Diameter
New Generation AAA Protocol - Design, Practice, and Applications
1. Edition April 2019
248 Pages, Hardcover
Wiley & Sons Ltd
ISBN:
978-1-118-87590-2
John Wiley & Sons
Further versions
Presents the principles, design, development and applications of the Diameter protocol suite
The Diameter protocol was born in the Internet Engineering Task Force (IETF) and designed to be a general-purpose Authentication, Authorization, and Accounting (AAA) protocol applicable to many network environments. This book is for everyone who wants to understand the Diameter protocol and its applications. This book explains the place Diameter holds in global telecommunication networks and teaches system architects and designers how to incorporate Diameter into their network environments.
Diameter: New Generation AAA Protocol - Design, Practice and Applications begins by describing the foundation of Diameter step-by-step, starting with building blocks of the protocol, and progressing from a simple two-party exchange to a multi-party exchange involving complex routing. It discusses the motivation for using Diameter, talks about its predecessor, RADIUS, and introduces the open source Diameter implementation, freeDiameter. The book expands beyond protocol basics to cover end-to-end communication, security functionality, and real-world applications, extending to the backend infrastructure of mobile telecommunications. In addition, an advanced chapter teaches readers how to develop Diameter extensions for their own AAA applications.
* Written by an experienced author team who are members of the group that standardized Diameter in the IETF and are at the forefront of this cutting-edge technology
* Presents the still-developing topic of Diameter from both introductory and advanced levels
* Makes available for download a virtual machine containing the open source implementation: https://diameter-book.info
* Provides hands-on experience via freeDiameter examples and exercises throughout the book
Diameter: New Generation AAA Protocol - Design, Practice and Applications will appeal to system architects and system designers, programmers, standardization experts new to Diameter, students and researchers interested in technology that is deployed by many network operators.
Disclaimer xiii
About the Authors xv
Foreword xvii
Preface xix
Acknowledgements xxiii
List of Abbreviations xxv
1 Introduction 1
1.1 What is AAA? 1
1.2 Open Standards and the IETF 2
1.3 What is Diameter? 3
1.3.1 Diameter versus RADIUS 4
1.3.2 Diameter Improvements 5
1.4 What is freeDiameter? 6
References 6
2 Fundamental Diameter Concepts and Building Blocks 9
2.1 Introduction 9
2.2 Diameter Nodes 9
2.3 Diameter Protocol Structure 10
2.4 Diameter Applications 10
2.5 Connections 11
2.5.1 Transport Layer 11
2.5.2 Peer-to-Peer Messaging Layer 12
2.5.3 Setting up a Connection between freeDiameter Peers 12
2.6 Diameter Message Overview 12
2.6.1 The Command Code Format 13
2.6.2 Message Structure 15
2.6.3 Attribute-Value Pairs 16
2.6.3.1 Format 16
2.6.4 Derived AVP Data Formats 20
2.7 Diameter Sessions 20
2.8 Transaction Results 21
2.8.1 Successful Transactions 21
2.8.2 Protocol Errors 21
2.8.3 Transient Failures 22
2.8.4 Permanent Failures 23
2.9 Diameter Agents 25
2.9.1 Saving State 25
2.9.2 Redirect Agents 25
2.9.3 Relay Agents 25
2.9.4 Proxy Agents 27
2.9.5 Translation Agents 27
References 27
3 Communication between Neighboring Peers 29
3.1 Introduction 29
3.2 Peer Connections and Diameter Sessions 29
3.3 The DiameterIdentity 29
3.4 Peer Discovery 31
3.4.1 Static Discovery 31
3.4.1.1 Static Discovery in freeDiameter 31
3.4.2 Dynamic Discovery 32
3.4.2.1 Dynamic Discovery and DiameterURI 35
3.4.2.2 DNS Further Reading 36
3.5 Connection Establishment 36
3.5.1 The Election Process: Handling Simultaneous Connection Attempts 37
3.6 Capabilities Exchange 37
3.6.1 freeDiameter example 38
3.6.2 The Capabilities Exchange Request 39
3.6.3 Capabilities Exchange Answer 40
3.6.4 Hop-by-Hop Identifiers 41
3.7 The Peer Table 42
3.8 Peer Connection Maintenance 43
3.8.1 Transport Failure, Failover, and Failback Procedures 45
3.8.2 Peer State Machine 49
3.9 Advanced Transport and Peer Topics 49
3.9.1 TCP Multi-homing 50
3.9.2 SCTP Multi-homing 51
3.9.2.1 Multi-homing in freeDiameter 53
3.9.3 Avoiding Head-of-Line Blocking 56
3.9.4 Multiple Connection Instances 56
References 59
4 Diameter End-to-End Communication 61
4.1 Introduction 61
4.2 The Routing Table 61
4.3 Diameter Request Routing 63
4.3.1 AVPs to Route Request Messages 64
4.3.1.1 Destination-Realm AVP 64
4.3.1.2 Destination-Host AVP 64
4.3.1.3 Auth-Application-Id and Acct-Application-Id AVPs 64
4.3.1.4 User-Name AVP 65
4.3.2 Routing AVPs 66
4.3.2.1 Route-Record AVP 66
4.3.2.2 Proxy-Info AVP 66
4.4 Request Routing Error Handling 67
4.4.1 Detecting Duplicated Messages 67
4.4.2 Error Codes 67
4.5 Answer Message Routing 68
4.5.1 Relaying and Proxying Answer Messages 69
4.6 Intra-Realm versus Inter-Realm Communication 69
4.7 Diameter Routing and Inter-Connection Networks 70
4.7.1 Inter-Connection Approaches 70
4.7.2 Dynamic Diameter Node Discovery 72
4.7.2.1 Alternative 1 73
4.7.2.2 Alternative 2 73
4.7.2.3 Alternative 3 73
4.8 Diameter Overload Control 75
4.8.1 Overload Reports 77
4.8.2 Overload Control State 77
4.8.3 Overload Abatement Considerations 79
References 79
5 Diameter Security 81
5.1 Introduction 81
5.2 Background 82
5.2.1 Unkeyed Primitives 83
5.2.2 Symmetric Key Primitives 84
5.2.3 Asymmetric Key Primitives 84
5.2.4 Key Length Recommendations 86
5.3 Security Threats 87
5.4 Security Services 90
5.4.1 Diameter Security Model 90
5.4.1.1 Secure Transports 91
5.4.1.2 Authorization 92
5.4.2 Relation to Threats 93
5.4.3 Mitigating Other Threats 93
5.5 PKI Example Configuration in freeDiameter 94
5.5.1 The Configuration File 94
5.5.2 The Certificate 96
5.5.3 Protecting Exchanges via TLS 97
5.5.3.1 Common Name and Hostname Mismatch 98
5.5.3.2 Unprotected Exchanges 99
5.5.3.3 Certificate Revocation 100
5.6 Security Evolution 102
References 102
6 Diameter Applications 105
6.1 Introduction 105
6.2 Base Accounting 105
6.2.1 Actors 106
6.2.2 Accounting Application Setup 106
6.2.3 Accounting Services 107
6.2.4 Accounting Records 109
6.2.5 Correlation of Accounting Records 109
6.2.6 Sending Accounting Information 110
6.2.7 Accounting AVPs 110
6.2.8 freeDiameter Example 112
6.2.9 Fault Resilience 113
6.2.10 Example: 3GPP Rf Interface for Mobile Offline Charging 113
6.2.10.1 Rf Interface Commands 114
6.3 Credit Control 115
6.3.1 Credit-Control-Request Command 116
6.3.2 Credit-Control-Answer Command 118
6.3.3 Failure Handling 120
6.3.4 Extensibility 121
6.3.5 Example: 3GPP Ro Interface for Online Charging 121
6.4 Quality of Service 122
6.4.1 Actors 122
6.4.2 Modes of Operation 123
6.4.2.1 Push Mode 123
6.4.2.2 Pull Mode 123
6.4.3 Authorization 124
6.4.3.1 Push Mode Authorization Schemes 124
6.4.3.2 Pull Mode Authorization 124
6.4.4 Establishing and Managing a QoS Application Session 126
6.4.4.1 Establishing a Session 126
6.4.5 Re-Authorizing a Session 129
6.4.5.1 Re-Authorization Initiated by the NE 129
6.4.5.2 Re-Authorization Initiated by the Authorizing Elements 129
6.4.6 Terminating a Session 129
6.4.6.1 Session Terminated by the NE 129
6.4.6.2 Session Terminated by the AE 129
6.5 Interworking RADIUS and Diameter 130
6.6 S6a Interface 137
6.6.1 Evolved Packet Core 137
6.6.2 S6a Overview 138
6.6.2.1 Common AVPs for S6a Commands 139
6.6.3 Authentication 140
6.6.3.1 Authentication-Information-Request Command 140
6.6.3.2 Authentication-Information-Answer Command 141
6.6.4 Location Management 142
6.6.4.1 Update-Location-Request Command 142
6.6.4.2 Cancel-Location-Request Command 144
6.6.4.3 Cancel-Location-Answer Command 145
6.6.4.4 Update-Location-Answer Command 145
6.6.5 Subscriber Data Handling 146
6.6.5.1 Insert-Subscriber-Data-Request Command 146
6.6.5.2 Insert-Subscriber-Data-Answer Command 147
6.6.5.3 Delete-Subscriber-Data-Request Command 149
6.6.5.4 Delete-Subscriber-Data-Answer Message 150
6.6.6 Fault Recovery 150
6.6.6.1 Reset-Request Command 150
6.6.6.2 Reset-Answer Command 151
6.6.7 Notifications 152
6.6.7.1 Notify-Request Command 152
6.6.7.2 Notify-Answer Command 154
6.6.8 Ending Subscriber Sessions 154
6.6.8.1 Purge-UE-Request AVPs 154
6.6.8.2 Purge-UE-Answer Command 155
6.6.9 Extensibility 156
References 156
7 Guidelines for Extending Diameter 159
7.1 Introduction 159
7.2 Registration Policies 160
7.3 Overview of Extension Strategies 161
7.4 Extending Attribute-Value Pairs 162
7.4.1 Extending Existing AVPs 162
7.4.1.1 Creating New AVP Flags 162
7.4.1.2 Adding AVP Extension Points 162
7.4.1.3 Adding New AVP Values 162
7.5 Extending Commands 163
7.5.1 Allocating New Command Flags 163
7.5.2 Adding New AVPs 163
7.5.2.1 Adding New AVPs to Base Commands 165
7.5.3 Creating New Commands 165
7.5.3.1 Routing AVPs 165
7.6 Creating New Applications 166
7.6.1 The Application-Id 166
7.7 Lessons Learned 167
7.8 Vendor-specific Extensions 169
7.8.1 AVPs 169
7.8.2 Command Codes 170
7.8.3 Diameter Applications 170
7.9 Prototyping with freeDiameter 170
References 170
Appendix A freeDiameter Tutorial 173
A.1 Introduction to Virtual Machines 173
A.2 Installing the Virtualization Software 174
A.3 Creating Your Own Environment 174
A.4 Downloading the VM Image 174
A.5 Installing and Starting the Master VM freeDiameter 174
A.6 Creating a Connection Between Two Diameter Peers 175
A.6.1 Building client.example.net 176
A.6.2 Building server.example.net 177
A.6.3 Creating the Diameter Connection 178
Appendix B freeDiameter from Sources 183
B.1 Introduction 183
B.2 Tools and Dependencies 183
B.2.1 Runtime Dependencies 184
B.2.1.1 SCTP 184
B.2.1.2 TLS 184
B.2.1.3 Internationalized Domain Names 185
B.3 Obtaining freeDiameter Source Code 185
B.4 Configuring the Build 186
B.5 Compiling freeDiameter 188
B.6 Installing freeDiameter 189
B.7 freeDiameter Configuration File 189
B.8 Running and Debugging freeDiameter 190
B.9 Extensions for Debug Support 192
B.9.1 Extended Trace 192
B.9.2 Logging Diameter Messages: dbg_msg_dumps.fdx 193
B.9.3 Measuring Processing Time: dbg_msg_timings.fdx 195
B.9.4 Viewing Queue Statistics: dbg_monitor.fdx 196
B.9.5 Understanding Routing Decisions: dbg_rt.fdx 197
B.9.6 The Interactive Python Shell Extension: dbg_interactive.fdx 198
B.10 Further Reading 199
Reference 199
Appendix C The freeDiameter Framework 201
C.1 Introduction 201
C.2 Framework Modules 201
C.3 freeDiameter API Overview 202
C.3.1 libfdproto.h 203
C.3.2 libfdcore.h 205
C.3.3 extension.h 207
C.4 freeDiameter Architectures 207
Reference 208
Glossary 209
Index 213
About the Authors xv
Foreword xvii
Preface xix
Acknowledgements xxiii
List of Abbreviations xxv
1 Introduction 1
1.1 What is AAA? 1
1.2 Open Standards and the IETF 2
1.3 What is Diameter? 3
1.3.1 Diameter versus RADIUS 4
1.3.2 Diameter Improvements 5
1.4 What is freeDiameter? 6
References 6
2 Fundamental Diameter Concepts and Building Blocks 9
2.1 Introduction 9
2.2 Diameter Nodes 9
2.3 Diameter Protocol Structure 10
2.4 Diameter Applications 10
2.5 Connections 11
2.5.1 Transport Layer 11
2.5.2 Peer-to-Peer Messaging Layer 12
2.5.3 Setting up a Connection between freeDiameter Peers 12
2.6 Diameter Message Overview 12
2.6.1 The Command Code Format 13
2.6.2 Message Structure 15
2.6.3 Attribute-Value Pairs 16
2.6.3.1 Format 16
2.6.4 Derived AVP Data Formats 20
2.7 Diameter Sessions 20
2.8 Transaction Results 21
2.8.1 Successful Transactions 21
2.8.2 Protocol Errors 21
2.8.3 Transient Failures 22
2.8.4 Permanent Failures 23
2.9 Diameter Agents 25
2.9.1 Saving State 25
2.9.2 Redirect Agents 25
2.9.3 Relay Agents 25
2.9.4 Proxy Agents 27
2.9.5 Translation Agents 27
References 27
3 Communication between Neighboring Peers 29
3.1 Introduction 29
3.2 Peer Connections and Diameter Sessions 29
3.3 The DiameterIdentity 29
3.4 Peer Discovery 31
3.4.1 Static Discovery 31
3.4.1.1 Static Discovery in freeDiameter 31
3.4.2 Dynamic Discovery 32
3.4.2.1 Dynamic Discovery and DiameterURI 35
3.4.2.2 DNS Further Reading 36
3.5 Connection Establishment 36
3.5.1 The Election Process: Handling Simultaneous Connection Attempts 37
3.6 Capabilities Exchange 37
3.6.1 freeDiameter example 38
3.6.2 The Capabilities Exchange Request 39
3.6.3 Capabilities Exchange Answer 40
3.6.4 Hop-by-Hop Identifiers 41
3.7 The Peer Table 42
3.8 Peer Connection Maintenance 43
3.8.1 Transport Failure, Failover, and Failback Procedures 45
3.8.2 Peer State Machine 49
3.9 Advanced Transport and Peer Topics 49
3.9.1 TCP Multi-homing 50
3.9.2 SCTP Multi-homing 51
3.9.2.1 Multi-homing in freeDiameter 53
3.9.3 Avoiding Head-of-Line Blocking 56
3.9.4 Multiple Connection Instances 56
References 59
4 Diameter End-to-End Communication 61
4.1 Introduction 61
4.2 The Routing Table 61
4.3 Diameter Request Routing 63
4.3.1 AVPs to Route Request Messages 64
4.3.1.1 Destination-Realm AVP 64
4.3.1.2 Destination-Host AVP 64
4.3.1.3 Auth-Application-Id and Acct-Application-Id AVPs 64
4.3.1.4 User-Name AVP 65
4.3.2 Routing AVPs 66
4.3.2.1 Route-Record AVP 66
4.3.2.2 Proxy-Info AVP 66
4.4 Request Routing Error Handling 67
4.4.1 Detecting Duplicated Messages 67
4.4.2 Error Codes 67
4.5 Answer Message Routing 68
4.5.1 Relaying and Proxying Answer Messages 69
4.6 Intra-Realm versus Inter-Realm Communication 69
4.7 Diameter Routing and Inter-Connection Networks 70
4.7.1 Inter-Connection Approaches 70
4.7.2 Dynamic Diameter Node Discovery 72
4.7.2.1 Alternative 1 73
4.7.2.2 Alternative 2 73
4.7.2.3 Alternative 3 73
4.8 Diameter Overload Control 75
4.8.1 Overload Reports 77
4.8.2 Overload Control State 77
4.8.3 Overload Abatement Considerations 79
References 79
5 Diameter Security 81
5.1 Introduction 81
5.2 Background 82
5.2.1 Unkeyed Primitives 83
5.2.2 Symmetric Key Primitives 84
5.2.3 Asymmetric Key Primitives 84
5.2.4 Key Length Recommendations 86
5.3 Security Threats 87
5.4 Security Services 90
5.4.1 Diameter Security Model 90
5.4.1.1 Secure Transports 91
5.4.1.2 Authorization 92
5.4.2 Relation to Threats 93
5.4.3 Mitigating Other Threats 93
5.5 PKI Example Configuration in freeDiameter 94
5.5.1 The Configuration File 94
5.5.2 The Certificate 96
5.5.3 Protecting Exchanges via TLS 97
5.5.3.1 Common Name and Hostname Mismatch 98
5.5.3.2 Unprotected Exchanges 99
5.5.3.3 Certificate Revocation 100
5.6 Security Evolution 102
References 102
6 Diameter Applications 105
6.1 Introduction 105
6.2 Base Accounting 105
6.2.1 Actors 106
6.2.2 Accounting Application Setup 106
6.2.3 Accounting Services 107
6.2.4 Accounting Records 109
6.2.5 Correlation of Accounting Records 109
6.2.6 Sending Accounting Information 110
6.2.7 Accounting AVPs 110
6.2.8 freeDiameter Example 112
6.2.9 Fault Resilience 113
6.2.10 Example: 3GPP Rf Interface for Mobile Offline Charging 113
6.2.10.1 Rf Interface Commands 114
6.3 Credit Control 115
6.3.1 Credit-Control-Request Command 116
6.3.2 Credit-Control-Answer Command 118
6.3.3 Failure Handling 120
6.3.4 Extensibility 121
6.3.5 Example: 3GPP Ro Interface for Online Charging 121
6.4 Quality of Service 122
6.4.1 Actors 122
6.4.2 Modes of Operation 123
6.4.2.1 Push Mode 123
6.4.2.2 Pull Mode 123
6.4.3 Authorization 124
6.4.3.1 Push Mode Authorization Schemes 124
6.4.3.2 Pull Mode Authorization 124
6.4.4 Establishing and Managing a QoS Application Session 126
6.4.4.1 Establishing a Session 126
6.4.5 Re-Authorizing a Session 129
6.4.5.1 Re-Authorization Initiated by the NE 129
6.4.5.2 Re-Authorization Initiated by the Authorizing Elements 129
6.4.6 Terminating a Session 129
6.4.6.1 Session Terminated by the NE 129
6.4.6.2 Session Terminated by the AE 129
6.5 Interworking RADIUS and Diameter 130
6.6 S6a Interface 137
6.6.1 Evolved Packet Core 137
6.6.2 S6a Overview 138
6.6.2.1 Common AVPs for S6a Commands 139
6.6.3 Authentication 140
6.6.3.1 Authentication-Information-Request Command 140
6.6.3.2 Authentication-Information-Answer Command 141
6.6.4 Location Management 142
6.6.4.1 Update-Location-Request Command 142
6.6.4.2 Cancel-Location-Request Command 144
6.6.4.3 Cancel-Location-Answer Command 145
6.6.4.4 Update-Location-Answer Command 145
6.6.5 Subscriber Data Handling 146
6.6.5.1 Insert-Subscriber-Data-Request Command 146
6.6.5.2 Insert-Subscriber-Data-Answer Command 147
6.6.5.3 Delete-Subscriber-Data-Request Command 149
6.6.5.4 Delete-Subscriber-Data-Answer Message 150
6.6.6 Fault Recovery 150
6.6.6.1 Reset-Request Command 150
6.6.6.2 Reset-Answer Command 151
6.6.7 Notifications 152
6.6.7.1 Notify-Request Command 152
6.6.7.2 Notify-Answer Command 154
6.6.8 Ending Subscriber Sessions 154
6.6.8.1 Purge-UE-Request AVPs 154
6.6.8.2 Purge-UE-Answer Command 155
6.6.9 Extensibility 156
References 156
7 Guidelines for Extending Diameter 159
7.1 Introduction 159
7.2 Registration Policies 160
7.3 Overview of Extension Strategies 161
7.4 Extending Attribute-Value Pairs 162
7.4.1 Extending Existing AVPs 162
7.4.1.1 Creating New AVP Flags 162
7.4.1.2 Adding AVP Extension Points 162
7.4.1.3 Adding New AVP Values 162
7.5 Extending Commands 163
7.5.1 Allocating New Command Flags 163
7.5.2 Adding New AVPs 163
7.5.2.1 Adding New AVPs to Base Commands 165
7.5.3 Creating New Commands 165
7.5.3.1 Routing AVPs 165
7.6 Creating New Applications 166
7.6.1 The Application-Id 166
7.7 Lessons Learned 167
7.8 Vendor-specific Extensions 169
7.8.1 AVPs 169
7.8.2 Command Codes 170
7.8.3 Diameter Applications 170
7.9 Prototyping with freeDiameter 170
References 170
Appendix A freeDiameter Tutorial 173
A.1 Introduction to Virtual Machines 173
A.2 Installing the Virtualization Software 174
A.3 Creating Your Own Environment 174
A.4 Downloading the VM Image 174
A.5 Installing and Starting the Master VM freeDiameter 174
A.6 Creating a Connection Between Two Diameter Peers 175
A.6.1 Building client.example.net 176
A.6.2 Building server.example.net 177
A.6.3 Creating the Diameter Connection 178
Appendix B freeDiameter from Sources 183
B.1 Introduction 183
B.2 Tools and Dependencies 183
B.2.1 Runtime Dependencies 184
B.2.1.1 SCTP 184
B.2.1.2 TLS 184
B.2.1.3 Internationalized Domain Names 185
B.3 Obtaining freeDiameter Source Code 185
B.4 Configuring the Build 186
B.5 Compiling freeDiameter 188
B.6 Installing freeDiameter 189
B.7 freeDiameter Configuration File 189
B.8 Running and Debugging freeDiameter 190
B.9 Extensions for Debug Support 192
B.9.1 Extended Trace 192
B.9.2 Logging Diameter Messages: dbg_msg_dumps.fdx 193
B.9.3 Measuring Processing Time: dbg_msg_timings.fdx 195
B.9.4 Viewing Queue Statistics: dbg_monitor.fdx 196
B.9.5 Understanding Routing Decisions: dbg_rt.fdx 197
B.9.6 The Interactive Python Shell Extension: dbg_interactive.fdx 198
B.10 Further Reading 199
Reference 199
Appendix C The freeDiameter Framework 201
C.1 Introduction 201
C.2 Framework Modules 201
C.3 freeDiameter API Overview 202
C.3.1 libfdproto.h 203
C.3.2 libfdcore.h 205
C.3.3 extension.h 207
C.4 freeDiameter Architectures 207
Reference 208
Glossary 209
Index 213
HANNES TSCHOFENIG is employed by Arm Ltd. where his focus is on improving the security of Internet of Things device. While working for Nokia Siemens Networks he co-chaired the IETF Diameter Maintenance and Extensions (DIME) working group.
SÉBASTIEN DECUGIS is a former Senior Visiting Researcher at Keio University in Japan, and developer of the freeDiameter implementation.
JEAN MAHONEY has more than a decade's worth of experience with IETF specifications and the servers and clients built on top of them. Jean is currently the co-chair of the IETF SIPCORE working group and Gen-ART Secretary.
JOUNI KORHONEN is Principal R&D Engineer with Nordic Semiconductor, and co-author of Deploying IPv6 in 3GPP Networks.
SÉBASTIEN DECUGIS is a former Senior Visiting Researcher at Keio University in Japan, and developer of the freeDiameter implementation.
JEAN MAHONEY has more than a decade's worth of experience with IETF specifications and the servers and clients built on top of them. Jean is currently the co-chair of the IETF SIPCORE working group and Gen-ART Secretary.
JOUNI KORHONEN is Principal R&D Engineer with Nordic Semiconductor, and co-author of Deploying IPv6 in 3GPP Networks.
