problem:  https://www.wi-fi.org/passpoint-release-2-operator-best-practices-for-aaa-interface-deployment-v200
> I have checked it. This is true that they want to have similar function, but their main actor is end user. I am thinking about fully transparency for end-user and also Hotels or hotspot domain admins. 

 I’ve spent time working at a WiFi inter-connect provider.  Interconnections are *hard*.  They require human involvement.  The protocols are easy.  RADIUS, IPSec, etc.  The hard part is that everyone’s business methods, billing, etc. are different.  The interconnect providers do significant work to mangle each packet to / from disparate ISPs.

> Is there any operators in this group to share the opinions from operators' point of view? Telekom? O2? Vodafone? I only can discuss this from industrial point of view. 

 The operators tend to not be involved in the IETF.  I spend a fair amount of time talking to them, though.

> Where secauth can work: 
> 1- If more than one industries, communication between SDN controllers.(interoperability of two different SDN providers)
> 2- The whole process for interdomain and cross domain authentication & probably authorization (if any specific policy should be applied in new network) including considering shared resources (for tokens and policies, etc.). Current standards like RADIUS, etc. cannot provide cross domain authentication.

 I have no idea what that means.  RADIUS is *widely* used on cross-domain authentication.  I can say without exaggeration that outside of 3G, it’s the *only* protocol used for cross-domain authentication.

 Eduroam is widely used.  IETF WGs like Abfab are standardizing cross-domain authentication, where the domains require no previous coordination to communicate.  They only require a common CA, which shows that both domains are part of the same roaming consortium.

> 3- seamless authentication and authorization (this is especially true for sensors or small devices without keyboard to set the authentication)

 These scenarios are widely deployed today.  e.g. medical devices which send telemetry data back to a central monitoring system.  The devices use EAP for authentication, and RADIUS for cross-domain authentication.

 Alan DeKok.