7.1 Authentication and Authorization in the IMS

Transcription

1 Chapter 7 AAA in the IMS Authentication and authorization are generally linked in the IMS. In contrast, accounting is a separate function executed by different nodes. This was the reason why we decided to separate the description of authentication and authorization from the description of accounting. Section 7.1 discusses authentication and authorization, and Section 7.4 discusses accounting. 7.1 Authentication and Authorization in the IMS Figure 7.1 shows the IMS architecture for performing authentication and authorization functions. There are three interfaces over which authentication and authorization actions are performed (namely the Cx, Dx,andSh interfaces). The Cx interface is specified between a Home Subscriber Server () and either an I-CSCF or an. When more than a single is present in a home network there is a need for a Subscription Locator Function (SLF) to help the I-CSCF or to determine which stores the data for a certain user. The Dx interface connects an I-CSCF or to an SLF running in Diameter redirect mode. The Sh interface is specified between an and either a SIP Application Server or an OSA Service Capability Server (for a complete description of the different types of Application Server in the IMS, see Section 5.8.2). In all of these interfaces the protocol used between any two nodes is Diameter (specified in RFC 3588 [96]) with an IMS-specific tailored application. Such a Diameter application defines new Diameter command codes and new Attribute-Value Pairs (AVPs). 7.2 The Cx and Dx Interfaces The Cx interface is specified between an I-CSCF and an or between an and an. Similarly, the Dx interface is specified between an I-CSCF and an SLF or between an and an SLF. The only difference between these interfaces is that the SLF implements the functionality of a Diameter redirect agent, whereas the acts as a Diameter server. In either case, both the I-CSCFs and s act as Diameter clients. In networks where there is more than a single, Diameter clients (, I-CSCF) need to contact the SLF to find out which of the several s in the network stores the user information for the user identified by the Public User Identity. The Diameter command the ía- M ar tín The 3G IP Multimedia Subsystem (IMS): Merging the Internet and the Cellular Worlds Third Edition Gonzalo Camarillo and Miguel A. Garc 2008 John Wiley & Sons, Ltd. ISBN:

2 228 CHAPTER 7. AAA IN THE IMS SIP-AS Sh OSA-SCS Sh Dx Cx Cx Dx SLF I-CSCF Figure 7.1: Architecture for authentication and authorization in the IMS or the I-CSCF sends is the same, no matter whether the message is addressed to the SLF or the. The SLF acts as an enhanced Diameter redirect agent and contains a table that maps Public User Identities to the address of the that contains the user information. The SLF then includes a Redirect-Host AVP in the answer. The Redirect-Host AVP contains the address of the particular that the I-CSCF or needs to contact. The I-CSCF or then forwards the Diameter message addressed to that. Because Diameter messages over the Cx and Dx interfaces are the same, the Dx interface can be considered as transparent to describe the interactions over the Cx interface. In this chapter we typically refer to the Cx interface and the, but the description applies in a similar manner to the Dx interface and the SLF. Note that the implements neither the Cx nor the Dx interface. For a particular user the I-CSCF and use the Cx and Dx interfaces to perform the following functions: to locate an already allocated to the user; to download the authentication vectors of the user; these vectors are stored in the ; to authorize the user to roam in a visited network; to record in the the address of the allocated to the user; to inform the about the registration state of a user s identity; to download from the the user profile that includes the filter criteria;

3 7.2. THE Cx AND Dx INTERFACES 229 to push the user profile from the to the when the user profile has changed; to provide the I-CSCF with the necessary information to select an. The Cx and Dx interfaces implement a vendor-specific Diameter application called the Diameter Application for the Cx Interface. This application is specified in 3GPP TS [40] and 3GPP TS [33]. The Diameter Application for the Cx Interface is not standardized in the IETF, but the IETF has authorized, for 3GPP Release 5, this application (as specified in RFC 3589 [210]). The Diameter Application for the Cx Interface has formed the basis of a generic AAA application for SIP servers (documented in RFC 4740 [150]). It is foreseen that in future 3GPP releases the vendor-specific Diameter application for the Cx Interface will migrate to the IETF standardized Diameter SIP application Command Codes Defined in the Diameter Application for the Cx Interface As previously mentioned, the I-CSCF and perform a number of functions over the Cx and Dx interfaces. In order to perform these functions the Diameter Application for the Cx Interface has defined a number of new commands (requests and answers). Table 7.1 lists the new commands specified in the Diameter Application for the Cx Interface. Table 7.1: List of commands defined by the Diameter Application for the Cx Interface Command-Name Abbreviation Command-Code User-Authorization-Request UAR 300 User-Authorization-Answer UAA 300 Server-Assignment-Request SAR 301 Server-Assignment-Answer SAA 301 Location-Info-Request LIR 302 Location-Info-Answer LIA 302 Multimedia-Auth-Request MAR 303 Multimedia-Auth-Answer MAA 303 Registration-Termination-Request RTR 304 Registration-Termination-Answer RTA 304 Push-Profile-Request PPR 305 Push-Profile-Answer PPA User Authorization Request and Answer (UAR, UAA) An I-CSCF sends a User-Authorization-Request (UAR) message when the I-CSCF receives a SIP REGISTER request from an IMS terminal. There are a few reasons why the I-CSCF sends the Diameter UAR message to the. The first filters the Public User Identity contained in the SIP REGISTER request. For instance, the verifies that the Public User Identity is allocated to a legitimate

4 230 CHAPTER 7. AAA IN THE IMS subscriber of the home network and that the user is a regular non-blocked user (i.e., not blocked for lack of payment or any other reason). The also verifies that the home network has a roaming agreement with the network where the is operating. This allows the network to exchange charging records with the home network. The I-CSCF also needs to determine whether there is an already allocated to the Public User Identity under registration, before the I-CSCF forwards the SIP REGISTER request to that. If there is not an allocated to the Public User Identity, the I-CSCF will receive the set of capabilities required in the, so that the I-CSCF is able to select an with those capabilities. The SIP REGISTER request typically carries the Private User Identity and the Public User Identity of the user. The checks that the Public User Identity can use that Private User Identity for authentication purposes. Figure 7.2 depicts a typical registration flow. When the I-CSCF receives a SIP REGISTER request (2) it sends the Diameter UAR message to the (3). The sends a Diameter User-Authorization-Answer (UAA) message (4) and then the I-CSCF proceeds with the registration process. The operation is also repeated in (13) and (14), since the I-CSCF does not keep a state in between these registrations. Furthermore, because of DNS loadbalancing mechanisms, the I-CSCF that receives the first SIP REGISTER request (2) might not be the same I-CSCF that receives the second SIP REGISTER request (12). The includes a Result-Code AVP in the UAA message that helps the I-CSCF to determine whether to continue with the registration or to reject it. If the registration is authorized, the UAA message contains AVPs that help the I-CSCF to determine whether there is an already allocated to the user or whether the I-CSCF has to select a new Multimedia Auth Request and Answer (MAR, MAA) Figure 7.2 is also valid for describing the Diameter Multimedia-Auth-Request (MAR) and Multimedia-Auth-Answer (MAA) messages. When the receives an initial SIP REGISTER request, it has to authenticate the IMS user. However, in an initial registration the does not have authentication vectors to authenticate the user. These vectors are stored in the. The sends a Diameter MAR message to the with the purpose of retrieving the authentication vectors. In addition, the records its own SIP URI in the user-related data stored in the, so that other CSCFs (e.g., I-CSCFs) or ASes are able to get the URI of the allocated to that particular user by interrogating the Server Assignment Request and Answer (SAR, SAA) Figure 7.2 also shows the use of the SAR and SAA messages. When the eventually authenticates the user (actually, the Private User Identity), the Public User Identity is registered and bound to a contact address. At that time the sends the SAR message to the to inform the that the user is currently registered in that. The also requests the user profile associated with that user. The attaches the user profile in the SAA message.

5 7.2. THE Cx AND Dx INTERFACES 231 IMS Terminal I-CSCF (1) REGISTER (10) 401 Unauthorized (2) REGISTER (9) 401 Unauthorized (3) Diameter UAR (4) Diameter UAA (5) REGISTER (6) Diameter MAR (7) Diameter MAA (8) 401 Unauthorized (11) REGISTER (20) 200 OK (12) REGISTER (19) 200 OK (13) Diameter UAR (14) Diameter UAA (15) REGISTER (18) 200 OK (16) Diameter SAR (17) Diameter SAA Figure 7.2: UAR/UAA, MAR/MAA, and SAR/SAA messages during registration The also sends a SAR message to the when the user is no longer registered in that, so that the is aware of the user registration status. The might also request the to continue to be the allocated to the user, even when the user is not registered. The final word belongs to the, because it authorizes whether the keeps the allocation or not. Keeping the allocation allows the to keep the user profile information. Subsequent registrations would not require downloading such information from the Location Information Request and Answer (LIR, LIA) An I-CSCF that receives a SIP request that does not contain a Route header field that points to the next SIP hop () needs to find out which (if any) is allocated to the user. On receiving the SIP request the I-CSCF sends a Location-Info-Request (LIR) to the. The replies with a Location-Info-Answer (LIA). The LIA command indicates the SIP URI of the allocated to the user or, if there is no allocated to the user, then the will include the set of capabilities that are required by the, so that the I-CSCF is able to select an for this user (similar to the selection that takes place during initial registration). According to Figure 7.3 an I-CSCF that receives a SIP request that does not contain routing information sends a Diameter LIR message to the. The replies with a

6 232 CHAPTER 7. AAA IN THE IMS I-CSCF (1) INVITE (2) Diameter LIR (3) Diameter LIA (4) INVITE (5) Diameter SAR (6) Diameter SAA (7) INVITE Figure 7.3: LIR/LIA and SAR/SAA messages Diameter LIA message that contains the address of the that is allocated to the user; therefore, the I-CSCF forwards the INVITE request to that Registration Termination Request and Answer (RTR, RTA) Because of administrative action, the operator of the home network may wish to deregister one or more registered Public User Identities allocated to a user. When this happens the sends a Registration-Termination-Request (RTR) message to the where the user is registered. Figure 7.4 depicts an sending an RTR message to the with the purpose of deregistering one or more Public User Identities. The notifies all the subscribers of the user s reg state; in this case, the and the IMS terminal. In this example both the and the IMS terminal have subscribed to the user s reg state, so the notifies the (3) and the IMS terminal (5) and (6) Push Profile Request and Answer (PPR, PPA) The may change the user profile at any time, such as when a new service is available to the user; this action typically requires the addition of new filter criteria to the user profile. When the user profile is updated the sends a Push-Profile-Request message to the allocated to the user, with the message containing an updated copy of the user profile. Figure 7.5 shows an example of the PPR and PPA Diameter messages. These messages are not connected to any SIP signaling AVPs Defined in the Diameter Application for the Cx Interface The Diameter Application for the Cx Interface defines a number of new Attribute-Value Pairs. Table 7.2 lists these new attributes together with their AVP code. The Vendor-Id field of all of these AVPs is set to the value 10415, which identifies 3GPP. The Visited-Network-Identifier AVP conveys an identifier of the network where the is located. An I-CSCF maps the P-Visited-Network-ID header field included

7 7.2. THE Cx AND Dx INTERFACES 233 IMS Terminal (1) Diameter RTR (2) Diameter RTA (3) NOTIFY (4) 200 OK (6) NOTIFY (7) 200 OK (5) NOTIFY (8) 200 OK Figure 7.4: RTR/RTA messages (1) Diameter PPR (2) Diameter PPA Figure 7.5: PPR/PPA messages in a SIP REGISTER request to the Visited-Network-Identifier AVP. The home network is able to authorize the IMS terminal to use a located in that network. The Public-Identity AVP carries a Public User Identity (SIP URI or TEL URI). The Server-Name AVP contains the URI of the SIP server node (e.g., the URI). Server-Capabilities is a grouped AVP whose main purpose is to convey the required capabilities of the that will be serving the user. The conveys these capabilities to the I-CSCF, so that the I-CSCF can select an adequate for that user. As this is a grouped AVP it contains, in turn, other AVPs: Mandatory-Capability, Optional-Capability,andServer-Name. The Mandatory-Capability AVP indicates a capability that the chosen has to implement, whereas the Optional-Capability contains a capability that the may optionally implement. Both AVPs can be repeated a number of times to allow several capabilities to be expressed. Capabilities are represented by an integer. The home operator allocates the semantics of the capabilities to each integer, which is a valid action because the Cx interface is only used inside the home network. For instance, the capability of the