Interworking between Wireless LAN and CDMA2000

Transcription

1 Interworking between Wireless LAN and CDMA2000 Thaison Dao and H Anthony Chan San Jose State University One Washington Square, San Jose, CA , USA thadao@cisco.com; h.a.chan@ieee.org Abstract CDMA2000 and WLAN have different capabilities in distance range, data rate, and in other features. Combining CDMA2000 and WLAN will enable these WAN and LAN technologies to complement each other to enhance the available wireless network services. An architecture of Interworking between CDMA2000 and WirelessLAN is presented. The interworking architecture includes Access Control requirements and principles, and also authentication methods and charging requirements. I. INTRODUCTION Wireless local area networks (WLANs) have the same architecture as the traditional wired LAN but have a wireless interface. With the introduction of small portable devices such as personal digital assistants (PDAs) and the laptop computer with PCMCIA wireless LAN adapter, the WLAN technology has begun to grow rapidly in popularity since WLANs provide relatively high-speed data communication in small areas such as a building or an office. It allows users to move around in a confined area while they are still connected to the networks. The third generation partner project 2 (CDMA2000) addresses wide area wireless networks. WLAN, on the other hand, is the dominant network for smaller areas. These two technologies possess complementary features. Combining these 2 technologies will address the need for a total wireless solution for both WAN and LAN. CDMA2000 networks will offer always-on, ubiquitous connectivity with below 2 Mbps data rates. WLAN (802.11) offers much higher data rates, and is comparable to wired networks. However, the short coming is that it can cover only smaller areas, suitable for hot-spot applications in hotels, airport or shopping mall. The performance and flexibility of wireless data services would be dramatically improved if users could seamlessly roam across the two networks. Given the seamless connectivity between the local area network and mobile network, the interworking between CDMA2000-WLAN offers a wide range of coverage to the users. It also provides great opportunity to Mobile operators and WLAN service providers to make available various services such as accessing Internet and evolve their business profitably. We will discuss the potential CDMA2000-WLAN interworking architecture needed to achieve an efficient and seamless network. We will then focus on security using Authentication, Authorization, and Accounting (AAA) to scale access control. With the evolving large networks, it is imperative that the service provider be able to monitor the access and use of the network. AAA provides the capability to track not just access and usage, but also the level of access and use of today s large-scale networks. It is also implemented to provide proactive tracking and supervision of the network resources. This paper provides a possible WLAN-CDMA2000 interworking architecture, which includes Access Control Requirements, Access Control Principles, and Authentication methods. We also address the charging requirements that the mobile operators and Wireless Internet Service Providers (WISP) may use in order to have the convergence of the mobile network and the WLAN. II. WLAN AND CDMA2000 FEASIBILITY Service Providers today are trying to gain market share, market penetration, and of course revenue growth by creating interfaces that integrate short range WLAN technology with various 3G technologies such as CDMA2000. To make this marriage between the two technologies successful, we need to satisfy two primary business fundamentals, study the need for this technology, and evaluate the business potential and revenue growth. As of now, WLANs are gaining popularity and acceptance as more and more corporations implement local, wireless networks. At the same time, WLANs are also popping up at the so-called hotspots, for example, hotel chains, restaurants (Starbucks), etc. Basically, what WLANs provide are wireless IP services in a small area. At the same time, service providers are using an IP backbone for various mobile phone services. What we intend to achieve is an always on IP service availability independent of location, movement, or infrastructure. Interworking between WLANs and CDMA2000 will enable us to satisfy today s driving need for wireless IP service. CDMA2000 provides high-bandwidth mobile services over an IP backbone. As a result, interworking these two technologies enables the achievement of our goal of mobile IP services. Mobile IP services will allow us to maintain continuous IP connectivity while crossing network boundaries. III. CDMA2000 WLAN INTERWORKING OBJECTIVES The objectives of CDMA2000-WLAN interworking are: 1. To suggest high-level functional requirements for the interworking between the WLAN and CDMA2000 systems, 2. To suggest a high-level description for accessing the WLAN from home as well as from a foreign CDMA2000 network. A simplified version of an interworking model between WLAN and CDMA2000 is shown in Figure 1. We will expand this simplified model and discuss various components and a detailed architecture.

2 Internet WLAN UE Network CDMA 2000 Internet/ Figure 1. High level Interworking model between CDMA2000 and WLAN In Figure 2, the Authentication, Authorization and Accounting (AAA) server is based protocol and interfaces to a Remote Authentication Dial In User Server (RADIUS) server. The Home Agent (HA), PSDN/Foreign Agent (FA) and routers are also parts of the CDMA2000 network elements. The WLAN includes Access Points and other devices such as routers or intermediate AAA elements. The User Equipment (UE) includes all equipment that is in possession of the end user, such as a PDA or a laptop computer with WLAN radio interface adapter. AP UE (R-UIM) AAAf FIRE WALL Internet AAAh FA HA Internet/ Figure 3. Architecture for roaming CDMA2000 and WLAN Interworking B. Server-HA Link UE (R-UIM) AP AAAh HA FIRE WALL Internet This link is located between the server and the Home Agent (HA) in the CDMA2000 network. When the server authenticates and authorizes the subscriber to use the network, this link carries the signals from the server to the Home agent in order to register the subscriber, assign the address to the mobile node, and to redirect the packets between the CDMA2000 and WLAN networks. The protocol crossing between the server and the Home Agent should be based on protocol. C. HA-AAAh Link Figure 2. Interworking model between CDMA2000 and WLAN Interworking in Figure 3 is the architecture for Roaming WLAN-CDMA2000 interworking. For the roaming architecture, the WLAN AAA of the CDMA2000 visited network is tunnelled to the WLAN AAA of the CDMA2000 home network. The home network is responsible for access control. Charging records can be generated in the visited and/or the home CDMA2000 networks. IV. THE LOGICAL LINKS IN THE HOME NETWORK A. WLAN-CDMA2000 Server Link This link provides agreement between CDMA2000 and WLAN networks and also provides authentication services between CDMA2000 and WLAN networks using LDAP and CHAP. Once the HA starts to redirect the data to the user, it relays the service information to the AAA server. This link also carries the provisioning information for each user to the AAA server. The accounting request/response and the status information of the user are provided to the AAA server via this link. This link is also based on the protocol. V. LOGICAL LINKS IN THE ROAMING ENVIRONMENT A. Visited Server-HA The HA opens an IPsec tunnel between the visited Server and the HA. The link sends a signal to the HA in order to provide the address and home assignments to the subscriber in the visited CDMA2000 network. This link is also based on the protocol.

3 B. HA-AAAh Link The functionality for this link is the same as the HA-AAAh Link for non-roaming environment. C. AAAh-AAAf Link This link carries the AAA information between the home AAA server and visited AAA server. This will enable the network to come up with the common bill while the user is roaming between CDMA2000 networks. This information includes parameters such as time of usage, type of bandwidth, type of data, etc. The link is also based on the protocol. D. AAAf-FA Link This link carries the radius based accounting and status information between the foreign agent and the foreign AAA server when the user is in the foreign network. E. FA-HA Link This link also carries the redirect packets and the Care Of Address (COA) from the home agent to the subscriber via a foreign agent through the IPsec tunnel. The protocol is also based. VI. AUTHENTICATION, AUTHORIZATION AND ACCOUNTING PROCESS FLOW 1. WLAN connection is established with a Wireless LAN technology specific procedure. 2. The CHAP authentication procedure is initiated. All EAP packets are transported over WLAN, all CHAP packets are transported between the user/wireless LAN to the CDMA2000 server. A number of EAP/CHAP Request EAP/CHAP Response message exchanges are executed between WLAN, CDMA2000 Server, and UE. The amount of round trips depends on the CHAP or EAP type [1]. 3. Obtain information to execute the authentication with the accessed user stored in the server directory to identify the user. The username part of the provided NAI identity is utilized [1]. 4. Subscribers of WLAN are authenticated against the directory on the server. For example, this may include the authorization information and permanent identity of the user [1]. 5. If the CHAP authentication was successful, then CDMA2000 Server sends Access Accept message to WLAN [2]. 6. Data starts to flow after the CDMA2000 server authorizes the user to use its network to access the WLAN. 7. AAA server locks all necessary parameters for account billing [3]. 8. Data stops when the user logs out. 9. AAA server stops locking the accounting data VII. EXAMPLES OF AAA PROCEDURES A. AAA in non-roaming Environment 1. The subscriber logs in to the WLAN via Access Point (AP) 2. The WLAN server asks for EAP request/identity 3. The subscriber responds with his/her NAI, EAP based [4] 4. WLAN server sends the request to CDMA2000 server for Internet/ access using the CDMA2000 network 5. CDMA2000 server asks WLAN for subscriber based NAI 6. WLAN provides the CDMA2000 server with the NAI it received earlier from the subscriber 7. The server challenges the subscriber with new NAI 8. Subscriber responds with the right key (new ID and password) 9. The server against the new key responds with its own directory using LDAP [1] 10. If the user s NAI matches the server database, CHAP is successful 11. The server signals the Home Agent to assign the IP address to the subscriber and to open the IPsec tunnel based on the subscriber service parameter from the AAA home server 12. Subscriber can now access the Internet or his/her corporate intranet 13. Home Agent relays the accounting (usage duration, type of data ) [5] and subscriber status to the home AAA server 14. Home AAA server starts accounting 15. Home Agent redirects the packets between the WLAN and the subscriber 16. Subscriber logs out 17. Home Agent sends closed session to the Home AAA 18. Home AAA server stops accounting 19. server closes session 20. server sends the abort session to WLAN 21. WLAN disconnects the subscriber from the CDMA2000 network and its own network B. AAA in Roaming Environment 1. The subscriber logs in to the WLAN via Access Point (AP) 2. The WLAN server asks for EAP request/identity 3. The subscriber responds with his/her NAI, EAP based [4] 4. WLAN server sends the request to CDMA2000 server for Internet/ access using the CDMA2000 network 5. CDMA2000 server asks WLAN for subscriber based NAI 6. WLAN provides the server with the NAI it received earlier from the subscriber 7. The server challenges the subscriber with new NAI 8. Subscriber responds with the right key (new ID and password) 9. The server against the new key responds with its own directory using LDAP [1]

4 10. If the user s NAI matches the server database, CHAP is successful 11. The visited server through the IPsec tunnel [6] signals the Home Agent to assign the IP address to the subscriber and to open the IPsec tunnel based on the subscriber service parameter from the AAA home server. The HA also assigns the Care of Address (COA) to the subscriber via Foreign Agent (FA). 16. The Home AAA server exchanges the AAA information with the visited AAA 17. FA and HA open the IPsec tunnel [6]. Subscriber can now access the Internet or his/her intranet via FA-HA IPsec tunnel. 18. Home Agent relays the accounting and subscriber status to home AAA server 19. Home AAA server starts accounting 20. Home AAA server relays the accounting information to the visited AAA server 21. Foreign Agent redirects the packets between the WLAN and the subscriber via Home Agent on IPsec tunnel 22. Subscriber logs out 23. Home Agent sends closed session to the Home AAA and visited server 24. Home AAA server stops accounting 25. Session closing information relays to visited AAA server 26. Visited server closes session 27. Visited server sends the abort session to WLAN and Foreign Agent 28. WLAN disconnects the subscriber from CDMA2000 network and its network VIII. SYSTEM REQUIREMENTS The list below describes the access control related functionality in the network elements of the CDMA2000-WLAN interworking model as shown above: 1. UE, equipped with UICC card including R-UIM utilized by a CDMA2000 subscriber to access the WLAN interworking service. The UE may be capable of WLAN access only, or it may be capable of both WLAN and CDMA2000 System access. 2. The CDMA2000 server functions include the following: a. Enables roaming agreements between CDMA2000 and WLAN network [7]. b. Provides authentication services between CDMA2000 and WLAN networks using LDAP (light weight directory access protocol).the CDMA2000 AAAf represents a proxy and filtering function that resides in the visited 3GPP network [8]. 3. The CDMA2000 AAAf functions include the following: a. Authenticate and authorize the user NAI in a roaming environment. The NAI is obtained via CHAP (for traditional PPP service) or a Foreign Agent Challenge [4, 8]. b. Relay the AAA information between WLAN and the CDMA2000 AAAh Server. c. Enforce policies derived from roaming agreements between CDMA2000 operators and between the WLAN operator and the CDMA2000 operator. d. Report charging/accounting information to local AAAh for roaming users. e. Service termination while in the visited network. f. Receives authorization information (Subscriber information) from AAAh. g. Forwarding authorization information to WLAN. h. Rejection of authorization according to local policy. The CDMA2000 AAAf functionality can reside in a separate physical network node; it may reside in a CDMA2000 AAA server or any other physical network node. 4. CDMA2000 AAAh servers is located within the CDMA2000 home network. The CDMA2000 AAAh server performs the following functions [4, 8]: a. Retrieves authentication information and subscriber profile (including subscriber's authorization information) from the HA of the CDMA2000 subscriber's home CDMA2000 network. b. Authenticates the CDMA2000 subscriber based on the authentication information retrieved from HA. The authentication signaling may pass through AAAf. c. Communicates authorization information to the WLAN potentially through AAAf. d. Registers its address or name with the HA for each authenticated and authorized CDMA2000 subscriber. e. FA is located in the PSDN CDMA2000 visited network. It performs the following functions: f. Open, maintain, and terminate the link between the UE and WLAN via the HA in the CDMA2000 home network. g. Provide provisioning and management of the subscribers. h. Relay the AAA for the UE while in the CDMA2000 visited network. i. Receive service parameters from AAA for the UE while in the CDMA2000 visited network. j. Collect usage duration, type of data service for accounting purpose to be relayed to the AAAf 5. HA is located within the CDMA2000 subscriber's home network. Its functionalities may include the following: [4, 8] a. Contain authentication and subscription data required for the CDMA2000 subscriber to access the WLAN interworking service. b. Provide provisioning and management of the subscribers. c. Maintain direct connection with AAA in order to receive provisioning information for subscribers. d. Simple IP is deployed for service e. Provide IPsec, IP-VPN, Web Steering, and Personal Content Portal [9] f. Maintain users registration and redirect packets to the FA if in the roaming environment. g. Establish an IP secure tunnel to the FA h. Assign dynamic or static home address i. Support reverse tunneling to FA in the visited environment

5 IX. CHALLENGES The key to having a successful implementation of any architecture is to anticipate possible roadblocks and challenges. If challenges are considered early in the process, we can address them before they become gating items for the implementation. Like any other technology, there are a number of challenges that need to be addressed for interworking between WLAN and CDMA2000. We anticipate three major challenges: (1) Acceptance, (2) Deployment, and (3) Billing. Let s briefly examine these three topics. A. Acceptance: One of our main challenges lies in designing a truly global, scalable, and secure wireless end-to-end solution that would seamlessly integrate into the existing WLAN and CDMA2000 network infrastructures. To reap the rewards that a ubiquitous wireless IP service would offer, security issues inherent in deploying a wireless solution need to be addressed whilst keeping usability and operation seamless. Emphasizing one at the expense of the other would result in either an unusable but extremely secure wireless network, or a wide open but very insecure wireless network. Careful reconciliation of these two considerations is essential. An increasingly mobile workforce means that architectural, procedural, and user standards are critical. For example, user experience should be the same from San Jose office to a café in Palo Alto to an Internet center at SFO airport. The issues discussed so far address a network operator s concerns. However, consumer expectations also need to be carefully managed. Negative perceptions and attitudes caused by over hyped marketing and expectations could prove to be damaging and difficult to reverse, as seen during the Internet bubble of the mid to late nineties. B. Deployment: The concept of interworking CDMA2000 with WLANs is immature, and interoperability between different vendors networks and mobile devices (PDA, handsets, laptops, etc.) is needed. The mobile devices will need to evolve over time based on mobility requirements and functionality. Coverage will initially be limited, as will internetwork roaming and applications roaming. Initially, managing the smooth evolution of existing customers to the next generation of service offerings will be crucial, and the cellular industry will also need to adopt a different business paradigm. Cellular operators must cement new relationships with content/application service providers, and the cellular operators role within the new CDMA2000/WLAN ecosystem needs to be redefined. Patience and perseverance are needed to ensure success. Over time, this interworked technology will mature, and subsequent waves of investors as well as subscribers will move in to drive the growth of profitable services. C. Billing: The accounting method and agreements still are the big challenges to the service provider in particular or to the next generation of data networks [10] in general. Since the subscribers move across multiple networks, the billing gets more complex. To come up with a common bill, the service providers need to compromise on billing method and protocol agreements For quick deployment of their networks, service providers need to ensure the operational readiness of their billing and flow-through provisioning system for a commercial launch. Compelling applications have yet to emerge, and service pricing must be affordable and understandable. There are doubts over significant increases in perceived end-user value. Increased competition and deregulation have significantly challenged the ability of carriers to track customers accurately. Fraud, access issues, and the lost revenues that result are a shared industry concern. The end result is that the network no longer provides a reliable source of data for billing purposes. Further compounding this problem is the advent of "truth in billing" regulations and industry efforts at number conservation. The Ordering and Billing Forum, an industry-led group sponsored by ATIS, addresses procedures for resolving today's complex billing challenges. X. REFERENCES [1] Cisco Systems, Wireless LAN Security White Paper. [2] RFC 2138, Protocol. [3] RFC 2139, Accounting Protocol. [4] Tom Hiller, AAA Requirements for CDMA2000. [5] Bridgewater Systems, AAA Services for CDMA2000 Networks. [6] RFC 2401, IPsec Architecture. [7] M.Buddhikot, G. Chandranmenon, S.Han, Y.W.Lee, S.Miller, L.Salgarelli Integration of and Third-Generation Wireless Data Networks. [8] RFC3141, CDMA2000 Wireless Data Requirements. [9] Nortel Networks, CDMA2000 3G Packet Core Data Network. [10] Cisco Systems, Billing for Mobile Wireless Data Services. Authors: H. Anthony Chan Ph.D is a Professor at San Jose State University. He was previously with AT&T Labs for 15 years. Thaison Dao works for Cisco Systems in San Jose, CA. He obtained a BSEE from University of Nevada, Reno and an MSEE from San Jose State University.