1. Pre-authentication Overview
March 23, 2006
IETF65 HOAKEY BOF

2. Pre-authentication Overview
Yoshihiro Ohba
Alper Yegin
Avi Lior
March 23, 2006
IETF65 HOAKEY BOF

3. Objective of pre-authentication
Optimize network access authentication and authorization by performing EAP authentication with a target authenticator before handoff using the connectivity to the current network

4. Expected Improvement with Pre-authentication
Network access Authentication and Authorization L2
Handoff
Without Pre-authentication
Time
With Pre-authentication
Time
Network access
Authentication and
Authorization
with Pre-authentication
Possible packet loss or
interface activation delay
during this period

5. Pre-authentication PANA EAP over AAA authenticator-1 access home
network-1
home
network
mobile
host
PANA
Internet
home AAA server
EAP over AAA
access
network-2
authenticator-2
- Generate MSK with the authenticator-2 by executing EAP through it.

6. Pre-authentication (alternative scenario)
authenticator-1
access
network-1
home
network
EAP over L2/L3
mobile
host
Internet
home AAA server
EAP over AAA
access
network-2
authenticator-2
- Generate MSK with the authenticator-2 by executing EAP through it.

7. AAA General
AAA authentication/Authorization for target Authenticator while session is in progress on the serving Authenticator.
Goal: Don’t want to have to do another AAA dip when or soon after the device moves!!!
“Preauth” should really be preauthentication and preauthorization.

8. AAA Normal Auth vs. Pre-Auth
AAA needs to know that this is a pre-authentication/Authorization.
User may only be allowed to have a single logon at the same time.

9. AAA handoff time.
AAA needs to know how long to hold the session before timing out.
Session timeout for pre-auth may be different for normal session.
If the mobile moves after timeout then do normal authentication.

10. Resource Reservation
In order to have a smooth handoff we need to make the resource currently in use available at the Target Authenticator.
Some resources may have been obtained on the initial Authentication/Authorization
but some other resources may have been obtained during subsequent AAA interaction.
So how do I get all the resources I need at the target Authenticator with the Initial AAA AuthN/AuthZ?

11. Accounting
Accounting record may be needed to allow billing of resources reserved whether used or not at the target Authenticator.
Holding of resources for mobile is not free.
Therefore need to send Accounting (Start) when pre-auth happens and not when the mobile moves.