H. Tschofenig ( hannes.tschofenig@siemens )

1. Requirements for PANA support of location based services (draft-anjum-pana-location-requirements-00.txt)http://www.opendiameter.org/draft-anjum-pana-location-requirements-00.txt H. Tschofenig (hannes.tschofenig@siemens.com) IETF65 PANA WG

2. What? • Location based services • Location based authorization (LBAr): Authorization based on location credentials • Can be incorporated into PANA messaging • Location credentials may be incorporated as data fields in payloads of selected PANA messages • E.g. GPS latitude/longitude information

3. How? • Two components • Technology to determine the user location securely • NOT OUR FOCUS HERE • Ability to convey information about the user location from the client device to network

4. Requirements for LBAr R1PAA must be able to obtain location information for a PaC. R2 PAA must be able to determine changes in PaC location during a PANA session R3 PAA must be capable of terminating network access in case the PaC location is outside the authorized region. R4 The PaC must be able to send location information confidentially to the PAA. R5 The PAA should also be able to verify that the location information indeed originated at the claimed PaC.

5. R1 PAA must be able to obtain location information for a PaC • Location credentials may be provided by PaC • In this case PaC is colocated with a location module (e.g. GPS receiver) that computes the required credentials • PANA messaging will be used to transfer the credentials from PaC to PAA • Location credentials could be provided by a third party location provider • E.g. In U-TDOA, location is computed by the network provider • In this case some out-of-band messaging is required between PAA and location provider • Not of concern for us here.

6. R2 PAA must be able to determine changes in PaC location during a PANA session • As a result of PaC mobility, PaC can move out of range • PANA “Access Phase” messaging may be used to get location updates from the PaC • Location updates can be triggered based on timeouts at the PaC or periodic queries from the PAA or any other appropriate mechanisms

7. R3 PAA must be capable of terminating network access in case the PaC location is outside the authorized region • PANA “Termination Phase” messaging may be used to end the PANA session • PAA should inform the EP to remove access privileges for the PaC

8. R4 The PaC must be able to send location information confidentially to the PAA.R5 The PAA should also be able to verify that the location information indeed originated at the claimed PaC.

9. Other issues • Privacy issues • Should PAA act as a passthrough or should PAA translate from PANA to RADIUS (Carrying Location Objects in RADIUS", draft-ietf-geopriv-radius-lo-06.txt) • In the former case, PAA does not look into the user policies while in the latter case PAA translates location based on user policies • In the former case PAA does not make location based authorization decisions (the AAA server does) while in the latter case the PAA might decide only with respect to the location aspects