無線網(Wi-Fi) 空中線(Antenna）(62)AAAのRFCを読む

Last updated at 2024-04-26Posted at 2019-02-11

AAA(Authentication（認証）、Authorization（許可）、Accounting（会計))のWikiの記述が少ない。
https://ja.wikipedia.org/wiki/AAA_プロトコル

RadiusのRFCを読む。
https://qiita.com/kaizen_nagoya/items/2d17342b9abfac945a1c

と並行してRFCを読み進める。

最初は表題にAAAがあるものだけ読む。

読む目的によって、全部読むか、全部に加えてそれぞれのRFCで参照しているRFCも全部読むか、現在有効な文書だけ読むか、現在重要な文書だけ読むかの4種類を想定
#重要な文書だけ読む

RADIUSの著名な書籍を読み、その参考文献、引用しているRFCだけ読む。
この方法だと、今回の目的のうち、RFCだけから理解するという作業にならなくなってしまう。
現在有効な文書だけ読む

下記検索結果からObsolatedとなっているもの以外を読む。

ここから始める。

まず、表題にAAAの文字があるものだけ最初に読む(1)。
RFC editor search
https://www.rfc-editor.org/search/rfc_search.php
読んだものからURLをつける。

もし、構造が変わるのであれば、前の文書をObsolateして、新しい文書番号をつけるはずだから。
（どんどん新しい文書にしていくものと、古い文書を大切にしてUpdateするものもあるかもしれず、かならずしも新番号がつかなければ中核とは限らないかもしれない。）

AAA RFCを全部読む

RFC Editor Searchで、AAAで検索した結果が下記。
他の通信規約の場合に、略称が全く出てこない文章もあったような気がする。
全部読む過程で、関連文書、変更文書などが、この一覧にないかを確認する。

AAA RFCで参照しているRFCも読む

ReferenceのRFCを理解していないと、本質的な事項がわからないかもしれない。

今回は、参照通信規約の重み付けは行なっていない。（重要度を評価するほど理解していない）

RFC editor search

Best Current Practice: B.C.P.
Draft Standard: D.S.
Experimental: Exp.
Informational: Inf.
Proposed Standard: P.S.

Glossary

RFC 2903

Application Specific Information (ASI)

information in an AAA
protocol message that is specific to a particular application.

Application Specific Module (ASM)

a software module that
implements a program interface to a generic AAA server which
handles application specific functionality for an AAA protocol
message.

RFC 2903, RFC2904, RFC2905

Service Provider

an organization which provides a service.

###User
the entity seeking authorization to use a resource or a ervice.
###User Home Organization (UHO)
An organization with whom the User
has a contractual relationship which can authenticate the User and
may be able to authorize access to resources or services.

RFC2904, RFC2905

Attribute Certificate

  structure containing authorization
  attributes which is digitally signed using public key cryptography.

###Contract Relationship
a relation established between two or more business entities where terms and conditions determine the exchange of goods or services.

Distributed Service

  a service that is provided by more than one
  Service Provider acting in concert.

Dynamic Trust Relationship

  a secure relationship which is
  dynamically created between two entities who may never have had
  any prior relationship. This relationship can be created if the
  involved entities have a mutually trusted third party. Example: A
  merchant trusts a cardholder at the time of a payment transaction
  because they both are known by a credit card organization.

Policy Decision Point (PDP)

  The point where policy decisions are made.

Policy Enforcement Point (PEP)

  The point where the policy decisions are actually enforced.

###Resource Manager
the component of an AAA Server which tracks the
state of sessions associated with the AAA Server or its associated
Service Equipment and provides an anchor point from which a
session can be controlled, monitored, and coordinated.

Roaming -- An authorization transaction in which the Service Provider

  and the User Home Organization are two different organizations.
  (Note that the dialin application is one for which roaming has
  been actively considered, but this definition encompasses other
  applications as well.)

Security Association

  a collection of security contexts, between a
  pair of nodes, which may be applied to protocol messages exchanged
  between them. Each context indicates an authentication algorithm
  and mode, a secret (a shared key, or appropriate public/private
  key pair), and a style of replay protection in use.

Service Equipment

  the equipment which provides a service.

###Service Provider
an organization which provides a service.

Static Trust Relationship

a pre-established secure relationship
  between two entities created by a trusted party.  This
  relationship facilitates the exchange of AAA messages with a
  certain level of security and traceability. Example: A network
  operator (trusted party) who has access to the wiring closet
  creates a connection between a user's wall outlet and a particular
  network port.  The user is thereafter trusted -- to a certain
  level -- to be connected to this particular network port.

Reference

RFC 2903

RFC 2903 Generic AAA Architecture https://www.rfc-editor.org/rfc/rfc2903.txt C. de Laat, G. Gross, L. Gommans, J. Vollbrecht, D. Spence August 2000 Exp.

RFC 2903 References

RFC 2904

RFC 2904 AAA Authorization Framework https://www.rfc-editor.org/rfc/rfc2904.txt J. Vollbrecht, P. Calhoun, S. Farrell, L. Gommans, G. Gross, B. de Bruijn, C. de Laat, M. Holdrege, D. Spence August 2000 Inf.

RFC2904 References

[1] Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, October 1996.
[2] Farrell, S., Vollbrecht, J., Calhoun, P., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Requirements", RFC 2906, August 2000.
[3] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Application Examples", RFC 2905, August 2000.
[4] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[5] Stevens, M., "Policy Framework", Work in Progress.
[6] Strassner, John, Ed Ellesson, and Bob Moore, "Policy Core Information Model -- Version 1 Specification", Work in Progress.
[7] Strassner, John, et al, "Policy Framework LDAP Core Schema", Work in Progress.
[8] Farrell, Stephen and Russell Housley, "An Internet Attribute Certificate Profile for Authorization", Work in Progress.
[9] Housley, R., Ford, W., Polk, W. and D. Solo, "Internet X.509 Public Key Infrastructure -- Certificate and CRL Profile", RFC 2459, January 1999.
[10] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy Implementation in Roaming", RFC 2607, June 1999.
[11] Rigney, C., Rubens, A., Simpson, W. and S. Willens, "Remote Authentication Dial In User Service (RADIUS)", RFC 2138, April 1997.
[12] Perkins, C., "IP Mobility Support", RFC 2002, October 1996.
[13] Yavatkar, R., Pendarakis, D. and R. Guerin, "A Framework for Policy-based Admission Control", RFC 2753, January 2000.

私見：11 RFC2138はRFC 2904発行前にRFC2865によって改訂されている。並行して関連文書を更新していると、しばしば最新の文書以外の文書を参照した規格ができることがある。相互に情報交換関係(liaison)を結んで、進捗を同期する方法がある。深刻な影響を与えない場合には、それぞれに作業した方が効率的なこともある。
規格間の整合性を厳密に取ることを推し進めたISOのOSIが、最終的には考え方は利用するが、厳密な定義は、設計が大きくなりすぎて採用されなかったか、実装が重すぎて実用的でないと感じて用いられなかったか、厳密な検証はしていない。

RFC 2905

RFC2905 AAA Authorization Application Examples https://www.rfc-editor.org/rfc/rfc2905.txt J. Vollbrecht, P. Calhoun, S. Farrell, L. Gommans, G. Gross, B. de Bruijn, C. de Laat, M. Holdrege, D. Spence August 2000 Inf.

RFC2905 References

[1] Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, October 1996.
[2] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Framework", RFC 2904, August 2000.
[3] Farrell, S., Vollbrecht, J., Calhoun, P., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Requirements", RFC 2906, August 2000.
[4] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[5] Aboba, B. and G. Zorn, "Criteria for Evaluating Roaming Protocols", RFC 2477, January 1999.
[6] Beadles, Mark Anthony, and David Mitton, "Criteria for Evaluating Network Access Server Protocols", Work in Progress.
[7] Aboba, B. and M. Beadles, "The Network Access Identifier", RFC 2486, January 1999.
[8] Rigney, C., Rubens, A., Simpson, W. and S. Willens, "Remote Authentication Dial In User Service (RADIUS)", RFC 2138, April 1997.
[9] Calhoun, P. and G. Zorn, "Roamops Authentication/Authorization Requirements", Work in Progress.
[10] Perkins, C., "IP Mobility Support", RFC 2002, October 1996.
[11] Glass, Steven, et al, "Mobile IP Authentication, Authorization, and Accounting Requirements", Work in Progress.
[12] Hiller, Tom, et al., "cdma2000 Wireless Data Requirements for AAA", Work in Progress.
[13] Neilson, Rob, Jeff Wheeler, Francis Reichmeyer, and Susan Hares, "A Discussion of Bandwidth Broker Requirements for Internet2 Qbone Deployment", ver. 0.7, August 1999, http://www.merit.edu/working.groups/i2-qbone-bb/doc/BB_Req7.pdf.
[14] deBry, R., "Internet Printing Protocol/1.0: Model and Semantics", RFC 2566, April 1999.
[15] Burdett, D., "Internet Open Trading Protocol - IOTP", RFC 2801, April 2000.
[16] "SET Secure Electronic Transaction Specification Book 1: Business Description", Version 1.0, May 31, 1997, http://www.setco.org/download/set_bk1.pdf.

RFC 2906

RFC 2906 AAA Authorization Requirements https://www.rfc-editor.org/rfc/rfc2906.txt S. Farrell, J. Vollbrecht, P. Calhoun, L. Gommans, G. Gross, B. de Bruijn, C. de Laat, M. Holdrege, D. Spence August 2000 Inf.

RFC2906References

[FRMW] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Framework", RFC 2904, August 2000.
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, October 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2138] Rigney, C., Rubens, A., Simpson, W. and S. Willens, "Remote Authentication Dial In User Service (RADIUS)", RFC 2138, April 1997.
[RFC2277] Alvestrand, H., "IETF Policy on Character Sets and Languages", RFC 2277, January 1998.
[SAMP] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Application Examples", RFC2905, August 2000.

RFC3539

RFC3539 Authentication, Authorization and Accounting (AAA) Transport Profile https://tools.ietf.org/html/rfc3539 B. Aboba, J. Wood June 2003 P.S.

RFC3539References

6.1. Normative References
[RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981.
[RFC896] Nagle, J., "Congestion Control in IP/TCP internetworks", RFC 896, January 1984.
[RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness Recommendations for Security", RFC 1750, December 1994.
[RFC2018] Mathis, M., Mahdavi, J., Floyd, S. and A. Romanow, "TCP Selective Acknowledgment Options", RFC 2018, October 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2486] Aboba, B. and M. Beadles, "The Network Access Identifier", RFC 2486, January 1999.
[RFC2581] Allman, M., Paxson, V. and W. Stevens, "TCP Congestion Control", RFC 2581, April 1999.
[RFC2883] Floyd, S., Mahdavi, J., Mathis, M., Podolsky, M. and A. Romanow, "An Extension to the Selective Acknowledgment (SACK) Option for TCP", RFC 2883, July 2000.
[RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson, "Stream Control Transmission Protocol", RFC 2960, October 2000.
[RFC2988] Paxson, V. and M. Allman, "Computing TCP's Retransmission Timer", RFC 2988, November 2000.
[RFC3042] Allman, M., Balakrishnan H. and S. Floyd, "Enhancing TCP's Loss Recovery Using Limited Transmit", RFC 3042, January 2001.
[RFC3074] Volz, B., Gonczi, S., Lemon, T. and R. Stevens, "DHC Load Balancing Algorithm", RFC 3074, February 2001.
[RFC3124] Balakrishnan, H. and S. Seshan, "The Congestion Manager", RFC 3124, June 2001.
6.2. Informative References
[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", RFC 2246, January 1999.
[RFC2401] Atkinson, R. and S. Kent, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.
[RFC2607] Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy Implementation in Roaming", RFC 2607, June 1999.
[RFC2861] Handley, M., Padhye, J. and S. Floyd, "TCP Congestion Window Validation", RFC 2861, June 2000.
[RFC2865] Rigney, C., Willens, S., Rubens, A. and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 2000.
[RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[RFC2914] Floyd, S., "Congestion Control Principles", BCP 41, RFC 2914, September 2000.
[RFC2975] Aboba, B., Arkko, J. and D. Harrington, "Introduction to Accounting Management", RFC 2975, June 2000.
[RFC3390] Allman, M., Floyd, S. and C. Partridge, "Increasing TCP's Initial Window", RFC 3390, October 2002.
[Congest] Jacobson, V., "Congestion Avoidance and Control", Computer Communication Review, vol. 18, no. 4, pp. 314-329, Aug. 1988. ftp://ftp.ee.lbl.gov/papers/congavoid.ps.Z
[Paxson] Paxson, V., "Measurement and Analysis of End-to-End Internet Dynamics", Ph.D. Thesis, Computer Science Division, University of California, Berkeley, April 1997.https://www2.eecs.berkeley.edu/Pubs/TechRpts/1997/CSD-97-945.pdf

RFC 相互関係

RFC	reference	title
2903	2026	The Internet Standards Process -- Revision 3
	2904	AAA Authorization Framework
	2905	AAA Authorization Application Examples
	2906	AAA Authorization Requirements
	2704	The KeyNote Trust-Management System Version 2
2904	2026	The Internet Standards Process -- Revision 3
	2906	AAA Authorization Requirements
	2905	AAA Authorization Application Examples
	2119	Key words for use in RFCs to Indicate Requirement Levels
	2459	Internet X.509 Public Key Infrastructure -- Certificate and CRL Profile
	2607	Proxy Chaining and Policy Implementation in Roaming
	2138	Remote Authentication Dial In User Service (RADIUS)
	2002	IP Mobility Support
	2753	A Framework for Policy-based Admission Control
2905	2026	The Internet Standards Process -- Revision 3
	2904	AAA Authorization Framework
	2906	AAA Authorization Requirements
	2119	Key words for use in RFCs to Indicate Requirement Levels
	2477	Criteria for Evaluating Roaming Protocols
	2486	The Network Access Identifier
	2138	Remote Authentication Dial In User Service (RADIUS)
	2002	IP Mobility Support
	2566	Internet Printing Protocol/1.0: Model and Semantics
	2801	Internet Open Trading Protocol - IOTP
2906	2904	AAA Authorization Framework
	2026	The Internet Standards Process -- Revision 3
	2119	Key words for use in RFCs to Indicate Requirement Levels
	2138	Remote Authentication Dial In User Service (RADIUS)
	2277	IETF Policy on Character Sets and Languages
	2905	AAA Authorization Application Examples
3539	793	Transmission Control Protocol
	896	Congestion Control in IP/TCP internetworks
	1750	Randomness Recommendations for Security
	2018	TCP Selective Acknowledgment Options
	2119	Key words for use in RFCs to Indicate Requirement Levels
	2486	The Network Access Identifier
	2581	TCP Congestion Control
	2883	An Extension to the Selective Acknowledgment (SACK) Option for TCP
	2960	Stream Control Transmission Protocol
	2988	Computing TCP's Retransmission Timer
	3042	nhancing TCP's Loss Recovery Using Limited Transmit
	3074	DHC Load Balancing Algorithm
	3142	The Congestion Manager
	2246	The TLS Protocol Version 1.0
	2401	Security Architecture for the Internet Protocol
	2409	The Internet Key Exchange (IKE)
	2607	Proxy Chaining and Policy Implementation in Roaming
	2861	TCP Congestion Window Validation
	2865	Remote Authentication Dial In User Service (RADIUS)
	2866	RADIUS Accounting
	2914	Congestion Control Principles
	2975	Introduction to Accounting Management

文書履歴(document history)

ver. 0.01 初稿(RFC2903, 2904, 2905)　20190211 昼
ver. 0.02 RFC3539 追記 20190211 午後
ver. 0.03 Glossary 追記 20190211 夕方
ver. 0.04 表題追記　　

最後までおよみいただきありがとうございました。

いいね　💚、フォローをお願いします。

Thank you very much for reading to the last sentence.

Please press the like icon 💚　and follow me for your happy life.

You get articles that match your needs
You can efficiently read back useful information
You can use dark theme

What you can do with signing up