| Thread Links | Date Links | ||||
|---|---|---|---|---|---|
| Thread Prev | Thread Next | Thread Index | Date Prev | Date Next | Date Index |
|
Linksec call 8/28/03
Attendees: Onn Haran, Antti Pietilanen, David Johnston, Dan Romascanu, Dolors Sala, Norm Finn We reviewed DJ material on handoff issues related to security: Goal: evaluate whether there is interaction between linksec with handoff
Identify NAP (network access points). It needs to know more than to know it is there but also what protocols it can support, how much it will cost (billing) and other decisions. Handoff functionality may have several MACs under it and use a different interface for each. But we would like a single interface for all technologies. Option 1 in slides (extends EAP) it limits the amount of data it can transmit and what times. Option 3 in slides is the one DJ prefers and advocates at the handoff group. This is a new entity to be independent of EAPoL. Timing is very important and this option allows asking questions even before EAP. 802 architecture seems to be able to support this option. The assumption is that you have AAA behind EAP protocol defined for that. To maintain security the controlled and uncontrolled part must be independent and careful attention is needed to not tight them together at the layer above. A bad design/implementation of layers above could produce leaks to the security architecture. Idea is to rely on good design from the implementers. A warning from Norm: there may be a possible battle to overcome if the handoff functionality is not transparent from the top. We do not want to have to evaluate every implementation to guarantee no leaks in security. DJ: it is possible to define the specification guaranteeing this transparency. You only allow transmitting higher layer data in the secure side. Key message of this presentation: allow handoff decision before security because it slows down the handoff function. Special review will take place on this functionality to be careful on what it is allowed. Norm: There is only one case that allows transmitting data before 802.1x. It was defined to allow operators sending something before a port could be authenticated to wake up a laptop and go back to sleep after authenticated. It is almost a controlled port where only certain multicast traffic was allowed to be passed. The pass of information in the uncontrolled port can be restricted to some “new” EAP traffic. So it will go through the necessary review before approval. ---- Additional discussion on activities of handoff study group: Seems work very related to authentication and makes sense to collaborate with 802.1. How many members of handoff group have experience in 802.1? none. There is an attendance from 15 – 50 people depending on session. The group approved to become a new WG but the SEC is leaning towards putting this activity within 802.1. Intention is to continue to collocate with wireless groups but continue collaboration with 802.1. DJ will attend 802.1 meeting in Sacramento. The handoff group is meeting two weeks before in Denver. |