Subject: RE: [eap] Re: network discovery & selection: problem definition

From: <[email-masked]>
Date: Mon, 8 Dec 2003 14:09:57 +0200

Hi Farid,

I actually like Bernard's idea of including identity
(credential) selection, since I don't think the assumption that
the user's terminal will have only a single set of credentials
is very realistic. Even if the terminal has only a single
identity for Public Wireless LANs, private WLANs (corporate,
home) are much more widely used.

Fortunately, it seems that all the proposed solutions will at
least partially solve this problem as well, so including it
doesn't seem to complicate things very much.

Other than that, I think your definition also captures the
essential parts of the problem quite well.

The most difficult thing seems to be going from discovery to
selection. Just knowing which choices are available is probably
enough for manual selection (and we certainly should support
that as a fallback). However, I think that automatic selection
is much more important, and to select which of the choices is 
the "most appropriate", the terminal needs more information 
than just realm names.

o  Some credentials (identities) may be preferred to others 
   (e.g. use private corporate WLAN if available, and  
   pay-for PWLAN only if outside office)

o  Use of an access network with direct connection to home 
   network may be preferred over using mediating networks.

o  Some mediating networks may be preferred to others, most 
   likely based on cost (but note that optimizing cost is not a 
   trivial problem, because the total cost may be a combination 
   of a fixed fee, per-minute, per-megabyte, volume discounts, etc.)

o  Some access networks may be preferred to others, based on e.g. 
   cost, bandwidth, quality of service, coverage, or value-added 
   services.

o  Preferences may come from the user, his or her employer (who's
   paying the bill), home network, or access network.

It seems to me that one of the main differences between
different approaches (discovering mediating networks with EAP or
virtual APs, or pre-provisioned SSID phonebook) is what kind of
"cost functions" they easily support for the automatic selection
problem.

For instance, implementing automatic selection that always
selects an access network with direct connection to home network
(if available) seems to be much easier with virtual APs and
"SSID phonebook" methods than EAP-based advertisements. 
Or to take a second example, considering costs in automatic 
selection is probably difficult without an "SSID phonebook".

I'm not saying that supporting everything is necessary,
but it's at least good to know what trade-offs we're making,
and what kind of automatic selection criteria we're supporting
and not supporting.

Best regards,
Pasi

> -----Original Message-----
> From: Adrangi, Farid
> Sent: Tuesday, December 02, 2003 5:08 AM
> To: Bernard Aboba
> Cc: [email-masked]
> Subject: RE: [eap] Re: network discovery & selection: problem definition
> 
> Hi Bernard,
> I have slightly different way of breaking down the problem 
> - maybe we are talking about the same thing and the differences
> is in wording it!  As the name implies, the problem has two 
> aspects: discovery and selection so maybe it is easier
> to understand the problem by describing the purpose of each
> aspect.
> 
> 
> Purpose of Network Discovery:
> ----------------------------
> 1) Discover 802.11 Access Networks within a coverage area.
> (Note, although our examples are 802.11, it is applicable to
> any access network).
> 
> 2) Discover Mediating or Service Networks that a given 
> 802.11 access network is affiliated with.  (Note that POP 
> is only know to the Access Network, but mediating networks 
> are known to both Access Networks and home service network
> because of romaing agreements.)
> 
> 
> Purpose of Network Selection:
> ----------------------------
> 1) Enable the WLAN client (manually or automatically) to select 
> the most appropriate 802.11 Access Network to associate with for
> a given "Network Identifier/credential" installed on the client's 
> device.
> 
> 2) The home service network needs to enable a policy 
> mechanism by which the WLAN client (manually or automatically) 
> can influence the routing of AAA packets through the preferred 
> Mediating Network to the WLAN client's home service network.  
> 
> Note:  IMO, "Identifier Selection" is an indenpent problem by 
> itself.
> 
> Best regards,
> Farid
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 8 Dec 2003 07:12:23 -0800 (PST)

> home) are much more widely used.

It is also possible that a terminal will have different EAP
identities/credentials depending on the media (PPP, 802.11, etc.).

> doesn't seem to complicate things very much.

There are some issues in identity/credential selection that are not
covered by the proposals.  For example, see:

http://www.ietf.org/internet-drafts/draft-ietf-pkix-wlan-extns-04.txt

> that as a fallback).

Yes.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 08 Dec 2003 17:34:11 -0500

-----BEGIN PGP SIGNED MESSAGE-----

So, I have another network selection problem/challenge. Feel free
to tell me I'm out of scope, but don't ask what I'm smoking, because
you can't have any :-)

It involves interactions between layers. I would like to be able to move
around from place to place, and have things "just work". (vs how things
went at the last IETF...)

At one colleague's office there is wireless. It happens to be a non-WEP
(we use IPsec, wavesec.org), with an unannounced ESSID. The DHCP will give
out public IP addresses, and also include other options that I want to
recognize. The next office over has a totally open network, NAT'ed. I won't
want to be on that network.

Naively, if you don't do the right thing, you wind up on the wrong network,
because the thing that knows what network I want to be one is the DHCP,
while the 802.11 stuff has already happened.

Meanwhile, at a different location, I want to recognize that I'm being
offered a for-pay EAP system. 

So, ideally, I'd like to have only one system. I'd like to have EAP,
DHCP and PPPoE discovery state machines all integrated together. Frankly,
I rather wish that we did EAP and PPPoE inside of DHCP.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [