Diameter is an authentication, authorization, and accounting (AAA) protocol for computer networks. It evolved from the earlier RADIUS protocol. It belongs to the application layer protocols in the Internet protocol suite.
Diameter Applications extend the base protocol by adding new commands and/or attributes, such as those for use with the Extensible Authentication Protocol (EAP).
Comparison with RADIUS The name is a play on words, derived from the RADIUS protocol, which is the predecessor (a diameter is twice the radius). Diameter is not directly backward compatible but provides an upgrade path for RADIUS. The main features provided by Diameter but lacking in RADIUS are: Support for SCTP Capability negotiation Application layer acknowledgements; Diameter defines failover methods and state machines (RFC 3539) Extensibility; new commands can be defined Aligned on 32 bit boundaries
Also: Like RADIUS, it is intended to work in both local and roaming AAA situations. It uses TCP or SCTP, unlike RADIUS which uses UDP. Unlike RADIUS it includes no encryption but can be protected by transport-level security (IPSEC or TLS). The base size of the AV identifier is 32 bit unlike RADIUS which uses 8 bit as the base AV identifier size. Like RADIUS, it supports stateless as well as stateful modes. Like RADIUS, it supports application-layer acknowledgment and defines failover. Diameter is used for many different interfaces defined by the 3GPP standards, with each interface typically defining new commands and attributes.
Applications A Diameter Application is not a software application but is a protocol based on the Diameter base protocol defined in RFC 6733 (obsoletes RFC 3588) and RFC 7075. Each application is defined by an application identifier and can add new command codes and/or new mandatory AVPs (Attribute-Value Pair). Adding a new optional AVP does not require a new application.
Examples of Diameter applications: Diameter Mobile IPv4 Application (MobileIP, RFC 4004) Diameter Network Access Server Application (NASREQ, RFC 7155)(Obsoletes: RFC 4005) Diameter Extensible Authentication Protocol Application (RFC 4072) Diameter Credit-Control Application (DCCA, RFC 8506])(Obsoletes: RFC 4006) Diameter Session Initiation Protocol Application (RFC 4740) Various applications in the 3GPP IP Multimedia Subsystem Both the HSS and the SLF communicate using the Diameter protocol. (Generic Bootstrapping Architecture): Bootstrapping Server Function
History The Diameter protocol was initially developed by Pat R. Calhoun, Glen Zorn, and Ping Pan in 1998 to provide a framework for authentication, authorization, and accounting (AAA) that could overcome the limitations of RADIUS. At the time Diameter was designed, RADIUS was believed to have issues with reliability, scalability, security, and flexibility. RADIUS also did not support large policies which were needed for telephony applications. The Diameter protocol defines a policy protocol used by clients to perform Policy, AAA, and resource control. This allows a single server to handle policies for many services.
Like RADIUS, Diameter provides AAA functionality, but uses TCP and SCTP instead of UDP, therefore delegating detection and handling of communication problems to those protocols. The Diameter protocol is enhanced further by the development of the 3rd Generation Partnership Project (3GPP) IP Multimedia Subsystem (IMS). The S6a, S6b, Gx, Gy, Sy, Rx, Cx, Dh, Dx, Rf, Ro, Sh and Zh interfaces are supported by Diameter applications. Through the use of extensions, the protocol was designed to be extensible to support proxies, brokers, strong security, mobile IP, network-access servers (NASREQ), accounting and resource management.
Protocol description
The Diameter base protocol is defined by RFC 6733 (Obsoletes: RFC 3588 and RFC 5719) and defines the minimum requirements for an AAA protocol. Diameter Applications can extend the base protocol by adding new commands, attributes, or both. Diameter security is provided by IPsec or TLS. The IANA has assigned TCP and SCTP port number 3868 to Diameter, as stated in section 11.4 of RFC 6733.
Packet format The packet consists of a Diameter header and a variable number of Attribute–Value Pairs, or AVPs, for encapsulating information relevant to the Diameter message.
+Diameter Header Bit offset 0 1 2 3 4 5 6 7 8 910111213141516171819202122232425262728293031 0 version message length 32 R P E T command code 64 application ID 96 hop-by-hop ID 128 end-to-end ID 160... AVPs...
Version This field indicates the version of the Diameter Base Protocol. As of 2014, the only value supported is 1.
Message length The Message Length field indicates the length of the Diameter message in bytes, including the header fields and the padded AVPs.
Command flags The "R" (Request) bit – If set, the message is a request. If cleared, the message is an answer.
The "P" (Proxiable) bit – If set, the message MAY be proxied, relayed or redirected. If cleared, the message MUST be locally processed.
The "E" (Error) bit – If set, the message contains a protocol error, and the message will not conform to the CCF described for this command. Messages with the "E" bit set are commonly referred to as error messages. This bit MUST NOT be set in request messages.
The "T" (Potentially re-transmitted message) bit – This flag is set after a link failover procedure, to aid the removal of duplicate requests. It is set when resending requests not yet acknowledged as an indication of a possible duplicate due to a link failure.
Commands Each command Request/Answer pair is assigned a command code. Whether it is the request or answer is identified via the 'R' bit in the Command Flags field of the header.
The values 0-255 are reserved for RADIUS backward compatibility. The values 256-16777213 are for permanent, standard commands allocated by IANA. The values 16777214 and 16777215 (hex 0xFFFFFE and 0xFFFFFF) are reserved for experimental and testing purposes.
A Command Code is used to determine the action that is to be taken for a particular message. Some common Diameter commands defined in the protocol (base and applications) are:
Command-NameAbbr.CodeApplication AA-RequestAAR265Diameter NAS Application - RFC 7155 AA-AnswerAAA265Diameter NAS Application - RFC 7155 Diameter-EAP-RequestDER268Diameter EAP Application - RFC 4072 Diameter-EAP-AnswerDEA268Diameter EAP Application - RFC 4072 Abort-Session-RequestASR274Diameter base Abort-Session-AnswerASA274Diameter base Accounting-RequestACR271Diameter base Accounting-AnswerACA271Diameter base Credit-Control-RequestCCR272Diameter Credit-Control Application - RFC 8506 (Obsoletes RFC 4006) Credit-Control-AnswerCCA272Diameter Credit-Control Application - RFC 8506 (Obsoletes RFC 4006) Capabilities-Exchange-RequestCER257Diameter base Capabilities-Exchange-AnswerCEA257Diameter base Device-Watchdog-RequestDWR280Diameter base Device-Watchdog-AnswerDWA280Diameter base Disconnect-Peer-RequestDPR282Diameter base Disconnect-Peer-AnswerDPA282Diameter base Re-Auth-RequestRAR258Diameter base Re-Auth-AnswerRAA258Diameter base Session-Termination-RequestSTR275Diameter base Session-Termination-AnswerSTA275Diameter base User-Authorization-RequestUAR283Diameter SIP Application - RFC 4740 User-Authorization-AnswerUAA283Diameter SIP Application - RFC 4740 Server-Assignment-RequestSAR284Diameter SIP Application - RFC 4740 Server-Assignment-AnswerSAA284Diameter SIP Application - RFC 4740 Location-Info-RequestLIR285Diameter SIP Application - RFC 4740 Location-Info-AnswerLIA285Diameter SIP Application - RFC 4740 Multimedia-Auth-RequestMAR286Diameter SIP Application - RFC 4740 Multimedia-Auth-AnswerMAA286Diameter SIP Application - RFC 4740 Registration-Termination-RequestRTR287Diameter SIP Application - RFC 4740 Registration-Termination-AnswerRTA287Diameter SIP Application - RFC 4740 Push-Profile-RequestPPR288Diameter SIP Application - RFC 4740 Push-Profile-AnswerPPA288Diameter SIP Application - RFC 4740 User-Authorization-RequestUAR300Diameter base (3GPP) RFC 3589 User-Authorization-AnswerUAA300Diameter base (3GPP) RFC 3589 Server-Assignment-RequestSAR301Diameter base (3GPP) RFC 3589 Server-Assignment-AnswerSAA301Diameter base (3GPP) RFC 3589 Location-Info-RequestLIR302Diameter base (3GPP) RFC 3589 Location-Info-AnswerLIA302Diameter base (3GPP) RFC 3589 Multimedia-Auth-RequestMAR303Diameter base (3GPP) RFC 3589 Multimedia-Auth-AnswerMAA303Diameter base (3GPP) RFC 3589 Registration-Termination-RequestRTR304Diameter base (3GPP) RFC 3589 Registration-Termination-AnswerRTA304Diameter base (3GPP) RFC 3589 Push-Profile-RequestPPR305Diameter base (3GPP) RFC 3589 Push-Profile-AnswerPPA305Diameter base (3GPP) RFC 3589 User-Data-RequestUDR306Diameter base (3GPP) RFC 3589 User-Data-AnswerUDA306Diameter base (3GPP) RFC 3589 Profile-Update-RequestPUR307Diameter base (3GPP) RFC 3589 Profile-Update-AnswerPUA307Diameter base (3GPP) RFC 3589 Subscribe-Notifications-RequestSNR308Diameter base (3GPP) RFC 3589 Subscribe-Notifications-AnswerSNA308Diameter base (3GPP) RFC 3589 Push-Notification-RequestPNR309Diameter base (3GPP) RFC 3589 Push-Notification-AnswerPNA309Diameter base (3GPP) RFC 3589 Bootstrapping-Info-RequestBIR310Diameter base (3GPP) RFC 3589 Bootstrapping-Info-AnswerBIA310Diameter base (3GPP) RFC 3589 Message-Process-RequestMPR311Diameter base (3GPP) RFC 3589 Message-Process-AnswerMPA311Diameter base (3GPP) RFC 3589 Update-Location-RequestULR316 3GPP TS 29.272 [RFC 5516] Update-Location-AnswerULA316 3GPP TS 29.272 [RFC 5516] Cancel-Location-RequestCLR317 3GPP TS 29.272 [RFC 5516] Cancel-Location-AnswerCLA317 3GPP TS 29.272 [RFC 5516] Authentication-Information-RequestAIR318 3GPP TS 29.272 [RFC 5516] Authentication-Information-AnswerAIA318 3GPP TS 29.272 [RFC 5516] Insert-Subscriber-Data-RequestIDR319 3GPP TS 29.272 [RFC 5516] Insert-Subscriber-Data-AnswerIDA319 3GPP TS 29.272 [RFC 5516] Delete-Subscriber-Data-RequestDSR320 3GPP TS 29.272 [RFC 5516] Delete-Subscriber-Data-AnswerDSA320 3GPP TS 29.272 [RFC 5516] Purge-UE-RequestPER321 3GPP TS 29.272 [RFC 5516] Purge-UE-AnswerPEA321 3GPP TS 29.272 [RFC 5516] Notify-RequestNR323 3GPP TS 29.272 [RFC 5516] Notify-AnswerNA323 3GPP TS 29.272 [RFC 5516] Provide-Location-RequestPLR83886203GPP-LCS-SLg (Application-ID 16777255) Provide-Location-AnswerPLA83886203GPP-LCS-SLg (Application-ID 16777255) Routing-Info-RequestRIR83886223GPP-LCS-SLh (Application-ID 16777291) Routing-Info-AnswerRIA83886223GPP-LCS-SLh (Application-ID 16777291) AA-Mobile-Node-RequestAMR260 Diameter Mobile IPv4 - RFC 4004 AA-Mobile-Node-AnswerAMA260 Diameter Mobile IPv4 - RFC 4004 Home-Agent-MIP-RequestHAR262 Diameter Mobile IPv4 - RFC 4004 Home-Agent-MIP-AnswerHAA262 Diameter Mobile IPv4 - RFC 4004 Configuration-Information-RequestCIR8388718 S6t per 3GPP TS 29.336 Configuration-Information-AnswerCIA8388718 S6t per 3GPP TS 29.336 Reporting-Information-RequestRIR8388719 S6t per 3GPP TS 29.336 Reporting-Information-AnswerRIA8388719 S6t per 3GPP TS 29.336 NIDD-Information-RequestNIR8388726 S6t per 3GPP TS 29.336 NIDD-Information-AnswerNIA8388726 S6t per 3GPP TS 29.336
Application-ID Application-ID is used to identify for which Diameter application the message is applicable. The application can be an authentication application, an accounting application, or a vendor-specific application.
Diameter agents conforming to a certain Diameter extension publicize its support by including a specific value of in the Auth-Application-ID Attribute of the Capabilities-Exchange-Request (CER) and Capabilities-Exchange-Answer (CEA) command.
The value of the Application-ID field in the header is the same as any relevant Application-ID AVPs contained in the message. For instance, the value of the Application-ID and of the Auth-Application-ID Attribute in the Credit-Control-Request (CCR) and Credit-Control-Answer (CCA) Command for the Diameter Credit-Control Application is 4.