WLAN IW Enhancement for Multiple Authentications Support QUALCOMM Inc.: Raymond Hsu, QUALCOMM Inc.: Masa Shirota, KDDI: Kazushi Imamoto, KDDI: Ryuhei Munakata, Notice: Contributors grant free, irrevocable license to 3GPP2 and its Organization Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner’s name any Organizational Partner’s standards publication even though it may include portions of the contribution; and at the Organization Partner’s sole discretion to permit others to reproduce in whole or in part such contributions or the resulting Organizational Partner’s standards publication. Contributors are also willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions for purpose of practicing an Organizational Partner’s standard which incorporates this contribution.This document has been prepared by the contributors to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on the contributors. The contributors specifically reserves the right to amend or modify the material contained herein and nothing herein shall be construed as conferring or offering licenses or rights with respect to any intellectual property of the contributors other than provided in the copyright statement above.

Introduction The approved WLAN Enhancement WID [X r3] includes the multiple authentications support: –External AAA Support: Based on CDMA2000 wireless IP standards architecture, authentication consists of 2-phases. The 1st phase is authenticated by HLR or AN-AAA, the 2nd phase is an IP service authentication which can be authenticated by external AAAs using PAP or CHAP. The mechanism which allows the latter authentication in addition to the current EAP authentication over IKE session is required. –IPv4 and IPv6 Simultaneous Operation: It is required that the MS and the PDIF support simultaneous packet data session which can be authenticated and authorized independently.

Multiple Authentications by Home & External AAA Usage scenario: When MS accesses PDIF, MS is required to be authenticated by both HAAA and an external AAA. Proposal: Use RFC4739 (Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol) for multiple EAP authentications in single IKE session. –The first authentication exchange is between MS and HAAA via PDIF. HAAA is the EAP authentication server. Use either EAP-AKA or EAP-TLS/PSK [X.P ]. –The second authentication exchange is between MS and external AAA via PDIF. External AAA authenticates CHAP response or PAP password. For CHAP support, EAP-MD5 is used to exchange CHAP challenge and response between MS and PDIF. For PAP support, EAP-GTC is used to carry PAP password from MS to PDIF. PDIF does not pass-through EAP messages to external AAA because it’s not EAP server. PDIF needs to place CHAP response or PAP password in RADIUS or Diameter message sent to external AAA. –IKE session is authenticated only if both authentications are successful.

Multiple Authentications with Single IKE Session MSPDIFHAAA Ext AAA IKE_SA_INIT Request (Ni, …) EAP-AKA or EAP/TLS-PSK over IKE_AUTH CHAP or PAP over RADIUS or Diameter IKE_SA_INIT Response (Multiple_Auth_Supported, Nr, …) EAP-AKA or EAP/TLS-PSK over RADIUS or Diameter IKE_AUTH Request (AUTH, Another_Auth_Followed) IKE_AUTH Response (AUTH) EAP-MD5 or EAP-GTC over IKE_AUTH IKE_AUTH Request (AUTH) IKE_SAUTH Response (AUTH, SA, …) IKE_AUTH Request (Multiple_Auth_Supported, IDi, SA, …)

Multiple Authentications of IPv4 & IPv6 Sessions Usage scenario: –Initially, MS accesses PDIF via IPv6. IPv6 session is authenticated by HAAA. IPv6 session is for IMS terminated- or originated calls and is long-lived. –Later, MS accesses PDIF via IPv4. IPv4 session is authenticated by external AAA. IPv4 session is for packet data services (e.g., download) and is short-lived (to conserve IPv4 addresses resource). Proposal: Use separate IKE sessions

Multiple Authentications with Separate IKE Sessions IPv6 session establishment authenticated by home network: –MS and HAAA perform mutual authentication using EAP-AKA or EAP- TLS/PSK exchange via PDIF. –MS and PDIF perform mutual authentication of the IKE session using MSK generated from the EAP exchange. IPv4 session establishment authenticated by both home (same as IPv6 session) and external networks: –RFC4739 is used for multiple authentication. –First, the home network authentication is performed using a PSK derived from the MSK of the first IKE session associated with the long- lived IPv6 session. The nonces exchanged via IKE_SA_INIT can provide the freshness for the PSK derivation. This is an optimization to speed-up the home network authentication without requiring EAP exchange between MS and HAAA. –Second, the external network authentication is performed via (EAP- MD5) or PAP (EAP-GTC), between the MS and external AAA via PDIF.

Multiple Authentications with Separate IKE Sessions MSPDIFHAAA Ext AAA IKE_SA_INIT Exchange EAP-AKA or EAP/TLS-PSK over IKE_AUTH CHAP or PAP over RADIUS or Diameter EAP-AKA or EAP/TLS-PSK over RADIUS or Diameter EAP-MD5 or EAP-GTC over IKE_AUTH Start IPv6 session IKE_AUTH Exchange (use MSK to verify AUTH) Derive MSK Obtain MSK from HAAA Start IPv4 session IKE_SA_INIT Exchange (nonces, Multiple_Auth_Supported) Derive PSK from MSK and nonces IKE_AUTH Exchange (use PSK to verify AUTH) IKE_AUTH (IDi) IKE_AUTH Request (AUTH, Another_Auth_Followed) IKE_AUTH Response (AUTH)

Recommendation Discuss and Adopt the proposals for the WLAN IW enhancements.