idnits 2.17.1 draft-ietf-dime-diameter-qos-15.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** You're using the IETF Trust Provisions' Section 6.b License Notice from 12 Sep 2009 rather than the newer Notice from 28 Dec 2009. (See https://trustee.ietf.org/license-info/) Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Line 2107 has weird spacing: '...ication along...' -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (March 7, 2010) is 5126 days in the past. Is this intentional? -- Found something which looks like a code comment -- if you have code sections in the document, please surround them with '' and '' lines. Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'TBD1' is mentioned on line 1367, but not defined == Missing Reference: 'TBD2' is mentioned on line 1392, but not defined == Missing Reference: 'TBD3' is mentioned on line 1421, but not defined == Missing Reference: 'TBD4' is mentioned on line 1446, but not defined == Missing Reference: 'TBD5' is mentioned on line 1341, but not defined ** Obsolete normative reference: RFC 3588 (Obsoleted by RFC 6733) ** Obsolete normative reference: RFC 4005 (Obsoleted by RFC 7155) == Outdated reference: A later version (-07) exists of draft-ietf-mmusic-media-path-middleboxes-02 -- Obsolete informational reference (is this intentional?): RFC 4282 (Obsoleted by RFC 7542) -- Obsolete informational reference (is this intentional?): RFC 4566 (Obsoleted by RFC 8866) -- Obsolete informational reference (is this intentional?): RFC 5246 (Obsoleted by RFC 8446) Summary: 3 errors (**), 0 flaws (~~), 8 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Diameter Maintenance and D. Sun, Ed. 3 Extensions (DIME) Alcatel-Lucent 4 Internet-Draft P. McCann 5 Intended status: Standards Track Motorola Labs 6 Expires: September 8, 2010 H. Tschofenig 7 Nokia Siemens Networks 8 T. Tsou 9 Huawei 10 A. Doria 11 Lulea University of Technology 12 G. Zorn, Ed. 13 Network Zen 14 March 7, 2010 16 Diameter Quality of Service Application 17 draft-ietf-dime-diameter-qos-15.txt 19 Abstract 21 This document describes the framework, messages and procedures for 22 the Diameter Quality of Service (QoS) application. The Diameter QoS 23 application allows network elements to interact with Diameter servers 24 when allocating QoS resources in the network. In particular, two 25 modes of operation, namely "Pull" and "Push", are defined. 27 Status of this Memo 29 This Internet-Draft is submitted to IETF in full conformance with the 30 provisions of BCP 78 and BCP 79. 32 Internet-Drafts are working documents of the Internet Engineering 33 Task Force (IETF), its areas, and its working groups. Note that 34 other groups may also distribute working documents as Internet- 35 Drafts. 37 Internet-Drafts are draft documents valid for a maximum of six months 38 and may be updated, replaced, or obsoleted by other documents at any 39 time. It is inappropriate to use Internet-Drafts as reference 40 material or to cite them other than as "work in progress." 42 The list of current Internet-Drafts can be accessed at 43 http://www.ietf.org/ietf/1id-abstracts.txt. 45 The list of Internet-Draft Shadow Directories can be accessed at 46 http://www.ietf.org/shadow.html. 48 This Internet-Draft will expire on September 8, 2010. 50 Copyright Notice 52 Copyright (c) 2010 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 68 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 69 3. Framework . . . . . . . . . . . . . . . . . . . . . . . . . . 7 70 3.1. Network Element Functional Model . . . . . . . . . . . . . 8 71 3.2. Implications of Endpoint QoS Capabilities . . . . . . . . 10 72 3.2.1. Endpoint Categories . . . . . . . . . . . . . . . . . 10 73 3.2.2. Interaction Modes Between the Authorizing Entity 74 and Network Element . . . . . . . . . . . . . . . . . 10 75 3.3. Authorization Schemes . . . . . . . . . . . . . . . . . . 12 76 3.3.1. Pull Mode Schemes . . . . . . . . . . . . . . . . . . 12 77 3.3.2. Push Mode Schemes . . . . . . . . . . . . . . . . . . 15 78 3.4. QoS Application Requirements . . . . . . . . . . . . . . . 16 79 4. QoS Application Session Establishment and Management . . . . . 20 80 4.1. Parties Involved . . . . . . . . . . . . . . . . . . . . . 20 81 4.2. Session Establishment . . . . . . . . . . . . . . . . . . 20 82 4.2.1. Session Establishment for Pull Mode . . . . . . . . . 21 83 4.2.2. Session Establishment for Push Mode . . . . . . . . . 23 84 4.2.3. Discovery and Selection of Peer Diameter QoS 85 Application Node . . . . . . . . . . . . . . . . . . . 26 86 4.3. Session Re-authorization . . . . . . . . . . . . . . . . . 26 87 4.3.1. Client-Side Initiated Re-Authorization . . . . . . . . 27 88 4.3.2. Server-Side Initiated Re-Authorization . . . . . . . . 28 89 4.4. Session Termination . . . . . . . . . . . . . . . . . . . 29 90 4.4.1. Client-Side Initiated Session Termination . . . . . . 29 91 4.4.2. Server-Side Initiated Session Termination . . . . . . 30 92 5. QoS Application Messages . . . . . . . . . . . . . . . . . . . 32 93 5.1. QoS-Authorization Request (QAR) . . . . . . . . . . . . . 33 94 5.2. QoS-Authorization Answer (QAA) . . . . . . . . . . . . . . 33 95 5.3. QoS-Install Request (QIR) . . . . . . . . . . . . . . . . 34 96 5.4. QoS-Install Answer (QIA) . . . . . . . . . . . . . . . . . 35 97 5.5. Re-Auth-Request (RAR) . . . . . . . . . . . . . . . . . . 35 98 5.6. Re-Auth-Answer (RAA) . . . . . . . . . . . . . . . . . . . 36 99 6. QoS Application State Machine . . . . . . . . . . . . . . . . 37 100 6.1. Supplemented States for Push Mode . . . . . . . . . . . . 37 101 7. QoS Application AVPs . . . . . . . . . . . . . . . . . . . . . 39 102 7.1. Reused Base Protocol AVPs . . . . . . . . . . . . . . . . 39 103 7.2. QoS Application Defined AVPs . . . . . . . . . . . . . . . 39 104 8. Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . 41 105 9. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 106 9.1. Example Call Flow for Pull Mode (Success Case) . . . . . . 42 107 9.2. Example Call Flow for Pull Mode (Failure Case) . . . . . . 44 108 9.3. Example Call Flow for Push Mode . . . . . . . . . . . . . 47 109 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 50 110 10.1. AVP Codes . . . . . . . . . . . . . . . . . . . . . . . . 50 111 10.2. Application IDs . . . . . . . . . . . . . . . . . . . . . 50 112 10.3. Command Codes . . . . . . . . . . . . . . . . . . . . . . 50 113 11. Security Considerations . . . . . . . . . . . . . . . . . . . 51 114 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 53 115 13. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 54 116 14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 55 117 14.1. Normative References . . . . . . . . . . . . . . . . . . . 55 118 14.2. Informative References . . . . . . . . . . . . . . . . . . 55 119 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 57 121 1. Introduction 123 This document describes the framework, messages and procedures for 124 the Diameter [RFC3588] Quality of Service (QoS) application. The 125 Diameter QoS application allows Network Elements (NEs) to interact 126 with Diameter servers when allocating QoS resources in the network. 128 Two modes of operation are defined. In the first, called "Pull" 129 mode, the network element requests QoS authorization from the 130 Diameter server based on some trigger (such as a QoS signaling 131 protocol) that arrives along the data path. In the second, called 132 "Push" mode, the Diameter server pro-actively sends a command to the 133 network element(s) to install QoS authorization state. This could be 134 triggered, for instance, by off-path signaling, such as Session 135 Initiation Protocol (SIP) [RFC3261] call control. 137 A set of command codes is specified that allows a single Diameter QoS 138 application server to support both Pull and Push modes based on the 139 requirements of network technologies, deployment scenarios and end- 140 host capabilities. In conjunction with Diameter AVPs defined in 141 [I-D.ietf-dime-qos-attributes] and in [RFC5624], this document 142 depicts basic call flow procedures used to establish, modify and 143 terminate a Diameter QoS application session. 145 This document defines a number of Diameter-encoded Attribute Value 146 Pairs (AVPs), which are described using a modified version of the 147 Augmented Backus-Naur Form (ABNF), see [RFC3588]. 149 2. Terminology 151 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 152 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 153 document are to be interpreted as described in RFC 2119 [RFC2119]. 155 The following terms are used in this document: 157 AAA Cloud 158 An infrastructure of Authentication, Authorization and Accounting 159 (AAA) entities (clients, agents, servers) communicating via a AAA 160 protocol over trusted, secure connections. It offers 161 authentication, authorization and accounting services to 162 applications in local and roaming scenarios. Diameter and RADIUS 163 [RFC2865] are both widely deployed AAA protocols. 165 Application Endpoint (AppE) 166 An Application Endpoint is an entity in an end-user device that 167 exchanges signaling messages with Application Servers or directly 168 with other Application Endpoints. Based on the result of this 169 signaling, the Endpoint may make a request for QoS from the 170 network. For example, a SIP User Agent is one kind of Application 171 Endpoint. 173 Application Server (AppS) 174 An Application Server is an entity that exchanges signaling 175 messages with an Application Endpoint (see above). It may be a 176 source of authorization for QoS-enhanced application flows. For 177 example, a SIP server is one kind of Application Server. 179 Authorizing Entity (AE) 180 The Authorizing Entity is a Diameter server that supports the QoS 181 application. It is responsible for authorizing QoS requests for a 182 particular application flow or aggregate. The Authorizing Entity 183 may be a standalone entity or may be integrated with an 184 Application Server and may be co-located with a subscriber 185 database. This entity corresponds to the Policy Decision Point 186 (PDP) [RFC2753]. 188 Network Element (NE) 189 A QoS aware router that acts as a Diameter client for the QoS 190 application. This entity triggers the protocol interaction for 191 the Pull mode, and it is the recipient of QoS information in the 192 Push mode. The Diameter Client at an Network Element corresponds 193 to the Policy Enforcement Point (PEP) [RFC2753]. 195 Pull Mode 196 In this mode, the QoS authorization process is invoked by the QoS 197 reservation request received from the Application Endpoint. The 198 Network Element then requests the QoS authorization decision from 199 the Authorizing Entity. 201 Push Mode 202 In this mode, the QoS authorization process is invoked by the 203 request from Application Server or local policies in the 204 Authorizing Entity. The Authorizing Entity then installs the QoS 205 authorization decision to the Network Element directly. 207 Resource Requesting Entity (RRE) 208 A Resource Requesting Entity is a logical entity that supports the 209 protocol interaction for QoS resources. The RRE resides in the 210 end-host and is able to communicate with peer logical entities in 211 an Authorizing Entity or a Network Element to trigger the QoS 212 authorization process. 214 3. Framework 216 The Diameter QoS application runs between a NE (acting as a Diameter 217 client) and the resource AE (acting as a Diameter server). A high- 218 level picture of the resulting architecture is shown in Figure 1. 220 +-------+---------+ 221 | Authorizing | 222 | Entity | 223 |(Diameter Server)| 224 +-------+---------+ 225 | 226 | 227 /\-----+-----/\ 228 //// \\\\ 229 || AAA Cloud || 230 | (Diameter application) | 231 || || 232 \\\\ //// 233 \-------+-----/ 234 | 235 +---+--+ +-----+----+ +---+--+ 236 | | | NE | | | Media 237 + NE +===+(Diameter +===+ NE +=============>> 238 | | | Client) | | | Flow 239 +------+ +----------+ +------+ 241 Figure 1: An Architecture Supporting QoS-AAA 243 Figure 1 depicts NEs through which media flows need to pass, a cloud 244 of AAA servers, and an AE. Note that there may be more than one 245 router that needs to interact with the AAA cloud along the path of a 246 given application flow, although the figure only depicts one for 247 clarity. 249 In some deployment scenarios, NEs may request authorization through 250 the AAA cloud based on an incoming QoS reservation request. The NE 251 will route the request to a designated AE. The AE will return the 252 result of the authorization decision. In other deployment scenarios, 253 the authorization will be initiated upon dynamic application state, 254 so that the request must be authenticated and authorized based on 255 information from one or more AppSs. After receiving the 256 authorization request from the AppS or the NE, the AE decides the 257 appropriate mode (i.e., Push or Pull). The usage Push or Pull mode 258 can be determined by the authorizing entity either statically or 259 dynamically. Static determination might be based on a configurable 260 defined policy in the authorizing entity, while dynamic determination 261 might be based on information received from an application server. 262 For Push mode, the authorizing entity needs to identify the 263 appropriate NE(s) to which QoS authorization information needs to be 264 pushed. It might determine this based on information received from 265 the AppS, such as the IP addresses of media flows. 267 In some deployment scenarios, there is a mapping between access 268 network type and the service logic (e.g., selection of the Push or 269 Pull mode, and other differentiated handling of the resource 270 admission and control). The access network type might be derived 271 from the authorization request from the AppS or the NE, and in this 272 case, the authorizing entity can identify the corresponding service 273 logic based on the mapping. 275 If the interface between the NEs and the AAA cloud is identical 276 regardless of whether the AE communicates with an AppS or not, 277 routers are insulated from the details of particular applications and 278 need not know that Application Servers are involved. Also, the AAA 279 cloud may also encompass business relationships such as those between 280 network operators and third-party application providers. This 281 enables flexible intra- or inter-domain authorization, accounting, 282 and settlement. 284 3.1. Network Element Functional Model 286 Figure 2 depicts a logical operational model of resource management 287 in a router. 289 +-------------------------------------------------------+ 290 | DIAMETER Client | 291 | Functionality | 292 | +---------------++-----------------++---------------+ | 293 | | User || QoS Application || Accounting | | 294 | | Authentication|| Client || Client (e.g., | | 295 | | Client || (Authorization ||for QoS Traffic| | 296 | +---------------+| of QoS Requests)|+---------------+ | 297 | +-----------------+ | 298 +-------------------------------------------------------+ 299 ^ 300 v 301 +--------------+ +----------+ 302 |QoS Signaling | | Resource | 303 |Msg Processing|<<<<<>>>>>>>|Management| 304 +--------------+ +----------+ 305 . ^ | * ^ 306 | v . * ^ 307 +-------------+ * ^ 308 |Signaling msg| * ^ 309 | Processing | * V 310 +-------------+ * V 311 | | * V 312 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 313 . . * V 314 | | * ............................. 315 . . * . Traffic Control . 316 | | * . +---------+. 317 . . * . |Admission|. 318 | | * . | Control |. 319 +----------+ +------------+ . +---------+. 320 <.->| Input | | Outgoing |<.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-> 321 | Packet | | Interface | .+----------+ +---------+. 322 ===>|Processing|====| Selection |===.| Packet |====| Packet |.=> 323 | | |(Forwarding)| .|Classifier| Scheduler|. 324 +----------+ +------------+ .+----------+ +---------+. 325 ............................. 326 <.-.-> = signaling flow 327 =====> = data flow (sender --> receiver) 328 <<<>>> = control and configuration operations 329 ****** = routing table manipulation 331 Figure 2: Network Element Functional Model 333 Processing of incoming QoS reservation requests includes three 334 actions: admission control, authorization and resource reservation. 336 The admission control function provides information about available 337 resources and determines whether there are enough resources to 338 fulfill the request. Authorization is performed by the Diameter 339 client, which involves contacting an authorization entity through the 340 AAA cloud shown in Section 3. If both checks are successful, the 341 authorized QoS parameters are set in the packet classifier and the 342 packet scheduler. Note that the parameters passed to the Traffic 343 Control function may be different from the ones requested QoS 344 (depending on the authorization decision). Once the requested 345 resource is granted, the Resource Management function provides 346 accounting information to the AE via the Diameter client. 348 3.2. Implications of Endpoint QoS Capabilities 350 3.2.1. Endpoint Categories 352 The QoS capabilities of Application Endpoints are varied, and can be 353 categorized as follows: 355 Category 1 356 A Category 1 Application Endpoint has no QoS capability at either 357 the application or the network level. This type of AppE may set 358 up a connection through application signaling, but it is incapable 359 of specifying resource/QoS requirements through either application 360 or network-level signaling. 362 Category 2 363 A Category 2 Application Endpoint only has QoS capability at the 364 application level. This type of AppE is able to set up a 365 connection through application signaling with certain resource/QoS 366 requirements (e.g., application attributes), but it is unable to 367 signal any resource/QoS requirements at the network level. 369 Category 3 370 A Category 3 Application Endpoint has QoS capability at the 371 network level. This type of AppE may set up a connection through 372 application signaling, translate service characteristics into 373 network resource/QoS requirements (e.g., network QoS class) 374 locally, and request the resources through network signaling, 375 e.g., Resource ReSerVation Protocol (RSVP) [RFC2205] or NSIS 376 [I-D.ietf-nsis-qos-nslp]. 378 3.2.2. Interaction Modes Between the Authorizing Entity and Network 379 Element 381 Different QoS mechanisms are employed in packet networks. Those QoS 382 mechanisms can be categorized into two schemes: IntServ [RFC2211], 383 [RFC2212] and DiffServ [RFC2474]. In the IntServ scheme, network 384 signaling (e.g., RSVP, NSIS, or link specific signaling) is commonly 385 used to initiate a request from an AppE for the desired QoS resource. 386 In the DiffServ scheme, QoS resources are provisioned based upon some 387 predefined QoS service classes rather than AppE-initiated, flow-based 388 QoS requests. 390 It is obvious that the eligible QoS scheme is correlated to the 391 AppE's capability in the context of QoS authorization. Since 392 Category 1 and 2 AppEs cannot initiate the QoS resource requests by 393 means of network signaling, using the current mechanism of IntServ 394 model to signal QoS information across the network is not applicable 395 to them in general. Depending on network technology and operator 396 requirements, a Category 3 AppE may either make use of network 397 signaling for resource requests or not. 399 The diversity of QoS capabilities of endpoints and QoS schemes of 400 network technology leads to the distinction on the interaction mode 401 between QoS authorization system and underlying NEs. When the 402 IntServ scheme is employed by a Category 3 endpoint, the 403 authorization process is typically initiated by a NE when a trigger 404 is received from the endpoint such as network QoS signaling. In the 405 DiffServ scheme, since the NE is unable to request the resource 406 authorization on its own initiative, the authorization process is 407 typically triggered by either the request of AppSs or policies 408 defined by the operator. 410 As a consequence, two interaction modes are needed in support of 411 different combinations of QoS schemes and endpoint's QoS 412 capabilities: Push mode and Pull mode. 414 Push mode 415 The QoS authorization process is triggered by AppSs or local 416 network conditions (e.g., time of day on resource usage and QoS 417 classes), and the authorization decisions are installed by the AE 418 to the network element on its own initiative without explicit 419 request. In order to support the push mode, the AE (i.e., 420 Diameter server) should be able to initiate a Diameter 421 authorization session to communicate with the NE (i.e., Diameter 422 client) without any pre-established connection from the network 423 element. 425 Pull mode 426 The QoS authorization process is triggered by the network 427 signaling received from end-user equipment or by a local event in 428 the NE according to pre-configured policies, and authorization 429 decisions are produced upon the request of the NE. In order to 430 support the pull mode, the NE (i.e., Diameter client) will 431 initiate a Diameter authorization session to communicate with the 432 authorizing entity (i.e., Diameter server). 434 For Category 1 and 2 Application Endpoints, Push mode is REQUIRED. 435 For a Category 3 AppE, either Push mode or Pull mode MAY be used. 437 Push mode is applicable to certain networks, for example, Cable 438 network, DSL, Ethernet, and Diffserv-enabled IP/MPLS. The Pull mode 439 is more appropriate to IntServ-enabled IP networks or certain 440 wireless networks such as the GPRS networks defined by 3GPP. Some 441 networks (for example, WiMAX) may require both Push and Pull modes. 443 3.3. Authorization Schemes 445 3.3.1. Pull Mode Schemes 447 Three types of basic authorization schemes for Pull mode exist: one 448 type of two-party scheme and two types of three-party schemes. The 449 notation adopted here is in respect to the entity that performs the 450 QoS authorization (QoS Authz). The authentication of the QoS 451 requesting entity might be done at the NE as part of the QoS 452 signaling protocol, or by an off-path protocol (on the application 453 layer or for network access authentication) or the AE might be 454 contacted with request for authentication and authorization of the 455 QoS requesting entity. From the Diameter QoS application's point of 456 view these schemes differ in type of information that need to be 457 carried. Here we focus on the 'Basic Three Party Scheme' (see 458 Figure 3) and the 'Token-based Three Party Scheme' (see Figure 4). 459 In the 'Two Party Scheme', the QoS RRE is authenticated by the NE and 460 the authorization decision is made either locally at the NE itself or 461 offloaded to a trusted entity (most likely within the same 462 administrative domain). In the two-party case no Diameter QoS 463 protocol interaction is required. 465 +--------------+ 466 | Authorizing | 467 | Entity | 468 | authorizing | <......+ 469 | resource | . 470 | request | . 471 +------------+-+ . 472 --^----------|-- . . 473 ///// | | \\\\\ . 474 // | | \\ . 475 | QoS | QoS AAA | QoS |. 476 | authz| protocol |authz |. 477 | req.| | res. |. 478 \\ | | // . 479 \\\\\ | | ///// . 480 QoS --|----------v-- . . 481 +-------------+ request +-+------------+ . 482 | Entity |----------------->| NE | . 483 | requesting | | performing | . 484 | resource |granted / rejected| QoS | <.....+ 485 | |<-----------------| reservation | financial 486 +-------------+ +--------------+ settlement 488 Figure 3: Three Party Scheme 490 In the 'Basic Three Party Scheme' a QoS reservation request that 491 arrives at the NE is forwarded to the Authorizing Entity (e.g., in 492 the user's home network), where the authorization decision is made. 493 As shown, financial settlement - a business relationship, such as a 494 roaming agreement, between the visited network and the home network 495 ensures that the visited network is compensated for the resources 496 consumed by the user via the home network. 498 financial settlement 499 ...........................+ 500 Authorization V ------- . 501 Token Request +--------------+ / QoS AAA \ . 502 +-------------->| | / protocol \ . 503 | | Authorizing +--------------+ \ . 504 | | Entity | | | | . 505 | +------+ |<--+----+ | | . 506 | | +--------------+ |QoS | |QoS |. 507 | | |authz| |authz|. 508 | |Authorization |req.+| |res. |. 509 | |Token |Token| | |. 510 | | | | | . | . 511 | | \ | | . / . 512 | | \ | | / . 513 | | QoS request |-----V . . 514 +-------------+ + Authz. Token +--------+-----+ . 515 | Entity |----------------->| NE | . 516 | requesting | | performing | . 517 | resource |granted / rejected| QoS | <....+ 518 | |<-----------------| reservation | 519 +-------------+ +--------------+ 521 Figure 4: Token-based Three Party Scheme 523 The 'Token-based Three Party Scheme' is applicable to environments 524 where a previous protocol interaction is used to request 525 authorization tokens to assist the authorization process at the NE or 526 the AE [RFC3521]. 528 The QoS RRE may be involved in an application layer protocol 529 interaction, for example using SIP [RFC3313], with the AE. As part 530 of this interaction, authentication and authorization at the 531 application layer might take place. As a result of a successful 532 authorization decision, which might involve the user's home AAA 533 server, an authorization token is generated by the AE (e.g., the SIP 534 proxy and an entity trusted by the SIP proxy) and returned to the end 535 host for inclusion into the QoS signaling protocol. The 536 authorization token will be used by a NE that receives the QoS 537 signaling message to authorize the QoS request. Alternatively, the 538 Diameter QoS application will be used to forward the authorization 539 token to the user's home network. The authorization token allows 540 that the authorization decision performed at the application layer 541 can be associated with a corresponding QoS signaling session. Note 542 that the authorization token might either refer to established state 543 concerning the authorization decision or the token might itself carry 544 the authorized parameters (protected by a digital signature or a 545 keyed message digest to prevent tampering). In the latter case the 546 authorization token may contain several pieces of information 547 pertaining to the authorized application session, but at minimum it 548 should contain: 549 o An identifier for the AE (for example, an AppS) that issued the 550 authorization token 551 o An identifier referring to a specific application protocol session 552 for which the token was issued and 553 o A keyed message digest or digital signature protecting the content 554 of the authorization token 556 A possible structure for the authorization token and the policy 557 element carrying it are proposed in context of RSVP [RFC3520]. 559 In the scenario mentioned above, where the QoS resource requesting 560 entity is involved in an application layer protocol interaction with 561 the AE, it may be worthwhile to consider a token-less binding 562 mechanism also. The application layer protocol interaction may have 563 indicated the transport port numbers at the QoS RRE where it might 564 receive media streams (for example in SIP/SDP [RFC4566] signalling, 565 these port numbers are advertised). The QoS RRE may also use these 566 port numbers in some IP filter indications to the NE performing QoS 567 reservation so that it may properly tunnel the inbound packets. The 568 NE performing QoS reservation will forward the QoS resource 569 requesting entity's IP address and the IP filter indications to the 570 AE in the QoS authorization request. The AE will use the QoS RRE's 571 IP address and the port numbers in the IP filter indication, which 572 will match the port numbers advertised in the earlier application 573 layer protocol interaction, to identify the right piece of policy 574 information to be sent to the NE performing the QoS reservation in 575 the QoS Authorization. response. 577 3.3.2. Push Mode Schemes 579 The push mode can be further divided into two types: endpoint- 580 initiated and network-initiated. In the former case, the 581 authorization process is triggered by AppS in response to an explicit 582 QoS request from an endpoint through application signaling, e.g., 583 SIP; in the latter case, the authorization process is triggered by 584 the AppS without an explicit QoS request from an endpoint. 586 In the endpoint-initiated scheme, the QoS RRE (i.e., the AppE) 587 determines the required application level QoS and sends a QoS request 588 through an application signaling message. The AppS will extract 589 application-level QoS information and trigger the authorization 590 process to the AE. In the network-initiated scheme, the AE and/or 591 AppS should derive and determine the QoS requirements according to 592 application attribute, subscription and endpoint's capability when 593 the endpoint does not explicitly indicate the QoS attributes. The AE 594 makes an authorization decision based on application level QoS 595 information, network policies, end-user subscription, network 596 resource availability, etc., and installs the decision to NE 597 directly. 599 A Category 1 AppE requires network-initiated Push mode and a Category 600 2 AppE may use either type of Push Mode. 602 financial settlement 603 ...........................+ 604 Application V ------- . 605 signaling msg +--------------+ / QoS AAA \ . 606 +-------------->| | / protocol \ . 607 | | Authorizing +--------------+ \ . 608 | | Entity | | | | . 609 | + |<--+----+ | | . 610 | +--------------+ |QoS | |QoS |. 611 | install| |install 612 | |rsp. | |req. |. 613 | | | | |. 614 | | | | . | . 615 | \ | | . / . 616 | \ | | / . 617 V |-----V . . 618 +-------------+ +--------+-----+ . 619 | Entity | | NE | . 620 | requesting | | performing | . 621 | resource |QoS rsrc granted | QoS | <....+ 622 | |<-----------------| reservation | 623 +-------------+ +--------------+ 625 Figure 5: Scheme for Push Mode 627 3.4. QoS Application Requirements 629 A QoS application must meet a number of requirements applicable to a 630 diverse set of networking environments and services. It should be 631 compatible with different deployment scenarios having specific QoS 632 signaling models and security issues. Satisfying the requirements 633 listed below while interworking with QoS signaling protocols, a 634 Diameter QoS application should accommodate the capabilities of the 635 QoS signaling protocols rather than introducing functional 636 requirements on them. A list of requirements for a QoS authorization 637 application is provided here: 639 Identity-based Routing 640 The Diameter QoS application MUST route AAA requests to the 641 Authorizing Entity, based on the provided identity of the QoS 642 requesting entity or the identity of the AE encoded in the 643 provided authorization token. 645 Flexible Authentication Support 646 The Diameter QoS application MUST support a variety of different 647 authentication protocols for verification of authentication 648 information present in QoS signaling messages. The support for 649 these protocols MAY be provided indirectly by tying the signaling 650 communication for QoS to a previous authentication protocol 651 exchange (e.g., using network access authentication). 653 Making an Authorization Decision 654 The Diameter QoS application MUST exchange sufficient information 655 between the AE and the enforcing entity (and vice versa) to 656 compute an authorization decision and to execute this decision. 658 Triggering an Authorization Process 659 The Diameter QoS application MUST allow periodic and event 660 triggered execution of the authorization process, originated at 661 the enforcing entity or even at the AE. 663 Associating QoS Reservations and Application State 664 The Diameter QoS application MUST carry information sufficient for 665 an AppS to identify the appropriate application session and 666 associate it with a particular QoS reservation. 668 Dynamic Authorization 669 It MUST be possible for the Diameter QoS application to push 670 updates towards the NE(s) from authorizing entities. 672 Bearer Gating 673 The Diameter QoS application MUST allow the AE to gate (i.e., 674 enable/disable) authorized application flows based on, e.g., 675 application state transitions. 677 Accounting Records 678 The Diameter QoS application MAY define QoS accounting records 679 containing duration, volume (byte count) usage information and 680 description of the QoS attributes (e.g., bandwidth, delay, loss 681 rate) that were supported for the flow. 683 Sending Accounting Records 684 The NE SHOULD be able to send accounting records for a particular 685 QoS reservation state to an accounting entity. 687 Failure Notification 688 The Diameter QoS application MUST allow the NE to report failures, 689 such as loss of connectivity due to movement of a mobile node or 690 other reasons for packet loss, to the authorizing entity. 692 Accounting Correlation 693 The Diameter QoS application MAY support the exchange of 694 sufficient information to allow for correlation between accounting 695 records generated by the NEs and accounting records generated by 696 an AppS. 698 Interaction with other AAA Applications 699 Interaction with other AAA applications, such as the Diameter 700 Network Access (NASREQ) application [RFC4005], may be required for 701 exchange of authorization, authentication and accounting 702 information. 704 In deployment scenarios where authentication of the QoS reservation 705 requesting entity (e.g., the user) is done by means outside the 706 Diameter QoS application protocol interaction, the AE is contacted 707 only with a request for QoS authorization. Authentication might have 708 taken place already via the interaction with the Diameter NASREQ 709 application or as part of the QoS signaling protocol (e.g., Transport 710 Layer Security (TLS) [RFC5246] in the General Internet Signaling 711 Transport (GIST) protocol [I-D.ietf-nsis-ntlp]). 713 Authentication of the QoS reservation requesting entity to the AE is 714 necessary if a particular Diameter QoS application protocol cannot be 715 related (or if there is no intention to relate it) to a prior 716 authentication. In this case the AE MUST authenticate the QoS 717 reservation requesting entity in order to authorize the QoS request 718 as part of the Diameter QoS protocol interaction. 720 The document refers to three types of sessions that need to be 721 properly correlated. 723 QoS Signaling Session 724 The time period during which a QoS signaling protocol establishes, 725 maintains and deletes a QoS reservation state at the QoS network 726 element is referred to as QoS signaling session. Different QoS 727 signaling protocols use different ways to identify QoS signaling 728 sessions. The same applies to different usage environments. 729 Currently, this document supports three types of QoS session 730 identifiers, namely a signaling session id (e.g., the Session 731 Identifier used by the NSIS protocol suite), a flow id (e.g., 732 identifier assigned by an application to a certain flow as used in 733 the 3GPP) and a flow description based on the IP parameters of the 734 flow's end points. 736 Diameter Authorization Session 737 The time period, for which a Diameter server authorizes a 738 requested service (i.e., QoS resource reservation) is referred to 739 as a Diameter authorization session. It is identified by a 740 Session-Id included in all Diameter messages used for management 741 of the authorized service (initial authorization, re- 742 authorization, termination), see [RFC3588]. 744 Application-layer Session 745 The application layer session identifies the duration of an 746 application layer service which requires provision of certain QoS. 747 An application layer session identifier is provided by the QoS 748 requesting entity in the QoS signaling messages, for example as 749 part of the authorization token. In general, the application 750 session identifier is opaque to the QoS aware NEs. It is included 751 in the authorization request message sent to the AE and helps it 752 to correlate the QoS authorization request to the application 753 session state information. 755 Correlating these sessions is done at each of the three involved 756 entities: The QoS requesting entity correlates the application with 757 the QoS signaling sessions. The QoS NE correlates the QoS signaling 758 session with the Diameter authorization sessions. The AE SHOULD bind 759 the information about the three sessions together. Note that in 760 certain scenarios not all of the sessions are present. For example, 761 the application session might not be visible to QoS signaling 762 protocol directly if there is no binding between the application 763 session and the QoS requesting entity using the QoS signaling 764 protocol. 766 4. QoS Application Session Establishment and Management 768 4.1. Parties Involved 770 Authorization models supported by this application include three 771 parties: 772 o Resource Requesting Entity 773 o Network Elements (Diameter QoS application (DQA) client) 774 o Authorizing Entity (Diameter QoS application (DQA) server) 776 Note that the QoS RRE is only indirectly involved in the message 777 exchange. This entity provides the trigger to initiate the Diameter 778 QoS protocol interaction by transmitting QoS signaling messages. The 779 Diameter QoS application is only executed between the Network Element 780 (i.e., DQA client) and the Authorizing Entity (i.e., DQA server). 782 The QoS RRE may communicate with the AE using application layer 783 signaling for negotiation of service parameters. As part of this 784 application layer protocol interaction, for example using SIP, 785 authentication and authorization might take place. This message 786 exchange is, however, outside the scope of this document. The 787 protocol communication between the QoS resource requesting entity and 788 the QoS NE might be accomplished using the NSIS protocol suite, RSVP 789 or a link layer signaling protocol. A description of these protocols 790 is also outside the scope of this document. 792 4.2. Session Establishment 794 The Pull and Push modes use a different set of command codes for 795 session establishment. For other operations, such as session 796 modification and termination, they use the same set of command codes. 798 The selection of Pull mode or Push mode operation is based on the 799 trigger of the QoS Authorization session. When a QoS-Authorization- 800 Request (QAR, see Section 5.1) message with a new session ID is 801 received, the AE operates in the Pull mode; when other triggers are 802 received, the AE operates in the Push mode. Similarly, when a QoS- 803 Install-Request (QIR, see Section 5.3} with a new session ID is 804 received, the NE operates in the Push mode; when other triggers are 805 received, the NE operation in the Pull mode. 807 The QoS authorization session is typically established per subscriber 808 base (i.e., all requests with the same user ID), but it is also 809 possible to be established on per node or per request base. The 810 concurrent sessions between an NE and an AE are identified by 811 different Session-ID. 813 4.2.1. Session Establishment for Pull Mode 815 A request for a QoS reservation or local events received by a NE can 816 trigger the initiation of a Diameter QoS authorization session. The 817 NE converts the required objects from the QoS signaling message to 818 Diameter AVPs and generates a QAR message. 820 Figure 6 shows the protocol interaction between a Resource Requesting 821 Entity, a Network Element and the Authorizing Entity. 823 The AE's identity, information about the application session and/or 824 identity and credentials of the QoS RRE, requested QoS parameters, 825 signaling session identifier and/or QoS enabled data flows 826 identifiers MAY be encapsulated into respective Diameter AVPs and 827 included in the Diameter message sent to the AE. The QAR is sent to 828 a Diameter server that can either be the home server of the QoS 829 requesting entity or an AppS. 831 +------------------------------------------+------------------------+ 832 | QoS-specific Input Data | Diameter AVPs | 833 +------------------------------------------+------------------------+ 834 | Authorizing entity ID (e.g., | Destination-Host | 835 | Destination-Host taken from | Destination-Realm | 836 | authorization token, Destination-Realm | | 837 | or derived from the NAI of the QoS | | 838 | requesting entity) | | 839 | | | 840 | Authorization Token Credentials of the | QoS-Authorization-Data | 841 | QoS requesting entity | User-Name | 842 | | | 843 | QoS-Resources (including QoS parameters) | | 844 +------------------------------------------+------------------------+ 846 Table 1: Mapping Input Data to QoS AVPs--Pull Mode 848 Authorization processing starts at the Diameter QoS server when it 849 receives the QAR. Based on the information in the QoS- 850 Authentication-Data, User-Name and QoS-Resources AVPs the server 851 determines the authorized QoS resources and flow state (enabled/ 852 disabled) from locally available information (e.g., policy 853 information that may be previously established as part of an 854 application layer signaling exchange, or the user's subscription 855 profile). The QoS-Resources AVP is defined in 856 [I-D.ietf-dime-qos-attributes]. The authorization decision is then 857 reflected in the response returned to the Diameter client with the 858 QoS-Authorization-Answer message (QAA). 860 Authorizing 861 End-Host Network Element Entity 862 requesting QoS ( Diameter ( Diameter 863 QoS Client) QoS Server) 864 | | | 865 +---QoS-Reserve---->| | 866 | +- - - - - QAR - - - - - >| 867 | |(QoS-Resources, | 868 | | QoS-Auth-Data,User-ID)| 869 | | +--------+--------------+ 870 | | | Authorize request | 871 | | | Keep session data | 872 | | |/Authz-time,Session-Id/| 873 | | +--------+--------------+ 874 | |< - - - - QAA - - - - - -+ 875 | |(Result-Code, | 876 | |QoS-Resources,Authz-time)| 877 | +-------+---------+ 878 | |Install QoS state| 879 | | + | 880 | | Authz. session | 881 | | /Authz-time/ | QoS Responder 882 | | | Node 883 | +-------+---------+ | 884 | +----------QoS-Reserve---....--->| 885 | | | 886 | |<---------QoS-Response--....----| 887 |<--QoS-Response----+ | 888 | | | 889 |=====================Data Flow==============....===>| 891 Figure 6: Initial QoS Request Authorization for Pull Mode 893 The Authorizing Entity keeps authorization session state and SHOULD 894 save additional information for management of the session (e.g., 895 Signaling-Session-Id, authentication data) as part of the session 896 state information. 898 The final result of the authorization request is provided in the 899 Result-Code AVP of the QAA message sent by the Authorizing Entity. 900 In case of successful authorization (i.e., Result-Code = 901 DIAMETER_LIMITED_SUCCESS, (see Section 7.1)), information about the 902 authorized QoS resources and the status of the authorized flow 903 (enabled/disabled) is provided in the QoS-Resources AVP of the QAA 904 message. The QoS information provided via the QAA is installed by 905 the QoS Traffic Control function of the NE. The value 906 DIAMETER_LIMITED_SUCCESS indicates that the AE expects confirmation 907 via another QAR message for successful QoS resource reservation and 908 for final reserved QoS resources (see below). 910 One important piece of information returned from the Authorizing 911 Entity is the authorization lifetime (carried inside the QAA). The 912 authorization lifetime allows the NE to determine how long the 913 authorization decision is valid for this particular QoS reservation. 914 A number of factors may influence the authorized session duration, 915 such as the user's subscription plan or currently available credits 916 at the user's account (see Section 8). The authorization duration is 917 time-based, as specified in [RFC3588]. For an extension of the 918 authorization period, a new QoS-Authorization-Request/Answer message 919 exchange SHOULD be initiated. Further aspects of QoS authorization 920 session maintenance is discussed in Section 4.3, Section 4.4 and 921 Section 8. 923 The indication of a successful QoS reservation and activation of the 924 data flow is provided by the transmission of a QAR message, which 925 reports the parameters of the established QoS state: reserved 926 resources, duration of the reservation, and identification of the QoS 927 enabled flow/QoS signaling session. The Diameter QoS server 928 acknowledges the reserved QoS resources with the QA Answer (QAA) 929 message where the Result-Code is set to 'DIAMETER_SUCCESS'. Note 930 that the reserved QoS resources reported in this QAR message MAY be 931 different than those authorized with the initial QAA message, due to 932 the QoS signaling specific behavior (e.g., receiver-initiated 933 reservations with One-Path-With-Advertisements) or specific process 934 of QoS negotiation along the data path. 936 4.2.2. Session Establishment for Push Mode 938 The Diameter QoS server in the AE initiates a Diameter QoS 939 authorization session upon the request for QoS reservation triggered 940 by application layer signaling or by local events, and generates a 941 QoS-Install-Request (QIR) message to Diameter QoS client in the NE in 942 which it maps required objects to Diameter payload objects. 944 Figure 7 shows the protocol interaction between the AE, a Network 945 Element and a RRE. 947 The NE's identity, information about the application session and/or 948 identity and credentials of the QoS resource requesting entity, 949 requested QoS parameters, signaling session identifier and/or QoS 950 enabled data flows identifiers MAY be encapsulated into respective 951 Diameter AVPs and included into the Diameter message sent from a 952 Diameter QoS server in the Authorizing Entity to a Diameter QoS 953 client in the NE. This requires that the AE has knowledge of 954 specific information for allocating and identifying the NE that 955 should be contacted and the data flow for which the QoS reservation 956 should be established. This information can be statically configured 957 or dynamically discovered, see Section 4.2.3 for details. 959 +-----------------------------------------+-------------------------+ 960 | QoS-specific Input Data | Diameter AVPs | 961 +-----------------------------------------+-------------------------+ 962 | Network Element ID | Destination-Host | 963 | | Destination-Realm | 964 | | | 965 | Authorization Token Credentials of the | QoS-Authorization-Data | 966 | QoS requesting entity | User-Name | 967 | | | 968 | QoS-Resources (including QoS | | 969 | parameters) | | 970 +-----------------------------------------+-------------------------+ 972 Table 2: Mapping Input Data to QoS AVPs--Push Mode 974 Authorization processing starts at the Diameter QoS server when it 975 receives a request from a RRE through an AppS (e.g., SIP Invite) or 976 is triggered by a local event (e.g., pre-configured timer). Based on 977 the received information the server determines the authorized QoS 978 resources and flow state (enabled/disabled) from locally available 979 information (e.g., policy information that may be previously 980 established as part of an application layer signaling exchange, or 981 the user's subscription profile). The authorization decision is then 982 reflected in the QoS-Install-Request message (QIR) to the Diameter 983 QoS client. 985 Authorizing 986 End-Host Network Element Entity 987 requesting QoS ( Diameter ( Diameter 988 QoS Client) QoS Server) 989 | | | 990 | | |<-- Trigger -- 991 | | +--------+--------------+ 992 | | | Authorize request | 993 | | | Keep session data | 994 | | |/Authz-time,Session-Id/| 995 | | +--------+--------------+ 996 | | | 997 | |<-- - -- - QIR - - - - - -+ 998 | |(Initial Request,Decision | 999 | |(QoS-Resources,Authz-time)| 1000 | +-------+---------+ 1001 | |Install QoS state| 1002 | | + | 1003 | | Authz. session | 1004 | | /Authz-time/ | 1005 | | | 1006 | +-------+---------+ 1007 | + - - - - QIA - - - - - ->| 1008 | | (Result-Code, | 1009 | | QoS-Resources) | 1010 | | +--------+--------------+ 1011 | | | Report for successful | 1012 | | | QoS reservation | 1013 | | |Update of reserved QoS | 1014 | | | resources | 1015 | | +--------+--------------+ 1016 | | QoS Responder 1017 | | Node 1018 | | | 1019 |=====================Data Flow==============....===>| 1021 Figure 7: Initial QoS Request Authorization for Push Mode 1023 The AE keeps authorization session state and SHOULD save additional 1024 information for management of the session (e.g., 1025 Signaling-Session-Id, authentication data) as part of the session 1026 state information. 1028 The final result of the authorization decision is provided in the 1029 QoS-Resources AVP of the QIR message sent by the AE. The QoS 1030 information provided via the QIR is installed by the QoS Traffic 1031 Control function of the NE. 1033 One important piece of information from the AE is the authorization 1034 lifetime (carried inside the QIR). The authorization lifetime allows 1035 the NE to determine how long the authorization decision is valid for 1036 this particular QoS reservation. A number of factors may influence 1037 the authorized session duration, such as the user's subscription plan 1038 or currently available credits at the user's account (see Section 8). 1039 The authorization duration is time-based as specified in [RFC3588]. 1040 For an extension of the authorization period, a new QoS-Install- 1041 Request/Answer message or QoS-Authorization-Request/Answer message 1042 exchange SHOULD be initiated. Further aspects of QoS authorization 1043 session maintenance are discussed in Section 4.3, Section 4.4 and 1044 Section 8. 1046 The indication of QoS reservation and activation of the data flow can 1047 be provided by the QoS-Install-Answer message immediately. In the 1048 case of successful enforcement, the Result-Code (= DIAMETER_SUCCESS, 1049 (see Section 7.1)) information is provided in the QIA message. Note 1050 that the reserved QoS resources reported in the QIA message may be 1051 different than those initially authorized with the QIR message, due 1052 to the QoS signaling specific behavior (e.g., receiver-initiated 1053 reservations with One-Path-With-Advertisements) or specific process 1054 of QoS negotiation along the data path. In the case Multiple AEs 1055 control the same NE, the NE should make the selection on the 1056 authorization decision to be enforced based on the priority of the 1057 request. 1059 4.2.3. Discovery and Selection of Peer Diameter QoS Application Node 1061 The Diameter QoS application node may obtain information of its peer 1062 nodes (e.g., FQDN, IP address) through static configuration or 1063 dynamic discovery as described in Section 5.2 of [RFC3588]. In 1064 particular, the NE shall perform the relevant operation for Pull 1065 mode; the AE shall perform the relevant operations for Push mode. 1067 Upon receipt of a trigger to initiate a new Diameter QoS 1068 authorization session, the Diameter QoS application node selects and 1069 retrieves the location information of the peer node that is 1070 associated with the affected user based on some index information 1071 provided by the RRE. For instance, it can be the Authorization 1072 Entity's ID stored in the authorization token, the end-user's 1073 identity (e.g., NAI [RFC4282]) or a globally routable IP address. 1075 4.3. Session Re-authorization 1077 Client and server-side initiated re-authorizations are considered in 1078 the design of the Diameter QoS application. Whether the re- 1079 authorization events are transparent for the resource requesting 1080 entity or result in specific actions in the QoS signaling protocol is 1081 outside the scope of the Diameter QoS application. It is directly 1082 dependent on the capabilities of the QoS signaling protocol. 1084 There are a number of options for policy rules according to which the 1085 NE (AAA client) contacts the AE for re-authorization. These rules 1086 depend on the semantics and contents of the QAA message sent by the 1087 AE: 1089 a. The QAA message contains the authorized parameters of the flow 1090 and its QoS and sets their limits (presumably upper). With these 1091 parameters the AE specifies the services that the NE can provide 1092 and will be financially compensated for. Therefore, any change 1093 or request for change of the parameters of the flow and its QoS 1094 that do not conform to the authorized limits requires contacting 1095 the AE for authorization. 1096 b. The QAA message contains authorized parameters of the flow and 1097 its QoS. The rules that determine whether parameters' changes 1098 require re-authorization are agreed out of band, based on a 1099 Service Level Agreement (SLA) between the domains of the NE and 1100 the AE. 1101 c. The QAA message contains the authorized parameters of the flow 1102 and its QoS. Any change or request for change of these 1103 parameters requires contacting the AE for re-authorization. 1104 d. In addition to the authorized parameters of the flow and its QoS, 1105 the QAA message contains policy rules that determine the NEs 1106 actions in case of change or request for change in authorized 1107 parameters. 1109 Provided options are not exhaustive. Elaborating on any of the 1110 listed approaches is deployment /solution specific and is not 1111 considered in the current document. 1113 In addition, the AE may use a RAR (Re-Authorization-Request) to 1114 perform re-authorization with the authorized parameters directly when 1115 the re-authorization is triggered by service request or local events/ 1116 policy rules. 1118 4.3.1. Client-Side Initiated Re-Authorization 1120 The AE provides the duration of the authorization session as part of 1121 the QoS-Authorization-Answer message (QAA). At any time before 1122 expiration of this period, a new QoS-Authorization-Request message 1123 (QAR) MAY be sent to the AE. The transmission of the QAR MAY be 1124 triggered when the NE receives a QoS signaling message that requires 1125 modification of the authorized parameters of an ongoing QoS session, 1126 or authorization lifetime expires. 1128 Authorizing 1129 End-Host Network Element Entity 1130 requesting QoS ( Diameter ( Diameter 1131 QoS Client) QoS Server) 1132 | | | 1133 |=====================Data Flow==========================> 1134 | | | 1135 | +-------+----------+ | 1136 | |Authz-time/CC-Time| | 1137 | | expires | | 1138 | +-------+----------+ | 1139 | +- - - - - QAR - - - - - >| 1140 | |(QoS-Resources, | 1141 | | QoS-Authorization-Data,User-ID) | 1142 | +--------+--------------+ 1143 NOTE: | | Authorize request | 1144 Re-authorization | | Update session data | 1145 is transparent to | |/Authz-time,Session-Id/| 1146 the End-Host | +--------+--------------+ 1147 |< - - - - QAA - - - - - -+ 1148 | |(Result-Code, | 1149 | |QoS-Resources,Authz-time)| 1150 | +-------+---------+ | 1151 | |Update QoS state | | 1152 | | + | | 1153 | | Authz. session | | 1154 | | /Authz-time/ | | 1155 | | | | 1156 | +-------+---------+ | 1157 | | | 1158 |=====================Data Flow==========================> 1159 | | 1161 Figure 8: Client-side Initiated QoS Re-Authorization 1163 4.3.2. Server-Side Initiated Re-Authorization 1165 The AE MAY initiate a QoS re-authorization by issuing a Re-Auth- 1166 Request message (RAR) as defined in the Diameter base protocol 1167 [RFC3588], which may include the parameters of the re-authorized QoS 1168 state: reserved resources, duration of the reservation, 1169 identification of the QoS enabled flow/QoS signaling session for re- 1170 installation of the resource state by the QoS Traffic Control 1171 function of the NE. 1173 A NE that receives such a RAR message with Session-Id matching a 1174 currently active QoS session acknowledges the request by sending the 1175 Re-Auth-Answer (RAA) message towards the AE. 1177 If RAR does not include any parameters of the re-authorized QoS 1178 state, the NE MUST initiate a QoS re-authorization by sending a QoS- 1179 Authorization-Request (QAR) message towards the AE. 1181 Authorizing 1182 End-Host Network Element Entity 1183 requesting QoS ( Diameter ( Diameter 1184 QoS Client) QoS Server) 1185 | | | 1186 | | |<-- Trigger -- 1187 | | +--------+--------------+ 1188 | | | Authorize request | 1189 | | | Keep session data | 1190 | | |/Authz-time,Session-Id/| 1191 | | +--------+--------------+ 1192 | | | 1193 | |<-- - -- - RAR - - - - - -+ 1194 | |(Request,Decision | 1195 | |(QoS-Resources,Authz-time)| 1196 | +-------+---------+ 1197 | |Install QoS state| 1198 | | + | 1199 | | Authz. session | 1200 | | /Authz-time/ | 1201 | | | 1202 | +-------+---------+ 1203 | + - - - - RAA - - - - - ->| 1204 | | (Result-Code, | 1205 | | QoS-Resources) | 1206 | | +--------+--------------+ 1207 | | | Report for successful | 1208 | | | QoS reservation | 1209 | | |Update of reserved QoS | 1210 | | | resources | 1211 | | +--------+--------------+ 1212 | | | 1214 Figure 9: Server-side Initiated QoS Re-Authorization 1216 4.4. Session Termination 1218 4.4.1. Client-Side Initiated Session Termination 1220 The authorization session for an installed QoS reservation state MAY 1221 be terminated by the Diameter client by sending a Session- 1222 Termination-Request message (STR) to the Diameter server with a 1223 response Session-Termination-Acknowledgement message (STA). This is 1224 a Diameter base protocol function and it is defined in [RFC3588]. 1225 Session termination can be caused by a QoS signaling messaging 1226 requesting deletion of the existing QoS reservation state or it can 1227 be caused as a result of a soft-state expiration of the QoS 1228 reservation state. 1230 Authorizing 1231 End-Host Network Element Entity 1232 requesting QoS ( Diameter ( Diameter 1233 QoS Client) QoS Server) 1234 | | | 1235 |==Data Flow==>X /Stop of the data flow/ | 1236 | | | 1237 +---QoS-Reserve---->| | 1238 | (Delete QoS +- - - - - STR - - - - - >| 1239 | reservation) | +--------+--------------+ 1240 | | | Remove authorization | 1241 | | | session state | 1242 | | +--------+--------------+ 1243 | |< - - - - STA - - - - - -+ 1244 | +-------+--------+ | 1245 | |Delete QoS state| 1246 | +-------+--------+ QoS Responder 1247 | | Node 1248 | +----------QoS-Reserve-----....--->| 1249 | | (Delete QoS | 1250 | | reservation) | 1251 | |<---------QoS-Response----....----+ 1252 |<--QoS-Response----+ | 1254 Figure 10: Client-Side Initiated Session Termination 1256 4.4.2. Server-Side Initiated Session Termination 1258 At anytime during a session the AE MAY send an Abort-Session-Request 1259 message (ASR) to the NE. This is a Diameter base protocol function 1260 and it is defined in [RFC3588]. Possible reasons for initiating the 1261 ASR message to the NE are insufficient credits or session termination 1262 at the application layer. The ASR message results in termination of 1263 the authorized session, release of the reserved resources at the NE 1264 and transmission of an appropriate QoS signaling message indicating a 1265 notification to other Network Elements aware of the signaling 1266 session. 1268 Authorizing 1269 End-Host Network Element Entity 1270 requesting QoS ( Diameter ( Diameter 1271 QoS Client) QoS Server) 1272 | | | 1273 |=====================Data Flow==========================> 1274 | | 1275 | |< - - - - ASR - - - - - -+ 1276 | | | 1277 |====Data Flow=====>X | QoS Responder 1278 | | | Node 1279 |<--QoS-Notify------+----------QoS-Reserve-----....--->| 1280 | | (Delete QoS | | 1281 | reservation) | 1282 +-------+--------+ | 1283 |Delete QoS state| | 1284 +-------+--------+ | 1285 +- - - - - ASA - - - - - >| 1286 | +--------+--------------+ 1287 | | Remove authorization | 1288 | | session state | 1289 | +--------+--------------+ 1290 | QoS Responder 1291 | Node 1292 |<---------QoS-Response----....----+ 1293 | | 1295 Figure 11: Server-Side Initiated Session Termination 1297 5. QoS Application Messages 1299 The Diameter QoS application requires the definition of new mandatory 1300 AVPs and Command-codes (see Section 3 of [RFC3588]). Four new 1301 Diameter messages are defined along with Command-Codes whose values 1302 MUST be supported by all Diameter implementations that conform to 1303 this specification. 1305 +---------------------------+---------+--------+-------------+ 1306 | Command Name | Abbrev. | Code | Reference | 1307 +---------------------------+---------+--------+-------------+ 1308 | QoS-Authorization-Request | QAR | [TBD1] | Section 5.1 | 1309 | | | | | 1310 | QoS-Authorization-Answer | QAA | [TBD2] | Section 5.2 | 1311 | | | | | 1312 | QoS-Install-Request | QIR | [TBD3] | Section 5.3 | 1313 | | | | | 1314 | QoS-Install-Answer | QIA | [TBD4] | Section 5.4 | 1315 +---------------------------+---------+--------+-------------+ 1317 Table 3: Diameter QoS Commands 1319 In addition, the following Diameter Base protocol messages are used 1320 in the Diameter QoS application: 1322 +-----------------------+---------+------+-----------+ 1323 | Command-Name | Abbrev. | Code | Reference | 1324 +-----------------------+---------+------+-----------+ 1325 | Re-Auth-Request | RAR | 258 | [RFC3588] | 1326 | | | | | 1327 | Re-Auth-Answer | RAA | 258 | [RFC3588] | 1328 | | | | | 1329 | Abort-Session-Request | ASR | 274 | [RFC3588] | 1330 | | | | | 1331 | Abort-Session-Answer | ASA | 274 | [RFC3588] | 1332 | | | | | 1333 | Session-Term-Request | STR | 275 | [RFC3588] | 1334 | | | | | 1335 | Session-Term-Answer | STA | 275 | [RFC3588] | 1336 +-----------------------+---------+------+-----------+ 1338 Table 4: Diameter Base Commands 1340 Diameter nodes conforming to this specification MAY advertise support 1341 for the Diameter QoS application by including the value of [TBD5] in 1342 the Auth-Application-Id or the Acct-Application-Id AVP of the 1343 Capabilities-Exchange-Request and Capabilities-Exchange-Answer 1344 commands, see [RFC3588]. 1346 The value of {TBD5] MUST be used as the Application-Id in all QAR/QAA 1347 and QIR/QIA commands. 1349 The value of zero (0) SHOULD be used as the Application-Id in all 1350 STR/STA, ASR/ASA, and RAR/RAA commands. 1352 5.1. QoS-Authorization Request (QAR) 1354 The QoS-Authorization-Request message (QAR) indicated by the Command- 1355 Code field (see Section 3 of [RFC3588]) set to [TBD1] and 'R' bit set 1356 in the Command Flags field is used by NEs to request quality of 1357 service related resource authorization for a given flow. 1359 The QAR message MUST carry information for signaling session 1360 identification, AE identification, information about the requested 1361 QoS, and the identity of the QoS requesting entity. In addition, 1362 depending on the deployment scenario, an authorization token and 1363 credentials of the QoS requesting entity SHOULD be included. 1365 The message format is defined as follows: 1367 ::= < Diameter Header: [TBD1], REQ, PXY > 1368 < Session-Id > 1369 { Auth-Application-Id } 1370 { Origin-Host } 1371 { Origin-Realm } 1372 { Destination-Realm } 1373 { Auth-Request-Type } 1374 [ Destination-Host ] 1375 [ User-Name ] 1376 * [ QoS-Resources ] 1377 [ QoS-Authorization-Data ] 1378 [ Bound-Auth-Session-Id ] 1379 * [ AVP ] 1381 5.2. QoS-Authorization Answer (QAA) 1383 The QoS-Authorization-Answer message (QAA), indicated by the Command- 1384 Code field set to [TBD2] and 'R' bit cleared in the Command Flags 1385 field is sent in response to the QoS-Authorization-Request message 1386 (QAR). If the QoS authorization request is successfully authorized, 1387 the response will include the AVPs to allow authorization of the QoS 1388 resources and transport plane gating information. 1390 The message format is defined as follows: 1392 ::= < Diameter Header: [TBD2], PXY > 1393 < Session-Id > 1394 { Auth-Application-Id } 1395 { Auth-Request-Type } 1396 { Result-Code } 1397 { Origin-Host } 1398 { Origin-Realm } 1399 * [ QoS-Resources ] 1400 [ Acct-Multisession-Id ] 1401 [ Session-Timeout ] 1402 [ Authorization-Session-Lifetime ] 1403 [ Authorization-Grace-Period ] 1404 * [ AVP ] 1406 5.3. QoS-Install Request (QIR) 1408 The QoS-Install Request message (QIR), indicated by the Command-Code 1409 field set to [TBD3] and 'R' bit set in the Command Flags field is 1410 used by AE to install or update the QoS parameters and the flow state 1411 of an authorized flow at the transport plane element. 1413 The message MUST carry information for signaling session 1414 identification or identification of the flow to which the provided 1415 QoS rules apply, identity of the transport plane element, description 1416 of provided QoS parameters, flow state and duration of the provided 1417 authorization. 1419 The message format is defined as follows: 1421 ::= < Diameter Header: [TBD3], REQ, PXY > 1422 < Session-Id > 1423 { Auth-Application-Id } 1424 { Origin-Host } 1425 { Origin-Realm } 1426 { Destination-Realm } 1427 { Auth-Request-Type } 1428 [ Destination-Host ] 1429 * [ QoS-Resources ] 1430 [ Session-Timeout ] 1431 [ Authorization-Session-Lifetime ] 1432 [ Authorization-Grace-Period ] 1433 [ Authorization-Session-Volume ] 1434 * [ AVP ] 1436 5.4. QoS-Install Answer (QIA) 1438 The QoS-Install Answer message (QIA), indicated by the Command-Code 1439 field set to [TBD4] and 'R' bit cleared in the Command Flags field is 1440 sent in response to the QoS-Install Request message (QIR) for 1441 confirmation of the result of the installation of the provided QoS 1442 reservation instructions. 1444 The message format is defined as follows: 1446 ::= < Diameter Header: [TBD4], PXY > 1447 < Session-Id > 1448 { Auth-Application-Id } 1449 { Origin-Host } 1450 { Origin-Realm } 1451 { Result-Code } 1452 * [ QoS-Resources ] 1453 * [ AVP ] 1455 5.5. Re-Auth-Request (RAR) 1457 The Re-Auth-Request message (RAR), indicated by the Command-Code 1458 field set to 258 and the 'R' bit set in the Command Flags field, is 1459 sent by the AE to the NE in order to initiate the QoS re- 1460 authorization from DQA server side. 1462 If the RAR command is received by the NE without any parameters of 1463 the re-authorized QoS state, the NE MUST initiate a QoS re- 1464 authorization by sending a QoS-Authorization-Request (QAR) message 1465 towards the AE. 1467 The message format is defined as follows: 1469 ::= < Diameter Header: 258, REQ, PXY > 1470 < Session-Id > 1471 { Origin-Host } 1472 { Origin-Realm } 1473 { Destination-Realm } 1474 { Destination-Host } 1475 { Auth-Application-Id } 1476 { Re-Auth-Request-Type } 1477 [ User-Name ] 1478 [ Origin-State-Id ] 1479 * [ Proxy-Info ] 1480 * [ Route-Record ] 1481 * [ QoS-Resources ] 1482 [ Session-Timeout ] 1483 [ Authorization-Session-Lifetime ] 1484 [ Authorization-Grace-Period ] 1485 [ Authorization-Session-Volume ] 1486 * [ AVP ] 1488 5.6. Re-Auth-Answer (RAA) 1490 The Re-Auth-Answer message (RAA), indicated by the Command-Code field 1491 set to 258 and the 'R' bit cleared in the Command Flags field, is 1492 sent by the NE to the AE in response to the RAR command. 1494 The message format is defined as follows: 1496 ::= < Diameter Header: 258, PXY > 1497 < Session-Id > 1498 { Result-Code } 1499 { Origin-Host } 1500 { Origin-Realm } 1501 [ User-Name ] 1502 [ Origin-State-Id ] 1503 [ Error-Message ] 1504 [ Error-Reporting-Host ] 1505 * [ Failed-AVP ] 1506 * [ Redirect-Host ] 1507 [ Redirect-Host-Usage ] 1508 [ Redirect-Host-Cache-Time ] 1509 * [ Proxy-Info ] 1510 * [ QoS-Resources ] 1511 * [ AVP ] 1513 6. QoS Application State Machine 1515 The QoS application defines its own state machine that is based on 1516 the authorization state machine defined in Section 8.1 of the Base 1517 Protocol ([RFC3588]). The Qos state machine uses own messages as 1518 defined in Section 5 and QoS AVPs as defined in Section 7. 1520 6.1. Supplemented States for Push Mode 1522 Using the Base Protocol state machine as a basis, the following 1523 states are supplemented to first 2 state machines in which the 1524 session state is maintained on the Server. These MUST be supported 1525 in any QoS application implementations in support of server initiated 1526 push mode (see (Section 4.2.2)). 1528 The following states are supplemented to the state machine on the 1529 Server when state is maintained on the client as defined in Section 1530 8.1 of the Base Protocol [RFC3588]: 1532 SERVER, STATEFUL 1533 State Event Action New State 1534 ------------------------------------------------------------- 1535 Idle An application or local Send Pending 1536 event triggers an initial QIR initial 1537 QoS request to the server request 1539 Pending Received QIA with a failed Cleanup Idle 1540 Result-Code 1542 Pending Received QIA with Result-Code Update Open 1543 = SUCCESS session 1544 Pending Error in processing received Send Discon 1545 QIA with Result-Code = SUCCESS ASR 1547 The following states are supplemented to the state machine on the 1548 client when state is maintained on the server as defined in Section 1549 8.1 of the Base Protocol [RFC3588]: 1551 CLIENT, STATEFUL 1552 State Event Action New State 1553 ------------------------------------------------------------- 1554 Idle QIR initial request Send Open 1555 received and successfully QIA initial 1556 processed answer, 1557 reserve resources 1559 Idle QIR initial request Send Idle 1560 received but not QIA initial 1561 successfully processed answer with 1562 Result-Code 1563 != SUCCESS 1565 7. QoS Application AVPs 1567 Each of the AVPs identified in the QoS-Authorization-Request/Answer 1568 and QoS-Install-Request/Answer messages and the assignment of their 1569 value(s) is given in this section. 1571 7.1. Reused Base Protocol AVPs 1573 The QoS application uses a number of session management AVPs, defined 1574 in the Base Protocol ([RFC3588]). 1576 Attribute Name AVP Code Reference [RFC3588] 1577 Origin-Host 264 Section 6.3 1578 Origin-Realm 296 Section 6.4 1579 Destination-Host 293 Section 6.5 1580 Destination-Realm 283 Section 6.6 1581 Auth-Application-Id 258 Section 6.8 1582 Result-Code 268 Section 7.1 1583 Auth-Request-Type 274 Section 8.7 1584 Session-Id 263 Section 8.8 1585 Authorization-Lifetime 291 Section 8.9 1586 Authorization-Grace-Period 276 Section 8.10 1587 Session-Timeout 27 Section 8.13 1588 User-Name 1 Section 8.14 1590 The Auth-Application-Id AVP (AVP Code 258) is assigned by IANA to 1591 Diameter applications. The value of the Auth-Application-Id for the 1592 Diameter QoS application is TBD. 1594 7.2. QoS Application Defined AVPs 1596 This document reuses the AVPs defined in Section 4 of 1597 [I-D.ietf-dime-qos-attributes]. 1599 This section lists the AVPs that are introduced specifically for the 1600 QoS application. The following new AVPs are defined: Bound-Auth- 1601 Session-Id and the QoS-Authorization-Data AVP. 1603 The following table describes the Diameter AVPs newly defined in this 1604 document for usage with the QoS Application, their AVP code values, 1605 types, possible flag values, and whether the AVP may be encrypted. 1607 +-------------------+ 1608 | AVP Flag rules | 1609 +----------------------------------------------|----+--------+-----+ 1610 | AVP Section | | SHLD| MUST| 1611 | Attribute Name Code Defined Data Type |MUST| NOT| NOT| 1612 +----------------------------------------------+----+--------+-----+ 1613 |QoS-Authorization-Data TBD 7.2 OctetString| M | | V | 1614 |Bound-Auth-Session-Id TBD 7.2 UTF8String | M | | V | 1615 +----------------------------------------------+----+--------+-----+ 1616 |M - Mandatory bit. An AVP with "M" bit set and its value MUST be | 1617 | supported and recognized by a Diameter entity in order the | 1618 | message, which carries this AVP, to be accepted. | 1619 |V - Vendor specific bit that indicates whether the AVP belongs to | 1620 | a address space. | 1621 +------------------------------------------------------------------+ 1623 QoS-Authorization-Data 1624 The QoS-Authorization-Data AVP (AVP Code TBD) is of type 1625 OctetString. It is a container that carries application session 1626 or user specific data that has to be supplied to the AE as input 1627 to the computation of the authorization decision. 1629 Bound-Authentication-Session-Id 1630 The Bound-Authentication-Session AVP (AVP Code TBD) is of type 1631 UTF8String. It carries the id of the Diameter authentication 1632 session that is used for the network access authentication (NASREQ 1633 authentication session). It is used to tie the QoS authorization 1634 request to a prior authentication of the end host done by a co- 1635 located application for network access authentication (Diameter 1636 NASREQ) at the QoS NE. 1638 8. Accounting 1640 A NE MAY start an accounting session by sending an Accounting-Request 1641 message (ACR) after successful QoS reservation and activation of the 1642 data flow (see Figure 6 and Figure 7). After every successful re- 1643 authorization procedure (see Figure 8 and Figure 9), the NE MAY 1644 initiate an interim accounting message exchange. After successful 1645 session termination (see Figure 10 and Figure 11), the NE may 1646 initiate a final exchange of accounting messages for terminating of 1647 the accounting session and reporting final records for the usage of 1648 the QoS resources reserved. It should be noted that the two sessions 1649 (authorization and accounting) have independent management by the 1650 Diameter base protocol, which allows for finalizing the accounting 1651 session after the end of the authorization session. 1653 The detailed QoS accounting procedures are out of scope in this 1654 document. 1656 9. Examples 1658 9.1. Example Call Flow for Pull Mode (Success Case) 1660 This section presents an example of the interaction between the end 1661 host and Diameter QoS application entities using Pull mode. The 1662 application layer signaling is, in this example, provided using SIP. 1663 Signaling for a QoS resource reservation is done using the QoS NSLP. 1664 The authorization of the QoS reservation request is done by the 1665 Diameter QoS application (DQA). 1667 End-Host SIP Proxy Correspondent 1668 requesting QoS (DQA Server) Node 1670 | | | 1671 ..|....Application layer SIP signaling.......|..............|.. 1672 . | Invite (SDP) | | . 1673 . +.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-> | . 1674 . | 100 Trying | | . 1675 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ Invite (SDP)| . 1676 . | +-.-.-.....-.-.> . 1677 . | | 180 SDP' | . 1678 . | <-.-.-.....-.-.+ . 1679 . | +--------+--------+ | . 1680 . | |Authorize session| | . 1681 . | | parameters | | . 1682 . | 180 (Session parameters) +--------+--------+ | . 1683 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ | . 1684 ..|..........................................|... ..........|.. 1685 | | | 1686 | +------------+ | | 1687 | | NE | | | 1688 | |(DQA Client)| | | 1689 | +------+-----+ | | 1690 | | | | 1691 |QoS NSLP Reserve | | | 1692 +------------------> QAR | | 1693 | (POLICY_DATA>v +- - - - -<>- - - -> | 1694 | QSPEC) v >===>(Destination-Host, | | 1695 | v >=======>QoS-Authorization-Data++------------+ | 1696 | >===========>QoS-Resources) |Authorize | | 1697 | | |QoS resources| | 1698 | | ++------------+ | 1699 | | QAA | | 1700 | <- - - - -<>- - - -+ | 1701 | |(Result-Code, | | 1702 | |QoS-Resources, | | 1703 | |Authorization-Lifetime)| | 1704 | +---------+--------+ | | 1705 | |Install QoS state1| | | 1706 | |+ Authz. session | | | 1707 | +---------+--------+ | | 1708 | |QoS NSLP Reserve | 1709 | +---------------..............---------> 1710 | | | 1711 | | QoS NSLP Response| 1712 |QoS NSLP Response <---------------..............---------+ 1713 <------------------+ | 1714 | | QoS NSLP Query| 1715 |QoS NSLP Query <---------------..............---------+ 1716 <------------------+ | 1717 |QoS NSLP Reserve | | 1718 +------------------> QAR | | 1719 | +- - - - -<>- - - -> | 1720 | | +---+---------+ | 1721 | | |Authorize | | 1722 | | |QoS resources| | 1723 | | QAA +---+---------+ | 1724 | <- - - - -<>- - - -+ | 1725 | +---------+--------+ | | 1726 | |Install QoS state2| | 1727 | |+ Authz. session | | 1728 | +---------+--------+ | 1729 | | QoS NSLP Reserve | 1730 | +---------------..............---------> 1731 | | QoS NSLP Response| 1732 |QoS NSLP Response <---------------..............---------+ 1733 <------------------+ | 1734 | | | 1735 /------------------+--Data Flow---------------------------\ 1736 \------------------+--------------------------------------/ 1737 | | | 1739 .-.-.-.-. SIP signaling 1740 --------- QoS NSLP signaling 1741 - - - - - Diameter QoS Application messages 1742 ========= Mapping of objects between QoS and AAA protocol 1744 Figure 12: QoS Authorization Example - Pull Mode 1746 The communication starts with SIP signaling between the two end 1747 points and the SIP proxy for negotiation and authorization of the 1748 requested service and its parameters (see Figure 12). As a part of 1749 the process, the SIP proxy verifies whether the user at Host A is 1750 authorized to use the requested service (and potentially the ability 1751 to be charged for the service usage). Negotiated session parameters 1752 are provided to the end host. 1754 Subsequently, Host A initiates a QoS signaling message towards Host 1755 B. It sends a QoS NSLP Reserve message, in which it includes 1756 description of the required QoS (QSPEC object) and authorization data 1757 for negotiated service session (part of the POLICY_DATA object). 1758 Authorization data includes, as a minimum, the identity of the AE 1759 (e.g., the SIP proxy) and an identifier of the application service 1760 session for which QoS resources are requested. 1762 A QoS NSLP Reserve message is intercepted and processed by the first 1763 QoS aware Network Element. The NE uses the Diameter QoS application 1764 to request authorization for the received QoS reservation request. 1765 The identity of the AE (in this case the SIP server that is co- 1766 located with a Diameter server) is put into the Destination-Host AVP, 1767 any additional session authorization data is encapsulated into the 1768 QoS-Authorization-Data AVP and the description of the QoS resources 1769 is included into QoS-Resources AVP. These AVPs are included into a 1770 QoS Authorization Request message, which is sent to the AE. 1772 A QAR message will be routed through the AAA network to the AE. The 1773 AE verifies the requested QoS against the QoS resources negotiated 1774 for the service session and replies with QoS-Authorization answer 1775 (QAA) message. It carries the authorization result (Result-Code AVP) 1776 and the description of the authorized QoS parameters (QoS-Resources 1777 AVP), as well as duration of the authorization session 1778 (Authorization-Lifetime AVP). 1780 The NE interacts with the traffic control function and installs the 1781 authorized QoS resources and forwards the QoS NSLP Reserve message 1782 further along the data path. Moreover, the NE may serve as a 1783 signaling proxy and process the QoS signaling (e.g., initiation or 1784 termination of QoS signaling) based on the QoS decision received from 1785 the authorizing entity. 1787 9.2. Example Call Flow for Pull Mode (Failure Case) 1789 This section illustrates the example shown Section 9.2 that fails due 1790 to an authorization failure. Failures can occur in various steps 1791 throughout the protocol execution and in this example we assume that 1792 the Diameter QAR request processed by the Diameter server leads to an 1793 unsuccessful result. The QAA message reponds, in this example, with 1794 a permanent error "DIAMETER_AUTHORIZATION_REJECTED" (5003)set in the 1795 Result-Code AVP. When the NE receives this response it discontinues 1796 the QoS reservation signaling downstream and provides an error 1797 message back to the end host that initiated the QoS signaling 1798 request. The QoS NSLP RESPONSE signaling message would in this case 1799 carry a INFO_SPEC object indicating the permanent failure as 1800 "Authorization failure" (0x02). 1802 End-Host SIP Proxy Correspondent 1803 requesting QoS (DQA Server) Node 1805 | | | 1806 ..|...................SIP Signaling..........|..............|.. 1807 . | Invite (SDP) | | . 1808 . +.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-> | . 1809 . | 100 Trying | | . 1810 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ Invite (SDP)| . 1811 . | +-.-.-.....-.-.> . 1812 . | | 180 SDP' | . 1813 . | <-.-.-.....-.-.+ . 1814 . | +--------+--------+ | . 1815 . | |Authorize session| | . 1816 . | | parameters | | . 1817 . | 180 (Session parameters) +--------+--------+ | . 1818 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-+ | . 1819 ..|..........................................|... ..........|.. 1820 | | | 1821 | +------------+ | | 1822 | | NE | | | 1823 | |(DQA Client)| | | 1824 | +------+-----+ | | 1825 | | | | 1826 |QoS NSLP Reserve | | | 1827 +------------------> QAR | | 1828 | (POLICY_DATA>v +- - - - -<>- - - -> | 1829 | QSPEC) v >===>(Destination-Host, | | 1830 | v >=======>QoS-Authorization-Data++------------+ | 1831 | >===========>QoS-Resources) |Authorize | | 1832 | | |QoS resources| | 1833 | | ++------------+ | 1834 | | QAA | | 1835 | <- - - - -<>- - - -+ | 1836 | |(Result-Code = 5003) | | 1837 | | | | 1838 |QoS NSLP Response | | | 1839 |(with error 0x02) | | | 1840 <------------------+ | | 1841 | | | | 1842 | | | | 1844 .-.-.-.-. SIP signaling 1845 --------- QoS NSLP signaling 1846 - - - - - Diameter QoS Application messages 1847 ========= Mapping of objects between QoS and AAA protocol 1849 Figure 13: QoS Authorization Example - Pull Mode (Failure Case) 1851 9.3. Example Call Flow for Push Mode 1853 This section presents an example of the interaction between the end 1854 host and Diameter QoS application entities using Push mode. The 1855 application layer signaling is, in this example, provided using SIP. 1856 Signaling for a QoS resource reservation is done using the QoS NSLP. 1857 The authorization of the QoS reservation request is done by the 1858 Diameter QoS application (DQA). 1860 End-Host NE SIP Proxy Correspondent 1861 requesting QoS (DQA Client) (DQA Server) Node 1863 | | | | 1864 ..|..................|...SIP Signaling..........|..............|.. 1865 . | Invite(SDP Offer)| | | . 1866 . +.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.+-.-.-.-.-.-.->| . 1867 . | | | 180 | . 1868 . |<-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.+-.-.-.-.-.-.-.| . 1869 ..|.............................................|..............|.. 1870 | | +---------+-------------+| 1871 | | | Authorize Request || 1872 | | | Keep Session Data || 1873 | | |/Authz-time,Session-Id/|| 1874 | | +---------+-------------+| 1875 | | | | 1876 | |<-- - -- - QIR - -- - -- -+ | 1877 | |(Initial Request,Decision | | 1878 | |(QoS-Resources,Authz-time)| | 1879 | +-------+---------+ | | 1880 | |Install QoS State| | | 1881 | | + | | | 1882 | | Authz. Session | | | 1883 | | /Authz-time/ | | | 1884 | +-------+---------+ | | 1885 | + - - -- - QIA - - - - - ->| | 1886 | | (Result-Code, | | 1887 | | QoS-Resources) | | 1888 | | +----------+------------+ | 1889 | | | Successful | | 1890 | | | QoS Reservation | | 1891 | | +----------+------------+ | 1892 ..|.............................................|..............|.. 1893 . | | | | . 1894 . | | | 200 OK (SDP)| . 1895 . | | <-.-.-.....-.-.+ . 1896 . | | +--------+-----------+ | . 1898 . | | | Activate Session | | . 1899 . | | | Parameters | | . 1900 . | | +--------+-----------+ | . 1901 . | 200 (SDP) | | | . 1902 . <.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.+ | . 1903 ..|.............................................|..............|.. 1904 | <- - - - - - RAR - - - - - + | 1905 | +---------+--------+ | | 1906 | |Activate QoS State| | | 1907 | +---------+--------+ | | 1908 | +- - - - - - RAA - - - - - > | 1909 | | | 1910 /------------------+-----Data Flow---------------------------\ 1911 \------------------+-----------------------------------------/ 1912 | | | 1914 .-.-.-.-. SIP signaling 1915 - - - - - Diameter QoS Application messages 1917 Figure 14: QoS Authorization Example - Push Mode 1919 The communication starts with SIP signaling between the two end 1920 points and the SIP proxy for negotiation and authorization of the 1921 requested service and its parameters (see Figure 14). As a part of 1922 the process, the SIP proxy verifies whether the user at Host A is 1923 authorized to use the requested service (and potentially the ability 1924 to be charged for the service usage). 1926 A few implementation choices exist regarding the decision about when 1927 to initiate the QoS reservation. 1928 [I-D.ietf-mmusic-media-path-middleboxes] discusses this aspect with a 1929 focus on firewalling. In the example above the DQA server is 1930 triggered to authorize the QoS request based on session parameters 1931 from the SDP payload. It will use a QIR message to do so. For this 1932 example message flow we assume a two-stage commit, i.e. the SIP proxy 1933 interacts with the NE twice. First, it only prepares the QoS 1934 reservation and then with the arrival of the 200 OK the QoS 1935 reservation is activated. 1937 This example does not describe how the DQA server learns which DQA 1938 client to contact. We assume pre-configuration in this example. In 1939 any case, the address of DQA client is put into the Destination-Host 1940 AVP, the description of the QoS resources is included into QoS- 1941 Resources AVP, and the duration of the authorization session is 1942 carried in the Authorization-Lifetime AVP. 1944 When the DQA client receives the QIR it interacts with the traffic 1945 control function and reserves the authorized QoS resources 1946 accordingly. At this point in time the QoS reservation is not yet 1947 activated. 1949 When a 200 OK is returned the DQA server may verify the accepted QoS 1950 against the pre-authorized QoS resources, and sends a Diameter RAR 1951 message to the DQA client in the NE for activating the installed 1952 policies and commit the resource allocation. 1954 10. IANA Considerations 1956 This section contains the namespaces that have either been created in 1957 this specification or had their values assigned to existing 1958 namespaces managed by IANA. 1960 10.1. AVP Codes 1962 IANA is requested to allocate two AVP codes to the registry defined 1963 in [RFC3588]: 1965 Registry: 1966 AVP Code AVP Name Reference 1967 ----------------------------------------------------------- 1968 to be assigned QoS-Authorization-Data Section 7.2 1969 to be assigned Bound-Auth-Session-Id Section 7.2 1971 10.2. Application IDs 1973 IANA is requested to allocate the following application ID from the 1974 registry defined in [RFC3588] (using the next available value from 1975 the 7-16777215 range). 1977 Registry: 1978 ID values Name Reference 1979 ----------------------------------------------------------- 1980 to be assigned Diameter QoS application Section 5 1982 10.3. Command Codes 1984 IANA is requested to allocate command code values from the registry 1985 defined in [RFC3588]. 1987 Registry: 1988 Code Value Name Reference 1989 ----------------------------------------------------------- 1990 TBD QoS-Authorization-Request (QAR) Section 5.1 1991 TBD QoS-Authorization-Answer (QAA) Section 5.2 1992 TBD QoS-Install-Request (QIR) Section 5.3 1993 TBD QoS-Install-Answer (QIA) Section 5.4 1995 11. Security Considerations 1997 This document describes a mechanism for performing authorization of a 1998 QoS reservation at a third party entity. The Authorizing Entity 1999 needs sufficient information to make such an authorization decision 2000 and this information may come from various sources, including the 2001 application layer signaling, the Diameter protocol (with its security 2002 mechanisms), from policy information stored available with a AAA 2003 server and from a QoS signaling protocol. 2005 Below there is a discussion about considerations for the Diameter QoS 2006 interaction between an Authorizing Entity and a Network Element. 2007 Security between the Authorizing Entity and the Network Element has a 2008 number of components: authentication, authorization, integrity and 2009 confidentiality. 2011 Authentication refers to confirming the identity of an originator for 2012 all datagrams received from the originator. Lack of authentication 2013 of Diameter messages between the Authorizing Entity and the Network 2014 Element can seriously jeopardize the fundamental service rendered by 2015 the Network Element. A consequence of not authenticating the message 2016 sender by the Network Element would be that an attacker could spoof 2017 the identity of a "legitimate" Authorizing Entity in order to 2018 allocate resources, change resource assignments or free resources. 2019 The adversary can also manipulate the state at the Network Element in 2020 such a way that it leads to a denial of service attack by, for 2021 example, setting the allowed bandwidth to zero or allocating the 2022 entire bandwidth available to a single flow. 2024 A consequence of not authenticating the Network Element to an 2025 Authorizing Entity is that an attacker could impact the policy based 2026 admission control procedure operated by the Authorizing Entity that 2027 provides a wrong view of the resources used in the network. Failing 2028 to provide the required credentials should be subject to logging. 2030 Authorization refers to whether a particular Authorizing Entity is 2031 authorized to signal a Network Element with requests for one or more 2032 applications, adhering to a certain policy profile. Failing the 2033 authorization process might indicate a resource theft attempt or 2034 failure due to administrative and/or credential deficiencies. In 2035 either case, the Network Element should take the proper measures to 2036 log such attempts. 2038 Integrity is required to ensure that a Diameter message has not been 2039 maliciously altered. The result of a lack of data integrity 2040 enforcement in an untrusted environment could be that an imposter 2041 will alter the messages exchanged between a Network Entity and an 2042 Authorizing Entity potentially causing a denial of service. 2044 Confidentiality protection of Diameter messages ensures that the 2045 signaling data is accessible only to the authorized entities. When 2046 signaling messages from the Application Server, via the Authorizing 2047 Entity towards the Network Element traverse untrusted networks, lack 2048 of confidentiality will allow eavesdropping and traffic analysis. 2049 Additionally, Diamater QoS messages may carry authorization tokens 2050 that require confidentiality protection. 2052 Diameter offers security mechanisms to deal with the functionality 2053 demanded in the paragraphs above. In particular, Diameter offers 2054 communication security between neighboring Diameter peers using 2055 Transport Layer Security (TLS) or IPsec. Authorization capabilities 2056 are application specific and part of the overal implementation. 2058 12. Acknowledgements 2060 The authors would like to thank John Loughney and Allison Mankin for 2061 their input to this document. In September 2005 Robert Hancock, 2062 Jukka Manner, Cornelia Kappler, Xiaoming Fu, Georgios Karagiannis and 2063 Elwyn Davies provided a detailed review. Robert also provided us 2064 with good feedback earlier in 2005. Jerry Ash provided us review 2065 comments late 2005/early 2006. Rajith R provided some inputs to the 2066 document early 2007. 2068 We would also like to thanks Alexey Melnikov, Adrian Farrel, and 2069 Robert Sparks for their IESG reviews. 2071 13. Contributors 2073 The authors would like to thank Tseno Tsenov and Frank Alfano for 2074 starting the Diameter Quality of Service work within the IETF, for 2075 your significant draft contributions and for being the driving force 2076 for the first few draft versions. 2078 14. References 2080 14.1. Normative References 2082 [I-D.ietf-dime-qos-attributes] 2083 Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M., 2084 and A. Lior, "Traffic Classification and Quality of 2085 Service Attributes for Diameter", 2086 draft-ietf-dime-qos-attributes-15 (work in progress), 2087 December 2009. 2089 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2090 Requirement Levels", BCP 14, RFC 2119, March 1997. 2092 [RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. 2093 Arkko, "Diameter Base Protocol", RFC 3588, September 2003. 2095 [RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton, 2096 "Diameter Network Access Server Application", RFC 4005, 2097 August 2005. 2099 [RFC5624] Korhonen, J., Tschofenig, H., and E. Davies, "Quality of 2100 Service Parameters for Usage with Diameter", RFC 5624, 2101 August 2009. 2103 14.2. Informative References 2105 [I-D.ietf-mmusic-media-path-middleboxes] 2106 Stucker, B. and H. Tschofenig, "Analysis of Middlebox 2107 Interactions for Signaling Protocol Communication along 2108 the Media Path", 2109 draft-ietf-mmusic-media-path-middleboxes-02 (work in 2110 progress), March 2009. 2112 [I-D.ietf-nsis-ntlp] 2113 Schulzrinne, H. and M. Stiemerling, "GIST: General 2114 Internet Signalling Transport", draft-ietf-nsis-ntlp-20 2115 (work in progress), June 2009. 2117 [I-D.ietf-nsis-qos-nslp] 2118 Manner, J., Karagiannis, G., and A. McDonald, "NSLP for 2119 Quality-of-Service Signaling", draft-ietf-nsis-qos-nslp-18 2120 (work in progress), January 2010. 2122 [RFC2205] Braden, B., Zhang, L., Berson, S., Herzog, S., and S. 2123 Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1 2124 Functional Specification", RFC 2205, September 1997. 2126 [RFC2211] Wroclawski, J., "Specification of the Controlled-Load 2127 Network Element Service", RFC 2211, September 1997. 2129 [RFC2212] Shenker, S., Partridge, C., and R. Guerin, "Specification 2130 of Guaranteed Quality of Service", RFC 2212, 2131 September 1997. 2133 [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, 2134 "Definition of the Differentiated Services Field (DS 2135 Field) in the IPv4 and IPv6 Headers", RFC 2474, 2136 December 1998. 2138 [RFC2753] Yavatkar, R., Pendarakis, D., and R. Guerin, "A Framework 2139 for Policy-based Admission Control", RFC 2753, 2140 January 2000. 2142 [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, 2143 "Remote Authentication Dial In User Service (RADIUS)", 2144 RFC 2865, June 2000. 2146 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 2147 A., Peterson, J., Sparks, R., Handley, M., and E. 2148 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 2149 June 2002. 2151 [RFC3313] Marshall, W., "Private Session Initiation Protocol (SIP) 2152 Extensions for Media Authorization", RFC 3313, 2153 January 2003. 2155 [RFC3520] Hamer, L-N., Gage, B., Kosinski, B., and H. Shieh, 2156 "Session Authorization Policy Element", RFC 3520, 2157 April 2003. 2159 [RFC3521] Hamer, L-N., Gage, B., and H. Shieh, "Framework for 2160 Session Set-up with Media Authorization", RFC 3521, 2161 April 2003. 2163 [RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The 2164 Network Access Identifier", RFC 4282, December 2005. 2166 [RFC4566] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session 2167 Description Protocol", RFC 4566, July 2006. 2169 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 2170 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 2172 Authors' Addresses 2174 Dong Sun (editor) 2175 Alcatel-Lucent 2176 600 Mountain Ave 2177 Murray Hill, NJ 07974 2178 USA 2180 Phone: +1 908 582 2617 2181 Email: d.sun@alcatel-lucent.com 2183 Peter J. McCann 2184 Motorola Labs 2185 1301 E. Algonquin Rd 2186 Schaumburg, IL 60196 2187 USA 2189 Phone: +1 847 576 3440 2190 Email: pete.mccann@motorola.com 2192 Hannes Tschofenig 2193 Nokia Siemens Networks 2194 Linnoitustie 6 2195 Espoo 02600 2196 Finland 2198 Phone: +358 (50) 4871445 2199 Email: Hannes.Tschofenig@gmx.net 2200 URI: http://www.tschofenig.priv.at 2202 Tina Tsou 2203 Huawei 2204 Shenzhen, 2205 P.R.C 2207 Email: tena@huawei.com 2208 Avri Doria 2209 Lulea University of Technology 2210 Arbetsvetenskap 2211 Lulea, SE-97187 2212 Sweden 2214 Email: avri@ltu.se 2216 Glen Zorn (editor) 2217 Network Zen 2218 1310 East Thomas Street 2219 #306 2220 Seattle, Washington 98102 2221 USA 2223 Phone: +1 (206) 377-9035 2224 Email: gwz@net-zen.net