1. AAA-ARCH IRTF-RG Authentication Authorisation and Accounting ARCHitecture Research Group chairs: C. de Laat J. Vollbrecht Content of this talk has contributions from many persons including: B. de Bruijn, C & K Dobbins, S. Farrell, G. Gross, L. Gommans, D. Spence, E. Verharen, T. Verschuren, T. Zseby 1 of 14

2. Applications –Network Access –Bandwidth Broker –Authorization of resources living in many administrative domains –Budget system –Library system –Computer based education system –E-Commerce –Micro-payments –Car Rental –Daily life 2 of 14

3. Physics-UU to IPP-FZJ => 7 kingdoms –Netherlands »Physics dept »Campus net »SURFnet –Europe »TEN 155 –Germany »WINS/DFN »Juelich, Campus »Plasma Physics dept Multi Kingdom Problem 3 of 14 USA line 3 ms Jülich 17 ms 2.5 ms

4. The need for AAA End user RRRR Remote service management 4 of 14 Kingdom NKingdom N+1 BB AAA BB management ? ? AAA $$$

5. User User Home Organization AAA Server Service Provider AAA Server Service Equipment Request 1 Approved 4 Commit Approval 3 Conditional Approval 2 5 use service 3 Example application: bandwidth brokerage at Enterprise/Service Provider boundary Roaming “Agent” Authorization Model 5 of 14

6. User User Home Organization AAA Server Service Provider AAA Server Service Equipment Request 1 Approved 4 Commit Approval 2 Conditional Approval 3 5 use service 4 Example applications: Mobile IP, PPP dial-in to NAS 1 Roaming “Pull” Authorization Model 6 of 14

7. User User Home Organization AAA Server Service Provider AAA Server Service Equipment Request 1 Approved 4 5 use service 4 Conditional Approval with ticket 2 Request with ticket 3 Example application: Internet printing, where file and print servers are in different admin domains Roaming “Push” Authorization Model 7 of 14

8. Generic AAA server Rule based engine Application Specific Module Auth rules Events API 2 11 3 AAA Server building block Types of communication: 1: “The” AAA protocol 2: interface (API) to app specific module (addressing!) 3: interface (API or connection) to repositories (e.g. LDAP) 8 of 14 Rule example: Auth_A = (B>9).or. C.and. D

9. Generic AAA server Rule based engine Application Specific Module Policy Events 2 11 3 Service 5 Types of communication: 5: Towards service (f.e. COPS, CLI, SNMPv3) Pushing the buttons 9 of 14

10. Generic AAA server Rule based engine Application specific Module Policy Events 2 11 3 4 Types of communication: 4: Legacy protocols (Radius, Diameter, …) 10 of 14 Legacy protocols

11. Generic AAA server Rule based engine Application specific Module Policy Events 2 11 3 4 GW 1 2 Gateway 11 of 14

12. AAA Server with Accounting as Separate Service Generic AAA server Rule based engine Application Specific Module Policy Events 2 11 3 Accounting Module Service 5 Metering 6 Acct Data 3 2 12 of 15

13. Generic AAA server Rule based engine Application specific Module Policy Events 2 11 3 Accounting/ Metering Service 5 Acct Data 3 5 AAA Server with Accounting as Part of the Service 13 of 16

14. Example: Interaction with Authorization User AAA Server Service Equipment Visited ISP Home ISP Collectors Meters Accounting Records (ARs) 1 2 3 4 5 6 Service parameters including Accounting Policy Charging Policies Bill Charging & Billing configuration 7 ARs 8 (optional online charging) 14 of 16

15. AAA server 15a of 16 Generic AAA Agent Model

16. Layer 3/4 Switch Internet User Content Server AAA Content Server AAA Content Server AAA Bandwidth Broker AAA User-Home Organ. AAA Financial Organ. AAA Service Profiles AAA ASPISP's 15b of 16 Future AAA Application (ASP)

17. RG-Goals-1 Specific goals of the RG are: develop generic AAA model by specifically including Authentication and Accounting develop auditability framework specification that allows the AAA system functions to be checked in a multi- organization environment develop a model that supports management of a "mesh" of interconnected AAA Servers define distributed policy framework, coordinate with policy framework WG and others develop an accounting model that allows authorization to define the type of accounting processing required for each session 15c of 16

18. RG-Goals-2 Specific goals of the RG are: implement a simulation model that allows experimentation with the the proposed architectural models (also work on an emulation) describe interdomain issues using generic model work with AAA WG to align short term AAA protocol requirements with long term requirements as much as possible complete the work in Q4 - 2000 (ambitious) 15d of 16

19. Research Group Name: AAAARCH - RG Chair(s) –John Vollbrecht -- jrv@merit.edu –Cees de Laat -- delaat@phys.uu.nl Web page –www.irtf.org –www.phys.uu.nl/~wwwfi/aaaarch Mailing list(s) –aaaarch@fokus.gmd.de –For subscription to the mailing list, send e-mail to majordomo@fokus.gmd.de with content of message subscribe aaaarch end –will be archived, retrieval with frames and in plain ascii: »http://www.fokus.gmd.de/glone/research/aaaarch/ »http://www.fokus.gmd.de/glone/research/mail-archive/aaaarch-current »ftp://ftp.fokus.gmd.de/pub/glone/mail-archive/aaaarch-current 16 of 16 Research Group - info