Tech-invite3GPPspaceIETFspace
959493929190898887868584838281807978777675747372717069686766656463626160595857565554535251504948474645444342414039383736353433323130292827262524232221201918171615141312111009080706050403020100
in Index   Prev   Next

RFC 4740

Diameter Session Initiation Protocol (SIP) Application

Pages: 72
Proposed Standard
Errata
Part 4 of 4 – Pages 59 to 72
First   Prev   None

Top   ToC   RFC4740 - Page 59   prevText

10. New Values for Existing AVPs

This section defines new values that the Diameter SIP application extends to already existing AVPs.

10.1. Extension to the Result-Code AVP Values

The Result-Code AVP is already defined in RFC 3588 [RFC3588]. In addition to the values already defined in RFC 3588 [RFC3588], the Diameter SIP application defines the following new Result-Code AVP values:

10.1.1. Success Result-Code AVP Values

A Diameter peer uses Result-Code AVP values that fall into the success category to inform the remote peer that a request has been successfully completed. o DIAMETER_FIRST_REGISTRATION 2003 The user was not previously registered. The Diameter server has now authorized the registration. o DIAMETER_SUBSEQUENT_REGISTRATION 2004 The user is already registered. The Diameter server has now authorized the re-registration. o DIAMETER_UNREGISTERED_SERVICE 2005 The user is not currently registered, but the requested service can still be granted to the user. o DIAMETER_SUCCESS_SERVER_NAME_NOT_STORED 2006 The request operation was successfully processed. The Diameter server does not keep a record of the SIP server address assigned to the user. o DIAMETER_SERVER_SELECTION 2007 The Diameter server has authorized the registration. The user has already been assigned a SIP server, but it may be necessary to select a new SIP server for the user.
Top   ToC   RFC4740 - Page 60
   o  DIAMETER_SUCCESS_AUTH_SENT_SERVER_NOT_STORED 2008
      The requested operation was successfully executed.  The Diameter
      server is sending a number of authentication credentials in the
      answer message.  The Diameter server does not keep a record of the
      SIP server.

10.1.2. Transient Failures Result-Code AVP Values

A Diameter peer uses a Result-Code AVP value that falls in the transient failures category to inform the remote peer that a request could not be satisfied at the time it was received, but it MAY be satisfied by the Diameter peer in the future. o DIAMETER_USER_NAME_REQUIRED 4013 The Diameter request did not contain a User-Name AVP, which is required to complete the transaction. The Diameter peer MAY include a User-Name AVP and attempt the request again.

10.1.3. Permanent Failures Result-Code AVP Values

A Diameter peer uses a Result-Code AVP value that falls into the permanent failure category to inform the remote peer that the request failed and should not be attempted again. o DIAMETER_ERROR_USER_UNKNOWN 5032 The SIP-AOR AVP value does not belong to a known user in this realm. o DIAMETER_ERROR_IDENTITIES_DONT_MATCH 5033 The value in one of the SIP-AOR AVPs is not allocated to the user specified in the User-Name AVP. o DIAMETER_ERROR_IDENTITY_NOT_REGISTERED 5034 A query for location information is received for a SIP AOR that has not been registered before. The user to which this identity belongs cannot be given service in this situation. o DIAMETER_ERROR_ROAMING_NOT_ALLOWED 5035 The user is not allowed to roam to the visited network. o DIAMETER_ERROR_IDENTITY_ALREADY_REGISTERED 5036 The identity being registered has already been assigned a server and the registration status does not allow that it is overwritten. o DIAMETER_ERROR_AUTH_SCHEME_NOT_SUPPORTED 5037 The authentication scheme indicated in an authentication request is not supported.
Top   ToC   RFC4740 - Page 61
   o  DIAMETER_ERROR_IN_ASSIGNMENT_TYPE 5038
      The SIP server address sent in the SIP-Server-URI AVP value of the
      Diameter Server-Assignment-Request (SAR) command is the same SIP
      server address that is currently assigned to the user name, but
      the SIP-Server-Assignment-Type AVP is not allowed.  For example,
      the user is registered and the Server-Assignment-Request indicates
      the assignment for an unregistered user.

   o  DIAMETER_ERROR_TOO_MUCH_DATA 5039
      The Diameter peer in the SIP server receives more data than it can
      accept.  The SIP server cannot overwrite the already stored data.

   o  DIAMETER_ERROR_NOT SUPPORTED_USER_DATA 5040
      The SIP server informs the Diameter server that the received
      subscription data contained information that was not recognized or
      supported.

11. Authentication Details

Authenticating a user can occur through various mechanisms. Currently HTTP Digest authentication is supported. The actual authentication is performed in either the SIP server or the Diameter server. If the Diameter server wants to assure that authentication will take place in the Diameter server (as opposed to a delegated authentication taking place in the SIP server), it MUST NOT include a Digest-HA1 AVP (part of the grouped SIP-Authenticate AVP, which in turn is part of the SIP-Auth-Data-Item AVP) in a MAA message. The Diameter server MAY include a pre-calculated Digest-HA1 AVP in the MAA message if it wants to delegate authentication of the user to the SIP server. Note that on systems where the SIP User Agent is using HTTP Digest authentication [RFC2617] inside of Transport Layer Security (TLS) [RFC4346], where only the SIP proxy server has a certificate, delegating authentication to the SIP server (by making Digest-HA1 available to the SIP server) might reduce the load on the Diameter server. When requesting authentication, the Diameter client indicates in the SIP-Number-Auth-Items AVP value of a Diameter MAR message how many authentication credentials are being requested. In the Diameter MAA message, the Diameter server MAY include more than one SIP-Auth-Data-Item AVP, but it is only useful for the Diameter client if the Digest-QoP AVP was set to 'auth-int' (in the MAR message), and if future authentications will have the same realm. When including more than one SIP-Auth-Data-Item AVP, the Diameter server SHOULD
Top   ToC   RFC4740 - Page 62
   indicate how many instances of SIP-Auth-Data-Item AVPs are present
   with the SIP-Number-Auth-Items AVP.  This number may be different
   from the one requested in the Diameter MAR message.  If multiple
   SIP-Auth-Data-Item AVPs are present, and their ordering is
   significant, the Diameter server MUST include a SIP-Item-Number AVP
   in each grouping to indicate the order.  The
   SIP-Authentication-Scheme AVP indicates "Digest" and the
   SIP-Authenticate AVP contains data (typically a challenge of some
   kind) that the user can use for her authentication.  The grouped
   SIP-Authorization AVP contains the AVPs that conform to the response
   expected from the user.

   If the Diameter server performs the authentication of the user, the
   Diameter MAR message that the Diameter client sends to the Diameter
   server MUST include all the authentication credentials supplied by
   the SIP UA (there might be more than one credential, e.g., different
   realms, authentication of proxies, etc.).  Each credential is
   inserted in a grouped SIP-Authorization AVP (part of the grouped
   SIP-Auth-Data-Item AVP).  The Diameter client MUST insert a
   SIP-Number-Auth-Items AVP with the value set to the number of
   credentials enclosed.  If necessary, the Digest-Entity-Body-Hash AVP
   will contain a hash of the body, needed to perform the
   authentication.  If the authentication is successful, the Diameter
   MAA message will contain a Result-Code AVP indicating success, and if
   necessary, the Diameter server MAY include one or more
   SIP-Auth-Data-Item AVPs to provide further authentication credentials
   to the SIP server.  If the authentication is unsuccessful due to
   missing credentials, the Diameter MAA message will include a
   SIP-Auth-Data-Item AVP with the SIP-Authentication-Scheme and
   SIP-Authenticate AVPs containing data (typically a challenge of some
   kind) that the user can use to authenticate itself.

   There are situations where a SIP request traverses several proxies,
   and each of the proxies requests to authenticate the SIP UA.  In this
   situation, it is a valid scenario that a SIP request received at a
   SIP server contains several sets of credentials.  The 'realm'
   directive in HTTP is the key that the Diameter client can use to
   determine which credential is applicable.  Also, none of the realms
   may be of interest to the Diameter client, in which case the Diameter
   client MUST consider that no credentials (of interest) were sent.  In
   any case, a Diameter client MUST send zero or exactly one credential
   to the Diameter server.  The Diameter client MUST choose the
   credential based on the 'realm' directive in the
   Authorization/Proxy-Authorization header field, and it MUST match the
   realm of the Diameter client.

   It must be noted that nonces are always generated in the Diameter
   server.
Top   ToC   RFC4740 - Page 63

12. Migration from RADIUS

RADIUS offers support for HTTP Digest authentication in the RADIUS Extension for Digest Authentication [RFC4590]. A number of AVPs (the Digest-* AVPs) of this Diameter SIP application are imported from the RADIUS attributes namespace, thus making the migration from RADIUS to Diameter smooth. Note that the RADIUS Extension for Digest Authentication [RFC4590] provides a more limited scope than this Diameter SIP application. Specifically, the RADIUS extension for Digest Authentication merely provides support for HTTP Digest authentication, whereas the Diameter SIP application provides support for user location, profile downloading and update, etc. The following sections discuss several configurations in which a gateway translates RADIUS to Diameter and vice versa.

12.1. Gateway from RADIUS Client to Diameter Server

The gateway maps Access-Request messages to MAR request. If a RADIUS Access-Request message contains at least one Digest-* attribute, the gateway maps all Digest-* attributes to the AVPs of a Diameter SIP-Authorization AVP, constructs a MAR message, and sends it to the Diameter server. If the RADIUS Access-Request message does not contain any Digest-* attribute, then the RADIUS client does not want to apply HTTP Digest authentication, in which case, actions at the gateway are outside the scope of this document. The Diameter server responds with a MAA message. If the MAA message contains a Result-Code AVP set to the value DIAMETER_MULTI_ROUND_AUTH and contains challenge parameters in a SIP-Authenticate AVP, then the gateway translates the AVPs of SIP-Authenticate AVP and puts the resulting RADIUS attributes into an Access-Challenge message. It sends the Access-Challenge message to the RADIUS client. If the MAA message contains a SIP-Authentication-Info and a Digest-Response AVP, the gateway converts these AVPs to the corresponding RADIUS attributes and constructs a RADIUS message. If the Result-Code AVP is DIAMETER_SUCCESS, an Access-Accept is sent. In all other cases, an Access-Reject is sent.

12.2. Gateway from Diameter Client to RADIUS Server

The Diameter client sends a Diameter MAR message to the gateway. If the MAR message does not contain SIP-Auth-Data-Item AVPs, the gateway constructs an Access-Request message and maps the SIP-AOR and SIP-Method AVPs to RADIUS attributes. The gateway sends the
Top   ToC   RFC4740 - Page 64
   Access-Request message to the RADIUS server, which will respond with
   an Access-Challenge.  The gateway creates a MAA message with a
   Result-Code AVP set to DIAMETER_MULTI_ROUND_AUTH and maps the
   Digest-* attributes to Diameter AVPs in a SIP-Authenticate AVP.  The
   gateway sends the resulting MAA to the Diameter client, which will
   respond with a new MAR.

   The gateway checks the SIP-Auth-Data-Item AVPs of this MAR for an AVP
   where the Digest-Realm AVP matches the locally configured realm
   value.  It takes the AVPs from this SIP-Auth-Data-Item AVP, converts
   them into the corresponding RADIUS attributes and constructs a RADIUS
   Access-Request message.  The gateway sends the Access-Request message
   to the RADIUS server.  If the RADIUS server responds with an
   Access-Accept message, the gateway converts the RADIUS attributes to
   Diameter AVPs, constructs a MAA message with a Result-Code AVP set to
   DIAMETER_SUCCESS and sends this message to the Diameter client.  If
   the RADIUS server responds with an Access-Reject message, the gateway
   converts the RADIUS attributes to Diameter AVPs, constructs a MAA
   message with a Result-Code AVP set to
   DIAMETER_ERROR_IDENTITIES_DONT_MATCH, and sends this message to the
   Diameter client.

12.3. Known Limitations

As mentioned earlier, there is not a 100% match between the Diameter SIP application and the RADIUS Extension for Digest Authentication [RFC4590]. In particular, the RADIUS Extension for Digest Authentication [RFC4590] does not offer equivalent functionality to the Diameter UAR/UAA, SAR/SAA, LIR/LIA, RTR/RTA, and PPR/PPA messages defined by this specification.

13. IANA Considerations

This document serves as IANA registration request for a number of items that should be registered in the AAA parameters registry.

13.1. Application Identifier

This document defines a standards-track Application-ID that falls into the Application Identifier standards-track address space defined by RFC 3588 [RFC3588] Section 11.3. This Application-ID has been registered in the Application IDs sub-registry of the AAA parameters registry with the following data: ID values Name Reference ----------- ------------------------ --------- 6 Diameter Session Initiation RFC 4740 Protocol (SIP) Application
Top   ToC   RFC4740 - Page 65

13.2. Command Codes

This document defines new standard commands whose Command Codes are to be allocated within the standard permanent Command Codes address space defined in RFC 3588 [RFC3588] Section 11.2.1. These command codes should be registered in the Command Codes sub-registry of the AAA parameters registry. Table 1 in Section 8 contains the detailed list of Command Code names and values that are part of this Diameter application.

13.3. AVP Codes

This document defines new standard AVPs, whose AVP Codes are to be allocated within the AVP Codes address space defined in RFC 3588 [RFC3588] Section 11.4. These AVP codes have been registered in the AVP Codes sub-registry of the AAA parameters registry. Table 2 in Section 9 contains the detailed list of AVP names and AVP codes that are part of this Diameter application.

13.4. Additional Values for the Result-Code AVP Value

This document defines new standard Result-Code AVP values to be allocated within the Result-Code AVP address space defined in RFC 3588 [RFC3588] Section 14.4.1. These values are listed in the Result-Code AVP values section of the AVP Specific Values sub-registry of the AAA parameters registry. Section 10.1.1 lists the new Result-Code AVP values that fall into the success category, according to RFC 3588 [RFC3588] Section 7.1.2. Section 10.1.2 lists the new Result-Code AVP values that fall into the transient failures category, according to RFC 3588 [RFC3588] Section 7.1.4. Section 10.1.3 lists the new Result-Code AVP values that fall into the permanent failures category, according to RFC 3588 [RFC3588] Section 7.1.5.
Top   ToC   RFC4740 - Page 66

13.5. Creation of the SIP-Server-Assignment-Type Section in the AAA Registry

This document defines a new SIP-Server-Assignment-Type AVP (see Section 9.4). This AVP is of type Enumerated. We define an initial set of values that should be registered by IANA. IANA should create a new "SIP-Sever-Assignment-Type AVP values" section under the AVP Specific Values sub-registry of the AAA parameters registry. The initial list of values is listed in Section 9.4.

13.6. Creation of the SIP-Authentication-Scheme Section in the AAA Registry

This document defines a new SIP-Authentication-Scheme AVP (see Section 9.5.1). This AVP is of type Enumerated. We currently define a single value that should be registered by IANA. IANA should create a new "SIP-Authentication-Scheme AVP values" section under the AVP Specific Values sub-registry of the AAA parameters registry. The initial list of values is included in Section 9.5.1.

13.7. Creation of the SIP-Reason-Code Section in the AAA Registry

This document defines a new SIP-Reason-Code AVP (see Section 9.7.1). This AVP is of type Enumerated. We define an initial set of values that should be registered by IANA. IANA should create a new "SIP-Reason-Code AVP values" section under the AVP Specific Values sub-registry of the AAA parameters registry. The initial list of values is listed in Section 9.7.1.

13.8. Creation of the SIP-User-Authorization-Type Section in the AAA Registry

This document defines a new SIP-User-Authorization-Type AVP (see Section 9.10). This AVP is of type Enumerated. We define an initial set of values that should be registered by IANA. IANA should create a new "SIP-User-Authorization-Type AVP values" section under the AVP Specific Values sub-registry of the AAA parameters registry. The initial list of values is listed in Section 9.10.

13.9. Creation of the SIP-User-Data-Already-Available Section in the AAA Registry

This document defines a new SIP-User-Data-Already-Available AVP (see Section 9.13). This AVP is of type Enumerated. We define an initial set of values which should be registered by IANA. IANA should create a new "SIP-User-Data-Already-Available AVP values" section under the AVP Specific Values sub-registry of the AAA parameters registry. The initial list of values is listed in Section 9.13.
Top   ToC   RFC4740 - Page 67

14. Security Considerations

This memo does not describe a stand-alone protocol, but a particular application for the Diameter protocol [RFC3588]. Consequently, all the security considerations applicable to Diameter automatically apply to this memo. In particular, Section 13 of RFC 3588 applies to this memo. This Diameter SIP application allows a Diameter client to use the properties of HTTP Digest authentication [RFC2617] by evaluating or sending to the Diameter server the credentials supplied by a user. The discussion of HTTP Digest authentication in Section 4 of RFC 2617 [RFC2617] is also applicable to this memo. This Diameter SIP application also allows a Diameter client to use the properties of HTTP Digest authentication using AKA [RFC3310] by evaluating or sending to the Diameter server the credentials supplied by a user. Section 5 of RFC 3310 [RFC3310] is also applicable to this memo.

14.1. Final Authentication Check in the Diameter Client/SIP Server

The Diameter SIP application can be configured to operate in a scenario where the final authentication check is performed in the Diameter client (SIP server). There are a number of security considerations associated to it; all of them are consequences of the requirement to transfer H(A1) from the Diameter server to the Diameter client: o Both Diameter client and server must trust each other, such as when both client and server belong to the same administrative domain. o To avoid eavesdroppers, the transport protocol between the Diameter client and server MUST be secured. RFC 3588 [RFC3588] specifies TLS [RFC4346] and IPsec as possible transport protection mechanisms for Diameter. Due to these security considerations, it is RECOMMENDED to configure the Diameter SIP application to operate in the mode where the final authentication check is performed in the Diameter server.
Top   ToC   RFC4740 - Page 68

15. Contributors

The authors would like to thank the following contributors who made substantial contributions to this work: Pete McCann Lucent Jaakko Rajaniemi Nokia Wolfgang Beck (Deutsche Telekom AG) provided the text in Section 12, "Migration from RADIUS".

16. Acknowledgements

The authors would like to thank Tony Johansson and Kevin Purser for their invaluable contribution to the start-up of this application and the continuous progress. The authors would like to thank Daniel Warren, Jayshree Bharatia, Kuntal Chowdhury, Jari Arkko, Avi Lior, Wolfgang Beck, Ulrich Wiehe, Cullen Jennings, Anu Leinonen, Glen Zorn, German Blanco, Mikko Aittola, Bert Wijnen, and Sam Hartman for their reviews and valuable comments. The Diameter SIP application is based on the Diameter application for the Cx interface of the 3GPP IP Multimedia Subsystem [3GPP.29.229]. The authors would like to thank 3GPP Working Group CN4 for this work.

17. References

17.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June 1999. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. [RFC3310] Niemi, A., Arkko, J., and V. Torvinen, "Hypertext Transfer Protocol (HTTP) Digest Authentication Using Authentication and Key Agreement (AKA)", RFC 3310, September 2002.
Top   ToC   RFC4740 - Page 69
   [RFC3588]      Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and
                  J.  Arkko, "Diameter Base Protocol", RFC 3588,
                  September 2003.

   [RFC4590]      Sterman, B., Sadolevsky, D., Schwartz, D., Williams,
                  D., and W. Beck, "RADIUS Extension for Digest
                  Authentication", RFC 4590, July 2006.

17.2. Informative References

[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.1", RFC 4346, April 2006. [RFC3263] Rosenberg, J. and H. Schulzrinne, "Session Initiation Protocol (SIP): Locating SIP Servers", RFC 3263, June 2002. [RFC3680] Rosenberg, J., "A Session Initiation Protocol (SIP) Event Package for Registrations", RFC 3680, March 2004. [RFC3880] Lennox, J., Wu, X., and H. Schulzrinne, "Call Processing Language (CPL): A Language for User Control of Internet Telephony Services", RFC 3880, October 2004. [RFC4004] Calhoun, P., Johansson, T., Perkins, C., Hiller, T., and P. McCann, "Diameter Mobile IPv4 Application", RFC 4004, August 2005. [RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton, "Diameter Network Access Server Application", RFC 4005, August 2005. [RFC4006] Hakala, H., Mattila, L., Koskinen, J-P., Stura, M., and J. Loughney, "Diameter Credit-Control Application", RFC 4006, August 2005. [3GPP.29.229] 3GPP, "Cx and Dx interfaces based on the Diameter protocol; Protocol details", 3GPP TS 29.229 5.12.0, June 2006. [JSR-000116] Java Community Process, "SIP Servlet API Specification 1.0 Final Release", JSR 000116, March 2003.
Top   ToC   RFC4740 - Page 70

Authors' Addresses

Miguel A. Garcia-Martin (Editor) Nokia P.O. Box 407 NOKIA GROUP, FIN 00045 Finland Phone: +358 50 480 4586 EMail: miguel.an.garcia@nokia.com Maria-Carmen Belinchon Ericsson Via de los Poblados 13 Madrid 28033 Spain Phone: +34 91 339 3535 EMail: maria.carmen.belinchon@ericsson.com Miguel A. Pallares-Lopez Ericsson Via de los Poblados 13 Madrid 28033 Spain Phone: +34 91 339 4222 EMail: miguel-angel.pallares@ericsson.com Carolina Canales-Valenzuela Ericsson Via de los Poblados 13 Madrid 28033 Spain Phone: +34 91 339 2680 EMail: carolina.canales@ericsson.com
Top   ToC   RFC4740 - Page 71
   Kalle Tammi
   Nokia
   P.O.Box 785
   Tampere  33101
   Finland

   Phone: +358 40 505 8670
   EMail: kalle.tammi@nokia.com
Top   ToC   RFC4740 - Page 72
Full Copyright Statement

   Copyright (C) The IETF Trust (2006).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST,
   AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES,
   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
   THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY
   IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
   PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.