Diameter Session Initiation Protocol (SIP) Application
Extracted elements (27)
A Diameter Subscriber Locator (SL) acting as a Redirect Agent was introduced to allow the architecture to scale across many Diameter servers. Given a user's SIP AOR, the SL consults its routing tables and redirects the Diameter client to the specific Diameter server that holds that user's data, using the standard Diameter redirect mechanism with Redirect-Host-Usage set to ALL_USER.
All data for a given user is required to be stored in a single Diameter server (possibly a redundant cluster). This simplifies the authentication and authorization lookup path and avoids distributed consistency problems, at the cost of needing a Subscriber Locator layer in large multi-server deployments.
Delegating the final authentication check to the SIP server (Section 6.3) was designed to reduce round-trips for operators with large SIP server farms. The optimization is inapplicable when MD5-sess is used, because computing H(A1) requires the client nonce that may not yet be available at the Diameter server at challenge-generation time.
Section 12 defines gateway procedures for translating between RADIUS clients and Diameter servers (Section 12.1) and between Diameter clients and RADIUS servers (Section 12.2), but Section 12.3 notes known limitations: several Diameter SIP AVPs have no RADIUS equivalents, so complete feature parity is not achievable through a gateway.
All Diameter implementations conforming to this specification MUST implement and support all twelve Diameter commands: UAR, UAA, SAR, SAA, LIR, LIA, MAR, MAA, RTR, RTA, PPR, and PPA.
Diameter implementations conforming to this specification MUST advertise support by including an Auth-Application-Id AVP set to the Diameter SIP application identifier in CER and CEA commands, as required by RFC 3588.
If a User-Name AVP is present in the UAR, the Diameter server MUST verify the user exists in the realm and MUST authorize that the User-Name is permitted to register the SIP-AOR; failure MUST yield DIAMETER_ERROR_USER_UNKNOWN or DIAMETER_ERROR_IDENTITIES_DONT_MATCH respectively.
If the SIP server is acting as a SIP registrar, its Diameter client MUST include a SIP-Server-URI AVP in the MAR command. In all other cases (e.g., outbound proxy performing authentication only), the Diameter client MUST NOT include SIP-Server-URI in the MAR command.
Implementations MUST support both Diameter-session-based and session-less SIP soft-state termination. With NO_STATE_MAINTAINED, client-initiated termination uses SAR with a deregistration assignment type; server-initiated uses RTR. With STATE_MAINTAINED, STR/ASR from RFC 3588 are used instead.
The Diameter client in the assigned SIP server MUST include its own URI in the SIP-Server-URI AVP of the SAR message. If SIP-Server-Assignment-Type is REGISTRATION, RE_REGISTRATION, UNREGISTERED_USER, NO_ASSIGNMENT, AUTHENTICATION_FAILURE, or AUTHENTICATION_TIMEOUT, exactly one SIP-AOR AVP MUST be present.
When SIP-User-Authorization-Type is REGISTRATION and no prior SIP server is known, the Diameter server MUST set Result-Code to DIAMETER_FIRST_REGISTRATION and SHOULD include SIP-Server-Capabilities. When a prior assigned SIP server is known without returning capabilities, it MUST set DIAMETER_SUBSEQUENT_REGISTRATION.
When SIP-Visited-Network-Id is present and the SIP-User-Authorization-Type is REGISTRATION or REGISTRATION&CAPABILITIES, the Diameter server SHOULD verify roaming authorization; if the user is not allowed to roam into that network, it MUST set Result-Code to DIAMETER_ERROR_ROAMING_NOT_ALLOWED.
New Result-Code values defined: success codes DIAMETER_FIRST_REGISTRATION, DIAMETER_SUBSEQUENT_REGISTRATION, DIAMETER_UNREGISTERED_SERVICE, DIAMETER_SUCCESS_SERVER_NAME_NOT_STORED, DIAMETER_SERVER_SELECTION; transient failure DIAMETER_USER_NAME_REQUIRED; permanent failures DIAMETER_ERROR_USER_UNKNOWN, DIAMETER_ERROR_IDENTITIES_DONT_MATCH, DIAMETER_ERROR_IDENTITY_NOT_REGISTERED, and DIAMETER_ERROR_ROAMING_NOT_ALLOWED.
The Location-Info-Request (LIR) and Location-Info-Answer (LIA) commands use Command-Code 285. LIR requests the URI of the SIP server assigned to a given SIP-AOR; LIA returns that URI or result codes DIAMETER_UNREGISTERED_SERVICE or DIAMETER_ERROR_IDENTITY_NOT_REGISTERED when no server is assigned.
The Multimedia-Auth-Request (MAR) and Multimedia-Auth-Answer (MAA) commands use Command-Code 286. MAR requests authentication parameters for a SIP user; MAA returns authentication vectors in SIP-Auth-Data-Item AVPs, and MAY include Digest-HA1 to allow the SIP server to perform the final credential check locally without a second round-trip.
The Push-Profile-Request (PPR) and Push-Profile-Answer (PPA) commands use Command-Code 288. PPR is sent asynchronously by the Diameter server to push updated user-profile data (one or more SIP-User-Data AVPs, a User-Name AVP, and zero or more SIP-AOR AVPs) to the SIP server when the profile changes outside a normal registration flow.
The Registration-Termination-Request (RTR) and Registration-Termination-Answer (RTA) commands use Command-Code 287. RTR is sent server-to-client to force deregistration of one or more SIP AORs, carrying SIP-Deregistration-Reason; RTA is the acknowledgment.
The Server-Assignment-Answer (SAA) command uses Command-Code 284 with the R bit cleared. It may include zero or more SIP-User-Data AVPs carrying the user profile and one SIP-Accounting-Information AVP; the Diameter server MUST clear the 'authentication pending' flag and SHOULD store the SIP server URI permanently upon success.
The Server-Assignment-Request (SAR) command uses Command-Code 284 with the R bit set. It informs the Diameter server of the SIP server URI now serving the user (via SIP-Server-URI), requests user-profile download, and identifies the reason for the request via SIP-Server-Assignment-Type.
The SIP-Auth-Data-Item AVP is a grouped AVP carrying authentication material for a single exchange: SIP-Authentication-Scheme (Enumerated), SIP-Item-Number (Unsigned32), SIP-Authenticate (OctetString), SIP-Authorization (OctetString), SIP-Authentication-Info (OctetString), and HTTP Digest sub-AVPs including Digest-HA1.
The SIP-Deregistration-Reason AVP (grouped) is carried in RTR messages and contains SIP-Reason-Code (Enumerated) and an optional SIP-Reason-Info (UTF8String) to inform the SIP server of the reason for forced deregistration.
The SIP-Server-Assignment-Type AVP (Enumerated) identifies the reason a SAR is sent. Defined values include REGISTRATION, RE_REGISTRATION, UNREGISTERED_USER, TIMEOUT_DEREGISTRATION, USER_DEREGISTRATION, DEREGISTRATION_TOO_MUCH_DATA, ADMINISTRATIVE_DEREGISTRATION, AUTHENTICATION_FAILURE, AUTHENTICATION_TIMEOUT, NO_ASSIGNMENT, TIMEOUT_DEREGISTRATION_STORE_SERVER_NAME, and USER_DEREGISTRATION_STORE_SERVER_NAME.
The SIP-User-Data AVP (grouped) delivers user-profile content from the Diameter server to the SIP server. It contains SIP-User-Data-Type (UTF8String, identifying the data format/schema) and SIP-User-Data-Contents (OctetString, the actual profile blob).
The User-Authorization-Answer (UAA) command uses Command-Code 283 with the R bit cleared. It returns the assigned SIP server URI (SIP-Server-URI), SIP server capabilities (SIP-Server-Capabilities), or both, along with result codes such as DIAMETER_FIRST_REGISTRATION, DIAMETER_SUBSEQUENT_REGISTRATION, or DIAMETER_SERVER_SELECTION.
The User-Authorization-Request (UAR) command uses Command-Code 283 with the R bit set. It is sent by the Diameter client in a SIP server to request authorization for a SIP REGISTER request, carrying SIP-AOR, Auth-Session-State, and optionally User-Name, SIP-Visited-Network-Id, and SIP-User-Authorization-Type AVPs.
IANA created: a Diameter SIP application identifier; command codes 283–288; new AVP codes for all SIP-specific AVPs; new Result-Code values; and five new sections in the AAA registry covering SIP-Server-Assignment-Type, SIP-Authentication-Scheme, SIP-Reason-Code, SIP-User-Authorization-Type, and SIP-User-Data-Already-Available.
When the Diameter server includes a Digest-HA1 AVP in MAA, the SIP server performs the final credential check locally using H(A1), without a second Diameter round-trip. This requires that the Diameter transport between SIP server and Diameter server be secured, as H(A1) is sensitive keying material sufficient to impersonate the user.