NSIS QoS NSLP Authorzation Issues Hannes Tschofenig

Current Status

Trust Model: New Jersey Turnpike Model Network ANetwork C Node A Node B Network B Peering relationship is used to provide charging between neighboring networks - similar to edge pricing proposed by Schenker et. al. David Clark: "We know how to route packets, what we don't know how to do is route dollars." Data Sender Data Receiver

Two-Party Approach Properties: –Strong trust relationship between "Entity authorizing resource request" and "Entity performing QoS reservation" –Typically: Data-origin authentication sufficient –Financial establishment pre-established based on previous protocol execution Examples: –PacketCable authorization within the network where the user is attached. QoS Request Entity requesting resource Entity authorizing resource request granted/rejected End Node Node within the attached network

Three-Party Approach Entity Authentication Financial establishment created between "Entity authorizing resource request" and "Entity performing QoS reservation" Properties / Usage Environment: –AAA-type authorization - splitting functional components –Dynamic re-authorization based on new incoming requests. –Typically: entity authentication between "Entity requesting resource" and "Entity authorizing resource requests" QoS Request Entity requesting resource Entity performing QoS reservations granted/rejected Entity authorizing resource request QoS Authz Request QoS Authz Response

Three-Party Approach Token based Mechanism Financial establishment created between "Entity authorizing resource request" and "Entity performing QoS reservation" Properties / Usage Environment: –Common authorization tokens (e.g., OSP - Tokens; RSVP Session and Media Authorization) –Token either allows two protocols to be linked or represents a monetary value –Provides some sort of anonymity –Digital money (or e-payment) could also be used QoS Request + Token Entity requesting resource Entity performing QoS reservations granted/rejected Entity authorizing resource request (TTP) Authz Token Request Authz Token

Open Issues

Authentication, Authorization and Accounting Infrastructure Authorization might not always happen at an NSIS element itself (see roaming scenarios) Information which is exchanged between the end host (e.g., NI) needs to be forwarded to a backend server (e.g., PDP or AAA server) NSIS and AAA protocols need to aligned Work ongoing with Frank Alfano, Pete McCann

State-of-the-Art: TLS-based Mutual Authentication | MN | | R1 | | Discovery Request/Response (NTLP) | | | | Transport Layer Connection Setup | | | | | Initial | Transport Layer Security | Setup | Handshake Layer (Mutual authentication) | +~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~+ | TLS Record Layer Established | +~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~+ | | | > | | NTLP/NSLP QoS CREATE msg | | | | < | | NTLP/NSLP QoS ACK msg | | |

Open Issue: C/R-based Authentication How long is the authorization decision valid? More flexible approach (support of different authentication protocols): EAP based authentication + Authorization QoS Request (Identity) Entity requesting resource Entity performing QoS reservations Unauthorized (challenge) Entity authorizing resource request QoS Request+Response Success/Failure AAA-QoS (identity) AAA-QoS (challenge) AAA-QoS (response) AAA-QoS (success/failure)

EAP-based Approach (1/2) | MN | | R1 | | Discovery Request/Response (NTLP) | | | | > | | Datagram Mode | | NTLP/NSLP QoS CREATE Req. | | (EAP-Auth/Authz requested; | Initial | EAP-Request/Identity) | Setup | | | < | | Datagram Mode | | NTLP/NSLP QoS CREATE Resp. | | (EAP-Request/AKA-Challenge | | (AT_RAND, AT_AUTN, AT_MAC)) | | (Algorithm/Parameter Negotiation) | | > | | Datagram Mode | | NTLP/NSLP QoS CREATE Req. | | (EAP-Response/AKA-Challenge | | (AT_RES, AT_MAC)) | | (Algorithm/Parameter Negotiation) |

EAP-based Approach (2/2) | | +~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~+ | Authentication Authorization finished | | Secure channel at the NSLP layer established | +~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~+ | < | | NTLP/NSLP QoS CREATE Resp. | | NTLP/NSLP QoS CREATE Req. | | (EAP-Success) | | (Secure Confirmation) | | | | > | | NTLP/NSLP QoS REFRSH msg | Refresh | | Msg | < | | NTLP/NSLP QoS ACK msg | + +