Subject: RE: [Sipping] SIP-AAA Requirements (fwd)

From: [email-masked]
Date: Thu, 2 May 2002 07:17:16 +0300

Hi Henry,

> As 3GPP, 3GPP2 and 802.11 wireless networks are poised to use both SIP
> and Mobile IP, one cannot help notice there seems to be a lot
> commonality between:
> 
> 1-SIP AAA requirements
> http://www-nrc.nokia.com/sua/draft-loughney-sip-aaa-req-00.txt
> 
> 2-3GPP Requirements on SIP
> http://ietf.org/internet-drafts/draft-garcia-sipping-3gpp-reqs-03.txt
> 
> 3-and most of all, Mobile IP AAA Requirements, RFC 2977
> ftp://ftp.isi.edu/in-notes/rfc2977.txt
> 
> The mobile IP WG 
> http://ietf.org/html.charters/mobileip-charter.html has
> actually covered a lot of groundwork, where it may make sense to avoid
> duplication, such as for example for AAA Registration Keys
> http://ietf.org/internet-drafts/draft-ietf-mobileip-aaa-key-09.txt

My comment would be that perhaps there are not many ways to skin a cat.

> One more item that the Mobile IP WG has successfully solved is the
> separation of specific AAA solutions such as RADIUS, DIAMETER or XML web
> services from the mobile IP protocol itself. It is not for the SIPPING
> WG to pick winners and losers in AAA solutions and promote one or
> another, as has been discussed.

Yes, that is why I was asked to work on the requirements, coming from
the AAA WG.  What is needed from SIPPING is to see what needs
SIP has, and I would appreciate feedback related to this.  From the AAA
WG view point (& IESG viewpoint, I believe) is that RADIUS is not
sufficient and there are well know deficiencies with RADIUS that
make further deployment problematic.  The ongoing Diameter work is
attempting to make AAA work for the Internet, which SIP is part of.
 
> We should try to avoid coming up with several different/incompatible
> infrastructures, multiple logons and general annoyance from 
> duplication of work. Or have the IESG step in to make order.

This is very important.  This is part of the exersize with regards
to SIP - we need to make sure the real requirements of SIP are covered.

> I believe the SIPPING Mobile IP and AAAarch IP folks should talk to each
> other during the WG discussions or maybe possibly at a Bar BOF. I have
> taken therefore the liberty to copy the Mobile IP and AAAarch lists.

I think that solutions for SIP-AAA need not overlap, but be re-used.  If
one solution can fufill 2 requirements, that solution seems quite ideal,
IMO.  Anyhow, I think the more immediate need would be to generate some
discussion on the draft, and see what has been left out.

thanks,
John

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Pete McCann <[email-masked]>
Date: Thu, 9 May 2002 13:25:54 -0500 (CDT)

Hi,

I have read over draft-loughney-sip-aaa-req-00.txt and I have some
comments below; unfortunately, I was not able to attend the interim
meeting.  Would anyone be willing to summarize the discussion that
took place on this draft?

I am glad to see that the first requirement mentions
access-independence.  I think it is very important for the IETF to
develop one common solution for SIP-AAA that works on any kind of
access network.

I noticed that a bit of terminology leaked into the document from
somewhere else: the term "home entry SIP proxy" is used in 2.1.6, but
I don't think it's defined anywhere in the draft.  I would like to
make sure that the discussion in the draft is focused on terms like
UACs, UASs, and proxies, without assuming any particular arrangement
of network elements or relationships between proxies.

The last paragraph of the introduction says:

   SIP sessions have needs for session authentication, authorization and
   accounting (i.e. - payment). 

I want to point out that accounting and payment are not the same
thing.  I think of accounting (in the AAA sense) as reporting usage,
and it could even be called "charging," but billing/payment/settlement
are separate issues.  Are they in the scope of SIP-AAA?  I am not
sure.

I notice section 2.3 only has one requirement - authorization of SIP
registration.  I would actually include subscriber-profile requirements
(e.g., 2.1.2 Distribution of Profiles) in this section.

Section 2.4.10 uses the terms "online" and "offline".  I think there
should be a definition of these terms and requirements added to
support both models.  "Online" accounting/charging usually means
downloading some kind of credit into the access device, and deducting
from that credit as usage accumulates.  The ID
draft-hakala-diameter-credit-control-02.txt is an example.  "Offline"
charging is simply transferring records to a home accounting server,
for later billing and settlement, without doing any accounting-related 
control or feedback for the services rendered.

I look forward to seeing Section 3 (Scenarios) fleshed out.

-Pete