1. Accounting, Auditing and Session IDs Nevil Brownlee The University of Auckland / CAIDA Adelaide, March 2000

2. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 1 / 13 Accounting and Auditing Auditing means “making and distributing records of network activity so that events, usage, etc. can be summarised for the users responsible for them” Accounting means “generating audit records” An Accounting ID is a globally unique identifier used by an Audit server to correlate audit records by session and sub-session Audit servers could allow controlled access to different parts of the audit database, e.g. users could see their usage records

3. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 2 / 13 Accounting IDs Several good ways to construct globally unique identifiers are already known, e.g. SMTP, DIAMETER, UUID URI, etc. A simple scheme for AAA could be nnn.ttt@server.foo.com where server.foo.com = server’s domain name ttt = time of day (UTC seconds) nnn = sequence number (set to a random value on server boot-up)

4. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 3 / 13 Using Accounting IDs Could have AAA server generate Accounting ID on authentication, and have all servers use it. This creates a bottleneck Better to have each server generate and use its own sub-session ID Each server will send audit records to one or more Audit Servers using their IDs The servers will also need to send the Audit servers information about the IDs, allowing it to keep track of the sub-session tree

5. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 4 / 13 ARAR AHAH ASAS S0S0 User Agent Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S 0 generates Accounting ID K 0, sends K 0 with Authentication Request via A R to A H A H returns Authentication Response to S 0, with list of Audit Servers (A H, A s ) User starts session

6. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 5 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S 0 sends Start Session request to its designated Audit Servers (A H, A s ) Start Session record includes the session Accounting ID, K 0 S 0 Initiates Auditing User Agent

7. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 6 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S 0 sends Audit Record(s) to its designated Audit Servers (A H, A s ) Every audit record record includes the session Accounting ID, K 0 S 0 Session Progresses User Agent

8. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 7 / 13 S 0 starts Sub-session S 1 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 Sub-session examples: Bandwidth Broker, VoIP Gateway S 0 sends S 1 a Start Sub-session request, which includes K 0 and (A H, A s ) Sub-session Server 1 User Agent

9. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 8 / 13 S 1 Initiates Auditing ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 S 1 generates sub-session Accounting ID K 1, sends Start Sub-session request to (A H, A s ), which includes K 0, K 1 and (A H, A s ) Sub-session Server 1 User Agent

10. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 9 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 S 1 sends Audit Record(s) with Accounting ID K 1 to (A H, A s ) S 1 Sub-session Progresses Sub-session Server 1 User Agent

11. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 10 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 S2S2 S 1 starts Sub-session S 2 S 1 sends S 2 a Start Sub-session request, which includes K 1 and (A H, A s ) Sub-session Server 1 Sub-session Server 2 User Agent

12. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 11 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 S2S2 S 2 Initiates Auditing S 2 generates sub-session Accounting ID K 2, sends Start Sub-session request to (A H, A s ), which includes K 1, K 2 and (A H, A s ) Sub-session Server 1 Sub-session Server 2 User Agent

13. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 12 / 13 ARAR AHAH ASAS S0S0 Home AAA Server Remote AAA Server Secondary Audit (AAA) Server S1S1 S2S2 S 2 Sub-session Progresses Sub-session Server 1 Sub-session Server 2 S 1 sends Audit Record(s) with Accounting ID K 1 to (A H, A s ) User Agent

14. Adelaide IETF, March 2000Nevil Brownlee, U of A / CAIDA 13 / 13 Summary There are several good ways to make a globally unique Accounting ID Accounting IDs can be generated by each server contributing to a session Each server must send Accounting IDs for itself and its parent to the Audit Server(s) as part of initiating sub-session audit activities Audit servers collect pairs of parent-child Accounting IDs and use them to reconstruct the session tree