1 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney SIP-AAA Requirements John Loughney Gonzalo Camarillo IETF 54

2 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney High-level Goals AAA = Authorization, Authentication & Accounting. There is a desire to involve a AAA infrastructure for SIP services. Potentially, this may simplify life for service providers and for users. The requirements are not meant prevent working / interworking without AAA. The requirements, as currently written, are not meant to all be applied in a single solution.

3 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney Common Requirements The basic AAA architecture allows for the support of different access methods and technologies. Service providers MUST be able to provide AAA services for SIP irrespective of access method or technology. AAA should not unduly burden call setup times where appropriate. It may be reasonable to support some delay during registration, but delay during sessions (especially real-time) are problematic. Ability for SIP Servers to provide the duration of a session, the parties involved, and other relevant information to the visited and home AAA servers as accounting information. AAA data must be able to be securely transported. Authentication of the endpoints must be possible. The endpoints may be authorized to access certain types of AAA data. The home AAA server must be able to inform a SIP server when a particular user is no longer authorized to perform a particular task, even if it is an ongoing task.

4 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney Authorization Requirements To Authorize: to grant authority or power to. SIP authorization vs. (network, service) provider authorization. One use is to see if the user has paid his bill and is entitled to the service; if the user has subscribed to the service, etc.

5 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney Authentication Requirements To authenticate: to determine as real and true Important to ensure a user is who the user reports he/she is.

6 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney Accounting Requirements To account: A precise list or enumeration of financial transactions. In this work, it may be more about SIP ‘transactions’ than financial ones. This is more than just charging and billing. Charging and billing for SIP is a very tricky thing & probably best contained in a separate document. Accounting could be just a simple transactional record about SIP messages, etc.

7 sip-aaa-req.PPT/ 16 Jul 2002 / John Loughney Next Steps Is this useful? Submit your favorite requirement for your favorite ‘A.’ Should this be a WG draft?