, Authorization and Accounting (AAA) Protocols

Agententechnologien in der Telekommunikation Sommersemester 2009

Babak Shafieian [email protected] A O T Agententechnologien in betrieblichen Anwendungen 10.06.2009 und der Telekommunikation Overview

A O T Agententechnologien in der Telekommunikation - 2 TU Berlin Motivation (Why AAA?)

Ö Telecommunications services are a global market worth over US$ 1.5 trillion in revenue. Home Entertainment

Voice over IP (VoIP) Multimedia Conference

Messaging/ Presence

A O T Agententechnologien in der Telekommunikation - 3 TU Berlin Authentication (Who is [email protected])

Ö Authentication is the process of verifying user’s identity using credentials like username, password or certificates.

Ö After the successful match of user’s authentication credentials with the credentials stored in the database of the service provider, the user is granted access to the network, otherwise the access is denied.

A O T Agententechnologien in der Telekommunikation - 4 TU Berlin Authorization

Ö Is the process of enforcing policies. It determines what types or qualities of network resources or specific services the user is permitted.

Ö By using the access policy defined for a specific user, the service provider grants or rejects the access requests from the user.

Ö Access policy could be applied on a per user or group basis.

A O T Agententechnologien in der Telekommunikation - 5 TU Berlin Accounting

Ö Is the process of keeping track of what the user is doing. Ö It includes: ƒ Amount of the time spent in the network (duration of session) ƒ Number of packets(or bytes) transmitted during a session. ƒ The accessed services during a session. Ö It may be used for: ƒ Billing ƒ Trend analysis ƒ Capacity planning and resource utilization ƒ Auditing

A O T Agententechnologien in der Telekommunikation - 6 TU Berlin History of AAA

Ö 1950’s/60’s: Classic Login ƒ Good old terminal logins on mainframes Ö 1993: TACACS (RFC 1492) ƒ Terminal Access Controller Access-Control System (TACACS) was originally designed to handle the access control in ARPANET. ƒ XTACACS is the extended version introduced by Cisco. ƒ The current version TACACS+ is an entirely new protocol and not compatible with older versions. Ö 1997: RADIUS (RFC 2058/2138/2865) Ö 1998: Framework Document (Internet Draft) Ö 2003: Diameter Base Protocol (RFC 3588) Ö 2005: Diameter Mobile IPv4 Application (RFC 4004)

A O T Agententechnologien in der Telekommunikation - 7 TU Berlin IRTF AAA Research Group

Ö The Authentication, Authorization and Accounting Working Group focused on the development of requirements for Authentication, Authorization and Accounting as applied to network access. Ö Archive available under http://www.aaaarch.org/ Ö Major RFCs: ƒ RFC 2903 Generic AAA Architecture ƒ RFC 2904 AAA Authorization Framework ƒ RFC 2905 AAA Authorization Application Examples ƒ RFC 2906 AAA Authorization Requirements

A O T Agententechnologien in der Telekommunikation - 8 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 9 TU Berlin AAA Architecture

A O T Agententechnologien in der Telekommunikation - 10 TU Berlin AAA Components

Ö End-User: Establishes a connection to the NAS via PPP and sends his credentials to it. Ö AAA Client: Gets the requests from the end-user and communicates via RADIUS protocol with AAA server. If the user could not be authenticated locally via PAP (Password ) or CHAP (Challenge Handshake Authentication Protocol), the AAA client sends a request to the AAA server. Ö AAA Server: The user data are stored in a database, LDAP directory or a text file.

A O T Agententechnologien in der Telekommunikation - 11 TU Berlin Flow of AAA Communication

A O T Agententechnologien in der Telekommunikation - 12 TU Berlin Flow of AAA Communication

1) In order to establish a connection with the network, the user sends his credentials to the AAA client. 2) The AAA client sends an Access-Request including user’s data to the AAA server. 3) The AAA server verifies the user’s credentials. In the case of successful authentication it replies with an Access-Accept otherwise with an Access-Reject. 4) The accounting data are sent to the AAA server after the user’s log-in and log-off. Other service related information could be also sent to the AAA server.

A O T Agententechnologien in der Telekommunikation - 13 TU Berlin AAA Failover

Ö For the sake of failover the administrator can define a list of AAA servers. t If the R1-Server responds with the PASS to the authentication request, then the access is granted. t If the R1- Server responds with the FAIL to the authentication request, then the access is rejected. t If there is no response at all from R1-Server, then the R2-Server is contacted.

A O T Agententechnologien in der Telekommunikation - 14 TU Berlin Authorization Sequences

Ö There are three types of communication relationships between the AAA components (in RFC 2904 as Single Domain Case Message Sequences):

1) Agent Sequence 2) Pull Sequence 3) Push Sequence

A O T Agententechnologien in der Telekommunikation - 15 TU Berlin Agent Sequence

1) The user sends a request to the AAA-Server 2) The AAA-Server authenticates the user and verifies whether the user is authorized for the service and requests the service from the service provider. 3) The service provider accepts the request. 4) The AAA-Server lets the user know that the access to service is granted.

A O T Agententechnologien in der Telekommunikation - 16 TU Berlin Pull Sequence

1) The user asks the AAA-Server directly for the service. 2) The service provider authenticates the user and verifies user’s credentials via AAA- Server. 3) The AAA-Server sends back the result. 4) The service provider provides the service.

A O T Agententechnologien in der Telekommunikation - 17 TU Berlin Push Sequence

1) The user is directly authenticated by the AAA-Server 2) The AAA-Server issues a signed ticket containing the authorization details. 3) The user presents the ticket to the service provider. 4) The service provider provides the service.

A O T Agententechnologien in der Telekommunikation - 18 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 19 TU Berlin AAA in CDMA

A O T Agententechnologien in der Telekommunikation - 20 TU Berlin AAA in CDMA

Ö Access Network AAA: Enables authentication and authorization functions at the AN.

Ö Broker AAA: Acts as an intermediary to proxy AAA traffic between roaming partner networks. (i.e., home network and serving network)

Ö Home AAA: The H-AAA is similar to the HLR in voice. The H-AAA stores user profile information, responds to authentication requests, and collects accounting information.

Ö Visited AAA: The V-AAA communicates with the H-AAA. Authentication requests and accounting information are forwarded by the V-AAA to the H-AAA, either directly or through a B-AAA.

A O T Agententechnologien in der Telekommunikation - 21 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 22 TU Berlin RADIUS History

Ö 1991: Originally specified by Merit Network to control dial-in access to NSFNET.

Ö 1993: First RADIUS server developed by Livingston Enterprises.

Ö 1996: IETF formalized Livingston’s work in 1996 by appointing RADIUS WG (Working Group).

Ö 1997: First RADIUS RFC (RFC 2058)

Ö 2001: RADIUS and IPv6 (RFC 3162)

Ö 2008: RADIUS Extension for Digest Authentication (RFC 5090)

A O T Agententechnologien in der Telekommunikation - 23 TU Berlin RADIUS Functionality

Ö Basics: RADIUS is a client/server protocol that runs in the application layer, using UDP as transport.

Ö Client-server-based operations: A RADIUS client resides on a NAS (e.g. WLAN access point, Foreign Agent, GGSN) collects user’s requests and forwards them to the RADIUS server. The RADIUS server may handle them locally or acts as a proxy for another RADIUS server.

Ö Network Security: The communication between a RADIUS client and server is authenticated by a shared secret key that is never sent over the network. The passwords are obfuscated using shared secrets along with the MD5 hashing algorithm.

A O T Agententechnologien in der Telekommunikation - 24 TU Berlin RADIUS Functionality

Ö Authentication Methods: RADIUS supports a wide range of authentication methods like PAP (Password Authentication Protocol), CHAP (Challenge Handshake Authentication Protocol) and EAP (Extended Authentication Protocol).

Ö Attribute Value Pairs (AVP): Transports AAA information in a RADIUS message. New attributes could be added.

A O T Agententechnologien in der Telekommunikation - 25 TU Berlin RADIUS Packet 1

Ö Code: determines the type of message.

Ö Identifier: helps to match requests and replies.

Ö Length: indicates the length of the entire RADIUS packet.

A O T Agententechnologien in der Telekommunikation - 26 TU Berlin RADIUS Packet 2

Ö Authenticator: is used to authenticate the reply from the RADIUS server, and is used in encrypting passwords.

Ö Attributes: contains the AAA information and configuration details regarding the requests/responses.

A O T Agententechnologien in der Telekommunikation - 27 TU Berlin Major RADIUS Codes

A O T Agententechnologien in der Telekommunikation - 28 TU Berlin Attribute-Value Pair (AVP)

A O T Agententechnologien in der Telekommunikation - 29 TU Berlin RADIUS Example – ISP Dial-In

1) User initiates PPP authentication to the NAS. 2) NAS prompts for username and password (if PAP) or challenge (if CHAP). 3) User replies. 4) RADIUS client sends username and encrypted password to the server. 5) RADIUS server responds with Accept, Reject, or Challenge. 6) The RADIUS client acts upon services parameters bundled with response.

A O T Agententechnologien in der Telekommunikation - 30 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 31 TU Berlin Extensible Authentication Protocol (EAP)

Ö Is a authentication framework used in wireless networks and PPP connections.

Ö IETF Standard (defined in RFC 3748)

Ö It runs directly over data link layers such as PPP or IEEE 802.

Ö It does not perform AAA tasks. It encapsulates third-party messages within its own messages, enabling client-server communication using any protocol.

Ö Supports a wide range of authentication methods e.g. TLS, MD5, PSK (Pre-Shared Key), SIM (Subscriber Identity) and AKA (Authentication and Key Agreement).

A O T Agententechnologien in der Telekommunikation - 32 TU Berlin EAP Message Flow

A O T Agententechnologien in der Telekommunikation - 33 TU Berlin EAP Framework

A O T Agententechnologien in der Telekommunikation - 34 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 35 TU Berlin Diameter

Ö It is a successor to RADIUS and is backward compatible to it.

Ö It was created to fix all the known RADIUS deficiencies.

Ö The Diameter Base Protocol is defined by RFC 3588 (2003)

Ö It can be extended to use it with new applications.

A O T Agententechnologien in der Telekommunikation - 36 TU Berlin New Functionalities

Ö Reliable message transport via TCP or SCTP.

Ö Server is able to initiate messages.

Ö Vendor specific AVPs could be integrated.

Ö Accounting information could be sent to the servers other than Authentication/Authorization Server.

Ö Hop-by-hop and end-to-end security with IPsec or TLS.

Ö Larger address space for attribute-value pairs (AVPs).

A O T Agententechnologien in der Telekommunikation - 37 TU Berlin RADIUS vs. Diameter

Characteristic RADIUS Diameter

Strict limitation of Only 1 byte reserved for the length of a Reserves 2 bytes for its length of a attribute data data field (max. 255) in its attribute data field (max. 16535) header

Inefficient Only 1 byte as identifier field to identify Reserved 4 bytes for this purpose retransmission retransmissions. This limits the number (max. 2^32) algorithm of requests that can be pending (max. 255) No failover server Server has no way of indicating that it is Supports keep-alive messages and support going down or is currently running. messages that indicate that a server is going downDifferent for a time period. services specified at each Hop-by-hop security Supports only hop-by-hop security; every Supports end-to-endlayer interface security, which hop can easily modify information that guarantees that information cannot be cannot be traced to its origin . modified without notice.

A O T Agententechnologien in der Telekommunikation - 38 TU Berlin Packet Format

...

A O T Agententechnologien in der Telekommunikation - 39 TU Berlin Diameter Design

Ö Diameter is defined as a Base Protocol which could be extended to the set of applications. Source Destination

A O T Agententechnologien in der Telekommunikation - 40 TU Berlin Diameter Applications

Ö Mobile IPv4 Application: It allows a Diameter server to authenticate, authorize and collect accounting information for Mobile IPv4 services rendered to a mobile node.

Ö Network Access Server Application (NASREQ): It is used for Authentication, Authorization, and Accounting (AAA) services in the Network Access Server (NAS) environment.

Ö EAP Application: It defines the Command-Codes and AVPs necessary to carry EAP packets between a Network Access Server (NAS) and a back-end authentication server.

Ö SIP Application: It provides a Diameter client co-located with a SIP server, with the ability to request the authentication of users and authorization of SIP resources usage from a Diameter server.

A O T Agententechnologien in der Telekommunikation - 41 TU Berlin Diameter Nodes

Ö Diameter Client: Performs the access control. E.g. Network Access Server (NAS) or Foreign Agent (FA). Ö Diameter Server: Handles authentication, authorization and accounting requests for a particular realm. Ö Relay Agent: Forwards the Diameter messages based on their information. Is able to modify routing information in the messages. Ö Proxy Agent: Forwards the Diameter messages. Is able to modify information in the messages. Ö Redirect Agent: Provides routing functionality. Acts as a centralized configuration repository for other Diameter nodes. Ö Translation Agent: Translates between different AAA protocols.

A O T Agententechnologien in der Telekommunikation - 42 TU Berlin Message Flows

A O T Agententechnologien in der Telekommunikation - 43 TU Berlin Commands

Ö Capabilities-Exchange-Request (CER): Is sent to exchange local capabilities.

Ö Capabilities-Exchange-Answer (CEA): Is sent in response to a CER message.

Ö Device-Watchdog-Request (DWR): Is sent to a peer when no traffic has been exchanged between two peers.

Ö Device-Watchdog-Answer (DWA): Is sent as a response to the DWR message.

Ö Disconnect-Peer-Request (DPR): Is sent to a peer to inform its intentions to shutdown the transport connection.

Ö Disconnect-Peer-Answer (DPA): Is sent as a response to the DPR message.

A O T Agententechnologien in der Telekommunikation - 44 TU Berlin Major RFCs

Ö RFC 3588: Diameter Base Protocol.

Ö RFC 3589: Diameter Command Codes for Third Generation Partnership Project.

Ö RFC 4004: Diameter Mobile IPv4 Application.

Ö RFC 4005: Diameter Network Access Server Application.

Ö RFC 4072: Diameter Extensible Authentication Protocol (EAP) Application.

Ö RFC 4740: Diameter Session Initiation Protocol (SIP) Application.

Ö RFC 5431: Diameter ITU-T Rw Policy Enforcement Interface Application.

Ö RFC 5447: Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction.

A O T Agententechnologien in der Telekommunikation - 45 TU Berlin Overview

A O T Agententechnologien in der Telekommunikation - 46 TU Berlin Real Life Scenario - eMobility

A O T Agententechnologien in der Telekommunikation - 47 TU Berlin Real Life Scenario - eMobility

A O T Agententechnologien in der Telekommunikation - 48 TU Berlin Real Life Scenario - eMobility

A O T Agententechnologien in der Telekommunikation - 49 TU Berlin ????????

A O T Agententechnologien in der Telekommunikation - 50 TU Berlin