Section: 16a.3a.1 Authentication, Authorization and Accounting procedures
Content: When a P-GW receives an initial access request (e.g.Create Session Request or Proxy Binding Update) message for a given APN, the P-GW may (depending on the configuration for this APN) send a Diameter AA-Request to a Diameter server. The Diameter server authenticates and authorizes the user. If the Diameter server is also responsible for IPv4 address and/or IPv6 prefix allocation the Diameter server shall return the allocated IPv4 address and/or IPv6 prefix in the AA-Answer message. When PDN type is IPv4v6 and deferred IPv4 addressing via IPv4 address pool in the AAA server is used, the P-GW may intiate Diameter re-authorization procedures after successful initial attach for the purpose of IPv4 address allocation or to renew the lease for a previously allocated IPv4 address. In this case, the P-GW shall set the Session-Id to the value used in the initial access request, the Auth-Request-Type AVP to "AUTHORIZE_ONLY" and the 3GPP-Allocate-IP-Type AVP to the type of IP address to be allocated in the AA-Request message sent to the AAA server. See subclause 16.4.7.2 for the conditions to use 3GPP-Allocate-IP-Type AVP in AA-Request messages. If the P-GW is using DHCPv4 signalling towards the UE and the Diameter server includes the Session-Timeout attribute in the Access-Accept, the P-GW may use the Session-Timeout value as the DHCP lease time. The P-GW shall not set the DHCPv4 lease time value higher than the Session-Timeout value. The P-GW may renew the DHCP lease to the UE without re-authorization towards the AAA server providing that the new lease expiry is no later than the Session-Timeout timer expiry. If the P-GW wishes to extend the lease time beyond the current Session-Timeout expiry, it shall initiate a new AAA re-authorization. Even if the P-GW was not involved in user authentication, it may send a Diameter Accounting-Request (START) message to a Diameter server. If no Diameter session is already open for the same PDN connection a Diameter session needs to be activated, otherwise the existing Diameter session is used to send the Accounting-Request (START). For GTP-based S5/S8/S2a/S2b, if accounting is used per IP-CAN bearer, the EPS bearer ID will identify the particular bearer this accounting message refers to. The Accounting-Request message also indicates to the Diameter server that the user session has started.This message contains parameters, e.g. the tuple which includes the user-id and IPv4 address and/or IPv6 prefix, to be used by application servers (e.g. WAP gateway) in order to identify the user. This message also indicates to the Diameter server that the user session has started. If some external applications require Diameter Accounting Request (START) information before they can process user packets, then the selected APN (P-GW) may be configured in such a way that the P-GW drops user data until an Accounting-Answer (START) indicating success is received from the Diameter server. The P-GW may wait for the Accounting-Answer (START) before sending the initial access response (e.g. Create Session Response or Proxy Binding Acknowledgement). The P-GW may reject the initial access request if the Accounting-Answer (START) is not received. The authentication and accounting servers may be separately configured for each APN. For PDN type IPv4, at IPv4 address allocation via DHCPv4 signalling between the UE and the PDN, no IPv4 address is available at initial access. In that case the P-GW may wait to send the Accounting-Request START message until the UE receives its IPv4 address in a DHCPACK. For PDN type IPv4v6 and deferred IPv4 addressing, when the IPv4 address is allocated or re-allocated, the accounting session that was established for the IPv6 prefix allocation shall be used to inform the accounting server about the allocated IPv4 address by sending Diameter Accounting-Request Interim-Update with the Framed-IP-Address AVP and its value field containing the allocated IPv4 address. When the P-GW receives a message indicating a bearer deactivation request or PDN disconnection request or detach request (e.g. Delete Bearer Command or Proxy Binding Update with lifetime equal 0) and providing a Diameter Accounting-Request START message was sent previously, the P-GW shall send a Diameter Accounting-Request (STOP) message to the Diameter server, which indicates the termination of this particular bearer or user session. The P-GW shall immediately send the corresponding response (e.g. Delete Bearer Request or Proxy Binding Ack with lifetime equal 0) to the peer node (e.g. S-GW) in the Packet Domain, without waiting for an Accounting-Answer (STOP) message from the Diameter server. If the last bearer of an IP-CAN session is deactivated, the P-GW shall additionally send an STR message to the Diameter server. The Diameter server shall reply with an STA and shall deallocate the IPv4 address and/or IPv6 prefix (if any) initially allocated to the subscriber. For PDN type IPv4v6 and deferred IPv4 addressing, when the P-GW receives a message from the UE or the network indicating the release of the IPv4 address (e.g. receiving DHCPRELEASE) or decides to release the IPv4 address on its own (e.g. due to DHCP lease timer expiry for P-GW assigned IPv4 address), the P-GW shall inform the accounting server about the deallocation of the IPv4 address by sending Diameter Accounting-Request Interim-Update without the Framed-IP-Address AVP. The following Figure 25d.1 is an example message flow to show the procedure of Diameter Authentication and Accounting, which is applicable for GTP based S5/S8: NOTE 1: If some external applications require Diameter Accounting request (Start) information before they can process user packets, then the selected APN (P-GW) may be configured in such a way that the P-GW drops user data until the Accounting Answer (START) is received from the Diameter server. The P-GW may wait for the Accounting Answer (START) before sending the Create Session Response. The P-GW may reject the bearer if the Accounting Answer (START) is not received. NOTE 2: Separate accounting and authentication servers may be used. Figure 25d.1: An example of Diameter Authentication and Accounting on Sgi for GTP-based S5/S8