Subject: RE: [SIP] Authentication and billing through proxy/re-direct serv er

From: "Arnoud van Wijk (ELN)" <[email-masked]>
Date: Tue, 10 Jul 2001 11:06:57 +0200

Mike,
That is indeed a good question. I personally like the fact of SIP and an OSP-token or some other token. Let a seperate node decide the policy and the permissions. Such a node can also be used for AAA functionality linked via DIAMETER etc. 

What SIP can do is sending an MESSAGE with additional information that is necessary for accounting, eg start time of a session and perhaps another to indicate the end-time and perhaps the selected QoS class etc. But this would be more as an addition and not to replace the current systems for AAA.

Maybe for real-time accounting? Then an operator gets an indication of the possible charges of a call and can see whether the user has enough credit on the account. And the AAA systems will sent the CDR and other acounting information at a later time.(the latter may be slow when you are a roaming mobile caller). I haven't had any time yet to look deeper into this matter.

Personally I like to get an indication of cost immediately when I place a call, it doesn't have to be 100% correct. 

But that are my own 2 cents.

Arnoud van Wijk
_______________________________________________________________
ERICSSON EUROLABS NETHERLANDS BV
Arnoud van Wijk
Innovation Unit
Research & Development (ELN/V)
Fax: +31-161 247569
_______________________________________________________________

-----Original Message-----
From: Dolan, Michael F (Mike) [mailto:[email-masked]]
Sent: dinsdag 10 jul 2001 5:23
To: Ashhar Farhan; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: RE: [SIP] Authentication and billing through proxy/re-direct
serv er

Ashhar,

3GPP2 is planning to use DIAMETER to capture and share such call record data
across system boundaries.  The AAA broker approach works well in this
application.  Is it necessary to re-create that entire mechanism in SIP as
well (along with proper authentication, etc.)?

Mike Dolan

Lucent Technologies - Bell Labs
263 Shuman Blvd., Room 2D-229
Naperville, IL 60566-7050,  USA
* Office:  +1.630.979.1033
* Mobile:  +1.630.697.3549
* Email:   [email-masked]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----Original Message-----
From: Ashhar Farhan [mailto:[email-masked]]
Sent: Friday, July 06, 2001 11:13 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: [SIP] Authentication and billing through proxy/re-direct server

by now, it is well understood that some sort of recording of the calls made
by a third party call-logging system is a requirement for many operative
networks. therefore we need a way of propagating CDRs to a remote entity.
for this, we have three options available to us:
1) introduce a new type of request message.
2) use NOTIFY with CDR in the body.
3) use MESSAGE with CDR in the body.
my personaly preference will be to NOTIFY the remote call-logger.
this is the simpler part of the issue.

about authentication:
authentication of a client with the gateway is a requirement. this
requirement is not necessarily for the purposes of billing. for instance, an
enterprise gateway may want to provide access to only certain caller. or a
personal gateway run at home over the DSL where only some are allowed to
call.

at all these times, the gateway needs to authenticate the caller without any
secret-sharing between them. therefore, there is a clear need for the
participation of the registrar or some other authenticating service to do
this.
if A calls B. B asks C is A real? C says yes because i have his secret.

while we could demand that the callers obtain their PGP keys, this is not a
workable solution. we need a simple, effective solution for this within the
SIP functionality (correct me if i am wrong on this).

my suggestions are like this:

1) Caller A issues an INVITE for the gateway to the proxy server.
2) proxy server challenges A, receives the correct response.
3) proxy server now proxies the INVITE to the gateway with no
authentication.
4) gateway challenges the proxy. proxy responds back with the digest over
the message headers, gateway password and the nonce issued by the gateway
(as described in the SIP RFC).

the second scheme is completely within the SIP framework. i wonder if a
stateless implementation of this scheme is possible.

____________________________________________________
Buy Feng Shui Package for Rs. 151/- only, at
http://shopping.rediff.com/shopping/fengshui_mailer.htm

_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip