diameter

最新推荐文章于 2024-08-22 10:05:52 发布
最新推荐文章于 2024-08-22 10:05:52 发布
阅读量4.5k 收藏 2
点赞数
分类专栏： 协议
本文深入探讨了Diameter协议，作为计算机网络中的一种高级认证、授权和计费机制，它取代了功能有限的RADIUS协议。文章详细介绍了与RADIUS的比较、应用程序扩展、历史背景、协议描述、包格式、状态机和消息流等内容，旨在提供全面的技术指南。

摘要生成于 C知道 ，由 DeepSeek-R1 满血版支持， 前往体验 >

http://en.wikipedia.org/wiki/Diameter_(protocol)


Diameter (protocol)

From Wikipedia, the free encyclopedia
Internet protocol suite
Application layer
Transport layer
Internet layer
Link layer

Diameter is an authentication, authorization, and accounting protocol for computer networks. It evolved from and replaces the much less capable RADIUS protocol that preceded it.

Diameter Applications extend the base protocol by adding new commands and/or attributes, such as those for use of the Extensible Authentication Protocol (EAP).

Comparison with RADIUS[edit source | editbeta]

The name is a play on words, derived from the RADIUS protocol, which is the predecessor (a diameter is twice the radius). Diameter is not directly backwards compatible but provides an upgrade path for RADIUS. The main differences are the following:

  • Reliable transport protocols (TCP or SCTP, not UDP)----------- 客户端可以支持TCP或者SCTP；而服务端和中继必须二者都支持。
  • Network or transport layer security (IPsec or TLS)---------- IPSec必须支持，TLS可选。
  • Transition support for RADIUS, although Diameter is not fully compatible with RADIUS
  • Larger address space for attribute-value pairs (AVPs) and identifiers(32 bits instead of 8 bits)
  • Client–server protocol, with exception of supporting some server-initiated messages as well(服务器端主动发起消息，如RAR，DPR，DWR消息)
  • Both stateful and stateless models can be used
  • Dynamic discovery of peers (using DNS SRV and NAPTR)
  • Capability negotiation（即CER，CEA）
  • Supports application layer acknowledgements, defines failover methods and state machines (RFC 3539)
  • Error notification
  • Better roaming support
  • More easily extended; new commands and attributes can be defined
  • Aligned on 32-bit boundaries
  • Basic support for user-sessions and accounting
  • 故障恢复就是failback；如果故障了，尝试使用另外一个，则是failover。

Applications[edit source | editbeta]

A Diameter Application is not a software application but is a protocol based on the Diameter base protocol defined in RFC 6733 (Obsoletes: RFC 3588). Each application is defined by an application identifier and can add new command codes and/or new mandatory AVPs. Adding a new optional AVP does not require a new application.

Examples of Diameter applications:

Both the  HSS and the  SLF communicate using the Diameter protocol.

(Generic Bootstrapping Architecture): Bootstrapping Server Function

History[edit source | editbeta]

The Diameter protocol was initially developed by Pat R. Calhoun, Glen Zorn, and Ping Pan in 1998 to provide an Authentication, Authorization, and Accounting (AAA) framework that could overcome the limitations of RADIUS. RADIUS had issues with reliability, scalability, security and flexibility. RADIUS cannot effectively deal well with remote access, IP mobility, and policy control. The Diameter protocol defines a policy protocol used by clients to perform Policy, AAA, and Resource Control. This allows a single server to handle policies for many services.[1]

Like RADIUS, Diameter provides AAA functionality but in addition it is made more reliable by using TCP and SCTP instead of UDP. The Diameter protocol is further enhanced by the development of the 3rd Generation Partnership Project (3GPP) IP Multimedia Subsystem (IMS). The Cx, Dh, Dx, Rf, Ro, and Shinterfaces are supported by Diameter applications.[2] Through the use of extensions, the protocol was designed to be extensible to support Proxies, Brokers, Strong Security, Mobile-IP, Network Access Servers (NASREQ), Accounting, and Resource Management.

Protocol description[edit source | editbeta]

[icon]This section requires expansion. (June 2008)

The Diameter base protocol is defined by RFC 6733 (Obsoletes: RFC 3588) and defines the minimum requirements for an AAA protocol. Diameter Applications can extend the base protocol by adding new commands, attributes, or both. Diameter security is provided by IPsec or TLS.The IANA has assigned TCP and SCTP port number 3868 to Diameter. 

----- TLS/TCP and Datagram Transport Layer Security，DTLS/SCTP缺省使用5658，为了兼容rfc3588，也可以支持3868。

Packet format[edit source | editbeta]

The packet consists of a Diameter header and a variable number of Attribute-Value Pairs, or AVPs, for encapsulating information relevant to the Diameter message.

Diameter Header
Bit offset  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
0versionmessage length
32RPET        command code
64
application ID ------  Diameter common message(0),NASreq(1),MOBILE-IP（2），diameter base accounting（3）；DCCA(4)
即使在同一个应用中的不同报文中此字段也可能不同，需要参考对应的RFC文档。
举例：
NASreq：在CER，CEA，AA-Request (AAR)，AA-Answer (AAA)中都是1。其他消息都是0。???
DCCA： 在CER，CEA，CCR，CCA，RAR，RAA中都是4。???
。。。。

The Gx application is defined as a vendorspecific Diameter application, 

where the vendor is 3GPP and the Application-IDfor the Gx Application in the present release is 16777238. The vendoridentifier assigned by IANA to 3GPP (http://www.iana.org/assignments/enterprise-numbers)is 10415.



The application can be an  authentication application, an accounting application, or a  vendor-specific application.
The value of the Application-ID field in the header MUST be the  same as any relevant Application-Id AVPs contained in the message.
此值必须和AVP里面的Application-Id相同。
96hop-by-hop ID
逐跳标识用于判断请求与应答的对应关系，尽可能保证重启后仍然唯一。不认识此值的应答消息要丢弃。

为了支持failover，需要缓存所有没有应答的消息；当收到应答消息，通过hop-by-hop ID找到并删除缓存的请求消息。
128end-to-end ID
端到端标识主要用于重复消息的检查
网络字节序；高12位为当前时间的低12位；低20位为随机值；要求保证至少4min只能本地唯一；和 Origin-Host AVP结合起来检查重复消息；

因为出现failover，所以会重复发送消息，带T标记，需要对端检查重复。
160
...		AVPs
...

The "R" (Request) bit – If set, the message is a request. If cleared, the message is an answer.

The "P" (Proxiable) bit – If set, the message MAY be proxied, relayed or redirected. If cleared, the message MUST be locally processed.

The "E" (Error) bit – If set, the message contains a protocol error, and the message will not conform to the ABNF described for this command. Messages with the "E" bit set are commonly referred to as error messages. This bit MUST NOT be set in request messages.

The "T" (Potentially re-transmitted message) bit – This flag is set after a link failover procedure, to aid the removal of duplicate requests. It is set when resending requests not yet acknowledged as an indication of a possible duplicate due to a link failure.一定不能出现在应答消息里。

Commands[edit source | editbeta]

Each command is assigned a command code, which is used for both Requests and Answers.

The values 0-255 are reserved for RADIUS backward compatibility. The values 256-16777213 are for permanent, standard commands allocated by IANA. The values 16777214 and 16777215 (hex 0xFFFFFE and 0xFFFFFF) are reserved for experimental and testing purposes.

Some common Diameter commands are:

Command-Name Abbr. Code
AA-RequestAAR265
AA-AnswerAAA265
Diameter-EAP-RequestDER268
Diameter-EAP-AnswerDEA268
Abort-Session-Request，必须包含< Session-Id >字段，和DPR不是一个级别的。ASR274
Abort-Session-AnswerASA274
Accounting-RequestACR271
Accounting-AnswerACA271
Credit-Control-Request，必须包含< Session-Id >字段CCR272
Credit-Control-AnswerCCA272
Capabilities-Exchange-RequestCER257
Capabilities-Exchange-AnswerCEA257
Device-Watchdog-RequestDWR280
Device-Watchdog-AnswerDWA280
Disconnect-Peer-RequestDPR282
Disconnect-Peer-AnswerDPA282
Re-Auth-Request，必须包含< Session-Id >字段RAR258
Re-Auth-AnswerRAA258
Session-Termination-RequestSTR275
Session-Termination-AnswerSTA275
User-Authorization-RequestUAR300
User-Authorization-AnswerUAA300
Server-Assignment-RequestSAR301
Server-Assignment-AnswerSAA301
Location-Info-RequestLIR302
Location-Info-AnswerLIA302
Multimedia-Auth-RequestMAR303
Multimedia-Auth-AnswerMAA303
Registration-Termination-RequestRTR304
Registration-Termination-AnswerRTA304
Push-Profile-RequestPPR305
Push-Profile-AnswerPPA305
User-Data-RequestUDR306
User-Data-AnswerUDA306
Profile-Update-RequestPUR307
Profile-Update-AnswerPUA307
Subscribe-Notifications-RequestSNR308
Subscribe-Notifications-AnswerSNA308
Push-Notification-RequestPNR309
Push-Notification-AnswerPNA309
Bootstrapping-Info-RequestBIR310
Bootstrapping-Info-AnswerBIA310
Message-Process-RequestMPR311
Message-Process-AnswerMPA311
Update-Location-RequestULR316
Update-Location-AnswerULA316
Authentication-Information-RequestAIR318
Authentication-Information-AnswerAIA318
Notify-RequestNR323
Notify-AnswerNA323
[icon]This section requires expansion.(December 2009)

Attribute-Value Pairs (AVP)[edit source | editbeta]

AVP Header
Bit offset  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
0AVP code-----32位长度，而radius只有255个。
32VMP          AVP length
64 vendor ID (optional)
96
...		data
...

For simplicity, "V" bit Means Vendor Specific; "M" bit means Mandatory;"P" bit means Protected.

The "V" bit, known as the Vendor-Specific bit, indicates whether the optional Vendor-ID field is present in the AVP header. When set the AVP Code belongs to the specific vendor code address space.

The "M" bit, known as the Mandatory bit, indicates whether support of the AVP is required. If an AVP with the "M" bit set is received by a Diameter client, server, proxy, or translation agent and either the AVP or its value is unrecognized, the message MUST be rejected. Diameter Relay and redirect agents MUST NOT reject messages with unrecognized AVPs.

The "P" bit indicates the need for encryption for end-to-end security.

Attribute-Name Code Data Type
Acct-Interim-Interval85Unsigned32
Accounting-Realtime-Required483Enumerated
Acct-Multi-Session-Id50UTF8String
Accounting-Record-Number485Unsigned32
Accounting-Record-Type480Enumerated
Accounting-Session-Id44OctetString
Accounting-Sub-Session-Id287Unsigned64
Acct-Application-Id259Unsigned32
Auth-Application-Id258Unsigned32
Auth-Request-Type274Enumerated
Authorization-Lifetime291Unsigned32
Auth-Grace-Period276Unsigned32
Auth-Session-State277Enumerated
Re-Auth-Request-Type285Enumerated
Class25OctetString
Destination-Host293DiamIdent
Destination-Realm283DiamIdent
Disconnect-Cause273Enumerated
E2E-Sequence300Grouped
Error-Message281UTF8String
Error-Reporting-Host294DiamIdent
Event-Timestamp55Time
Experimental-Result297Grouped
Experimental-Result-Code298Unsigned32
Failed-AVP279Grouped
Firmware-Revision267Unsigned32
Host-IP-Address257Address
Inband-Security-Id299Unsigned32
Multi-Round-Time-Out272Unsigned32
Origin-Host264DiamIdent
Origin-Realm296DiamIdent
Origin-State-Id278Unsigned32
Product-Name269UTF8String
Proxy-Host280DiamIdent
Proxy-Info284Grouped
Proxy-State33OctetString
Redirect-Host292DiamURI
Redirect-Host-Usage261Enumerated
Redirect-Max-Cache-Time262Unsigned32
Result-Code268Unsigned32
Route-Record282DiamIdent
Session-Id263UTF8String
Session-Timeout27Unsigned32
Session-Binding270Unsigned32
Session-Server-Failover271Enumerated
Supported-Vendor-Id265Unsigned32
Termination-Cause295Enumerated
User-Name1UTF8String
Vendor-Id266Unsigned32
Vendor-Specific-Application-Id260Grouped

State machines[edit source | editbeta]

[icon]This section requires expansion.(December 2009)

The RFC 3588 defines a core state machine for maintaining connections between peers and processing messages. This is part of the basic protocol functionality and all stacks should support it and as such abstract from the connectivity related operations.

  • Peer State Machine Part 1

     

  • Peer State Machine Part 2

Additionally, application specific state machines can be introduced either later or at a higher abstraction layer. The RFC 3588 defines an authorization and an accounting state machine.

  • Diameter Authorization State Machines (Client)

     

  • Diameter Authorization State Machines (Server)

     

  • Diameter Accounting State Machines (Client)

     

  • Diameter Accounting State Machines (Server)

Message flows[edit source | editbeta]

Diameter message flow.png

The communication between two diameter peers starts with the establishment of a transport connection (TCP or SCTP). The initiator then sends a Capabilities-Exchange-Request (CER) to the other peer, which responds with a Capabilities-Exchange-Answer (CEA).For RFC3588 compliant peers TLS (Transport Layer Security) may optionally be negotiated. For RFC6733 compliant peers TLS negotiation may optionally happen before the CER/CEA.TLS功能是协商的。

The connection is then ready for exchanging application messages.

If no messages have been exchanged for some time either side may send a Device-Watchdog-Request (DWR) and the other peer must respond with Device-Watchdog-Answer. 如果一段时间没有消息，任何一端可以发送DWR。

Either side may terminate the communication by sending a Disconnect-Peer-Request (DPR) which the other peer must respond to with Disconnect-Peer-Answer. After that the transport connection can be disconnected. 任何一端可以主动通过DPR断开连接

RFCs[edit source | editbeta]

The Diameter protocol is currently defined in the following IETF RFCs: Obsolete RFCs are indicated with strikethrough text.

# Title Date published Related article Obsoleted by Notes
RFC 3588Diameter Base Protocol.September 2003 RFC 6733 
RFC 3589Diameter Command Codes for Third Generation Partnership Project (3GPP) Release 5.September 2003   
RFC 4004Diameter Mobile IPv4 Application.August 2005   
RFC 4005Diameter Network Access Server ApplicationAugust 2005   
RFC 4006Diameter Credit-Control Application.August 2005Diameter Credit-Control Application  
RFC 4072Diameter Extensible Authentication Protocol (EAP) Application.August 2005   
RFC 4740Diameter Session Initiation Protocol (SIP) Application. M.November 2006   
RFC 5224Diameter Policy Processing Application.March 2008   
RFC 5431Diameter ITU-T Rw Policy Enforcement Interface Application.March 2009   
RFC 5447Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction.February 2009   
RFC 5516Diameter Command Code Registration for the Third Generation Partnership Project (3GPP) Evolved Packet System (EPS).April 2009  -
RFC 5624Quality of Service Parameters for Usage with Diameter.August 2009   
RFC 6733Diameter Base Protocol.October 2012   
RFC 6737The Diameter Capabilities Update Application.October 2012   


 8. Diameter SIP Application Command Codes .........................22
      8.1. User-Authorization-Request (UAR) Command ..................22
      8.2. User-Authorization-Answer (UAA) Command ...................23
      8.3. Server-Assignment-Request (SAR) Command ...................27
      8.4. Server-Assignment-Answer (SAA) Command ....................29
      8.5. Location-Info-Request (LIR) Command .......................33
      8.6. Location-Info-Answer (LIA) Command ........................33
      8.7. Multimedia-Auth-Request (MAR) Command .....................35
      8.8. Multimedia-Auth-Answer (MAA) Command ......................36
      8.9. Registration-Termination-Request (RTR) Command ............39
      8.10. Registration-Termination-Answer (RTA) Command ............39
      8.11. Push-Profile-Request (PPR) Command .......................41
      8.12. Push-Profile-Answer (PPA) Command ........................42

VOLTE 流程
ma_tou的博客
06-19 8790
1、用户发起呼叫，CM 通知IMS ，IMS 创建并发送INVITE 消息Reliable provisional responses (100 Rel)SDP for audio codec support2、当LTE栈接收到该消息时，它启动一个服务请求过程。 RRC层执行RACH过程以进入RRC连接状态并发送该消息。3、LTE栈发送INVITE 消息a、INVITE到达P-CSCF1。 它通过...
Diameter消息应用层路由
weixin_33688840的博客
09-02 480
1. 创建和发送Request消息： 1) 产生一个Request消息时，必须遵守下列规则： · 设置头部的Command code； · 设置头部的 'R' 位； · 设置头部的End-to-End 为本地的唯一值； · Origin-Host 和 Origin-Realm AVPs 必须携带, 用来标识消息的源地址； · Destination-Host 和 Destination...
Diameter基础协议摘要
Minico's blog
07-09 9046
Diameter是新一代AAA协议，可以承载与TCP或者SCTP协议之上，被广泛应用于IMS，LTE网络中。RFC3588定义了Diameter的基础协议，各种应用可以在此基础上对其进行扩展(主要是定义新的Application ID，Command和AVP)；基础协议中包括一个基本的Accounting功能，如果需要Authentication或者Authorization通常需要进行对基础协议扩展。
22-LTE Policy and Charging Control (PCC)
sundaygeek的专栏
09-18 3642
原文链接：http://www.netmanias.com/en/?m=view&id=techdocs&no=6562I. introduction为了使用LTE服务，用户必须购买一个LTE设备，和运营商签署一个账户，并选择服务类型和想要的计划。为了支持和管理这些选择的服务，运营商根据用户的签约信息来配置签约文件。当用户使用LTE服务时，对每一个和不同服务相关的APN建立EPS会话。这时，网络决定
下一代的AAA协议标准-Diameter
Anthony的专栏
09-22 1205
IETF的AAA工作组同意将Diameter协议作为下一代的AAA协议标准。Diameter(为直径，RADIUS:半径)包括基本协议，NAS(网络接入服务)协议，EAP(可扩展鉴别)协议，MIP(移动IP)协议，CMS(密码消息语法)协议等。Diameter协议支持移动IP、NAS请求和移动代理的认证、授权和计费工作，其中详细规定了错误处理, failover机制,采用TCP协议，支持分布式计费
JavaDiameterPeer.tar.gz_IMS_diameter java_java diameter_java ims
07-15
JavaDiameterPeer.tar.gz 是一个压缩包文件，包含与IMS（IP Multimedia Subsystem）网络中的Diameter协议相关的Java源代码实现。IMS是现代移动通信系统中用于提供多媒体服务的核心网络架构，而Diameter协议则是IMS中...
Diameter协议
05-27
《Diameter协议详解》 Diameter协议，作为RADIUS（Remote Authentication Dial-In User Service）协议的后继者，是互联网工程任务组（IETF）为解决RADIUS在处理高负载和提供更安全服务时的局限性而设计的一种认证、...
Seagull_Diameter性能与功能测试与详解.rar
08-12
Seagull Diameter是一款强大的多协议流量生成工具，用于测试网络设备和服务的性能和稳定性，尤其在处理Diameter协议时表现出色。Diameter是IP网络中的一种基础协议，用于AAA（认证、授权和计费）服务，它替代了早期...
rfc3588-diameter.pdf
05-09
标题 "rfc3588-diameter.pdf" 指的是关于 Diameter 协议的RFC文档编号3588。Diameter 协议是用于4G网络中的信令解析的网络协议，它是 Radius 协议的替代和增强版，广泛应用于认证、授权、计费（AAA）系统中。...
netty-diameter
06-05
Netty-Diameter是一个基于Netty 4.0.x框架实现的实验性Diameter协议API。Diameter协议是一种网络协议，主要用于在AAA（认证、授权、计费）场景中，为IP网络提供通信服务，比如在移动网络中进行用户身份验证、权限...
Diameter 协议
Socrates的专栏
07-24 7040
Diameter
Diameter协议摘要
weixin_30779691的博客
06-03 2629
　　　　　　---------选择同学整理文档 1. 协议概述 Diameter协议主要为应用程序提供认证、鉴权、计费框架，即AAA，并支持本地AAA和漫游场景下的AAA。 1.1. 特点介绍 以前的AAA协议如RADIUS、TACACS主要是针对PPP服务和终端服务而设计的。随着网络技术的发展，新的接入方式如无线接入、DSL接入、移动IP陆续出现，以太网也不断发展，AAA中的网络访...
VoLTE 信令分析手册
热门推荐
达帮主
01-23 1万+
1 初始注册 1) VoLTE UE 在 LTE 网络内发起 Initial attach 流程，建立数据 APN 的 PDN connection，相应的 default EPS bearer 为 QCI9/8（由 HSS 上用户签约数据决定）； 当核心网也支持 VoLTE 时，MME 会在 Attach 过程中告知 UE 网络侧支持 VoLTE。 2) VoLTE UE 发起到 IMS APN 的 PDN connection 建立流程，相应的缺省承载为 QCI5；在该过 程中，获取 IMS .
VoLTE基本信令流程(整理的学习笔记)
最新发布
weixin_50281314的博客
08-22 4135
VoLTE的基本流程
SCTP：记录一次Diameter消息卡顿延迟问题
test1280
05-09 1618
从客户端侧看，发现客户端Diameter模块与服务端Diameter模块的SCTP的读缓冲区都是空，没有堆积，并非是客户端Diameter模块收读的慢。应用程序能看到的是，write SCTP data to SCTP conn，是很快的，立刻返回，没有时延。客户端是27.29、27.55、24.17、24.101、24.39，有27网段，也有24网段；在将客户端与服务端同网段调整后，问题解决，不再有堆积，时延也消失。可见，服务端给客户端的SCTP链路中，有大量的SCTP消息堆积。
RetrofitUtils工具类
weixin_44570672的博客
03-24 214
public class RetrofitUtils { private static RetrofitUtils instance; private RetrofitUtils(){} public static RetrofitUtils getInstance(){ if(instance==null){ synchroniz...
diameter协议栈_Diameter协议学习笔记一(协议介绍)
weixin_28818643的博客
01-17 1512
原文来自百度文库http://wenku.baidu.com/view/bc91976127d3240c8447efec.html?re=view一、摘要：Diameter协议主要为应用程序提供认证、鉴权、计费框架，即AAA，并支持本地AAA和漫游场景下的AAA。二、介绍：AAA协议、例如TACACS、RADIUS起初是为了提供PPP及终端接入，随着Internet及新的接入技术的发展，包括无线、...
Diameter协议技术要求详解
"Diameter基础协议技术要求" Diameter是一种基于 Diameter Base Protocol 的网络协议，用于在通信设备之间传输认证、授权和计费(AAA)信息。该协议是为了解决RADIUS协议的局限性而设计的，特别是考虑到IPv6和移动...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值