draft-ietf-rap-rsvp-authsession-02.txt   draft-ietf-rap-rsvp-authsession-03.txt 
RAP Working Group L-N. Hamer RAP Working Group L-N. Hamer
Internet Draft B. Gage Internet Draft B. Gage
Expires August 31, 2002 M. Broda M. Broda
Nortel Networks Document: draft-ietf-rap-rsvp-authsession-03.txt Nortel Networks
B. Kosinski B. Kosinski
University of Alberta University of Alberta
Hugh Shieh Hugh Shieh
AT&T Wireless AT&T Wireless
February 2002 June 2002
Session Authorization for RSVP Session Authorization for RSVP
draft-ietf-rap-rsvp-authsession-02.txt
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026 [1]. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Internet-Drafts are draft documents valid for a maximum of Drafts. Internet-Drafts are draft documents valid for a maximum of
six months and may be updated, replaced, or obsoleted by other six months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-Drafts as documents at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress." reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet- Draft Shadow Directories can be accessed at The list of Internet- Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
The distribution of this memo is unlimited. This memo is filed as The distribution of this memo is unlimited. This memo is filed as
<draft-ietf-rap-rsvp-authsession-02.txt>, and expires August 31, <draft-ietf rap-rsvp-authsession-03.txt>, and expires November,
2002. Please send comments to the authors. 2002. Please send comments to the authors.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract Abstract
This document describes the representation of session authorization This document describes the representation of session authorization
information in the POLICY_DATA object [POL-EXT] for supporting information in the POLICY_DATA object (RFC 2750) for supporting
policy-based per-session authorization and admission control in policy-based per-session authorization and admission control in
RSVP. The goal of session authorization is to allow the exchange RSVP. The goal of session authorization is to allow the exchange of
of information between network elements in order to authorize the information between network elements in order to authorize the use
use of resources for a service and to co-ordinate actions between of resources for a service and to co-ordinate actions between the
the signaling and transport planes. This document describes how a signaling and transport planes. This document describes how a
process on a system authorizes the reservation of resources by a process on a system authorizes the reservation of resources by a
host and then provides that host with a session authorization host and then provides that host with a session authorization policy
policy element which can be inserted into the RSVP PATH message to element which can be inserted into the RSVP PATH message to
facilitate proper and secure reservation of those resources within facilitate proper and secure reservation of those resources within
the network. We describe the encoding of media authorization the network. We describe the encoding of media authorization
information as RSVP policy elements and provide details relating to information as RSVP policy elements and provide details relating to
operations, processing rules and error scenarios. operations, processing rules and error scenarios.
Contents
Status of this Memo................................................1
Copyright Notice...................................................1
Abstract...........................................................1
1. Conventions used in this document...............................3
2. Introduction....................................................3
3. Policy Element for Session Authorization Data...................4
3.1 Policy Data Object Format......................................4
3.2 Session Authorization Data Policy Element......................4
3.3 Session Authorization Attributes...............................4
3.3.1 Authorizing Entity Identifier................................6
3.3.2 Session Identifier...........................................7
3.3.3 Source Address...............................................7
3.3.4 Destination Address..........................................9
3.3.5 Start time..................................................10
3.3.6 End time....................................................11
3.3.7 Resources Authorized........................................11
3.3.8 Authentication data.........................................12
4. Integrity of the AUTH_SESSION policy element...................13
4.1 Shared private keys...........................................13
4.1.1 Operational Setting using shared private keys...............13
4.2 Kerberos......................................................14
4.2.1. Operational Setting using Kerberos.........................14
4.3 Public Key....................................................15
4.3.1. Operational Setting for public key based authentication....15
5. Framework......................................................16
5.1 The coupled model.............................................16
5.2 The associated model with one policy server...................16
5.3 The associated model with two policy servers..................17
5.4 The non-associated model......................................17
6. Message Processing Rules.......................................17
6.1 Message Generation (RSVP Host)................................17
6.2 Message Reception (Router)....................................18
6.3 Authorization (Router/PDP)....................................18
7. Error Signaling................................................18
8. IANA Considerations............................................19
9. Security Considerations........................................20
10. Acknowledgments...............................................21
11. Normative References..........................................21
12. Informative References........................................23
13. Author Information............................................23
14. Full Copyright Statement......................................24
15. Notices.......................................................24
16. RFC Editor Considerations.....................................25
1. Conventions used in this document 1. Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in
document are to be interpreted as described in [RFC-2119]. this document are to be interpreted as described in [RFC-2119].
2. Introduction 2. Introduction
RSVP [RFC-2205] is a resource reservation setup protocol designed RSVP [RFC-2205] is a resource reservation setup protocol designed
for an integrated services [RFC-1633] or DiffEdge [RFC-2998] for an integrated services [RFC-1633] or Integrated Services over
Internet. The RSVP protocol is used by a host to request specific Diffserv networks [RFC-2998]. The RSVP protocol is used by a host to
qualities of service from the network for particular application request specific services from the network for particular
data streams or flows. RSVP is also used by routers to deliver application data streams or flows. RSVP is also used to deliver
quality-of-service (QoS) requests to all nodes along the path(s) of quality-of-service (QoS) requests to all routers along the path(s)
the flows and to establish and maintain state to provide the of the flows and to establish and maintain state to provide the
requested service. RSVP requests will generally result in requested quality of service. RSVP requests will generally result
resources being reserved in each node along the data path. RSVP in resources being reserved in each router along the data path.
allows users to obtain preferential access to network resources, RSVP allows users to obtain preferential access to network
under the control of an admission control mechanism. Such resources, under the control of an admission control mechanism.
admission control is often based on user or application identity Such admission control is often based on user or application
[I-REP], however, it is also valuable to provide the ability for identity [RFC-3182], however, it is also valuable to provide the
per-session admission control. ability for per-session admission control.
In order to allow for per-session admission control, it is necessary In order to allow for per-session admission control, it is necessary
to provide a mechanism for ensuring an RSVP request from a host has to provide a mechanism for ensuring use of resources by a host has
been properly pre-authorized before allowing the reservation of been properly authorized before allowing the reservation of those
resources. In order to meet this requirement, there must be resources. In order to meet this requirement, there must be
information in the RSVP message which may be used to verify the information in the RSVP message which may be used to verify the
validity of the RSVP request. This may be done by providing the host validity of the RSVP request. This can be done by providing the
with a token upon authorization which may be inserted into the RSVP host with a token upon authorization which is inserted into the RSVP
PATH message and verified by the network. PATH message and verified by the network.
We describe the session authorization element (AUTH_SESSION) This document describes the session authorization element
contained in the POLICY_DATA object. The user process must obtain an (AUTH_SESSION) contained in the POLICY_DATA object. The user
AUTH_SESSION object from an authorizing entity, which it may then process must obtain an AUTH_SESSION object from an authorizing
pass to the RSVP process (service) on the originating host. The RSVP entity, which it then passes to the RSVP process (service) on the
service then inserts the AUTH_SESSION object into the RSVP PATH originating host. The RSVP service then inserts the AUTH_SESSION
message to allow verification of the network resource request. object into the RSVP PATH message to allow verification of the
Network elements, such as routers, verify the request and then admit network resource request. Network elements verify the request and
the RSVP message based on admission policy. then process the RSVP message based on admission policy.
[S-AUTH] describes a framework in which a session authorization [S-AUTH] describes a framework in which a session authorization
policy element may be utilized to contain information relevant to policy element may be utilized to contain information relevant to
the network's decision to grant a reservation request. the network's decision to grant a reservation request.
3. Policy Element for Session Authorization Data 3. Policy Element for Session Authorization Data
3.1 Policy Data Object Format 3.1 Policy Data Object Format
POLICY_DATA objects contain policy information and are carried by POLICY_DATA objects contain policy information and are carried by
RSVP messages. A detail description of the format of POLICY_DATA RSVP messages. A detailed description of the format of POLICY_DATA
object can be found in "RSVP Extensions for Policy Control" [POL- object can be found in "RSVP Extensions for Policy Control" [RFC-
EXT]. 2750].
3.2 Session Authorization Data Policy Element 3.2 Session Authorization Data Policy Element
In this section we describe a policy element (PE) called session In this section we describe a policy element (PE) called session
authorization data (AUTH_SESSION). The AUTH_SESSION policy element authorization data (AUTH_SESSION). The AUTH_SESSION policy element
contains a list of fields which describe the session, along with contains a list of fields which describe the session, along with
other attributes. other attributes.
+-------------+-------------+-------------+-------------+ +-------------+-------------+-------------+-------------+
| Length | P-Type = AUTH_SESSION | | Length | P-Type = AUTH_SESSION |
+-------------+-------------+-------------+-------------+ +-------------+-------------+-------------+-------------+
// Session Authorization Attribute List // // Session Authorization Attribute List //
+-------------------------------------------------------+ +-------------------------------------------------------+
Length Length: 16 bits
The length of the policy element (including the Length and The length of the policy element (including the Length and
P-Type) is in number of octets (MUST be in multiples of 4) and P-Type) is in number of octets (MUST be in multiples of 4) and
indicates the end of the session authorization information indicates the end of the session authorization information block.
block.
P-Type (Session Authorization Type) P-Type: 16 bits (Session Authorization Type)
AUTH_SESSION = TBD-by-IANA
The Policy element type (P-type) of this element. The The Policy element type (P-type) of this element. The
Internet Assigned Numbers Authority (IANA) acts as a registry Internet Assigned Numbers Authority (IANA) acts as a registry
for policy element types for identity as described in for policy element types for identity as described in
[POL-EXT]. The definition for AUTH_SESSION is currently to be [RFC-2750].
defined.
Session Authorization Attribute List Session Authorization Attribute List: variable length
The session authorization attribute list is a collection of The session authorization attribute list is a collection of
objects which describes the session and provides other objects which describes the session and provides other
information necessary to verify the RSVP request. information necessary to verify the RSVP request. An initial set
of valid objects is described in Section 3.
3.3 Session Authorization Attributes 3.3 Session Authorization Attributes
A session authorization attribute may contain a variety of A session authorization attribute may contain a variety of
information and has both an attribute type and subtype. The information and has both an attribute type and subtype. The
attribute itself MUST be a multiple of 4 octets in length, and any attribute itself MUST be a multiple of 4 octets in length, and any
attributes that are not a multiple of 4 octets long MUST be padded attributes that are not a multiple of 4 octets long MUST be padded
to a 4-octet boundary. to a 4-octet boundary. All padding bytes MUST have a value of zero.
+--------+--------+--------+--------+ +--------+--------+--------+--------+
| Length | S-Type |SubType | | Length | S-Type |SubType |
+--------+--------+--------+--------+ +--------+--------+--------+--------+
| Value ... | Value ...
+--------+--------+--------+--------+ +--------+--------+--------+--------+
Length Length: 16 bits
The length field is two octets and indicates the actual length The length field is two octets and indicates the actual length
of the attribute (including Length, S-Type and SubType fields) of the attribute (including Length, S-Type and SubType fields)
in number of octets. The length does NOT include any bytes in number of octets. The length does NOT include any bytes
padding to the value field to make the attribute a multiple of padding to the value field to make the attribute a multiple of
4 octets long. 4 octets long.
S-Type S-Type: 8 bits
Session authorization attribute type (S-Type) field is one Session authorization attribute type (S-Type) field is one
octet. IANA SHALL act as a registry for S-Types as described octet. IANA acts as a registry for S-Types as described
in section 7, IANA Considerations. Initially, the registry in section 7, IANA Considerations. Initially, the registry
contains the following S-Types: contains the following S-Types:
1 AUTH_ENT_ID The unique identifier of the entity 1 AUTH_ENT_ID The unique identifier of the entity
which authorized the session. which authorized the session.
2 AUTH_ENT_CRED The credentials of the authorizing 2 SESSION_ID Unique identifier for this session.
entity, such as a digital
certificate.
3 SESSION_ID Unique identifier for this session.
4 SOURCE_ADDR Address specification for the 3 SOURCE_ADDR Address specification for the
session originator. session originator.
5 DEST_ADDR Address specification for the 4 DEST_ADDR Address specification for the
session end-point. session end-point.
6 START_TIME The starting time for the session. 5 START_TIME The starting time for the session.
7 END_TIME The end time for the session. 6 END_TIME The end time for the session.
8 RESOURCES The resources which the user is 7 RESOURCES The resources which the user is
authorized to request. authorized to request.
9 DIGITAL_SIGNATURE Digital signature of the session 8 AUTHENTICATION_DATA Authentication data of the session
authorization policy element. authorization policy element.
SubType SubType: 8 bits
Session authorization attribute sub-type is one octet in Session authorization attribute sub-type is one octet in
length. The value of the SubType depends on the S-Type. length. The value of the SubType depends on the S-Type.
Value Value: variable length
The attribute specific information. The attribute specific information.
3.3.1 Authorizing Entity Identifier 3.3.1 Authorizing Entity Identifier
AUTH_ENT_ID is used to identify the entity which authorized the AUTH_ENT_ID is used to identify the entity which authorized the
initial service request and generated the session authorization initial service request and generated the session authorization
policy element. The AUTH_ENT_ID may be represented in various policy element. The AUTH_ENT_ID may be represented in various
formats, and the SubType is used to define the format for the ID. formats, and the SubType is used to define the format for the ID.
The format for AUTH_ENT_ID is as follows: The format for AUTH_ENT_ID is as follows:
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
AUTH_ENT_ID AUTH_ENT_ID
SubType SubType
The following sub-types for AUTH_ENT_ID are defined. IANA The following sub-types for AUTH_ENT_ID are defined. IANA
SHALL act as a registry for AUTH_ENT_ID sub-types as described acts as a registry for AUTH_ENT_ID sub-types as described
in section 7, IANA Considerations. Initially, the registry in section 7, IANA Considerations. Initially, the registry
contains the following sub-types of AUTH_ENT_ID: contains the following sub-types of AUTH_ENT_ID:
1 IPV4_ADDRESS IPv4 address 1 IPV4_ADDRESS IPv4 address represented in 32 bits
2 IPV6_ADDRESS IPv6 address 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 FQDN Fully Qualified Domain Name 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string.
4 ASCII_DN X.500 Distinguished name as defined 4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string. in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined 5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string. in RFC-2253 as a UNICODE string.
6 URI Universal Resource Identifier, as 6 URI Universal Resource Identifier, as
defined in RFC-2396. defined in RFC-2396.
7 KRB_PRINCIPAL Kerberos principal name as defined in 7 KRB_PRINCIPAL Fully Qualified Kerberos Principal name
RFC-1510. represented by the ASCII string of a
principal followed by the @ realm name as
8 KRB_REALM Kerberos realm as defined in RFC-1510. defined in RFC-1510 (e.g.
principalX@realmY).
OctetString
Contains the authorizing entity identifier.
3.3.2 Authorizing Entity Credentials
AUTH_ENT_CRED contains the credentials of the authorizing entity,
which can then be used by the network to ensure that the entity
which generated this session authorization policy element is a
valid trusted entity.
+-------+-------+-------+-------+
| Length |S-Type |SubType|
+-------+-------+-------+-------+
| OctetString ...
+-------+-------+-------+-------+
Length
Length of the attribute, which MUST be >= 4.
S-Type
AUTH_ENT_CRED
SubType
The type of credentials contained in this attribute. IANA
SHALL act as a registry for AUTH_ENT_CRED sub-types as
described in section 7, IANA Considerations. Initially, the
registry contains the following sub-types:
1 ASCII_ID The authorizing entity identification in a
plain ASCII text string.
2 UNICODE_ID The authorizing entity identification in a
plain UNICODE text string.
3 X509_V3_CERT A chain of authorizing entity's X.509 V3 8 X509_V3_CERT A chain of authorizing entity's X.509 V3
digital certificates. digital certificates.
4 PGP_CERT The PGP digital certificate of the 9 PGP_CERT The PGP digital certificate of the
authorizing entity. authorizing entity.
OctetString OctetString
Contains the authorizing entity credentials. Contains the authorizing entity identifier.
3.3.3 Session Identifier 3.3.2 Session Identifier
SESSION_ID is a unique identifier for this session. It may be used SESSION_ID is a unique identifier used by the authorizing entity to
for a number of purposes, including replay detection, or even identify the request. It may be used for a number of purposes,
mapping this request to a policy decision entry made by the including replay detection, or to correlate this request to a policy
authorizing entity. The SESSION_ID can be based on simple sequence decision entry made by the authorizing entity. For example, the
number or on a standard NTP timestamp. SESSION_ID can be based on simple sequence number or on a standard
NTP timestamp.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
Dependant on the environment, the session identifier will have
different lengths in order to ensure uniqueness during the
lifetime of a token (equal to the lifetime of the session).
We recommend using an octet string of a minimum of 32 bit, but
a value of 64 bit may be required in some environments.
S-Type S-Type
SESSION_ID SESSION_ID
SubType SubType
The following sub-types for SESSION_ID are defined. IANA No subtypes for SESSION ID are currently defined; this field MUST
SHALL act as a registry for SESSION_ID sub-types as described be set to zero. The authorizing entity is the only network entity
in section 7, IANA Considerations. Initially, the registry that needs to interpret the contents of the SESSION ID therefore the
contains the following sub-types of SESSION_ID: contents and format are implementation dependent.
1 ASCII_ID Simple plain ASCII string identifier.
2 UNICODE_ID Simple plain UNICODE string identifier.
3 OCTET_ID Raw octet string identifier.
4 NTP_TIMESTAMP NTP Timestamp Format as defined in
RFC-1305.
OctetString OctetString
Contains the actual session identifier. Contains the session identifier.
3.3.4 Source Address 3.3.3 Source Address
SOURCE_ADDR is used to identify the source address specification of SOURCE_ADDR is used to identify the source address specification of
the authorized session. This S-Type MAY be useful in some scenarios the authorized session. This S-Type may be useful in some scenarios
to make sure the resource request has been authorized for that to make sure the resource request has been authorized for that
particular source IP address and/or port. particular source address and/or port.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
SOURCE_ADDR SOURCE_ADDR
SubType SubType
The following sub types for SOURCE_ADDR are defined. IANA The following sub types for SOURCE_ADDR are defined. IANA
SHALL act as a registry for SOURCE_ADDR sub-types as acts as a registry for SOURCE_ADDR sub-types as
described in section 7, IANA Considerations. Initially, the described in section 7, IANA Considerations. Initially, the
registry contains the following sub types for SOURCE_ADDR: registry contains the following sub types for SOURCE_ADDR:
1 IPV4_ADDRESS IPv4 address 1 IPV4_ADDRESS IPv4 address represented in 32 bits
2 IPV6_ADDRESS IPv6 address 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 UDP_PORT UDP port specification
4 TCP_PORT TCP port specification 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string.
4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string.
6 UDP_PORT LIST list of UDP port specifications,
represented as 16 bits per list entry.
7 TCP_PORT LIST list of TCP port specifications,
represented as 16 bits per list entry.
OctetString OctetString
The OctetString contains the source address information. The OctetString contains the source address information.
3.3.5 Destination Address In scenarios where a source address is required (see Section 5), at
least one of the subtypes 1 through 5 (inclusive) MUST be included
in every Session Authorization Data Policy Element. Multiple SOURCE
ADDR attributes MAY be included if multiple addresses have been
authorized. The source address field of the RSVP datagram MUST match
one of the SOURCE ADDR attributes contained in this Session
Authorization Data Policy Element when resolved to an IP address.
At most, one instance of subtype 6 MAY be included in every Session
Authorization Data Policy Element. At most, one instance of subtype
7 MAY be included in every Session Authorization Data Policy
Element. Inclusion of a subtype 6 attribute does not prevent
inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may
be authorized).
If no PORT attributes are specified, then all ports are considered
valid; otherwise, only the specified ports are authorized for use.
Every source address and port list must be included in a separate
SOURCE_ADDR attribute.
3.3.4 Destination Address
DEST_ADDR is used to identify the destination address of the DEST_ADDR is used to identify the destination address of the
authorized session. This S-Type MAY be useful in some scenarios to authorized session. This S-Type may be useful in some scenarios to
make sure the resource request has been authorized for that make sure the resource request has been authorized for that
particular destination IP address and/or port. particular destination address and/or port.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
DEST_ADDR DEST_ADDR
SubType SubType
The following sub types for DEST_ADDR are defined. IANA SHALL The following sub types for DEST_ADDR are defined. IANA
act as a registry for DEST_ADDR sub-types as described in acts as a registry for DEST_ADDR sub-types as described in
section 7, IANA Considerations. Initially, the registry section 7, IANA Considerations. Initially, the registry
contains the following sub types for DEST_ADDR: contains the following sub types for DEST_ADDR:
1 IPV4_ADDRESS IPv4 address 1 IPV4_ADDRESS IPv4 address represented in 32 bits
2 IPV6_ADDRESS IPv6 address 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 UDP_PORT UDP port specification 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string.
4 TCP_PORT TCP port specification 4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string.
6 UDP_PORT LIST list of UDP port specifications,
represented as 16 bits per list entry.
7 TCP_PORT LIST list of TCP port specifications,
represented as 16 bits per list entry.
OctetString OctetString
The OctetString contains the destination address specification. The OctetString contains the destination address specification.
3.3.6 Start time In scenarios where a destination address is required (see Section
5), at least one of the subtypes 1 through 5 (inclusive) MUST be
included in every Session Authorization Data Policy Element.
Multiple DEST ADDR attributes MAY be included if multiple addresses
have been authorized. The destination address field of the RSVP
datagram MUST match one of the DEST ADDR attributes contained in
this Session Authorization Data Policy Element when resolved to an
IP address.
At most, one instance of subtype 6 MAY be included in every Session
Authorization Data Policy Element. At most, one instance of subtype
7 MAY be included in every Session Authorization Data Policy
Element. Inclusion of a subtype 6 attribute does not prevent
inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may
be authorized).
If no PORT attributes are specified, then all ports are considered
valid; otherwise, only the specified ports are authorized for use.
Every destination address and port list must be included in a
separate DEST_ADDR attribute.
3.3.5 Start time
START_TIME is used to identify the start time of the authorized START_TIME is used to identify the start time of the authorized
session. This S-Type MAY be useful in some scenarios to specify a Session and can be used to prevent replay attacks. If the
start time for the authorized session. AUTH_SESSION policy element is presented in a resource request, the
network SHOULD reject the request if it is not received within a few
seconds of the start time specified.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
START_TIME START_TIME
SubType SubType
The following sub types for START_TIME are defined. IANA SHALL The following sub types for START_TIME are defined. IANA
act as a registry for START_TIME sub-types as described in acts as a registry for START_TIME sub-types as described in
section 7, IANA Considerations. Initially, the registry section 7, IANA Considerations. Initially, the registry
contains the following sub types for START_TIME: contains the following sub types for START_TIME:
1 NTP_TIMESTAMP NTP Timestamp Format as defined in 1 NTP_TIMESTAMP NTP Timestamp Format as defined in
RFC-1305. RFC-1305.
OctetString OctetString
The OctetString contains the start time. The OctetString contains the start time.
3.3.7 End time 3.3.6 End time
END_TIME is used to identify the end time of the authorized END_TIME is used to identify the end time of the authorized
session. This S-Type MAY be useful in some scenarios to specify a session and can be used to limit the amount of time that resources
end time for the authorized session. are authorized for use (e.g. in prepaid session scenarios).
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
END_TIME END_TIME
SubType SubType
The following sub types for END_TIME are defined. IANA SHALL The following sub types for END_TIME are defined. IANA
act as a registry for END_TIME sub-types as described in acts as a registry for END_TIME sub-types as described in
section 7, IANA Considerations. Initially, the registry section 7, IANA Considerations. Initially, the registry
contains the following sub types for END_TIME: contains the following sub types for END_TIME:
1 NTP_TIMESTAMP NTP Timestamp Format as defined in 1 NTP_TIMESTAMP NTP Timestamp Format as defined in
RFC-1305. RFC-1305.
OctetString OctetString
The OctetString contains the end time. The OctetString contains the end time.
3.3.8 Resources Authorized 3.3.7 Resources Authorized
RESOURCES is used to define the characteristics of the authorized RESOURCES is used to define the characteristics of the authorized
session. This S-Type MAY be useful in some scenarios to specify the session. This S-Type may be useful in some scenarios to specify the
specific resources authorized to ensure the request fits the specific resources authorized to ensure the request fits the
authorized specifications. authorized specifications.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
RESOURCES RESOURCES
SubType SubType
The following sub-types for RESOURCES are defined. IANA SHALL The following sub-types for RESOURCES are defined. IANA
act as a registry for RESOURCES sub-types as described in acts as a registry for RESOURCES sub-types as described in
section 7, IANA Considerations. Initially, the registry section 7, IANA Considerations. Initially, the registry
contains the following sub types for RESOURCES: contains the following sub types for RESOURCES:
1 BANDWIDTH Maximum bandwidth (kbps) authorized. 1 BANDWIDTH Maximum bandwidth (kbps) authorized.
2 FLOW_SPEC Flow spec specification as defined in 2 FLOW_SPEC Flow spec specification as defined in
RFC-2205. RFC-2205.
3 SDP SDP Media Descriptor as defined in 3 SDP SDP Media Descriptor as defined in
RFC-2327. RFC-2327.
4 DSCP Differentiated services codepoint as 4 DSCP Differentiated services codepoint as
defined in RFC-2474. defined in RFC-2474.
OctetString OctetString
The OctetString contains the resources specification. The OctetString contains the resources specification.
3.3.9 Digital Signature In scenarios where a resource specification is required (see Section
5), at least one of the subtypes 1 through 4 (inclusive) MUST be
included in every Session Authorization Data Policy Element.
Multiple RESOURCE attributes MAY be included if multiple types of
resources have been authorized (e.g. DSCP and BANDWIDTH).
The DIGITAL_SIGNATURE attribute contains the digital signature of 3.3.8 Authentication data
the AUTH_SESSION policy element and signs all the data in the
policy element up to the DIGITAL_SIGNATURE. If the
DIGITAL_SIGNATURE attribute has been included in the AUTH_SESSION
policy element, it MUST be the last attribute in the list.
A summary of DIGITAL_SIGNATURE attribute format is described below. The AUTHENTICATION_DATA attribute contains the authentication data
of the AUTH_SESSION policy element and signs all the data in the
policy element up to the AUTHENTICATION_DATA. If the
AUTHENTICATION_DATA attribute has been included in the AUTH_SESSION
policy element, it MUST be the last attribute in the list. The
algorithm used to compute the authentication data depends on the
AUTH_ENT_ID SubType field. See Section 4 entitled Integrity of the
AUTH_SESSION policy element.
A summary of AUTHENTICATION_DATA attribute format is described
below.
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| Length |S-Type |SubType| | Length |S-Type |SubType|
+-------+-------+-------+-------+ +-------+-------+-------+-------+
| OctetString ... | OctetString ...
+-------+-------+-------+-------+ +-------+-------+-------+-------+
Length Length
Length of the attribute, which MUST be >= 4. Length of the attribute, which MUST be > 4.
S-Type S-Type
DIGITAL_SIGNATURE AUTHENTICATION_DATA
SubType SubType
The following sub-types for DIGITAL_SIGNATURE are No sub types for AUTHENTICATION_DATA are currently defined. This
defined. IANA SHALL act as a registry for DIGITAL_SIGNATURE field MUST be set to 0.
sub-types as described in section 7, IANA
Considerations. Initially, the registry contains the following
sub types for DIGITAL_SIGNATURE:
1 DSA_SHA1 DSA signature using SHA1 [X.509]. OctetString
OctetString contains the authentication data of the AUTH_SESSION.
2 RSA_SHA1 RSA signature using SHA1 [X.509]. 4. Integrity of the AUTH_SESSION policy element
3 RSA_MD5 RSA signature using MD5 [X.509]. This section describes how to ensure the integrity of the policy
element is preserved.
4 HMAC_SHA1 HMAC with SHA1 [RFC 2104]. 4.1 Shared private keys
5 HMAC_MD5 HMAC with MD5 [RFC 2104]. In shared private key environments, the AUTH_ENT_ID MUST be of
subtypes: IPV4_ADDR, IPV6_ADDR, FQDN, ASCII_DN, UNICODE_DN or URI.
An example AUTH_SESSION policy element is shown below.
OctetString +--------------+--------------+--------------+--------------+
OctetString contains the digital signature of the AUTH_SESSION. | Length | P-type = AUTH_SESSION |
+--------------+--------------+--------------+--------------+
| Length |SESSION_ID | zero |
+--------------+--------------+--------------+--------------+
| OctetString (The session identifier) ...
+--------------+--------------+--------------+--------------+
| Length |AUTH DATA. | zero |
+--------------+--------------+--------------+--------------+
| OctetString (Authentication data) ...
+--------------+--------------+--------------+--------------+
4. Framework 4.1.1 Operational Setting using shared private keys
[S-AUTH] describes a framework in which the session authorization This assumes both the Authorizing Entity and the Network router/PDP
policy element may be utilized to transport information for use in are provisioned with shared private keys and with policies detailing
authorizing resource reservation for media flows. which algorithm to be used for computing the authentication data.
5. Message Processing Rules Key maintenance is outside the scope of this document, but
AUTH_SESSION implementations MUST at least provide the ability to
manually configure keys and their parameters locally. The key used
to produce the authentication data is identified by the AUTH_ENT_ID
field. Each key must also be configured with lifetime parameters for
the time period within which it is valid as well as an associated
cryptographic algorithm parameter specifying the algorithm to be
used with the key. At a minimum, all AUTH_SESSION implementations
MUST support the HMAC-MD5-96 [RFC-2104][FRC-1321] cryptographic
algorithm for computing the authentication data.
5.1 Message Generation (RSVP Host) It is good practice to regularly change keys. Keys MUST be
configurable such that their lifetimes overlap allowing smooth
transitions between keys. At the midpoint of the lifetime overlap
between two keys, senders should transition from using the current
key to the next/longer-lived key. Meanwhile, receivers simply accept
any identified key received within its configured lifetime and
reject those that are not.
4.2 Kerberos
In a Kerberos environment, the AUTH_ENT_ID MUST be of the subtype
KRB_PRINCIPAL. Kerberos [RFC 1510] authentication uses a trusted
third party (the Kerberos Distribution Center - KDC) to provide for
authentication of the AUTH_SESSION to a network server. It is
assumed that a KDC is present and both host and verifier of
authentication information (authorizing entity and router/PDP)
implement Kerberos authentication.
An example of the Kerberos AUTH_DATA policy element is shown below.
+--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_SESSION |
+--------------+--------------+--------------+--------------+
| Length |SESSION_ID | zero |
+--------------+--------------+--------------+--------------+
| OctetString (The session identifier) ...
+--------------+--------------+--------------+--------------+
| Length | AUTH_ENT_ID | KERB_P. |
+--------------+--------------+--------------+--------------+
| OctetString (The principal@realm name) ...
+--------------+--------------+--------------+--------------+
4.2.1. Operational Setting using Kerberos
An authorizing entity is configured to construct the AUTH_SESSION
policy element that designates use of the Kerberos authentication
method (KRB_PRINCIPAL). Upon reception of the RSVP request, the
router/PDP contacts the local KDC to request a ticket for the
authorizing entity (principal@realm). The router/PDP uses the ticket
to access the authorizing entity and obtain authentication data for
the message.
For cases where the authorizing entity is in a different realm (i.e.
administrative domain, organizational boundary), the router/PDP
needs to fetch a cross-realm Ticket Granting Ticket (TGT) from its
local KDC. This TGT can be used to fetch authorizing entity tickets
from the KDC in the remote realm. Note that for performance
considerations, tickets are typically cached for extended periods.
4.3 Public Key
In a public key environment, the AUTH_ENT_ID MUST be of the
subtypes: X509_V3_CERT or PGP_CERT. The authentication data is used
for authenticating the authorizing entity. An example of the public
key AUTH_SESSION policy element is shown below.
+--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_SESSION |
+--------------+--------------+--------------+--------------+
| Length |SESSION_ID | zero |
+--------------+--------------+--------------+--------------+
| OctetString (The session identifier) ...
+--------------+--------------+--------------+--------------+
| Length | AUTH_ENT_ID | PGP_CERT |
+--------------+--------------+--------------+--------------+
| OctetString (Authorizing entity Digital Certificate) ...
+--------------+--------------+--------------+--------------+
| Length |AUTH DATA. | zero |
+--------------+--------------+--------------+--------------+
| OctetString (Authentication data) ...
+--------------+--------------+--------------+--------------+
4.3.1. Operational Setting for public key based authentication
Public key based authentication assumes following:
- Authorizing entities have a pair of keys (private key and
public key).
- Private key is secured with the authorizing entity.
- Public keys are stored in digital certificates and a
trusted party, certificate authority (CA) issues these
digital certificates.
- The verifier (PDP or router) has the ability to verify the
digital certificate.
Authorizing entity uses its private key to generate
AUTHENTICATION_DATA. Authenticators (router, PDP) use the
authorizing entity's public key (stored in the digital certificate)
to verify and authenticate the policy element.
5. Framework
[S-AUTH] describes a framework in which the AUTH_SESSION
policy element may be utilized to transport information required for
authorizing resource reservation for media flows. [S-AUTH]
introduces 4 different models:
1- the coupled model
2- the associated model with one policy server
3- the associated model with two policy servers
4- the non-associated model.
The fields that are required in an AUTH SESSION policy element is
dependent on which of the models is used.
5.1 The coupled model
In the Coupled Model, the only information that MUST be included in
the policy element is the SESSION ID; it is used by the Authorizing
Entity to correlate the resource reservation request with the media
authorized during session set up. Since the End Host is assumed to
be untrusted, the Policy Server SHOULD take measures to ensure that
the integrity of the SESSION ID is preserved in transit; the exact
mechanisms to be used and the format of the SESSION ID are
implementation dependent.
5.2 The associated model with one policy server
In this model, the contents of the AUTH_SESSION policy element MUST
include:
- A session identifier - SESSION_ID. This is information that the
authorizing entity can use to correlate the resource reservation
request with the media authorized during session set up.
- The identity of the authorizing entity _ AUTH_ENT_ID. This
information is used by the Edge Router to determine which
authorizing entity (Policy Server) should be used to solicit
resource policy decisions.
In some environments, an Edge Router may have no means for
determining if the identity refers to a legitimate Policy Server
within its domain. In order to protect against redirection of
authorization requests to a bogus authorizing entity, the
AUTH_SESSION MUST also include:
- AUTHENTICATION_DATA. This authentication data is calculated over
all other fields of the AUTH_SESSION policy element.
5.3 The associated model with two policy servers
The content of the AUTH_SESSION Policy Element is identical to the
associated model with one policy server.
5.4 The non-associated model
In this model, the AUTH_SESSION MUST contain sufficient information
to allow the Policy Server to make resource policy decisions
autonomously from the authorizing entity. The policy element is
created using information about the session by the authorizing
entity. The information in the AUTH_SESSION policy element MUST
include:
- Calling party IP address or Identity (e.g. FQDN) - SOURCE_ADDR S-
TYPE
- Called party IP address or Identity (e.g. FQDN) - DEST_ADDR S-
TYPE
- The characteristics of (each of) the media stream(s) authorized
for this session - RESOURCES S-TYPE
- The authorization lifetime - START_TIME S-TYPE
- The identity of the authorizing entity to allow for validation of
the token in shared private key and Kerberos schemes -
AUTH_ENT_ID S-TYPE
- The credentials of the authorizing entity in a public-key scheme
- AUTH_ENT_ID S-TYPE
- Authentication data used to prevent tampering with the
AUTH_SESSION policy element - AUTHENTICATION_DATA
Furthermore, the AUTH_SESSION policy element MAY contain:
- The lifetime of (each of) the media stream(s) - END_TIME S-TYPE
- Calling party port number - SOURCE_ADDR S-TYPE
- Called party port number - DEST_ADDR S-TYPE
All AUTH_SESSION fields MUST match with the resource request. If a
field does not match, the request SHOULD be denied.
6. Message Processing Rules
6.1 Message Generation (RSVP Host)
An RSVP message is created as specified in [RFC-2205] with following An RSVP message is created as specified in [RFC-2205] with following
modifications. modifications.
1. RSVP message MUST contain at most one AUTH_SESSION policy element. 1. RSVP message MUST contain at most one AUTH_SESSION policy
element.
2. A Session Authorization policy element (AUTH_SESSION) is created 2. A Session Authorization policy element (AUTH_SESSION) is created
and the IdentityType field is set to indicate the identity type and the IdentityType field is set to indicate the identity type
in the policy element. Only the required Session Authorization in the policy element. Only the required Session Authorization
attributes are added. attributes are added.
3. POLICY_DATA object (containing the AUTH_SESSION policy element) 3. POLICY_DATA object (containing the AUTH_SESSION policy element)
is inserted in the RSVP message in the appropriate place. is inserted in the RSVP message in the appropriate place.
5.2 Message Reception (Router) 6.2 Message Reception (Router)
RSVP message is processed as specified in [RFC-2205] with following RSVP message is processed as specified in [RFC-2205] with following
modifications. modifications.
1. If router is policy aware then it SHOULD send the RSVP 1. If router is policy aware then it SHOULD send the RSVP
message to the PDP and wait for response. If the router is message to the PDP and wait for response. If the router is
policy unaware then it ignores the policy data objects and policy unaware then it ignores the policy data objects and
continues processing the RSVP message. continues processing the RSVP message.
2. Reject the message if the response from the PDP is negative. 2. Reject the message if the response from the PDP is negative.
3. Continue processing the RSVP message. 3. Continue processing the RSVP message.
5.3 Authorization (Router/PDP) 6.3 Authorization (Router/PDP)
1. Retrieve the AUTH_SESSION policy element. Check the PE type 1. Retrieve the AUTH_SESSION policy element. Check the PE type
field and return an error if the identity type is not supported. field and return an error if the identity type is not supported.
2. Verify the authorizing entity credentials and message integrity. 2. Verify the message integrity.
- Pre-shared key authentication: Get entity ID, identify - Shared private key authentication: Get authorizing entity ID,
appropriate pre-shared key for the authorizing entity, and identify appropriate algorithm and shared private key for the
validate signature. authorizing entity, and validate signature.
- Public Key: Validate the certificate chain against - Public Key: Validate the certificate chain against
trusted Certificate Authority (CA) and valide the trusted Certificate Authority (CA) and validate the
message signature using the public key. message signature using the public key.
- Kerberos Ticket: Request a ticket for the authorizing entity - Kerberos Ticket: If the AUTH_ENT_ID is of subtype KRB_PRINCIPAL,
Request a ticket for the authorizing entity (principal@realm)
from the local KDC. Use the ticket to access the authorizing from the local KDC. Use the ticket to access the authorizing
entity and obtain authentication data for the message (e.g. entity and obtain authentication data for the message.
the signing key) or the data itself.
3. Verify the requested QoS does not exceed the authorized QoS. 3. Verify the requested resources do not exceed the authorized QoS.
6. Error Signaling 7. Error Signaling
If PDP fails to verify the AUTH_SESSION policy element then it MUST If a PDP fails to verify the AUTH_SESSION policy element then it
return policy control failure (Error Code = 02) to the PEP. The MUST return a policy control failure (Error Code = 02) to the PEP.
error values are described in [RFC-2205] and [POL-EXT]. Also PDP The error values are described in [RFC-2205] and [RFC-2750]. Also
SHOULD supply a policy data object containing an AUTH_DATA the PDP SHOULD supply a policy data object containing an AUTH_DATA
Policy Element with A-Type=POLICY_ERROR_CODE containing more Policy Element with A-Type=POLICY_ERROR_CODE containing more
details on the Policy Control failure [I-REP]. The PEP details on the Policy Control failure [RFC-3182]. The PEP
will include this Policy Data object in the outgoing RSVP Error MUST include this Policy Data object in the outgoing RSVP Error
message. message.
7. IANA Considerations 8. IANA Considerations
Following the policies outlined in [IANA-CONSIDERATIONS], Standard
RSVP Policy Elements (P-type values) are assigned by IETF Consensus
action as described in [RFC-2750].
P-Type AUTH_SESSION is assigned the value TBD-by-IANA.
Following the policies outlined in [IANA-CONSIDERATIONS], session Following the policies outlined in [IANA-CONSIDERATIONS], session
authorization attribute types (S-Type)in the range 0-127 are authorization attribute types (S-Type)in the range 0-127 are
allocated through an IETF Consensus action, S-Type values between allocated through an IETF Consensus action; S-Type values between
128-255 are reserved for Private Use and are not assigned by IANA. 128-255 are reserved for Private Use and are not assigned by IANA.
S-Type AUTH_ENT_ID is assigned the value 1.
S-Type SESSION_ID is assigned the value 2.
S-Type SOURCE_ADDR is assigned the value 3.
S-Type DEST_ADDR is assigned the value 4.
S-Type START_TIME is assigned the value 5.
S-Type END_TIME is assigned the value 6.
S-Type RESOURCES is assigned the value 7.
S-Type AUTHENTICATION_DATA is assigned the value 8.
Following the policies outlined in [IANA-CONSIDERATIONS], Following the policies outlined in [IANA-CONSIDERATIONS],
AUTH_ENT_ID, AUTH_ENT_CRED, SESSION_ID, START_TIME, STOP_TIME, AUTH_ENT_ID SubType values in the range 0-127 are allocated through
SOURCE_IP, DEST_IP, RESOURCES and DIGITAL_SIGNATURE SubType values an IETF Consensus action, SubType values between 128-255 are
in the range 0-127 are allocated through an IETF Consensus action, reserved for Private Use and are not assigned by IANA.
SubType values between 128-255 are reserved for Private Use and are
not assigned by IANA.
8. Security Considerations AUTH_ENT_ID SubType IPV4_ADDRESS is assigned the value 1.
SubType IPV6_ADDRESS is assigned the value 2.
SubType FQDN is assigned the value 3.
SubType ASCII_DN is assigned the value 4.
SubType UNICODE_DN is assigned the value 5.
SubType URI is assigned the value 6.
SubType KRB_PRINCIPAL is assigned the value 7.
SubType X509_V3_CERT is assigned the value 8.
SubType PGP_CERT is assigned the value 9.
Following the policies outlined in [IANA-CONSIDERATIONS],
SOURCE_ADDR SubType values in the range 0-127 are allocated through
an IETF Consensus action, SubType values between 128-255 are
reserved for Private Use and are not assigned by IANA.
SOURCE_ADDR SubType IPV4_ADDRESS is assigned the value 1.
SubType IPV6_ADDRESS is assigned the value 2.
SubType FQDN is assigned the value 3.
SubType ASCII_DN is assigned the value 4.
SubType UNICODE_DN is assigned the value 5.
SubType UDP_PORT_LIST is assigned the value 6.
SubType TCP_PORT_LIST is assigned the value 7.
Following the policies outlined in [IANA-CONSIDERATIONS],
DEST_ADDR SubType values in the range 0-127 are allocated through an
IETF Consensus action, SubType values between 128-255 are reserved
for Private Use and are not assigned by IANA.
DEST_ADDR SubType IPV4_ADDRESS is assigned the value 1.
SubType IPV6_ADDRESS is assigned the value 2.
SubType FQDN is assigned the value 3.
SubType ASCII_DN is assigned the value 4.
SubType UNICODE_DN is assigned the value 5.
SubType UDP_PORT_LIST is assigned the value 6.
SubType TCP_PORT_LIST is assigned the value 7.
Following the policies outlined in [IANA-CONSIDERATIONS],
START_TIME SubType values in the range 0-127 are allocated through
an IETF Consensus action, SubType values between 128-255 are
reserved for Private Use and are not assigned by IANA.
START_TIME SubType NTP_TIMESTAMP is assigned the value 1.
Following the policies outlined in [IANA-CONSIDERATIONS],
END TIME SubType values in the range 0-127 are allocated through an
IETF Consensus action, SubType values between 128-255 are reserved
for Private Use and are not assigned by IANA.
END TIME SubType NTP_TIMESTAMP is assigned the value 1.
Following the policies outlined in [IANA-CONSIDERATIONS],
RESOURCES SubType values in the range 0-127 are allocated through an
IETF Consensus action, SubType values between 128-255 are reserved
for Private Use and are not assigned by IANA.
RESOURCES SubType BANDWIDTH is assigned the value 1.
SubType FLOW_SPEC is assigned the value 2.
SubType SDP is assigned the value 3.
SubType DSCP is assigned the value 4.
9. Security Considerations
The purpose of this draft is to describe a mechanism for session The purpose of this draft is to describe a mechanism for session
authorization to prevent theft of service. authorization to prevent theft of service.
In order to ensure that the integrity of the token is preserved in Replay attacks MUST be prevented. In the non-associated model, the
some environments, the digital signature attribute SHOULD be used. AUTH_SESSION policy element MUST include a START_TIME field. The
In fact, since the token is to be relayed through the end host, start time is used to verify that the request is not being replayed
which is usually considered untrusted, we strongly recommend the at a later time. In all other models, the SESSION_ID is used by the
use of the digital signature attribute. Policy Server to ensure that the resource request successfully
correlates with records of an authorized session. If a AUTH_SESSION
is replayed, it MUST be detected by the policy server (using
internal algorithms) and the request MUST be rejected.
Simple authentication (e.g. plain ASCII or UNICODE) does not To ensure that the integrity of the policy element is preserved in
contain credential that can be securely authenticated and is untrusted environments, the AUTHENTICATION_DATA attribute MUST be
inherently less secured. included.
The Kerberos authentication mechanism is reasonably well secured. In order to keep the AUTH_SESSION policy element size to a strict
Kerberos is more efficient than the PKI mechanism from minimum, in environments where shared private keys are possible,
computational point of view. they should be used. This is especially true in wireless
environments where the AUTH_SESSION policy element is sent over-the-
air. The shared private keys authentication option MUST be supported
by all AUTH_SESSION implementations.
PKI authentication option should provide highest level of If shared private keys are not a valid option, the Kerberos
security and good scalability, however it requires infrastructure authentication mechanism is reasonably well secured and efficient in
support and may have performance impacts. terms of AUTH_SESSION size. The AUTH_SESSION only needs to contain
the principal@realm name of the authorizing entity. This is much
more efficient than the PKI authentication option.
9. Acknowledgments PKI authentication option provides a high level of security and good
scalability, however it requires the presence of credentials in the
AUTH_SESSION policy element which impacts its size.
We would like to thank Francois Audet, Don Wade, Hamid Syed, 10. Acknowledgments
Kwok Ho Chan and many others for their valuable comments.
We would like to thank Louis LeVay, Francois Audet, Don Wade, Hamid
Syed, Kwok Ho Chan and many others for their valuable comments.
In addition, we would like to thank S. Yadav, et al, for their In addition, we would like to thank S. Yadav, et al, for their
efforts on RFC 3182, as this document borrows from their work. efforts on RFC 3182, as this document borrows from their work.
10. References 11. Normative References
[I-REP] S. Yadav et al, "Identity Representation for
RSVP", RFC 3182, October 2001
[S-AUTH] L-N. Hamer et al., "Framework for [S-AUTH] Hamer, L.-N., Gage, B., Shieh, H., "Framework
session setup with media authorization", for session setup with media authorization",
Internet-Draft, Internet-Draft,
draft-hamer-rap-session-auth-03.txt, draft-ietf-rap-session-auth-04.txt,
February 2002. June 2002.
[ASCII] Coded Character Set -- 7-Bit American Standard
Code for Information Interchange, ANSI X3.4-
1986.
[IANA-CONSIDERATIONS] Alvestrand, H. and T. Narten, "Guidelines for [ASCII] Coded Character Set -- 7-Bit American
Writing an IANA Considerations Section in Standard Code for Information Interchange,
RFCs", BCP 26, RFC 2434, October 1998. ANSI X3.4-1986.
[POL-EXT] Herzog, S., "RSVP Extensions for Policy [RFC-2750] Herzog, S., "RSVP Extensions for Policy
Control", RFC 2750, January 2000. Control", RFC 2750, January 2000.
[POL-FRAME] Yavatkar, R., Pendarakis, D. and R. Guerin, "A [RFC-2753] Yavatkar, R., Pendarakis, D. and R. Guerin, "A
Framework for Policy-based Admission Control Framework for Policy-based Admission Control
RSVP", RFC 2753, January 2000. RSVP", RFC 2753, January 2000.
[RFC-1034] Mockapetris, P.V., "Domain names - concepts
and facilities", RFC 1034, November 1987.
[RFC-1305] Mills, David L., "Network Time Protocol [RFC-1305] Mills, David L., "Network Time Protocol
(Version 3) Specification, Implementation, and (Version 3) Specification, Implementation, and
Analysis", RFC 1305, March 1992. Analysis", RFC 1305, March 1992.
[RFC-1321] Rivest, R., "The MD5 Message-Digest
Algorithm",RFC 1321, April 1992.
[RFC-1510] Kohl, J. and C. Neuman, "The Kerberos Network [RFC-1510] Kohl, J. and C. Neuman, "The Kerberos Network
Authentication Service (V5)", RFC 1510, Authentication Service (V5)", RFC 1510,
September 1993. September 1993.
[RFC-1633] Braden, R., Clark, D., Shenker, S., [RFC-2104] Krawczyk, H., Bellare, M. and R. Canetti,
"Integrated Services in the Internet "HMAC: Keyed-Hashing for Message
Architecture: An Overview", RFC 1633, Authentication", RFC 2104, February 1997.
June 1994.
[RFC-2253] Wahl, M. et al., "UTF-8 String [RFC-2253] Wahl, M. et al., "UTF-8 String
Representation of Distinguished Names", Representation of Distinguished Names",
RFC 2253, December 1997. RFC 2253, December 1997.
[RFC-2205] Braden, R., Zhang, L., Berson, S., Herzog, S. [RFC-2205] Braden, R., Zhang, L., Berson, S., Herzog, S.
and S. Jamin, "Resource ReSerVation Protocol and S. Jamin, "Resource ReSerVation Protocol
(RSVP) - Version 1 Functional Specification", (RSVP) - Version 1 Functional Specification",
RFC 2205, September 1997. RFC 2205, September 1997.
[RFC-2209] Braden, R. and L. Zhang, "Resource ReSerVation [RFC-2209] Braden, R. and L. Zhang, "Resource
Protocol (RSVP) - Version 1 Message Processing ReSerVation Protocol (RSVP) - Version 1
Rules", RFC 2209, September 1997. Message Processing Rules", RFC 2209,
September 1997.
[RFC-2327] Handley, M., Jacobson, V., "SDP: Session [RFC-2327] Handley, M., Jacobson, V., "SDP: Session
Description Protocol", RFC 2327, October 1998. Description Protocol", RFC 2327, October
1998.
[RFC-2396] Berners-Lee, T., Fielding, R., Irvine, U.C., [RFC-2396] Berners-Lee, T., Fielding, R., Irvine, U.C.,
Masinter, L., "Uniform Resource Identifiers Masinter, L., "Uniform Resource Identifiers
(URI): Generic Syntax", RFC 2396, August 1998. (URI): Generic Syntax", RFC 2396, August
1998.
[RFC-2474] Nichols, K., Blake, S., Baker, F., Black, D., [RFC-2474] Nichols, K., Blake, S., Baker, F., Black, D.,
"Definition of the Differentiated Services "Definition of the Differentiated Services
Field (DS Field) in the IPv4 and IPv6 Field (DS Field) in the IPv4 and IPv6
Headers", RFC 2474, December 1998. Headers", RFC 2474, December 1998.
[RFC-2998] Bernet, Y., Ford, P., Yavatkar, R., Baker, F., [UNICODE] The Unicode Consortium, "The Unicode
Zhang, L., Speer, M., Braden, R., Davie, B., Standard,Version 2.0", Addison-Wesley,
Wroclawski, J., Felstaine, E., "A Framework Reading, MA, 1996.
for Integrated Services Operation over
Diffserv Networks", RFC 2998, November 2000.
[UNICODE] The Unicode Consortium, "The Unicode Standard,
Version 2.0", Addison-Wesley, Reading, MA,
1996.
[X.509] Housley, R., Ford, W., Polk, W. and D. Solo, [X.509] Housley, R., Ford, W., Polk, W. and D. Solo,
"Internet X.509 Public Key Infrastructure "Internet X.509 Public Key Infrastructure
Certificate and CRL Profile", RFC 2459, January Certificate and CRL Profile", RFC 2459,
1999. January 1999.
[X.509-ITU] ITU-T (formerly CCITT) Information technology - [X.509-ITU] ITU-T (formerly CCITT) Information technology
Open Systems Interconnection - The Directory: Open Systems Interconnection - The Directory:
Authentication Framework Recommendation X.509 Authentication Framework Recommendation X.509
ISO/IEC 9594-8 ISO/IEC 9594-8
11. Author Information 12. Informative References
[RFC-3182] S. Yadav et al, "Identity Representation for
RSVP", RFC 3182, October 2001
[RFC-2998] Bernet, Y., Ford, P., Yavatkar, R.,
Baker, F.,Zhang, L., Speer, M., Braden, R.,
Davie, B., Wroclawski, J., Felstaine, E., "A
Framework for Integrated Services Operation
over Diffserv Networks", RFC 2998, November
2000.
[RFC-1633] Braden, R., Clark, D., Shenker, S.,
"Integrated Services in the Internet
Architecture: An Overview", RFC 1633,
June 1994.
[IANA-CONSIDERATIONS] Alvestrand, H. and T. Narten, "Guidelines for
Writing an IANA Considerations Section in
RFCs", BCP 26, RFC 2434, October 1998.
13. Author Information
Louis-Nicolas Hamer Louis-Nicolas Hamer
Nortel Networks Nortel Networks
Ottawa, Canada PO Box 3511 Station C
Ottawa, Ontario
Canada K1Y 4H7
Phone: +1 613.768.3409
EMail: nhamer@nortelnetworks.com EMail: nhamer@nortelnetworks.com
Brett Kosinski Brett Kosinski
University of Alberta University of Alberta
Edmonton, Canada Edmonton, Alberta
Canada T6G 2M7
EMail: kosinski@cs.ualberta.ca EMail: kosinski@cs.ualberta.ca
Bill Gage Bill Gage
Nortel Networks Nortel Networks
Ottawa, Canada PO Box 3511 Station C
Ottawa, Ontario
Canada K1Y 4H7
Phone: +1 613.763.4400
EMail: gageb@nortelnetworks.com EMail: gageb@nortelnetworks.com
Matt Broda Matt Broda
Nortel Networks Nortel Networks
Ottawa, Canada PO Box 3511 Station C
Ottawa, Ontario
Canada K1Y 4H7
Phone: +1 613.763.7399
EMail: mbroda@nortelnetworks.com EMail: mbroda@nortelnetworks.com
Hugh Shieh Hugh Shieh
AT&T Wireless AT&T Wireless
Redmond, USA 7277 164th Avenue NE
Redmond, WA
USA 98073-9761
Phone: +1 425.580.6898
Email: hugh.shieh@attws.com Email: hugh.shieh@attws.com
12. Full Copyright Statement 14. Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved. This Copyright (C) The Internet Society (2002). All Rights Reserved. This
document and translations of it may be copied and furnished to document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph kind, provided that the above copyright notice and this paragraph
are included on all such copies and derivative works. However, this are included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organisations, except as needed for the purpose of Internet organisations, except as needed for the purpose of
developing Internet standards in which case the procedures for developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be copyrights defined in the Internet Standards process must be
followed, or as required to translate it into. followed, or as required to translate it into.
Expiration Date 15. Notices
This memo is filed as <draft-ietf-rap-rsvp-authsession-02.txt>, and "The IETF takes no position regarding the validity or scope of
expires August 31, 2002. any intellectual property or other rights that might be claimed
to pertain to the implementation or use of the technology
described in this document or the extent to which any license
under such rights might or might not be available; neither does
it represent that it has made any effort to identify any such
rights. Information on the IETF's procedures with respect to
rights in standards-track and standards-related documentation
can be found in BCP-11. Copies of claims of rights made
available for publication and any assurances of licenses to
be made available, or the result of an attempt made
to obtain a general license or permission for the use of such
proprietary rights by implementors or users of this
specification can be obtained from the IETF Secretariat."
"The IETF invites any interested party to bring to its
attention any copyrights, patents or patent applications, or
other proprietary rights which may cover technology that may be
required to practice this standard. Please address the
information to the IETF Executive Director."
16. RFC Editor Considerations
This document references an IETF Internet-Draft that is in the IESG
last call stage. Please use the corresponding RFC number prior to
publishing of this document as a RFC. The referenced IETF I-D is
[S-AUTH].
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/