diameter

Diameter is an authentication, authorization, and accounting protocol for computer networks. It evolved from and replaces the much less capable RADIUS protocol that preceded it.

Diameter Applications extend the base protocol by adding new commands and/or attributes, such as those for use of the Extensible Authentication Protocol (EAP).

Comparison with RADIUS[edit source | editbeta]

The name is a play on words, derived from the RADIUS protocol, which is the predecessor (a diameter is twice the radius). Diameter is not directly backwards compatible but provides an upgrade path for RADIUS. The main differences are the following:

• Reliable transport protocols (TCP or SCTP, not UDP)----------- 客户端可以支持TCP或者SCTP；而服务端和中继必须二者都支持。
  • The IETF is in the process of standardizing TCP Transport for RADIUS
• Network or transport layer security (IPsec or TLS)---------- IPSec必须支持，TLS可选。
  • The IETF is in the process of standardizing Transport Layer Security for RADIUS
• Transition support for RADIUS, although Diameter is not fully compatible with RADIUS
• Larger address space for attribute-value pairs (AVPs) and identifiers(32 bits instead of 8 bits)
• Client–server protocol, with exception of supporting some server-initiated messages as well(服务器端主动发起消息，如RAR，DPR，DWR消息)
• Both stateful and stateless models can be used
• Dynamic discovery of peers (using DNS SRV and NAPTR)
• Capability negotiation（即CER，CEA）
• Supports application layer acknowledgements, defines failover methods and state machines (RFC 3539)
• Error notification
• Better roaming support
• More easily extended; new commands and attributes can be defined
• Aligned on 32-bit boundaries
• Basic support for user-sessions and accounting
• 故障恢复就是failback；如果故障了，尝试使用另外一个，则是failover。

Applications[edit source | editbeta]

A Diameter Application is not a software application but is a protocol based on the Diameter base protocol defined in RFC 6733 (Obsoletes: RFC 3588). Each application is defined by an application identifier and can add new command codes and/or new mandatory AVPs. Adding a new optional AVP does not require a new application.

Examples of Diameter applications:

• Diameter Mobile IPv4 Application (MobileIP, RFC 4004)
• Diameter Network Access Server Application (NASREQ, RFC 4005)
• Diameter Extensible Authentication Protocol Application (RFC 4072)
• Diameter Credit-Control Application (DCCA, RFC 4006) --------------------- 用于3gpp 32.299的在线离线计费。
• Diameter Session Initiation Protocol Application (RFC 4740)
• Various applications in the 3GPP IP Multimedia Subsystem

Both the  HSS and the  SLF communicate using the Diameter protocol.

(Generic Bootstrapping Architecture): Bootstrapping Server Function

History[edit source | editbeta]

The Diameter protocol was initially developed by Pat R. Calhoun, Glen Zorn, and Ping Pan in 1998 to provide an Authentication, Authorization, and Accounting (AAA) framework that could overcome the limitations of RADIUS. RADIUS had issues with reliability, scalability, security and flexibility. RADIUS cannot effectively deal well with remote access, IP mobility, and policy control. The Diameter protocol defines a policy protocol used by clients to perform Policy, AAA, and Resource Control. This allows a single server to handle policies for many services.^[1]

Like RADIUS, Diameter provides AAA functionality but in addition it is made more reliable by using TCP and SCTP instead of UDP. The Diameter protocol is further enhanced by the development of the 3rd Generation Partnership Project (3GPP) IP Multimedia Subsystem (IMS). The Cx, Dh, Dx, Rf, Ro, and Shinterfaces are supported by Diameter applications.^[2] Through the use of extensions, the protocol was designed to be extensible to support Proxies, Brokers, Strong Security, Mobile-IP, Network Access Servers (NASREQ), Accounting, and Resource Management.

Protocol description[edit source | editbeta]

This section requires expansion. (June 2008)

The Diameter base protocol is defined by RFC 6733 (Obsoletes: RFC 3588) and defines the minimum requirements for an AAA protocol. Diameter Applications can extend the base protocol by adding new commands, attributes, or both. Diameter security is provided by IPsec or TLS.The IANA has assigned TCP and SCTP port number 3868 to Diameter. 

----- TLS/TCP and Datagram Transport Layer Security，DTLS/SCTP缺省使用5658，为了兼容rfc3588，也可以支持3868。

Packet format[edit source | editbeta]

The packet consists of a Diameter header and a variable number of Attribute-Value Pairs, or AVPs, for encapsulating information relevant to the Diameter message.

The "R" (Request) bit – If set, the message is a request. If cleared, the message is an answer.

The "P" (Proxiable) bit – If set, the message MAY be proxied, relayed or redirected. If cleared, the message MUST be locally processed.

The "E" (Error) bit – If set, the message contains a protocol error, and the message will not conform to the ABNF described for this command. Messages with the "E" bit set are commonly referred to as error messages. This bit MUST NOT be set in request messages.

The "T" (Potentially re-transmitted message) bit – This flag is set after a link failover procedure, to aid the removal of duplicate requests. It is set when resending requests not yet acknowledged as an indication of a possible duplicate due to a link failure.一定不能出现在应答消息里。

Commands[edit source | editbeta]

Each command is assigned a command code, which is used for both Requests and Answers.

The values 0-255 are reserved for RADIUS backward compatibility. The values 256-16777213 are for permanent, standard commands allocated by IANA. The values 16777214 and 16777215 (hex 0xFFFFFE and 0xFFFFFF) are reserved for experimental and testing purposes.

Some common Diameter commands are:

This section requires expansion.(December 2009)

Attribute-Value Pairs (AVP)[edit source | editbeta]

For simplicity, "V" bit Means Vendor Specific; "M" bit means Mandatory;"P" bit means Protected.

The "V" bit, known as the Vendor-Specific bit, indicates whether the optional Vendor-ID field is present in the AVP header. When set the AVP Code belongs to the specific vendor code address space.

The "M" bit, known as the Mandatory bit, indicates whether support of the AVP is required. If an AVP with the "M" bit set is received by a Diameter client, server, proxy, or translation agent and either the AVP or its value is unrecognized, the message MUST be rejected. Diameter Relay and redirect agents MUST NOT reject messages with unrecognized AVPs.

The "P" bit indicates the need for encryption for end-to-end security.

State machines[edit source | editbeta]

This section requires expansion.(December 2009)

The RFC 3588 defines a core state machine for maintaining connections between peers and processing messages. This is part of the basic protocol functionality and all stacks should support it and as such abstract from the connectivity related operations.

• 

  Peer State Machine Part 1

   
• 

  Peer State Machine Part 2

Additionally, application specific state machines can be introduced either later or at a higher abstraction layer. The RFC 3588 defines an authorization and an accounting state machine.

• 

  Diameter Authorization State Machines (Client)

   
• 

  Diameter Authorization State Machines (Server)

   
• 

  Diameter Accounting State Machines (Client)

   
• 

  Diameter Accounting State Machines (Server)

Message flows[edit source | editbeta]

The communication between two diameter peers starts with the establishment of a transport connection (TCP or SCTP). The initiator then sends a Capabilities-Exchange-Request (CER) to the other peer, which responds with a Capabilities-Exchange-Answer (CEA).For RFC3588 compliant peers TLS (Transport Layer Security) may optionally be negotiated. For RFC6733 compliant peers TLS negotiation may optionally happen before the CER/CEA.TLS功能是协商的。

The connection is then ready for exchanging application messages.

If no messages have been exchanged for some time either side may send a Device-Watchdog-Request (DWR) and the other peer must respond with Device-Watchdog-Answer. 如果一段时间没有消息，任何一端可以发送DWR。

Either side may terminate the communication by sending a Disconnect-Peer-Request (DPR) which the other peer must respond to with Disconnect-Peer-Answer. After that the transport connection can be disconnected. 任何一端可以主动通过DPR断开连接

RFCs[edit source | editbeta]

The Diameter protocol is currently defined in the following IETF RFCs: Obsolete RFCs are indicated with strikethrough text.