Pre-authentication Operation (before handover) Initiation of pre-authentication: Pre-authentication may be initiated by both a PaC and a preparing PAA. Distinguishing pre-authentication from normal authentication A new flag P-flag is defined in the PANA header When pre-authentication is performed, the P-flag of PANA messages are set Negotiating pre-authentication (PaC-initiated pre-authentication) PaC unicasts PDI with the P-flag set. The PAA responds with a PSR with the P-flag set only when it supports pre-authentication. Otherwise, it MUST silently discard the message. Negotiating pre-authentication (PAA-initiated pre-authentication) PAA sends a PSR with the P-flag set. The PaC responds with a PSA with the P-flag set only when it supports pre-authentication. Otherwise, it MUST silently discard the message After successful pre-authentication negotiation, subsequent PANA messages exchanged between them MUST have the P-flag set |