* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download No Slide Title
Survey
Document related concepts
Deep packet inspection wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Net neutrality law wikipedia , lookup
Extensible Authentication Protocol wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Computer network wikipedia , lookup
Distributed firewall wikipedia , lookup
SIP extensions for the IP Multimedia Subsystem wikipedia , lookup
Network tap wikipedia , lookup
Airborne Networking wikipedia , lookup
Wireless security wikipedia , lookup
TV Everywhere wikipedia , lookup
Cracking of wireless networks wikipedia , lookup
Transcript
Nomadism/FMC Use Cases and AAA Impact Mohit Thakur 14th December, 2006 www.ist-muse.eu Outline 1. Introduction. 2. Understanding FMC challenges. 3. MUSE Business Roles. 4. FMC Use Case 1: Nomadism with video call and IPTV service upgrade. 5. Authentication and Authorisation Requirements For Use Case 1. 6. FMC Use Case 2: Session Continuity with conversational services (Voice and Video over IP). 7. Authentication and Authorisation Requirements For Use Case 2 Using IWLAN. 8. Authentication and Authorisation Requirements For Use Case 2 Using SIP. 9. FMC Use Case 3: Nomadic user with public access over private domain. 10. Authentication and Authorisation Requirements For Use Case 3. 11. Conclusion. Slide Nr.: 2 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Introduction Project Introduction > MUSE is a large integrated R&D project on Broadband Access. > Objective: The overall objective of MUSE is the research and development of a future, low cost, multi-service access network. The access network should provide secure connectivity between end-user terminals and edge nodes in a multi-provider environment. It should be suited for the ubiquitous delivery of broadband services to every European citizen. Paper Introduction > We (in MUSE) analyse and understand the FMC (Fixed Mobile Convergence) aspects in the todays access network. > Use Case formulation to cover evolving current and futuristic scenarios to represent users behaviour while accessing his services namely: 1. Nomadism. 2. Session Continuity. 3. Public access through private WLAN. > Proposition of high level AAA requirements to meet the goal of above mentioned scenarios. Slide Nr.: 3 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu MUSE Business Roles > Packager • • • > Network Service Provider (NSP) • • > Offers application services. Connectivity Provider (CP) • • • • > Assignment of public IP addresses and connects to internet or corporate network. NSP definitely needs to have a AAA infrastructure Application Service Provider (ASP) • > Keeps customer profiles (e.g. desired policy in case of conflicting requests for different services) Keeps customer information for session authentication. Collects accounting information End-to-end (e2e) connectivity between the Customer and ASP, guaranteeing and monitoring agreed e2e QoS and security Provides the means to perform AAA. Assembly of billing info for packager Assignment of private IP addresses to retail end-user (or NAP) Network Access Provider (NAP) / Regional Network Provider (RNP) • • Slide Nr.: 4 Transport and resource management between the RGW and the edge router with the QoS requested by the CP(s) RNP aggregates traffic from different edge nodes and delivers this to the appropriate service (or other) edge nodes. Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Understanding FMC challenges > Nomadism: Ability of the user to change his network access point on moving; when changing the network access point, the user's service session is completely stopped and then started again, i.e. there is no session continuity or handover possible. > Session Continuity: Ability of the user or terminal to change the network access point while maintaining the ongoing session. > Roaming: Ability of the user to access services according to his/her profile while moving outside of his/her subscribed home network, i.e. by using an access point of a visited network. > Nomadism put new requirements like: 1. 2. > Authentication. QoS. FMC puts even more: 1. Roaming between home and visited networks from different providers, degrees of service continuity etc. Roaming Nomadism Nomadism Session Session Continuity Continuity Continuous Mobility Handover Seamless SeamlessHandover Handover Figure 1: MUSE view on FMC related definitions Slide Nr.: 5 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu FMC Use Case 1: Nomadism with video call and IPTV service upgrade Use Case Description User Aspects Network Aspects Service Aspects Jose starts his parents PC and access the Web portal of this SP, authenticates himself and due to his nomadic features he has access to all his services. Access to services from remote terminal. AA, ACC, ARD, NRP, LOC AA, SEC, SEP, LOC He then initiates a video over IP call from the PC to his video capable multimedia phone at home using his own subscription Video call service can be used from a different access network connection ARD, NRP, LOC, MSA ACC, MEA, SEC, SEP, LOC He uses the Internet to access his media-center, where he has stored all the pictures from his daughter’s last birthday, and shows it on the TV screen at his parents home Remote access to private server ARD, NLR, SEC SEP, Photo viewing software (e.g. web server) or FTP server in the CPN As Jose has a HDTV subscription, he contacts his service provider and upgrades the IP TV service to HDTV DRM, Service quality upgrade for a nomadic user ACC, ARD, NRP, LOC DRM, MEA, SEP, LOC Slide Nr.: 6 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Authentication and Authorisation Requirements For Use Case 1 1. Authentication could be based on: a) Per Device; b) Per Session; c) Per User. 2. User would authenticate with NSP (Network Service Provider) to gain its high speed access network. The authentication is done over an already existing internet connection. 3. To upgrade the quality of IPTV to HDTV, bandwidth enhancement and QoS should be guaranteed by the service provider. Application based authentication would enforce the authentication result backwards from provider end to user end. 4. The 2 sessions, Jose’s parents initial normal internet connection and Jose’s high speed internet connection with HDTV have to exist in parallel. Slide Nr.: 7 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu FMC Use Case 2: Session Continuity with conversational services (Voice and Video over IP) Company's building Bob's home Park Access network Home Gateway 802.11b/g audio + video audio+video Wifi / WiMAX / UMTS audio Use Case Description User Aspects Network Aspects Service Aspects Shortly after, Bob’s phone gets out of the reach of the wireless home network, the phone is connected to a WIMAX (or UMTS) base station. Session continuity between private home network and a WiMAX / UMTS network or public hotspot AA, ACC, SEC, HOV, ROA, LOC SEP, LOC Since bandwidth is more expensive on this network, Bob receives a message on his screen asking whether he wants to continue with the video path. Since video is not really important while walking, Bob decides to save money and tells his colleague that he will end the video path. The audio path stays active, so they will be able to continue their conversation. Media adaptation based on network capability and price ACC, LOC ACC, MEA, SEP, LOC At his office he transfers the running video call from the mobile terminal (WiMAX, UMTS) to his Notebook connected to a fixed access network Continue session on different terminal AA, SEC, HOV, ROA, LOC AA, SEP, LOC Slide Nr.: 8 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Authentication and Authorisation Requirements For Use Case 2 Using IWLAN Slide Nr.: 9 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu 1. Wireless user device must have several interfaces for e.g. WLAN, UMTS etc. 2. IWLAN provides only network layer authentication solution, other protocols like SIP should take care of service level authentication. 3. EAP-AKA and EAP-SIM could be used for mutual authentication to create IPsec security tunnel between UE and Packet Data Gateway. 4. IWLAN provides either ‘Direct IP Access’ or ‘3GPP IP access’. Authentication and Authorisation Requirements For Use Case 2 Using SIP Slide Nr.: 10 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu 1. SIP based service authentication is a mandatory method in IMS. 2. IT does not require network layer tunelling (IPsec). 3. Service layer mutual authentication employing SIP registration mechanisms (AKA, SIM) normally are sufficient. 4. Security of SIP authentication signaling is provided by SIPSecure and SecureRTP. FMC Use Case 3: Nomadic user with public access over private domain Company's building Private network owner who offers public network access to visitors Bob's home Park Access network Access network Home Gateway Home Gateway settop box 802.11b/g 802.11b/g Television Wifi / WiMAX / UMTS Bobs multi media device Use Case Description User Aspects Network Aspects Service Aspects Some of the houses nearby provide public access over their private WiFi network. According to the network settings on his multimedia device, Bob gets connected to one of these networks and orders the pizza over the Internet. Public access over a private domain AA, ACC, ARD, RP, SEC, LOC AA, LOC Slide Nr.: 11 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Authentication and Authorisation Requirements For Use Case 3 > The difference between use cases 1, 2 and 3 is that in the latter one the owner of the private network does not necessarily have to know the visitor. > There could be 2 possibilities for specifying the AA requirements here: 1. The visitor authenticates to his service provider who has a direct relationship with the host’s NAP (Network Access Provider). Due to the relationship, it is possible to support QoS in the access network, e.g. by separating the host’s and visitor’s traffic by means of VLANs. 2. In the second scenario the visitor authenticates against a third party (like in FON). QoS in the access network can only be supported if the third party has a direct relationship with the host’s SP. Slide Nr.: 12 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu Conclusion > “Anytime & Anywhere” services are constantly growing which leads to FMC technologies are being developed to provide nomadism, session continuity and roaming between fixed networks and mobile networks. > Multiprovider and multiservice networks have to be taken into consideration before designing any sort of AAA architecture. Slide Nr.: 13 Mohit Thakur, Siemens AGMohit Thakur, Siemens AG www.ist-muse.eu