idnits 2.17.1 draft-ietf-dime-diameter-qos-06.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 24. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 2150. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 2161. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 2168. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 2174. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (July 13, 2008) is 5766 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'TBD1' is mentioned on line 1367, but not defined == Missing Reference: 'TBD2' is mentioned on line 1392, but not defined == Missing Reference: 'TBD3' is mentioned on line 1421, but not defined == Missing Reference: 'TBD4' is mentioned on line 1446, but not defined == Missing Reference: 'TBD5' is mentioned on line 1339, but not defined == Outdated reference: A later version (-15) exists of draft-ietf-dime-qos-attributes-07 == Outdated reference: A later version (-11) exists of draft-ietf-dime-qos-parameters-06 ** Obsolete normative reference: RFC 3588 (Obsoleted by RFC 6733) ** Obsolete normative reference: RFC 4005 (Obsoleted by RFC 7155) ** Obsolete normative reference: RFC 4234 (Obsoleted by RFC 5234) == Outdated reference: A later version (-20) exists of draft-ietf-nsis-ntlp-15 == Outdated reference: A later version (-18) exists of draft-ietf-nsis-qos-nslp-16 -- Obsolete informational reference (is this intentional?): RFC 4282 (Obsoleted by RFC 7542) -- Obsolete informational reference (is this intentional?): RFC 4346 (Obsoleted by RFC 5246) -- Obsolete informational reference (is this intentional?): RFC 4566 (Obsoleted by RFC 8866) Summary: 4 errors (**), 0 flaws (~~), 10 warnings (==), 10 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Diameter Maintenance and D. Sun, Ed. 3 Extensions (DIME) Alcatel-Lucent 4 Internet-Draft P. McCann 5 Intended status: Standards Track Motorola Labs 6 Expires: January 14, 2009 H. Tschofenig 7 Nokia Siemens Networks 8 T. Tsou 9 Huawei 10 A. Doria 11 Lulea University of Technology 12 G. Zorn, Ed. 13 Aruba Networks 14 July 13, 2008 16 Diameter Quality of Service Application 17 draft-ietf-dime-diameter-qos-06.txt 19 Status of this Memo 21 By submitting this Internet-Draft, each author represents that any 22 applicable patent or other IPR claims of which he or she is aware 23 have been or will be disclosed, and any of which he or she becomes 24 aware will be disclosed, in accordance with Section 6 of BCP 79. 26 Internet-Drafts are working documents of the Internet Engineering 27 Task Force (IETF), its areas, and its working groups. Note that 28 other groups may also distribute working documents as Internet- 29 Drafts. 31 Internet-Drafts are draft documents valid for a maximum of six months 32 and may be updated, replaced, or obsoleted by other documents at any 33 time. It is inappropriate to use Internet-Drafts as reference 34 material or to cite them other than as "work in progress." 36 The list of current Internet-Drafts can be accessed at 37 http://www.ietf.org/ietf/1id-abstracts.txt. 39 The list of Internet-Draft Shadow Directories can be accessed at 40 http://www.ietf.org/shadow.html. 42 This Internet-Draft will expire on January 14, 2009. 44 Abstract 46 This document describes the framework, messages and procedures for 47 the Diameter Quality of Service (QoS) application. The Diameter QoS 48 application allows network elements to interact with Diameter servers 49 when allocating QoS resources in the network. In particular, two 50 modes of operation -- Pull and Push -- are defined. 52 Table of Contents 54 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 55 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 56 3. Framework . . . . . . . . . . . . . . . . . . . . . . . . . . 7 57 3.1. Network Element Functional Model . . . . . . . . . . . . . 8 58 3.2. Implications of Endpoint QoS Capabilities . . . . . . . . 10 59 3.2.1. Endpoint Categories . . . . . . . . . . . . . . . . . 10 60 3.2.2. Interaction Modes Between the Authorizing Entity 61 and Network Element . . . . . . . . . . . . . . . . . 10 62 3.3. Authorization Schemes . . . . . . . . . . . . . . . . . . 12 63 3.3.1. Pull Mode Schemes . . . . . . . . . . . . . . . . . . 12 64 3.3.2. Push Mode Schemes . . . . . . . . . . . . . . . . . . 15 65 3.4. QoS Application Requirements . . . . . . . . . . . . . . . 16 66 4. QoS Application Session Establishment and Management . . . . . 20 67 4.1. Parties Involved . . . . . . . . . . . . . . . . . . . . . 20 68 4.2. Session Establishment . . . . . . . . . . . . . . . . . . 20 69 4.2.1. Session Establishment for Pull Mode . . . . . . . . . 20 70 4.2.2. Session Establishment for Push Mode . . . . . . . . . 23 71 4.2.3. Discovery and Selection of Peer Diameter QoS 72 Application Node . . . . . . . . . . . . . . . . . . . 26 73 4.3. Session Re-authorization . . . . . . . . . . . . . . . . . 27 74 4.3.1. Client-Side Initiated Re-Authorization . . . . . . . . 27 75 4.3.2. Server-Side Initiated Re-Authorization . . . . . . . . 28 76 4.4. Session Termination . . . . . . . . . . . . . . . . . . . 30 77 4.4.1. Client-Side Initiated Session Termination . . . . . . 30 78 4.4.2. Server-Side Initiated Session Termination . . . . . . 30 79 5. QoS Application Messages . . . . . . . . . . . . . . . . . . . 32 80 5.1. QoS-Authorization Request (QAR) . . . . . . . . . . . . . 33 81 5.2. QoS-Authorization Answer (QAA) . . . . . . . . . . . . . . 33 82 5.3. QoS-Install Request (QIR) . . . . . . . . . . . . . . . . 34 83 5.4. QoS-Install Answer (QIA) . . . . . . . . . . . . . . . . . 35 84 5.5. Re-Auth-Request (RAR) . . . . . . . . . . . . . . . . . . 35 85 5.6. Re-Auth-Answer (RAA) . . . . . . . . . . . . . . . . . . . 36 86 6. QoS Application State Machine . . . . . . . . . . . . . . . . 37 87 6.1. Supplemented States for Push Mode . . . . . . . . . . . . 37 88 7. QoS Application AVPs . . . . . . . . . . . . . . . . . . . . . 39 89 7.1. Reused Base Protocol AVPs . . . . . . . . . . . . . . . . 39 90 7.2. QoS Application Defined AVPs . . . . . . . . . . . . . . . 39 92 8. Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . 41 93 9. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 94 9.1. Example Call Flow for Pull Mode . . . . . . . . . . . . . 42 95 9.2. Example Call Flow for Push Mode . . . . . . . . . . . . . 44 96 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 47 97 10.1. AVP Codes . . . . . . . . . . . . . . . . . . . . . . . . 47 98 10.2. AVP Specific Values . . . . . . . . . . . . . . . . . . . 47 99 10.3. AVP Flags . . . . . . . . . . . . . . . . . . . . . . . . 47 100 10.4. Application IDs . . . . . . . . . . . . . . . . . . . . . 47 101 10.5. Command Codes . . . . . . . . . . . . . . . . . . . . . . 48 102 11. Security Considerations . . . . . . . . . . . . . . . . . . . 49 103 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 50 104 13. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 51 105 14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 52 106 14.1. Normative References . . . . . . . . . . . . . . . . . . . 52 107 14.2. Informative References . . . . . . . . . . . . . . . . . . 52 108 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 54 109 Intellectual Property and Copyright Statements . . . . . . . . . . 56 111 1. Introduction 113 This document describes the framework, messages and procedures for 114 the Diameter Quality of Service (QoS) Application. The Diameter QoS 115 Application allows Network Elements (NEs) to interact with Diameter 116 servers when allocating QoS resources in the network. 118 Two modes of operation are defined. In the first, called "Pull" 119 mode, the network element requests QoS authorization from the 120 Diameter server based on some trigger (such as a QoS signaling 121 protocol) that arrives along the data path. In the second, called 122 "Push" mode, the Diameter server pro-actively sends a command to the 123 network element(s) to install QoS authorization state. This could be 124 triggered, for instance, by off-path signaling such as Session 125 Initiation Protocol (SIP) [RFC3261] call control. 127 A set of command codes is specified that allows a single Diameter QoS 128 application server to support both Pull and Push modes based on the 129 requirements of network technologies, deployment scenarios and end- 130 host capabilities. In conjunction with parameters defined in the 131 documents "Quality of Service Attributes for Diameter" 132 [I-D.ietf-dime-qos-attributes] and "Quality of Service Parameters for 133 Usage with the AAA Framework" [I-D.ietf-dime-qos-parameters], this 134 note depicts the basic call flow procedures used to establish, modify 135 and terminate a Diameter QoS application session. 137 2. Terminology 139 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 140 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 141 document are to be interpreted as described in RFC 2119 [RFC2119]. 143 The following terms are used in this document: 145 AAA Cloud 146 An infrastructure of AAA entities (clients, agents, servers) 147 communicating via a AAA protocol over trusted, secure connections. 148 It offers authentication, authorization and accounting services to 149 applications in flexible local and roaming scenarios. Diameter 150 [RFC3588] and RADIUS [RFC2865] are both widely deployed AAA 151 protocols. 153 Application Endpoint (AppE) 154 An Application Endpoint is an entity in an end-user device that 155 exchanges signaling messages with Application Servers (see below) 156 or directly with other Application Endpoints. Based on the result 157 of this signaling, the Endpoint may make a request for QoS from 158 the network. For example, a SIP Agent is one kind of Application 159 Endpoint. 161 Application Server (AppS) 162 An Application Server is an entity that exchanges signaling 163 messages with an Application Endpoint (see above). It may be a 164 source of authorization for QoS-enhanced application flows. For 165 example, a SIP server is one kind of Application Server. 167 Authorizing Entity (AE) 168 The Authorizing Entity is a Diameter server that supports the QoS 169 application. It is responsible for authorizing QoS requests for a 170 particular application flow or aggregate. The Authorizing Entity 171 may be a standalone entity or may be integrated with an 172 Application Server and may be co-located with a subscriber 173 database. This entity corresponds to the Policy Decision Point 174 (PDP) [RFC2753]. 176 Network Element (NE) 177 A QoS aware router that acts as a Diameter client for the QoS 178 application. This entity triggers the protocol interaction for 179 the Pull mode, and it is the recipient of QoS information in the 180 Push mode. The Network Element corresponds to the Policy 181 Enforcement Point (PEP) [RFC2753]. 183 Pull Mode 184 In this mode, the QoS authorization process is invoked by the QoS 185 reservation request received from the Application Endpoint. The 186 Network Element then requests the QoS authorization decision from 187 the Authorizing Entity. 189 Push Mode 190 In this mode, the QoS authorization process is invoked by the 191 request from Application Server or local policies in the 192 Authorizing Entity. The Authorizing Entity then installs the QoS 193 authorization decision to the Network Element directly. 195 Resource Requesting Entity (RRE) 196 A Resource Requesting Entity is a logical entity that supports the 197 protocol interaction for QoS resources. The RRE resides in the 198 end-host and is able to communicate with peer logical entities in 199 an Authorizing Entity or a Network Element to trigger the QoS 200 authorization process. 202 3. Framework 204 The Diameter QoS application runs between a NE (acting as a Diameter 205 client) and the resource AE (acting as a Diameter server). A high- 206 level picture of the resulting architecture is shown in Figure 1. 208 +-------+---------+ 209 | Authorizing | 210 | Entity | 211 |(Diameter Server)| 212 +-------+---------+ 213 | 214 | 215 /\-----+-----/\ 216 //// \\\\ 217 || AAA Cloud || 218 | (Diameter application) | 219 || || 220 \\\\ //// 221 \-------+-----/ 222 | 223 +---+--+ +-----+----+ +---+--+ 224 | | | NE | | | Media 225 + NE +===+(Diameter +===+ NE +=============>> 226 | | | Client) | | | Flow 227 +------+ +----------+ +------+ 229 Figure 1: An Architecture Supporting QoS-AAA 231 Figure 1 depicts NEs through which media flows need to pass, a cloud 232 of AAA servers, and an AE. Note that there may be more than one 233 router that needs to interact with the AAA cloud along the path of a 234 given application flow, although the figure only depicts one for 235 clarity. 237 In some deployment scenarios, NEs may request authorization through 238 the AAA cloud based on an incoming QoS reservation request. The NE 239 will route the request to a designated AE. The AE will return the 240 result of the authorization decision. In other deployment scenarios, 241 the authorization will be initiated upon dynamic application state, 242 so that the request must be authenticated and authorized based on 243 information from one or more AppSs. After receiving the 244 authorization request from the AppS or the NE, the AE decides the 245 appropriate mode (i.e. Push or Pull). The usage Push or Pull mode 246 can be determined by the authorizing entity either statically or 247 dynamically. Static determination might be based on a configurable 248 defined policy in the authorizing entity, while dynamic determination 249 might be based on information received from an application server. 250 For Push mode, the authorizing entity needs to identify the 251 appropriate NE(s) to which QoS authorization information needs to be 252 pushed. It might determine this based on information received from 253 the AppS, such as the IP addresses of media flows. 255 In some deployment scenarios, there is a mapping between access 256 network type and the service logic (e.g. selection of the Push or 257 Pull mode, and other differentiated handling of the resource 258 admission and control). The access network type might be derived 259 from the authorization request from the AppS or the NE, and in this 260 case, the authorizing entity can identify the corresponding service 261 logic based on the mapping. 263 If defined properly, the interface between the NEs and AAA cloud 264 would be identical whether the AE communicates with an AppS or not. 265 Routers are therefore insulated from the details of particular 266 applications and need not know that Application Servers are involved 267 at all. Also, the AAA cloud would naturally encompass business 268 relationships such as those between network operators and third-party 269 application providers, enabling flexible intra- or inter-domain 270 authorization, accounting, and settlement. 272 3.1. Network Element Functional Model 274 Figure 2 depicts a logical operational model of resource management 275 in a router. 277 +-------------------------------------------------------+ 278 | DIAMETER Client | 279 | Functionality | 280 | +---------------++-----------------++---------------+ | 281 | | User || QoS Application || Accounting | | 282 | | Authentication|| Client || Client (e.g. | | 283 | | Client || (Authorization ||for QoS Traffic| | 284 | +---------------+| of QoS Requests)|+---------------+ | 285 | +-----------------+ | 286 +-------------------------------------------------------+ 287 ^ 288 v 289 +--------------+ +----------+ 290 |QoS Signaling | | Resource | 291 |Msg Processing|<<<<<>>>>>>>|Management| 292 +--------------+ +----------+ 293 . ^ | * ^ 294 | v . * ^ 295 +-------------+ * ^ 296 |Signaling msg| * ^ 297 | Processing | * V 298 +-------------+ * V 299 | | * V 300 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 301 . . * V 302 | | * ............................. 303 . . * . Traffic Control . 304 | | * . +---------+. 305 . . * . |Admission|. 306 | | * . | Control |. 307 +----------+ +------------+ . +---------+. 308 <-.-| Input | | Outgoing |-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-> 309 | Packet | | Interface | .+----------+ +---------+. 310 ===>|Processing|====| Selection |===.| Packet |====| Packet |.=> 311 | | |(Forwarding)| .|Classifier| Scheduler|. 312 +----------+ +------------+ .+----------+ +---------+. 313 ............................. 314 <.-.-> = signaling flow 315 =====> = data flow (sender --> receiver) 316 <<<>>> = control and configuration operations 317 ****** = routing table manipulation 319 Figure 2: Network Element Functional Model 321 Processing of incoming QoS reservation requests includes three 322 actions: admission control, authorization and resource reservation. 324 The admission control function provides information about available 325 resources and determines whether there are enough resources to 326 fulfill the request. Authorization is performed by the Diameter 327 client, which involves contacting an authorization entity through the 328 AAA cloud shown in Section 3. If both checks are successful, the 329 authorized QoS parameters are set in the packet classifier and the 330 packet scheduler. Note that the parameters passed to the Traffic 331 Control function may be different from requested QoS (depending on 332 the authorization decision). Once the requested resource is granted, 333 the Resource Management function provides accounting information to 334 the AE via the Diameter client. 336 3.2. Implications of Endpoint QoS Capabilities 338 3.2.1. Endpoint Categories 340 The QoS capabilities of Application Endpoints are varied, and can be 341 categorized as follows: 343 Category 1 344 A Category 1 Application Endpoint has QoS capability at neither 345 the application nor the network level. This type of AppE may set 346 up a connection through application signaling, but it is incapable 347 of specifying resource/QoS requirements through either application 348 or network-level signaling. 350 Category 2 351 A Category 2 Application Endpoint only has QoS capability at the 352 application level. This type of AppE is able to set up a 353 connection through application signaling with certain resource/QoS 354 requirements (e.g., application attributes), but it is unable to 355 signal any resource/QoS requirements at the network level. 357 Category 3 358 A Category 3 Application Endpoint has QoS capability at the 359 network level. This type of AppE may set up a connection through 360 application signaling, translate service characteristics into 361 network resource/QoS requirements (e.g., network QoS class) 362 locally, and request the resources through network signaling, 363 e.g., Resource ReSerVation Protocol (RSVP) [RFC2205] or NSIS 364 [I-D.ietf-nsis-qos-nslp]. 366 3.2.2. Interaction Modes Between the Authorizing Entity and Network 367 Element 369 Different QoS mechanisms are employed in packet networks. Those QoS 370 mechanisms can be categorized into two schemes: IntServ [RFC2211], 371 [RFC2212] and DiffServ [RFC2474]. In the IntServ scheme, network 372 signaling (e.g., RSVP, NSIS, or link specific signaling) is commonly 373 used to initiate a request from an AppE for the desired QoS resource. 374 In the DiffServ scheme, QoS resources are provisioned based upon some 375 predefined QoS service classes rather than AppE-initiated, flow-based 376 QoS requests. 378 It is obvious that the eligible QoS scheme is correlated to the 379 AppE's capability in the context of QoS authorization. Since 380 Category 1 and 2 AppEs cannot initiate the QoS resource requests by 381 means of network signaling, the IntServ model is not applicable to 382 them in general. Depending on network technology and operator 383 requirements, a Category 3 AppE may either make use of network 384 signaling for resource requests or not. 386 The diversity of QoS capabilities of endpoints and QoS schemes of 387 network technology leads to the distinction on the interaction mode 388 between QoS authorization system and underlying NEs. When the 389 IntServ scheme is employed by a Category 3 endpoint, the 390 authorization process is typically initiated by a NE when a trigger 391 such as network signaling is received from the endpoint. In the 392 DiffServ scheme, since the NE is unable to request the resource 393 authorization on its own initiative, the authorization process is 394 typically triggered by either the request of AppSs or policies 395 defined by the operator. 397 As a consequence, two interaction modes are needed in support of 398 different combinations of QoS schemes and endpoint's QoS 399 capabilities: Push mode and Pull mode. 401 Push mode 402 The QoS authorization process is triggered by AppSs or local 403 network conditions (e.g., time of day on resource usage and QoS 404 classes), and the authorization decisions are installed by the AE 405 to the network element on its own initiative without explicit 406 request. In order to support the push mode, the AE (i.e., 407 Diameter server) should be able to initiate a Diameter 408 authorization session to communicate with the NE (i.e., Diameter 409 client) without any pre-established connection from the network 410 element. 412 Pull mode 413 The QoS authorization process is triggered by the network 414 signaling received from end-user equipment or by a local event in 415 the NE according to pre-configured policies, and authorization 416 decisions are produced upon the request of the NE. In order to 417 support the pull mode, the NE (i.e., Diameter client) will 418 initiate a Diameter authorization session to communicate with the 419 authorizing entity (i.e., Diameter server). 421 For Category 1 and 2 Application Endpoints, Push mode is required. 422 For a Category 3 AppE, either Push mode or Pull mode may be used. 424 Push mode is applicable to certain networks, for example, Cable 425 network, DSL, Ethernet, and Diffserv-enabled IP/MPLS as defined by 426 other SDOs (e.g., ETSI TISPAN and ITU-T}. The Pull mode is more 427 appropriate to IntServ-enabled IP networks or certain wireless 428 networks such as the GPRS networks defined by 3GPP. Some networks 429 (for example, WiMAX) may require both Push and Pull modes. 431 3.3. Authorization Schemes 433 3.3.1. Pull Mode Schemes 435 Three basic authorization schemes for Pull mode exist: one two-party 436 and two three-party schemes. The notation adopted here is in respect 437 to the entity that performs the QoS authorization. The 438 authentication of the QoS requesting entity might be done at the NE 439 as part of the QoS signaling protocol, or by an off-path protocol run 440 (on the application layer or for network access authentication) or 441 the AE might be contacted with request for authentication and 442 authorization of the QoS requesting entity. From the Diameter QoS 443 application's point of view these schemes differ in type of 444 information that need to be carried. Here we focus on the 'Basic 445 Three Party Scheme' (see Figure 3) and the 'Token-based Three Party 446 Scheme' (see Figure 4). In the 'Two Party Scheme', the QoS RRE is 447 authenticated by the NE and the authorization decision is made either 448 locally at the NE itself or offloaded to a trusted entity (most 449 likely within the same administrative domain). In the two-party case 450 no Diameter QoS protocol interaction is required. 452 +--------------+ 453 | Entity | 454 | authorizing | <......+ 455 | resource | . 456 | request | . 457 +------------+-+ . 458 --^----------|-- . . 459 ///// | | \\\\\ . 460 // | | \\ . 461 | QoS | QoS AAA | QoS |. 462 | authz| protocol |authz |. 463 | req.| | res. |. 464 \\ | | // . 465 \\\\\ | | ///// . 466 QoS --|----------v-- . . 467 +-------------+ request +-+------------+ . 468 | Entity |----------------->| NE | . 469 | requesting | | performing | . 470 | resource |granted / rejected| QoS | <.....+ 471 | |<-----------------| reservation | financial 472 +-------------+ +--------------+ settlement 474 Figure 3: Three Party Scheme 476 In the 'Basic Three Party Scheme' a QoS reservation request that 477 arrives at the NE is forwarded to the Authorizing Entity (e.g., in 478 the user's home network), where the authorization decision is made. 479 A business relationship, such as a roaming agreement, between the 480 visited network and the home network ensures that the visited network 481 is compensated for the resources consumed by the user via the home 482 network. 484 financial settlement 485 ...........................+ 486 Authorization V ------- . 487 Token Request +--------------+ / QoS AAA \ . 488 +-------------->| | / protocol \ . 489 | | Authorizing +--------------+ \ . 490 | | Entity | | | | . 491 | +------+ |<--+----+ | | . 492 | | +--------------+ |QoS | |QoS |. 493 | | |authz| |authz|. 494 | |Authorization |req.+| |res. |. 495 | |Token |Token| | |. 496 | | | | | . | . 497 | | \ | | . / . 498 | | \ | | / . 499 | | QoS request |-----V . . 500 +-------------+ + Authz. Token +--------+-----+ . 501 | Entity |----------------->| NE | . 502 | requesting | | performing | . 503 | resource |granted / rejected| QoS | <....+ 504 | |<-----------------| reservation | 505 +-------------+ +--------------+ 507 Figure 4: Token-based Three Party Scheme 509 The 'Token-based Three Party Scheme' is applicable to environments 510 where a previous protocol interaction is used to request 511 authorization tokens to assist the authorization process at the NE or 512 the AE [RFC3521]. 514 The QoS RRE may be involved in an application layer protocol 515 interaction, for example using SIP [RFC3313], with the AE. As part 516 of this interaction, authentication and authorization at the 517 application layer might take place. As a result of a successful 518 authorization decision, which might involve the user's home AAA 519 server, an authorization token is generated by the AE (e.g., the SIP 520 proxy and an entity trusted by the SIP proxy) and returned to the end 521 host for inclusion into the QoS signaling protocol. The 522 authorization token will be used by a NE that receives the QoS 523 signaling message to authorize the QoS request. Alternatively, the 524 Diameter QoS application will be used to forward the authorization 525 token to the user's home network. The authorization token allows the 526 authorization decision performed at the application layer protocol 527 run to be associated with a corresponding QoS signaling session. 528 Note that the authorization token might either refer to established 529 state concerning the authorization decision or the token might itself 530 carry the authorized parameters (protected by a digital signature or 531 a keyed message digest to prevent tampering). In the latter case the 532 authorization token may contain several pieces of information 533 pertaining to the authorized application session, but at minimum it 534 should contain: 535 o An identifier for the AE (for example, an AppS) that issued the 536 authorization token 537 o An identifier referring to a specific application protocol session 538 for which the token was issued and 539 o A keyed message digest or digital signature protecting the content 540 of the authorization token 542 A possible structure for the authorization token and the policy 543 element carrying it are proposed in context of RSVP [RFC3520]. 545 In the scenario mentioned above, where the QoS resource requesting 546 entity is involved in an application layer protocol interaction with 547 the AE, it may be worthwhile to consider a token-less binding 548 mechanism also. The application layer protocol interaction may have 549 indicated the transport port numbers at the QoS RRE where it might 550 receive media streams (for example in SIP/SDP [RFC4566] signalling, 551 these port numbers are advertised). The QoS RRE may also use these 552 port numbers in some IP filter indications to the NE performing QoS 553 reservation so that it may properly tunnel the inbound packets. The 554 NE performing QoS reservation will forward the QoS resource 555 requesting entity's IP address and the IP filter indications to the 556 AE in the QoS authorization request. The AE will use the QoS RRE's 557 IP address and the port numbers in the IP filter indication, which 558 will match the port numbers advertised in the earlier application 559 layer protocol interaction, to identify the right piece of policy 560 information to be sent to the NE performing the QoS reservation in 561 the QoS authz. response. 563 3.3.2. Push Mode Schemes 565 The push mode can be further divided into two types: endpoint- 566 initiated and network-initiated. In the former case, the 567 authorization process is triggered by AppS in response to an explicit 568 QoS request from an endpoint through application signaling, e.g. 569 SIP; in the latter case, the authorization process is triggered by 570 the AppS without an explicit QoS request from an endpoint. 572 In the endpoint-initiated scheme, the QoS RRE (i.e., the AppE) 573 determines the required application level QoS and sends a QoS request 574 through an application signaling message. The AppS will extract 575 application-level QoS information and trigger the authorization 576 process to the AE. In the network-initiated scheme, the AE and/or 577 AppS should derive and determine the QoS requirements according to 578 application attribute, subscription and endpoint's capability when 579 the endpoint does not explicitly indicate the QoS attributes. The AE 580 makes an authorization decision based on application level QoS 581 information, network policies, end-user subscription, network 582 resource availability, etc., and installs the decision to NE 583 directly. 585 A Category 1 AppE requires network-initiated Push mode and a Category 586 2 AppE may use either mode 588 financial settlement 589 ...........................+ 590 Application V ------- . 591 signaling msg +--------------+ / QoS AAA \ . 592 +-------------->| | / protocol \ . 593 | | Authorizing +--------------+ \ . 594 | | Entity | | | | . 595 | + |<--+----+ | | . 596 | +--------------+ |QoS | |QoS |. 597 | install| |install 598 | |rsp. | |req. |. 599 | | | | |. 600 | | | | . | . 601 | \ | | . / . 602 | \ | | / . 603 V |-----V . . 604 +-------------+ +--------+-----+ . 605 | Entity | | NE | . 606 | requesting | | performing | . 607 | resource |QoS rsrc granted | QoS | <....+ 608 | |<-----------------| reservation | 609 +-------------+ +--------------+ 611 Figure 5: Scheme for Push Mode 613 3.4. QoS Application Requirements 615 A QoS application must meet a number of requirements applicable to a 616 diverse set of networking environments and services. It should be 617 compatible with different deployment scenarios having specific QoS 618 signaling models and security issues. Satisfying the requirements 619 listed below while interworking with QoS signaling protocols, a 620 Diameter QoS application should accommodate the capabilities of the 621 QoS signaling protocols rather than introducing functional 622 requirements on them. A list of requirements for a QoS authorization 623 application is provided here: 625 Inter-domain support 626 In particular, users may roam outside their home network, leading 627 to a situation where the NE and AE are in different administrative 628 domains. 630 Identity-based Routing 631 The QoS AAA protocol MUST route AAA requests to the Authorizing 632 Entity, based on the provided identity of the QoS requesting 633 entity or the identity of the AE encoded in the provided 634 authorization token. 636 Flexible Authentication Support 637 The QoS AAA protocol MUST support a variety of different 638 authentication protocols for verification of authentication 639 information present in QoS signaling messages. The support for 640 these protocols MAY be provided indirectly by tying the signaling 641 communication for QoS to a previous authentication protocol 642 exchange (e.g., using network access authentication). 644 Making an Authorization Decision 645 The QoS AAA protocol MUST exchange sufficient information between 646 the AE and the enforcing entity (and vice versa) to compute an 647 authorization decision and to execute this decision. 649 Triggering an Authorization Process 650 The QoS AAA protocol MUST allow periodic and event triggered 651 execution of the authorization process, originated at the 652 enforcing entity or even at the AE. 654 Associating QoS Reservations and Application State 655 The QoS AAA protocol MUST carry information sufficient for an AppS 656 to identify the appropriate application session and associate it 657 with a particular QoS reservation. 659 Dynamic Authorization 660 It MUST be possible for the QoS AAA protocol to push updates 661 towards the NE(s) from authorizing entities. 663 Bearer Gating 664 The QoS AAA protocol MUST allow the AE to gate (i.e., enable/ 665 disable) authorized application flows based on, e.g., application 666 state transitions. 668 Accounting Records 669 The QoS AAA protocol may define QoS accounting records containing 670 duration, volume (byte count) usage information and description of 671 the QoS attributes (e.g., bandwidth, delay, loss rate) that were 672 supported for the flow. 674 Sending Accounting Records 675 The NE SHOULD be able to send accounting records for a particular 676 QoS reservation state to an accounting entity. 678 Failure Notification 679 The QoS AAA protocol MUST allow the NE to report failures, such as 680 loss of connectivity due to movement of a mobile node or other 681 reasons for packet loss, to the authorizing entity. 683 Accounting Correlation 684 The QoS AAA protocol may support the exchange of sufficient 685 information to allow for correlation between accounting records 686 generated by the NEs and accounting records generated by an AppS. 688 Interaction with other AAA Applications 689 Interaction with other AAA applications such as Diameter Network 690 Access (NASREQ) application [RFC4005] is required for exchange of 691 authorization, authentication and accounting information. 693 In deployment scenarios where authentication of the QoS reservation 694 requesting entity (e.g., the user) is done by means outside the 695 Diameter QoS application protocol interaction, the AE is contacted 696 only with a request for QoS authorization. Authentication might have 697 taken place already via the interaction with the Diameter NASREQ 698 application or as part of the QoS signaling protocol (e.g., Transport 699 Layer Security (TLS) [RFC4346] in the General Internet Signaling 700 Transport (GIST) protocol [I-D.ietf-nsis-ntlp]). 702 Authentication of the QoS reservation requesting entity to the AE is 703 necessary if a particular Diameter QoS application protocol run 704 cannot be related (or if there is no intention to relate it) to a 705 prior authentication. In this case the AE MUST authenticate the QoS 706 reservation requesting entity in order to authorize the QoS request 707 as part of the Diameter QoS protocol interaction. 709 The document refers to three types of sessions that need to be 710 properly correlated. 712 QoS Signaling Session 713 The time period during which a QoS signaling protocol establishes, 714 maintains and deletes a QoS reservation state at the QoS network 715 element is referred to as QoS signaling session. Different QoS 716 signaling protocols use different ways to identify QoS signaling 717 sessions. The same applies to different usage environments. 718 Currently, this document supports three types of QoS session 719 identifiers, namely a signaling session id (e.g., the Session 720 Identifier used by the NSIS protocol suite), a flow id (e.g., 721 identifier assigned by an application to a certain flow as used in 722 the 3GPP) and a flow description based on the IP parameters of the 723 flow's end points. 725 Diameter Authorization Session 726 The time period, for which a Diameter server authorizes a 727 requested service (i.e., QoS resource reservation) is referred to 728 as a Diameter authorization session. It is identified by a 729 Session-Id included in all Diameter messages used for management 730 of the authorized service (initial authorization, re- 731 authorization, termination), see [RFC3588]. 733 Application-layer Session 734 The application layer session identifies the duration of an 735 application layer service which requires provision of certain QoS. 736 An application layer session identifier is provided by the QoS 737 requesting entity in the QoS signaling messages, for example as 738 part of the authorization token. In general, the application 739 session identifier is opaque to the QoS aware NEs. It is included 740 in the authorization request message sent to the AE and helps it 741 to correlate the QoS authorization request to the application 742 session state information. 744 Correlating these sessions is done at each of the three involved 745 entities: The QoS requesting entity correlates the application with 746 the QoS signaling sessions. The QoS NE correlates the QoS signaling 747 session with the Diameter authorization sessions. The AE SHOULD bind 748 the information about the three sessions together. Note that in 749 certain scenarios not all of the sessions are present. For example, 750 the application session might not be visible to QoS signaling 751 protocol directly if there is no binding between the application 752 session and the QoS requesting entity using the QoS signaling 753 protocol. 755 4. QoS Application Session Establishment and Management 757 4.1. Parties Involved 759 Authorization models supported by this application include three 760 parties: 761 o Resource Requesting Entity 762 o Network Elements (Diameter QoS application (DQA) client) 763 o Authorizing Entity (Diameter QoS application (DQA) server) 765 Note that the QoS RRE is only indirectly involved in the message 766 exchange. This entity provides the trigger to initiate the Diameter 767 QoS protocol interaction by transmitting QoS signaling messages. The 768 Diameter QoS application is only executed between the Network Element 769 (i.e., DQA client) and the Authorizing Entity (i.e., DQA server). 771 The QoS RRE may communicate with the AE using application layer 772 signaling for negotiation of service parameters. As part of this 773 application layer protocol interaction, for example using SIP, 774 authentication and authorization might take place. This message 775 exchange is, however, outside the scope of this document. The 776 protocol communication between the QoS resource requesting entity and 777 the QoS NE might be accomplished using the NSIS protocol suite, RSVP 778 or a link layer signaling protocol. A description of these protocols 779 is also outside the scope of this document and a tight coupling with 780 these protocols is not desirable since this applications aims to be 781 generic. 783 4.2. Session Establishment 785 The Pull and Push modes use a different set of command codes for 786 session establishment. For other operations, such as session 787 modification and termination, they use the same set of command codes. 789 The selection of Pull mode or Push mode operation is based on the 790 trigger of the QoS Authorization session. When a QoS-Authz-Request 791 (QAR, see Section 5.1) message with a new session ID is received, the 792 AE operates in the Pull mode; when other triggers are received, the 793 AE operates in the Push mode. Similarly, when a QoS-Install-Request 794 (QIR, see Section 5.3} with a new session ID is received, the NE 795 operates in the Push mode; when other triggers are received, the NE 796 operation in the Pull mode. 798 4.2.1. Session Establishment for Pull Mode 800 A request for a QoS reservation or local events received by a NE can 801 trigger the initiation of a Diameter QoS authorization session. The 802 NE generates a QAR message in which the required objects from the QoS 803 signaling message to Diameter AVPs. 805 Figure 6 shows the protocol interaction between a Resource Requesting 806 Entity, a Network Element and the Authorizing Entity. 808 The AE's identity, information about the application session and/or 809 identity and credentials of the QoS RRE, requested QoS parameters, 810 signaling session identifier and/or QoS enabled data flows 811 identifiers MAY be encapsulated into respective Diameter AVPs and 812 included in the Diameter message sent to the AE. The QAR is sent to 813 a Diameter server that can either be the home server of the QoS 814 requesting entity or an AppS. 816 +-----------------------------------------------+-------------------+ 817 | QoS-specific Input Data | Diameter AVPs | 818 +-----------------------------------------------+-------------------+ 819 | Authorizing entity ID (e.g., Destination-Host | Destination-Host | 820 | taken from authorization token, | Destination-Realm | 821 | Destination-Realm or derived from the NAI of | | 822 | the QoS requesting entity) | | 823 | | | 824 | Authorization Token Credentials of the QoS | QoS-Authz-Data | 825 | requesting entity | User-Name | 826 | | | 827 | QoS parameters | QoS-Resources | 828 +-----------------------------------------------+-------------------+ 830 Table 1: Mapping Input Data to QoS AVPs--Pull Mode 832 Authorization processing starts at the Diameter QoS server when it 833 receives the QAR. Based on the information in the QoS- 834 Authentication-Data, User-Name and QoS-Resources AVPs the server 835 determines the authorized QoS resources and flow state (enabled/ 836 disabled) from locally available information (e.g., policy 837 information that may be previously established as part of an 838 application layer signaling exchange, or the user's subscription 839 profile). The QoS-Resources AVP is defined in 840 [I-D.ietf-dime-qos-attributes]. The authorization decision is then 841 reflected in the response returned to the Diameter client with the 842 QoS-Authorization-Answer message (QAA). 844 Authorizing 845 End-Host Network Element Entity 846 requesting QoS ( Diameter ( Diameter 847 QoS Client) QoS Server) 848 | | | 849 +---QoS-Reserve---->| | 850 | +- - - - - QAR - - - - - >| 851 | |(QoS-Resources, | 852 | | QoS-Auth-Data,User-ID)| 853 | | +--------+--------------+ 854 | | | Authorize request | 855 | | | Keep session data | 856 | | |/Authz-time,Session-Id/| 857 | | +--------+--------------+ 858 | |< - - - - QAA - - - - - -+ 859 | |(Result-Code, | 860 | |QoS-Resources,Authz-time)| 861 | +-------+---------+ 862 | |Install QoS state| 863 | | + | 864 | | Authz. session | 865 | | /Authz-time/ | QoS Responder 866 | | | Node 867 | +-------+---------+ | 868 | +----------QoS-Reserve---....--->| 869 | | | 870 | |<---------QoS-Response--....----| 871 |<--QoS-Response----+ | 872 | | | 873 |=====================Data Flow==============....===>| 874 | | 875 | +- - - - - QAR - - - - - >| 876 | |(START,QoS-Resources) | 877 | | | 878 | | +--------+--------------+ 879 | | | Report for successful | 880 | | | QoS reservation | 881 | | |Update of reserved QoS | 882 | | | resources | 883 | | +--------+--------------+ 884 | |< - - - - QAA - - - - - -+ 885 | | | 887 Figure 6: Initial QoS Request Authorization for Pull Mode 889 The Authorizing Entity keeps authorization session state and SHOULD 890 save additional information for management of the session (e.g., 891 Signaling-Session-Id, authentication data) as part of the session 892 state information. 894 The final result of the authorization request is provided in the 895 Result-Code AVP of the QAA message sent by the Authorizing Entity. 896 In case of successful authorization (i.e., Result-Code = 897 DIAMETER_LIMITED_SUCCESS, (see Section 7.1)), information about the 898 authorized QoS resources and the status of the authorized flow 899 (enabled/disabled) is provided in the QoS-Resources AVP of the QAA 900 message. The QoS information provided via the QAA is installed by 901 the QoS Traffic Control function of the NE. The value 902 DIAMETER_LIMITED_SUCCESS indicates that the AE expects confirmation 903 via another QAR message for successful QoS resource reservation and 904 for final reserved QoS resources (see below). 906 One important piece of information returned from the Authorizing 907 Entity is the authorization lifetime (carried inside the QAA). The 908 authorization lifetime allows the NE to determine how long the 909 authorization decision is valid for this particular QoS reservation. 910 A number of factors may influence the authorized session duration, 911 such as the user's subscription plan or currently available credits 912 at the user's account (see Section 8). The authorization duration is 913 time-based as specified in [RFC3588]. For an extension of the 914 authorization period, a new QoS-Authorization-Request/Answer message 915 exchange SHOULD be initiated. Further aspects of QoS authorization 916 session maintenance is discussed in Section 4.3, Section 4.4 and 917 Section 8. 919 The indication of a successful QoS reservation and activation of the 920 data flow is provided by the transmission of a QAR message, which 921 reports the parameters of the established QoS state: reserved 922 resources, duration of the reservation, and identification of the QoS 923 enabled flow/QoS signaling session. The Diameter QoS server 924 acknowledges the reserved QoS resources with the QA Answer (QAA) 925 message where the Result-Code is set to 'DIAMETER_SUCCESS'. Note 926 that the reserved QoS resources reported in this QAR message MAY be 927 different than those authorized with the initial QAA message, due to 928 the QoS signaling specific behavior (e.g., receiver-initiated 929 reservations with One-Path-With-Advertisements) or specific process 930 of QoS negotiation along the data path. 932 4.2.2. Session Establishment for Push Mode 934 The Diameter QoS server in the AE initiates a Diameter QoS 935 authorization session upon the request for QoS reservation triggered 936 by application layer signaling or by local events, and generates a 937 QoS-Install-Request (QIR) message to Diameter QoS client in the NE in 938 which it maps required objects to Diameter payload objects. 940 Figure 7 shows the protocol interaction between the AE, a Network 941 Element and a RRE. 943 The NE's identity, information about the application session and/or 944 identity and credentials of the QoS resource requesting entity, 945 requested QoS parameters, signaling session identifier and/or QoS 946 enabled data flows identifiers MAY be encapsulated into respective 947 Diameter AVPs and included into the Diameter message sent from a 948 Diameter QoS server in the Authorizing Entity to a Diameter QoS 949 client in the NE. This requires that the AE has knowledge of 950 specific information for allocating and identifying the NE that 951 should be contacted and the data flow for which the QoS reservation 952 should be established. This information can be statically configured 953 or dynamically discovered, see Section 4.2.3 for details. 955 +-----------------------------------------+-------------------------+ 956 | QoS-specific Input Data | Diameter AVPs | 957 +-----------------------------------------+-------------------------+ 958 | Network Element ID | Destination-Host | 959 | | Destination-Realm | 960 | | | 961 | Authorization Token Credentials of the | QoS-Authz-Data | 962 | QoS requesting entity | User-Name | 963 | | | 964 | QoS parameters | QoS-Resources | 965 +-----------------------------------------+-------------------------+ 967 Table 2: Mapping Input Data to QoS AVPs--Push Mode 969 Authorization processing starts at the Diameter QoS server when it 970 receives a request from a RRE through an AppS (e.g., SIP Invite) or 971 is triggered by a local event (e.g., pre-configured timer). Based on 972 the received information the server determines the authorized QoS 973 resources and flow state (enabled/disabled) from locally available 974 information (e.g., policy information that may be previously 975 established as part of an application layer signaling exchange, or 976 the user's subscription profile). The authorization decision is then 977 reflected in the QoS-Install-Request message (QIR) to the Diameter 978 QoS client. 980 Authorizing 981 End-Host Network Element Entity 982 requesting QoS ( Diameter ( Diameter 983 QoS Client) QoS Server) 984 | | | 985 | | |<-- Trigger -- 986 | | +--------+--------------+ 987 | | | Authorize request | 988 | | | Keep session data | 989 | | |/Authz-time,Session-Id/| 990 | | +--------+--------------+ 991 | | | 992 | |<-- - -- - QIR - - - - - -+ 993 | |(Initial Request,Decision | 994 | |(QoS-Resources,Authz-time)| 995 | +-------+---------+ 996 | |Install QoS state| 997 | | + | 998 | | Authz. session | 999 | | /Authz-time/ | 1000 | | | 1001 | +-------+---------+ 1002 | + - - - - QIA - - - - - ->| 1003 | | (Result-Code, | 1004 | | QoS-Resources) | 1005 | | +--------+--------------+ 1006 | | | Report for successful | 1007 | | | QoS reservation | 1008 | | |Update of reserved QoS | 1009 | | | resources | 1010 | | +--------+--------------+ 1011 | | QoS Responder 1012 | | Node 1013 | | | 1014 |=====================Data Flow==============....===>| 1015 | | 1016 | (+- - - - - QAR - - - - - >|) 1017 | (|(START,QoS-Resources) |) 1018 | (|< - - - - QAA - - - - - -+) 1019 | | | 1021 Figure 7: Initial QoS Request Authorization for Push Mode 1023 The AE keeps authorization session state and SHOULD save additional 1024 information for management of the session (e.g., 1025 Signaling-Session-Id, authentication data) as part of the session 1026 state information. 1028 The final result of the authorization decision is provided in the 1029 QoS-Resources AVP of the QIR message sent by the AE. The QoS 1030 information provided via the QIR is installed by the QoS Traffic 1031 Control function of the NE. 1033 One important piece of information from the AE is the authorization 1034 lifetime (carried inside the QIR). The authorization lifetime allows 1035 the NE to determine how long the authorization decision is valid for 1036 this particular QoS reservation. A number of factors may influence 1037 the authorized session duration, such as the user's subscription plan 1038 or currently available credits at the user's account (see Section 8). 1039 The authorization duration is time-based as specified in [RFC3588]. 1040 For an extension of the authorization period, a new QoS-Install- 1041 Request/Answer message or QoS-Authorization-Request/Answer message 1042 exchange SHOULD be initiated. Further aspects of QoS authorization 1043 session maintenance is discussed in Section 4.3, Section 4.4 and 1044 Section 8. 1046 The indication of QoS reservation and activation of the data flow can 1047 be provided by the QoS-Install-Answer message immediately. In the 1048 case of successful enforcement, the Result-Code (= DIAMETER_SUCCESS, 1049 (see Section 7.1)) information is provided in the QIA message. Note 1050 that the reserved QoS resources reported in the QIA message MAY be 1051 different than those initially authorized with the QIR message, due 1052 to the QoS signaling specific behavior (e.g., receiver-initiated 1053 reservations with One-Path-With-Advertisements) or specific process 1054 of QoS negotiation along the data path. When path coupled signaling 1055 is used for QoS reservation along the data path, QAR/QAA may be used 1056 to update the results of QoS reservation and enforcement following 1057 the establishment of data flows. 1059 4.2.3. Discovery and Selection of Peer Diameter QoS Application Node 1061 The Diameter QoS application node may obtain information of its peer 1062 nodes (e.g., FQDN, IP address) through static configuration or 1063 dynamic discovery as described in [RFC3588]. In particular, the NE 1064 shall perform the relevant operation for Pull mode; the AE shall 1065 perform the relevant operations for Push mode. 1067 Upon receipt of a trigger to initiate a new Diameter QoS 1068 authorization session, the Diameter QoS application node selects and 1069 retrieves the location information of the peer node and based on some 1070 index information provided by the RRE. For instance, it can be the 1071 Authorization Entity's ID stored in the authorization token, the end- 1072 user's identity (e.g., NAI [RFC4282]) or globally routable IP 1073 address. 1075 4.3. Session Re-authorization 1077 Client and server-side initiated re-authorizations are considered in 1078 the design of the Diameter QoS application. Whether the re- 1079 authorization events are transparent for the resource requesting 1080 entity or result in specific actions in the QoS signaling protocol is 1081 outside the scope of the Diameter QoS application. It is directly 1082 dependent on the capabilities of the QoS signaling protocol. 1084 There are a number of options for policy rules according to which the 1085 NE (AAA client) contacts the AE for re-authorization. These rules 1086 depend on the semantics and contents of the QAA message sent by the 1087 AE: 1089 a. The QAA message contains the authorized parameters of the flow 1090 and its QoS and sets their limits (presumably upper). With these 1091 parameters the AE specifies the services that the NE can provide 1092 and will be financially compensated for. Therefore, any change 1093 or request for change of the parameters of the flow and its QoS 1094 that do not conform to the authorized limits requires contacting 1095 the AE for authorization. 1096 b. The QAA message contains authorized parameters of the flow and 1097 its QoS. The rules that determine whether parameters' changes 1098 require re-authorization are agreed out of band, based on a 1099 Service Level Agreement (SLA) between the domains of the NE and 1100 the AE. 1101 c. The QAA message contains the authorized parameters of the flow 1102 and its QoS. Any change or request for change of these 1103 parameters requires contacting the AE for re-authorization. 1104 d. In addition to the authorized parameters of the flow and its QoS, 1105 the QAA message contains policy rules that determine the NEs 1106 actions in case of change or request for change in authorized 1107 parameters. 1109 Provided options are not exhaustive. Elaborating on any of the 1110 listed approaches is deployment /solution specific and is not 1111 considered in the current document. 1113 In addition, the AE may use a RAR to perform re-authorization with 1114 the authorized parameters directly when the re-authorization is 1115 triggered by service request or local events/policy rules. 1117 4.3.1. Client-Side Initiated Re-Authorization 1119 The AE provides the duration of the authorization session as part of 1120 the QoS-Authorization-Answer message (QAA). At any time before 1121 expiration of this period, a new QoS-Authorization-Request message 1122 (QAR) MAY be sent to the AE. The transmission of the QAR MAY be 1123 triggered when the NE receives a QoS signaling message that requires 1124 modification of the authorized parameters of an ongoing QoS session, 1125 or authorization lifetime expires. 1127 Authorizing 1128 End-Host Network Element Entity 1129 requesting QoS ( Diameter ( Diameter 1130 QoS Client) QoS Server) 1131 | | | 1132 |=====================Data Flow==========================> 1133 | | | 1134 | +-------+----------+ | 1135 | |Authz-time/CC-Time| | 1136 | | expires | | 1137 | +-------+----------+ | 1138 | +- - - - - QAR - - - - - >| 1139 | |(QoS-Resources, | 1140 | | QoS-Authz-Data,User-ID) | 1141 | +--------+--------------+ 1142 NOTE: | | Authorize request | 1143 Re-authorization | | Update session data | 1144 is transparent to | |/Authz-time,Session-Id/| 1145 the End-Host | +--------+--------------+ 1146 |< - - - - QAA - - - - - -+ 1147 | |(Result-Code, | 1148 | |QoS-Resources,Authz-time)| 1149 | +-------+---------+ | 1150 | |Update QoS state | | 1151 | | + | | 1152 | | Authz. session | | 1153 | | /Authz-time/ | | 1154 | | | | 1155 | +-------+---------+ | 1156 | | | 1157 |=====================Data Flow==========================> 1158 | | 1160 Figure 8: Client-side Initiated QoS Re-Authorization 1162 4.3.2. Server-Side Initiated Re-Authorization 1164 The AE MAY initiate a QoS re-authorization by issuing a Re-Auth- 1165 Request message (RAR) as defined in the Diameter base protocol 1166 [RFC3588], which may include the parameters of the re-authorized QoS 1167 state: reserved resources, duration of the reservation, 1168 identification of the QoS enabled flow/QoS signaling session for re- 1169 installation of the resource state by the QoS Traffic Control 1170 function of the NE. 1172 A NE that receives such a RAR message with Session-Id matching a 1173 currently active QoS session acknowledges the request by sending the 1174 Re-Auth-Answer (RAA) message towards the AE. 1176 If RAR does not include any parameters of the re-authorized QoS 1177 state, the NE MUST initiate a QoS re-authorization by sending a QoS- 1178 Authorization-Request (QAR) message towards the AE. 1180 Authorizing 1181 End-Host Network Element Entity 1182 requesting QoS ( Diameter ( Diameter 1183 QoS Client) QoS Server) 1184 | | | 1185 | | |<-- Trigger -- 1186 | | +--------+--------------+ 1187 | | | Authorize request | 1188 | | | Keep session data | 1189 | | |/Authz-time,Session-Id/| 1190 | | +--------+--------------+ 1191 | | | 1192 | |<-- - -- - RAR - - - - - -+ 1193 | |(Request,Decision | 1194 | |(QoS-Resources,Authz-time)| 1195 | +-------+---------+ 1196 | |Install QoS state| 1197 | | + | 1198 | | Authz. session | 1199 | | /Authz-time/ | 1200 | | | 1201 | +-------+---------+ 1202 | + - - - - RAA - - - - - ->| 1203 | | (Result-Code, | 1204 | | QoS-Resources) | 1205 | | +--------+--------------+ 1206 | | | Report for successful | 1207 | | | QoS reservation | 1208 | | |Update of reserved QoS | 1209 | | | resources | 1210 | | +--------+--------------+ 1211 | | | 1213 Figure 9: Server-side Initiated QoS Re-Authorization 1215 4.4. Session Termination 1217 4.4.1. Client-Side Initiated Session Termination 1219 The authorization session for an installed QoS reservation state MAY 1220 be terminated by the Diameter client by sending a Session- 1221 Termination-Request message (STR) to the Diameter server. This is a 1222 Diameter base protocol function and it is defined in [RFC3588]. 1223 Session termination can be caused by a QoS signaling messaging 1224 requesting deletion of the existing QoS reservation state or it can 1225 be caused as a result of a soft-state expiration of the QoS 1226 reservation state. 1228 Authorizing 1229 End-Host Network Element Entity 1230 requesting QoS ( Diameter ( Diameter 1231 QoS Client) QoS Server) 1232 | | | 1233 |==Data Flow==>X /Stop of the data flow/ | 1234 | | | 1235 +---QoS-Reserve---->| | 1236 | (Delete QoS +- - - - - STR - - - - - >| 1237 | reservation) | +--------+--------------+ 1238 | | | Remove authorization | 1239 |<--QoS-Response----+ | session state | 1240 | | +--------+--------------+ 1241 |< - - - - STA - - - - - -+ 1242 +-------+--------+ | 1243 |Delete QoS state| 1244 +-------+--------+ QoS Responder 1245 | Node 1246 +----------QoS-Reserve-----....--->| 1247 | (Delete QoS | 1248 | reservation) | 1249 |<---------QoS-Response----....----+ 1250 | | 1252 Figure 10: Client-Side Initiated Session Termination 1254 4.4.2. Server-Side Initiated Session Termination 1256 At anytime during a session the AE MAY send an Abort-Session-Request 1257 message (ASR) to the NE. This is a Diameter base protocol function 1258 and it is defined in [RFC3588]. Possible reasons for initiating the 1259 ASR message to the NE are insufficient credits or session termination 1260 at the application layer. The ASR message results in termination of 1261 the authorized session, release of the reserved resources at the NE 1262 and transmission of an appropriate QoS signaling message indicating a 1263 notification to other Network Elements aware of the signaling 1264 session. 1266 Authorizing 1267 End-Host Network Element Entity 1268 requesting QoS ( Diameter ( Diameter 1269 QoS Client) QoS Server) 1270 | | | 1271 |=====================Data Flow==========================> 1272 | | 1273 | |< - - - - ASR - - - - - -+ 1274 | | | 1275 |====Data Flow=====>X | QoS Responder 1276 | | | Node 1277 |<--QoS-Notify------+----------QoS-Reserve-----....--->| 1278 | | (Delete QoS | | 1279 | reservation) | 1280 +-------+--------+ | 1281 |Delete QoS state| | 1282 +-------+--------+ | 1283 +- - - - - ASA - - - - - >| 1284 | +--------+--------------+ 1285 | | Remove authorization | 1286 | | session state | 1287 | +--------+--------------+ 1288 | QoS Responder 1289 | Node 1290 |<---------QoS-Response----....----+ 1291 | | 1293 Figure 11: Server-Side Initiated Session Termination 1295 5. QoS Application Messages 1297 The Diameter QoS Application requires the definition of new mandatory 1298 AVPs and Command-codes (see Section 3 of [RFC3588]). Four new 1299 Diameter messages are defined along with Command-Codes whose values 1300 MUST be supported by all Diameter implementations that conform to 1301 this specification. 1303 +---------------------+---------+--------+-------------+ 1304 | Command Name | Abbrev. | Code | Reference | 1305 +---------------------+---------+--------+-------------+ 1306 | QoS-Authz-Request | QAR | [TBD1] | Section 5.1 | 1307 | | | | | 1308 | QoS-Authz-Answer | QAA | [TBD2] | Section 5.2 | 1309 | | | | | 1310 | QoS-Install-Request | QIR | [TBD3] | Section 5.3 | 1311 | | | | | 1312 | QoS-Install-Answer | QIA | [TBD4] | Section 5.4 | 1313 +---------------------+---------+--------+-------------+ 1315 Table 3: Diameter QoS Commands 1317 In addition, the following Diameter Base protocol messages are used 1318 in the Diameter QoS application: 1320 +-----------------------+---------+------+-----------+ 1321 | Command-Name | Abbrev. | Code | Reference | 1322 +-----------------------+---------+------+-----------+ 1323 | Re-Auth-Request | RAR | 258 | [RFC3588] | 1324 | | | | | 1325 | Re-Auth-Answer | RAA | 258 | [RFC3588] | 1326 | | | | | 1327 | Abort-Session-Request | ASR | 274 | [RFC3588] | 1328 | | | | | 1329 | Abort-Session-Answer | ASA | 274 | [RFC3588] | 1330 | | | | | 1331 | Session-Term-Request | STR | 275 | [RFC3588] | 1332 | | | | | 1333 | Session-Term-Answer | STA | 275 | [RFC3588] | 1334 +-----------------------+---------+------+-----------+ 1336 Table 4: Diameter Base Commands 1338 Diameter nodes conforming to this specification MAY advertise support 1339 by including the value of [TBD5] in the Auth-Application-Id or the 1340 Acct-Application-Id AVP of the Capabilities-Exchange-Request and 1341 Capabilities-Exchange-Answer commands, see [RFC3588]. 1343 The value of {TBD5] MUST be used as the Application-Id in all QAR/QAA 1344 and QIR/QIA commands. 1346 The value of zero (0) SHOULD be used as the Application-Id in all 1347 STR/STA, ASR/ASA, and RAR/RAA commands, because these commands are 1348 defined in the Diameter base protocol and no additional mandatory 1349 AVPs for those commands are defined in this document. 1351 5.1. QoS-Authorization Request (QAR) 1353 The QoS-Authorization-Request message (QAR) indicated by the Command- 1354 Code field (see Section 3 of [RFC3588]) set to [TBD1] and 'R' bit set 1355 in the Command Flags field is used by NEs to request quality of 1356 service related resource authorization for a given flow. 1358 The QAR message MUST carry information for signaling session 1359 identification, AE identification, information about the requested 1360 QoS, and the identity of the QoS requesting entity. In addition, 1361 depending on the deployment scenario, an authorization token and 1362 credentials of the QoS requesting entity SHOULD be included. 1364 The message format, presented in ABNF form [RFC4234], is defined as 1365 follows: 1367 ::= < Diameter Header: [TBD1], REQ, PXY > 1368 < Session-Id > 1369 { Auth-Application-Id } 1370 { Origin-Host } 1371 { Origin-Realm } 1372 { Destination-Realm } 1373 { Auth-Request-Type } 1374 [ Destination-Host ] 1375 [ User-Name ] 1376 * [ QoS-Resources ] 1377 [ QoS-Authz-Data ] 1378 [ Bound-Auth-Session-Id ] 1379 * [ AVP ] 1381 5.2. QoS-Authorization Answer (QAA) 1383 The QoS-Authorization-Answer message (QAA), indicated by the Command- 1384 Code field set to [TBD2] and 'R' bit cleared in the Command Flags 1385 field is sent in response to the QoS-Authorization-Request message 1386 (QAR). If the QoS authorization request is successfully authorized, 1387 the response will include the AVPs to allow authorization of the QoS 1388 resources and transport plane gating information. 1390 The message format is defined as follows: 1392 ::= < Diameter Header: [TBD2], PXY > 1393 < Session-Id > 1394 { Auth-Application-Id } 1395 { Auth-Request-Type } 1396 { Result-Code } 1397 { Origin-Host } 1398 { Origin-Realm } 1399 * [ QoS-Resources ] 1400 [ Acc-Multisession-Id ] 1401 [ Session-Timeout ] 1402 [ Authz-Session-Lifetime ] 1403 [ Authz-Grace-Period ] 1404 * [ AVP ] 1406 5.3. QoS-Install Request (QIR) 1408 The QoS-Install Request message (QIR), indicated by the Command-Code 1409 field set to [TBD3] and 'R' bit set in the Command Flags field is 1410 used by AE to install or update the QoS parameters and the flow state 1411 of an authorized flow at the transport plane element. 1413 The message MUST carry information for signaling session 1414 identification or identification of the flow to which the provided 1415 QoS rules apply, identity of the transport plane element, description 1416 of provided QoS parameters, flow state and duration of the provided 1417 authorization. 1419 The message format is defined as follows: 1421 ::= < Diameter Header: [TBD3], REQ, PXY > 1422 < Session-Id > 1423 { Auth-Application-Id } 1424 { Origin-Host } 1425 { Origin-Realm } 1426 { Destination-Realm } 1427 { Auth-Request-Type } 1428 [ Destination-Host ] 1429 * [ QoS-Resources ] 1430 [ Session-Timeout ] 1431 [ Authz-Session-Lifetime ] 1432 [ Authz-Grace-Period ] 1433 [ Authz-Session-Volume ] 1434 * [ AVP ] 1436 5.4. QoS-Install Answer (QIA) 1438 The QoS-Install Answer message (QIA), indicated by the Command-Code 1439 field set to [TBD4] and 'R' bit cleared in the Command Flags field is 1440 sent in response to the QoS-Install Request message (QIR) for 1441 confirmation of the result of the installation of the provided QoS 1442 reservation instructions. 1444 The message format is defined as follows: 1446 ::= < Diameter Header: [TBD4], PXY > 1447 < Session-Id > 1448 { Auth-Application-Id } 1449 { Origin-Host } 1450 { Origin-Realm } 1451 { Result-Code } 1452 * [ QoS-Resources ] 1453 * [ AVP ] 1455 5.5. Re-Auth-Request (RAR) 1457 The Re-Auth-Request message (RAR), indicated by the Command-Code 1458 field set to 258 and the 'R' bit set in the Command Flags field, is 1459 sent by the AE to the NE in order to initiate the QoS re- 1460 authorization from DQA server side. 1462 If the RAR command is received by the NE without any parameters of 1463 the re-authorized QoS state, the NE MUST initiate a QoS re- 1464 authorization by sending a QoS-Authorization-Request (QAR) message 1465 towards the AE. 1467 The message format is defined as follows: 1469 ::= < Diameter Header: 258, REQ, PXY > 1470 < Session-Id > 1471 { Auth-Application-Id } 1472 { Origin-Host } 1473 { Origin-Realm } 1474 { Destination-Realm } 1475 { Auth-Request-Type } 1476 [ Destination-Host ] 1477 * [ QoS-Resources ] 1478 [ Session-Timeout ] 1479 [ Authz-Session-Lifetime ] 1480 [ Authz-Grace-Period ] 1481 [ Authz-Session-Volume ] 1483 * [ AVP ] 1485 5.6. Re-Auth-Answer (RAA) 1487 The Re-Auth-Answer message (RAA), indicated by the Command-Code field 1488 set to 258 and the 'R' bit cleared in the Command Flags field, is 1489 sent by the NE to the AE in response to the RAR command. 1491 The message format is defined as follows: 1493 ::= < Diameter Header: 258, PXY > 1494 < Session-Id > 1495 { Auth-Application-Id } 1496 { Origin-Host } 1497 { Origin-Realm } 1498 { Result-Code } 1499 * [ QoS-Resources ] 1500 * [ AVP ] 1502 6. QoS Application State Machine 1504 The QoS application reuses the authorization state machine defined in 1505 Section 8.1 of the Base Protocol ([RFC3588]) with its own messages as 1506 defined in Section 5 and QoS AVPs as defined in Section 7. 1508 6.1. Supplemented States for Push Mode 1510 In addition to the reused state machines, the following states are 1511 supplemented to first 2 state machines in which the session state is 1512 maintained on the Server, and MUST be supported in any QoS 1513 application implementations in support of server initiated push mode 1514 (see (Section 4.2.2)). 1516 The following states are supplemented to the state machine on the 1517 server when it is maintaining state for the session as defined in 1518 Section 8.1 of the Base Protocol [RFC3588]: 1520 SERVER, STATEFUL 1521 State Event Action New State 1522 ------------------------------------------------------------- 1523 Idle An application or local Send Pending 1524 event triggers an initial QIR initial 1525 QoS request to the server request 1527 Pending Received QIA with a failed Cleanup Idle 1528 Result-Code 1530 Pending Received QIA with Result-Code Update Open 1531 = SUCCESS session 1532 Pending Error in processing received Send Discon 1533 QIA with Result-Code = SUCCESS ASR 1535 The following states are supplemented to the state machine on the 1536 client when state is maintained on the server as defined in Section 1537 8.1 of the Base Protocol [RFC3588]: 1539 CLIENT, STATEFUL 1540 State Event Action New State 1541 ------------------------------------------------------------- 1542 Idle QIR initial request Send Open 1543 received and successfully QIA initial 1544 processed answer, 1545 reserve resources 1547 Idle QIR initial request Send Idle 1548 received but not QIA initial 1549 successfully processed answer with 1550 Result-Code 1551 != SUCCESS 1553 7. QoS Application AVPs 1555 Each of the AVPs identified in the QoS-Authorization-Request/Answer 1556 and QoS-Install-Request/Answer messages and the assignment of their 1557 value(s) is given in this section. 1559 7.1. Reused Base Protocol AVPs 1561 The QoS application uses a number of session management AVPs, defined 1562 in the Base Protocol ([RFC3588]). 1564 Attribute Name AVP Code Reference [RFC3588] 1565 Origin-Host 264 Section 6.3 1566 Origin-Realm 296 Section 6.4 1567 Destination-Host 293 Section 6.5 1568 Destination-Realm 283 Section 6.6 1569 Auth-Application-Id 258 Section 6.8 1570 Result-Code 268 Section 7.1 1571 Auth-Request-Type 274 Section 8.7 1572 Session-Id 263 Section 8.8 1573 Authz-Lifetime 291 Section 8.9 1574 Authz-Grace-Period 276 Section 8.10 1575 Session-Timeout 27 Section 8.13 1576 User-Name 1 Section 8.14 1578 The Auth-Application-Id AVP (AVP Code 258) is assigned by IANA to 1579 Diameter applications. The value of the Auth-Application-Id for the 1580 Diameter QoS application is TBD. 1582 7.2. QoS Application Defined AVPs 1584 This document reuses the AVPs defined in Section 4 of 1585 [I-D.ietf-dime-qos-attributes]. 1587 This section lists the AVPs that are introduced specifically for the 1588 QoS application. The following new AVPs are defined: Bound-Auth- 1589 Session-Id and the QoS-Authz-Data AVP. 1591 The following table describes the Diameter AVPs newly defined in this 1592 document for usage with the QoS Application, their AVP code values, 1593 types, possible flag values, and whether the AVP may be encrypted. 1595 +-------------------+ 1596 | AVP Flag rules | 1597 +----------------------------------------------|----+---+----+-----+ 1598 | AVP Section | | |SHLD| MUST| 1599 | Attribute Name Code Defined Data Type |MUST|MAY| NOT| NOT| 1600 +----------------------------------------------+----+---+----+-----+ 1601 |QoS-Authz-Data TBD 7.2 Grouped | M | P | | V | 1602 |Bound-Auth-Session-Id TBD 7.2 UTF8String | M | P | | V | 1603 +----------------------------------------------+----+---+----+-----+ 1604 |M - Mandatory bit. An AVP with "M" bit set and its value MUST be | 1605 | supported and recognized by a Diameter entity in order the | 1606 | message, which carries this AVP, to be accepted. | 1607 |P - Indicates the need for encryption for end-to-end security. | 1608 |V - Vendor specific bit that indicates whether the AVP belongs to | 1609 | a address space. | 1610 +------------------------------------------------------------------+ 1612 QoS-Authz-Data 1613 The QoS-Authz-Data AVP (AVP Code TBD) is of type OctetString. It 1614 is a container that carries application session or user specific 1615 data that has to be supplied to the AE as input to the computation 1616 of the authorization decision. 1618 Bound-Authentication-Session-Id 1619 The Bound-Authentication-Session AVP (AVP Code TBD) is of type 1620 UTF8String. It carries the id of the Diameter authentication 1621 session that is used for the network access authentication (NASREQ 1622 authentication session). It is used to tie the QoS authorization 1623 request to a prior authentication of the end host done by a co- 1624 located application for network access authentication (Diameter 1625 NASREQ) at the QoS NE. 1627 8. Accounting 1629 A NE may start an accounting session by sending an Accounting-Request 1630 message (ACR) after successful QoS reservation and activation of the 1631 data flow (see Figure 6 and Figure 7). After every successful re- 1632 authorization procedure (see Figure 8 and Figure 9), the NE may 1633 initiate an interim accounting message exchange. After successful 1634 session termination (see Figure 10 and Figure 11), the NE may 1635 initiate a final exchange of accounting messages for terminating of 1636 the accounting session and reporting final records for the usage of 1637 the QoS resources reserved. It should be noted that the two sessions 1638 (authorization and accounting) have independent management by the 1639 Diameter base protocol, which allows for finalizing the accounting 1640 session after the end of the authorization session. 1642 The detailed QoS accounting procedures are out of scope in this 1643 document. 1645 9. Examples 1647 9.1. Example Call Flow for Pull Mode 1649 This section presents an example of the interaction between the end 1650 host and Diameter QoS application entities using Pull mode. The 1651 application layer signaling is, in this example, provided using SIP. 1652 Signaling for a QoS resource reservation is done using the QoS NSLP. 1653 The authorization of the QoS reservation request is done by the 1654 Diameter QoS application (DQA). 1656 End-Host SIP Server Correspondent 1657 requesting QoS (DQA Server) Node 1659 | | | 1660 ..|....Application layer SIP signaling.......|..............|.. 1661 . | Invite (SDP) | | . 1662 . +.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-> | . 1663 . | 100 Trying | | . 1664 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ Invite (SDP)| . 1665 . | +-.-.-.....-.-.> . 1666 . | | 180 SDP' | . 1667 . | <-.-.-.....-.-.+ . 1668 . | +--------+--------+ | . 1669 . | |Authorize session| | . 1670 . | | parameters | | . 1671 . | 180 (Session parameters) +--------+--------+ | . 1672 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ | . 1673 ..|..........................................|... ..........|.. 1674 | | | 1675 | +------------+ | | 1676 | | NE | | | 1677 | |(DQA Client)| | | 1678 | +------+-----+ | | 1679 | | | | 1680 |QoS NSLP Reserve | | | 1681 +------------------> QAR | | 1682 | (POLICY_DATA>v +- - - - -<>- - - -> | 1683 | QSPEC) v >===>(Destination-Host, | | 1684 | v >=======>QoS-Authz-Data ++------------+ | 1685 | >===========>QoS-Resources) |Authorize | | 1686 | | |QoS resources| | 1687 | | ++------------+ | 1688 | | QAA | | 1689 | <- - - - -<>- - - -+ | 1690 | |(Result-Code, | | 1691 | |QoS-Resources, | | 1692 | |Authz-Lifetime) | | 1693 | +---------+--------+ | | 1694 | |Install QoS state1| | | 1695 | |+ Authz. session | | | 1696 | +---------+--------+ | | 1697 | |QoS NSLP Reserve | 1698 | +---------------..............---------> 1699 | | | 1700 | | QoS NSLP Response| 1701 |QoS NSLP Response <---------------..............---------+ 1702 <------------------+ | 1703 | | QoS NSLP Query| 1704 |QoS NSLP Query <---------------..............---------+ 1705 <------------------+ | 1706 |QoS NSLP Reserve | | 1707 +------------------> QAR | | 1708 | +- - - - -<>- - - -> | 1709 | | +---+---------+ | 1710 | | |Authorize | | 1711 | | |QoS resources| | 1712 | | QAA +---+---------+ | 1713 | <- - - - -<>- - - -+ | 1714 | +---------+--------+ | | 1715 | |Install QoS state2| | 1716 | |+ Authz. session | | 1717 | +---------+--------+ | 1718 | | QoS NSLP Reserve | 1719 | +---------------..............---------> 1720 | | QoS NSLP Response| 1721 |QoS NSLP Response <---------------..............---------+ 1722 <------------------+ | 1723 | | | 1724 /------------------+--Data Flow---------------------------\ 1725 \------------------+--------------------------------------/ 1726 | | | 1728 .-.-.-.-. SIP signaling 1729 --------- QoS NSLP signaling 1730 - - - - - Diameter QoS Application messages 1731 ========= Mapping of objects between QoS and AAA protocol 1733 Figure 12: QoS Authorization Example - Pull Mode 1735 The communication starts with SIP signaling between the two end 1736 points and the SIP server for negotiation and authorization of the 1737 requested service and its parameters (see Figure 12). As a part of 1738 the process, the SIP server verifies whether the user at Host A is 1739 authorized to use the requested service (and potentially the ability 1740 to be charged for the service usage). Negotiated session parameters 1741 are provided to the end host. 1743 Subsequently, Host A initiates a QoS signaling message towards Host 1744 B. It sends a QoS NSLP Reserve message, in which it includes 1745 description of the required QoS (QSPEC object) and authorization data 1746 for negotiated service session (part of the POLICY_DATA object). 1747 Authorization data includes, as a minimum, the identity of the AE 1748 (e.g., the SIP server) and an identifier of the application service 1749 session for which QoS resources are requested. 1751 A QoS NSLP Reserve message is intercepted and processed by the first 1752 QoS aware Network Element. The NE uses the Diameter QoS application 1753 to request authorization for the received QoS reservation request. 1754 The identity of the AE (in this case the SIP server that is co- 1755 located with a Diameter server) is put into the Destination-Host AVP, 1756 any additional session authorization data is encapsulated into the 1757 QoS-Authz-Data AVP and the description of the QoS resources is 1758 included into QoS-Resources AVP. These AVPs are included into a QoS 1759 Authorization Request message, which is sent to the AE. 1761 A QAR message will be routed through the AAA network to the AE. The 1762 AE verifies the requested QoS against the QoS resources negotiated 1763 for the service session and replies with QoS-Authorization answer 1764 (QAA) message. It carries the authorization result (Result-Code AVP) 1765 and the description of the authorized QoS parameters (QoS-Resources 1766 AVP), as well as duration of the authorization session 1767 (Authorization-Lifetime AVP). 1769 The NE interacts with the traffic control function and installs the 1770 authorized QoS resources and forwards the QoS NSLP Reserve message 1771 further along the data path. Moreover, the NE may serve as a 1772 signaling proxy and process the QoS signaling (e.g. initiation or 1773 termination of QoS signaling) based on the QoS decision received from 1774 the authorizing entity. 1776 9.2. Example Call Flow for Push Mode 1778 This section presents an example of the interaction between the end- 1779 host and Diameter QoS application entities using Push mode. The 1780 application layer signaling is, in this example, provided using SIP. 1781 Signaling for a QoS resource reservation is done using the QoS NSLP. 1782 The authorization of the QoS reservation request is done by the 1783 Diameter QoS application (DQA). 1785 End-Host NE SIP Server Correspondent 1786 requesting QoS (DQA Client) (DQA Server) Node 1787 | | | | 1788 ..|....Application layer SIP signaling..........|..............|.. 1789 . | Invite(SDP offer)| | | . 1790 . +.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.> | . 1791 . | 100 Trying | | | . 1792 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.+ | . 1793 . |.............................................|..............| . 1794 | | +---------+-------------+| 1795 | | | Authorize request || 1796 | | | Keep session data || 1797 | | |/Authz-time,Session-Id/|| 1798 | | +---------+-------------+| 1799 | | | | 1800 | |<-- - -- - QIR - -- - -- -+ | 1801 | |(Initial Request,Decision | | 1802 | |(QoS-Resources,Authz-time)| | 1803 | +-------+---------+ | | 1804 | |Install QoS state| | | 1805 | | + | | | 1806 | | Authz. session | | | 1807 | | /Authz-time/ | | | 1808 | +-------+---------+ | | 1809 | + - - -- - QIA - - - - - ->| | 1810 | | (Result-Code, | | 1811 | | QoS-Resources) | | 1812 | | +----------+------------+ | 1813 | | | Report for successful | | 1814 | | | QoS reservation | | 1815 | | |Update of reserved QoS | | 1816 | | | resources | | 1817 | | +----------+------------+ | 1818 . | | | Invite (SDP) | . 1819 . | | +-.-.-.....-.-.> . 1820 . | 180 (Ringing) | | . 1821 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.<.-.-.-.-.-.-.-+ . 1822 . | | | 200 OK (SDP)| . 1823 . | | <-.-.-.....-.-.+ . 1824 | | +--------+-----------+ | 1825 | | |re-Authorize session| | 1826 | | | parameters | | 1827 | | +--------+-----------+ | 1828 | <- - - - - - RAR - - - - - + | 1829 | +---------+--------+ | | 1830 | |Activate QoS state| | | 1831 | +---------+--------+ | | 1832 | +- - - - - - RAA - - - - - > | 1833 . | 200 (SDP answer) | | | . 1834 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.+ | . 1836 | | | 1837 /------------------+-----Data Flow---------------------------\ 1838 \------------------+-----------------------------------------/ 1839 | | | 1841 .-.-.-.-. SIP signaling 1842 - - - - - Diameter QoS Application messages 1844 Figure 13: QoS Authorization Example - Push Mode 1846 The communication starts with SIP signaling between the two end 1847 points and the SIP server for negotiation and authorization of the 1848 requested service and its parameters (see Figure 13). As a part of 1849 the process, the SIP server verifies whether the user at Host A is 1850 authorized to use the requested service (and potentially the ability 1851 to be charged for the service usage). The DQA server is triggered to 1852 authorize the QoS request based on session parameters (i.e., SDP 1853 offer), initiate a Diameter QoS authorization session and install 1854 authorized QoS state to the Network Element via QIR message. 1856 The DQA server may obtain the info of peer DQA client from pre- 1857 configured information or query the DNS based on Host A's identity or 1858 IP address (In this case a DQA server is co-located with a SIP server 1859 and a DQA client is co-located with a NE). The identity of Network 1860 Element is put into the Destination-Host AVP, the description of the 1861 QoS resources is included into QoS-Resources AVP, as well as duration 1862 of the authorization session (Authorization-Lifetime AVP). The NE 1863 interacts with the traffic control function and reserves the 1864 authorized QoS resources accordingly, for instance, the NE may serve 1865 as a signaling proxy and process the QoS signaling (e.g. initiation 1866 or termination of QoS signaling) based on the QoS decision received 1867 from the authorizing entity. 1869 With successful QoS authorization, the SDP offer in SIP Invite is 1870 forwarded to Host B. Host B sends back a 18x (ringing) message 1871 towards Host A and processes the SDP. Once Host B accepts the call, 1872 it sends back a 200 OK, in which it includes description of the 1873 accepted session parameters (i.e. SDP answer). 1875 The DQA server may verify the accepted QoS against the pre-authorized 1876 QoS resources, and sends a Diameter RAR message to the DQA client in 1877 the NE for activating the installed policies and commit the resource 1878 allocation. With successful QoS enforcement, the 200 OK is forwarded 1879 towards Host A. 1881 Note that the examples above show a sender-initiated reservation from 1882 the end host towards the corresponding node and a receiver-initiated 1883 reservation from the correspondent node towards the end host. 1885 10. IANA Considerations 1887 This section contains the namespaces that have either been created in 1888 this specification or had their values assigned to existing 1889 namespaces managed by IANA. 1891 10.1. AVP Codes 1893 IANA is requested to allocate two AVP codes to the following: 1895 Registry: 1896 AVP Code Attribute Name Reference 1897 ----------------------------------------------------------- 1898 to be assigned QoS-Authz-Data Section 7.2 1899 to be assigned Bound-Auth-Session-Id Section 7.2 1901 10.2. AVP Specific Values 1903 IANA is requested to allocate the following sub-registry values. 1905 Sub-registry: Auth-Application-Id AVP Values (code 258) 1906 Registry: 1907 AVP Values Attribute Name Reference 1908 ------------- ------------------------------------------- 1909 to be assigned DIAMETER-QOS-NOSUPPORT Section 5 1910 to be assigned DIAMETER-QOS-SUPPORT Section 5 1912 Sub-registry: Acct-Application-Id AVP Values (code 259) 1913 Registry: 1914 AVP Values Attribute Name Reference 1915 ------------- ------------------------------------------- 1916 to be assigned DIAMETER-QOS-NOSUPPORT Section 5 1917 to be assigned DIAMETER-QOS-SUPPORT Section 5 1919 10.3. AVP Flags 1921 There are no new AVP flags defined for either the QoS-Authz-Data AVP 1922 or the Bound-Ath-Session-ID AVP. 1924 10.4. Application IDs 1926 IANA is requested to allocate the following application ID using the 1927 next value from the 7-16777215 range. 1929 Registry: 1930 ID values Name Reference 1931 ----------------------------------------------------------- 1932 to be assigned Diameter QoS application Section 5 1934 10.5. Command Codes 1936 IANA is requested to allocate command code values for the following 1937 from the range 289-299. 1939 Registry: 1940 Code Value Name Reference 1941 ----------------------------------------------------------- 1942 to be assigned QoS-Authz-Request (QAR) Section 5.1 1943 to be assigned QoS-Authz-Answer (QAA) Section 5.2 1944 to be assigned QoS-Install-Request (QIR) Section 5.3 1945 to be assigned QoS-Install-Answer (QIA) Section 5.4 1947 11. Security Considerations 1949 This document describes a mechanism for performing authorization of a 1950 QoS reservation at a third party entity. Therefore, the QoS 1951 signaling application carry sufficient information that the backend 1952 AAA server can make a authorization decision. This functionality is 1953 particularly useful in roaming environments where the authorization 1954 decision is most likely provided at an entity where the user can be 1955 authenticated, such as in the home realm. 1957 QoS signaling application MAY re-use the authenticated identities 1958 used for the establishment of the secured transport channel for the 1959 signaling messages, e.g., TLS or IPsec between the end host and the 1960 policy aware QoS NE. In addition, a collocation of the QoS NE with, 1961 for example, the Diameter NASREQ application (see [RFC4005]) may 1962 allow the QoS authorization to be based on the authenticated identity 1963 used during the network access authentication protocol run. If a co- 1964 located deployment is not desired then special security protection is 1965 required to ensure that arbitrary nodes cannot reuse a previous 1966 authentication exchange to perform an authorization decision. 1968 Additionally, QoS authorization might be based on the usage of 1969 authorization tokens that are generated by the AE and provided to the 1970 end host via application layer signaling. 1972 The impact of the existence of different authorization models is 1973 (with respect to this Diameter QoS application) the ability to carry 1974 different authentication and authorization information. 1976 12. Acknowledgements 1978 The authors would like to thank John Loughney and Allison Mankin for 1979 their input to this document. In September 2005 Robert Hancock, 1980 Jukka Manner, Cornelia Kappler, Xiaoming Fu, Georgios Karagiannis and 1981 Elwyn Davies provided a detailed review. Robert also provided us 1982 with good feedback earlier in 2005. Jerry Ash provided us review 1983 comments late 2005/early 2006. Rajith R provided some inputs to the 1984 document early 2007 1986 13. Contributors 1988 The authors would like to thank Tseno Tsenov and Frank Alfano for 1989 starting the Diameter Quality of Service work within the IETF, for 1990 your significant draft contributions and for being the driving force 1991 for the first few draft versions. 1993 14. References 1995 14.1. Normative References 1997 [I-D.ietf-dime-qos-attributes] 1998 Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M., 1999 and A. Lior, "Quality of Service Attributes for Diameter", 2000 draft-ietf-dime-qos-attributes-07 (work in progress), 2001 June 2008. 2003 [I-D.ietf-dime-qos-parameters] 2004 Korhonen, J. and H. Tschofenig, "Quality of Service 2005 Parameters for Usage with the AAA Framework", 2006 draft-ietf-dime-qos-parameters-06 (work in progress), 2007 May 2008. 2009 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2010 Requirement Levels", BCP 14, RFC 2119, March 1997. 2012 [RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. 2013 Arkko, "Diameter Base Protocol", RFC 3588, September 2003. 2015 [RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton, 2016 "Diameter Network Access Server Application", RFC 4005, 2017 August 2005. 2019 [RFC4234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax 2020 Specifications: ABNF", RFC 4234, October 2005. 2022 14.2. Informative References 2024 [I-D.ietf-nsis-ntlp] 2025 Schulzrinne, H. and R. Hancock, "GIST: General Internet 2026 Signalling Transport", draft-ietf-nsis-ntlp-15 (work in 2027 progress), February 2008. 2029 [I-D.ietf-nsis-qos-nslp] 2030 Manner, J., Karagiannis, G., and A. McDonald, "NSLP for 2031 Quality-of-Service Signaling", draft-ietf-nsis-qos-nslp-16 2032 (work in progress), February 2008. 2034 [RFC2205] Braden, B., Zhang, L., Berson, S., Herzog, S., and S. 2035 Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1 2036 Functional Specification", RFC 2205, September 1997. 2038 [RFC2211] Wroclawski, J., "Specification of the Controlled-Load 2039 Network Element Service", RFC 2211, September 1997. 2041 [RFC2212] Shenker, S., Partridge, C., and R. Guerin, "Specification 2042 of Guaranteed Quality of Service", RFC 2212, 2043 September 1997. 2045 [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, 2046 "Definition of the Differentiated Services Field (DS 2047 Field) in the IPv4 and IPv6 Headers", RFC 2474, 2048 December 1998. 2050 [RFC2753] Yavatkar, R., Pendarakis, D., and R. Guerin, "A Framework 2051 for Policy-based Admission Control", RFC 2753, 2052 January 2000. 2054 [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, 2055 "Remote Authentication Dial In User Service (RADIUS)", 2056 RFC 2865, June 2000. 2058 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 2059 A., Peterson, J., Sparks, R., Handley, M., and E. 2060 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 2061 June 2002. 2063 [RFC3313] Marshall, W., "Private Session Initiation Protocol (SIP) 2064 Extensions for Media Authorization", RFC 3313, 2065 January 2003. 2067 [RFC3520] Hamer, L-N., Gage, B., Kosinski, B., and H. Shieh, 2068 "Session Authorization Policy Element", RFC 3520, 2069 April 2003. 2071 [RFC3521] Hamer, L-N., Gage, B., and H. Shieh, "Framework for 2072 Session Set-up with Media Authorization", RFC 3521, 2073 April 2003. 2075 [RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The 2076 Network Access Identifier", RFC 4282, December 2005. 2078 [RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security 2079 (TLS) Protocol Version 1.1", RFC 4346, April 2006. 2081 [RFC4566] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session 2082 Description Protocol", RFC 4566, July 2006. 2084 Authors' Addresses 2086 Dong Sun (editor) 2087 Alcatel-Lucent 2088 600 Mountain Ave 2089 Murray Hill, NJ 07974 2090 USA 2092 Phone: +1 908 582 2617 2093 Email: dongsun@alcatel-lucent.com 2095 Peter J. McCann 2096 Motorola Labs 2097 1301 E. Algonquin Rd 2098 Schaumburg, IL 60196 2099 USA 2101 Phone: +1 847 576 3440 2102 Email: pete.mccann@motorola.com 2104 Hannes Tschofenig 2105 Nokia Siemens Networks 2106 Linnoitustie 6 2107 Espoo 02600 2108 Finland 2110 Phone: +358 (50) 4871445 2111 Email: Hannes.Tschofenig@gmx.net 2112 URI: http://www.tschofenig.priv.at 2114 Tina Tsou 2115 Huawei 2116 Shenzhen, 2117 P.R.C 2119 Email: tena@huawei.com 2120 Avri Doria 2121 Lulea University of Technology 2122 Arbetsvetenskap 2123 Lulea, SE-97187 2124 Sweden 2126 Email: avri@ltu.se 2128 Glen Zorn (editor) 2129 Aruba Networks 2130 1322 Crossman Avenue 2131 Sunnyvale, CA 94089-1113 2132 USA 2134 Email: gwz@arubanetworks.com 2136 Full Copyright Statement 2138 Copyright (C) The IETF Trust (2008). 2140 This document is subject to the rights, licenses and restrictions 2141 contained in BCP 78, and except as set forth therein, the authors 2142 retain all their rights. 2144 This document and the information contained herein are provided on an 2145 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 2146 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 2147 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 2148 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 2149 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 2150 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 2152 Intellectual Property 2154 The IETF takes no position regarding the validity or scope of any 2155 Intellectual Property Rights or other rights that might be claimed to 2156 pertain to the implementation or use of the technology described in 2157 this document or the extent to which any license under such rights 2158 might or might not be available; nor does it represent that it has 2159 made any independent effort to identify any such rights. Information 2160 on the procedures with respect to rights in RFC documents can be 2161 found in BCP 78 and BCP 79. 2163 Copies of IPR disclosures made to the IETF Secretariat and any 2164 assurances of licenses to be made available, or the result of an 2165 attempt made to obtain a general license or permission for the use of 2166 such proprietary rights by implementers or users of this 2167 specification can be obtained from the IETF on-line IPR repository at 2168 http://www.ietf.org/ipr. 2170 The IETF invites any interested party to bring to its attention any 2171 copyrights, patents or patent applications, or other proprietary 2172 rights that may cover technology that may be required to implement 2173 this standard. Please address the information to the IETF at 2174 ietf-ipr@ietf.org.