Section: 16.3a.1 Authentication, Authorization and Accounting procedures
Content: When a P-GW receives an initial access request (e.g. Create Session Request or Proxy Binding Update) message for a given APN, the P-GW may (depending on the configuration for this APN) send a RADIUS Access-Request to an AAA server. The AAA server authenticates and authorizes the user. If the RADIUS server is also responsible for IPv4 address and/or IPv6 prefix allocation, the AAA server shall return the allocated IPv4 address and/or IPv6 prefix in the Access-Accept message. When PDN type is IPv4v6 and deferred IPv4 addressing via IPv4 address pool in the AAA server is used, the P-GW may intiate RADIUS re-authorization procedures after successful initial attach for the purpose of IPv4 address allocation or to renew the lease for a previously allocated IPv4 address. In this case, the P-GW shall set the Service-Type attribute to "Authorize Only" and the 3GPP-Allocate-IP-Type subattribute to the type of IP address to be allocated in the Access-Request message sent to the AAA server. See subclause 16.4.7.2 for the conditions to use 3GPP-Allocate-IP-Type sub-attribute in Access-Request messages. If the P-GW is using DHCPv4 signalling towards the UE and the RADIUS server includes the Session-Timeout attribute in the Access-Accept, the P-GW may use the Session-Timeout value as the DHCPv4 lease time. The P-GW shall not set the DHCPv4 lease time value higher than the Session-Timeout value. The P-GW may renew the DHCP lease to the UE without re-authorization towards the AAA server providing that the new lease expiry is no later than the Session-Timeout timer expiry. If the P-GW wishes to extend the lease time beyond the current Session-Timeout expiry, it shall initiate a new AAA re-authorization. Even if the P-GW was not involved in user authentication, it may send a RADIUS Accounting-Request (START) message to an AAA server. This message may contain parameters, e.g. the tuple which includes the user-id and IPv4 address and/or IPv6 prefix, to be used by application servers (e.g. WAP gateway) in order to identify the user. This message also indicates to the AAA server that the user session has started. The session is uniquely identified by the Acct-Session-Id that is composed of the Charging-Id and the PGW-Address. If some external applications require RADIUS Accounting-Request (START) information before they can process user packets, then the selected APN (P-GW) may be configured in such a way that the P-GW drops user data until the Accounting-Response (START) is received from the AAA server. The P-GW may wait for the Accounting-Response (START) before sending the initial access response (e.g. Create Session Response or Proxy Binding Acknowledgement). The P-GW may reject the initial access request if the Accounting-Response (START) is not received. The authentication and accounting servers may be separately configured for each APN. For PDN type IPv4, at IPv4 address allocation via DHCPv4 signalling between the UE and the PDN, no IPv4 address is available at initial access. In that case the P-GW may wait to send the Accounting-Request (START) message until the UE receives its IPv4 address in a DHCPACK. For PDN type IPv4v6 and deferred IPv4 addressing, when the IPv4 address is allocated or re-allocated, the accounting session that was established for the IPv6 prefix allocation shall be used to inform the accounting server about the allocated IPv4 address by sending RADIUS Accounting-Request Interim-Update with the Framed-IP-Address attribute and its value field containing the allocated IPv4 address. When the P-GW receives a message indicating a bearer deactivation request or PDN disconnection request or detach request (e.g. Delete Bearer Command or Proxy Binding Update with lifetime equal 0) and providing a RADIUS Accounting-Request (START) message was sent previously, the P-GW shall send a RADIUS Accounting-Request (STOP) message to the AAA server, which indicates the termination of this particular bearer or user session. The P-GW shall immediately send the corresponding response (e.g. Delete Bearer Request or Proxy Binding Ack with lifetime equal 0) to the peer node (e.g. S-GW) in the Packet Domain, without waiting for an Accounting-Response (STOP) message from the AAA server. The AAA server shall deallocate the IPv4 address and/or IPv6 prefix initially allocated to the subscriber, if there is no session for the subscriber. For PDN type IPv4v6 and deferred IPv4 addressing, when the P-GW receives a message from the UE or the network indicating the release of the IPv4 address (e.g. receiving DHCPRELEASE) or decides to release the IPv4 address on its own (e.g. due to DHCP lease timer expiry or P-GW assigned IPv4 address), the P-GW shall inform the accounting server about the deallocation of the IPv4 address by sending RADIUS Accounting-Request Interim-Update without the Framed-IP-Address attribute. Accounting-Request (ON) and Accounting-Request (OFF) messages may be sent from the P-GW to the AAA server to ensure the correct synchronization of the session information in the P-GW and the AAA server. The P-GW may send an Accounting-Request (ON) message to the AAA server to indicate that a restart has occurred. The AAA server may then release the associated resources. Prior to a scheduled restart, the P-GW may send Accounting-Request (OFF) message to the AAA server. The AAA server may then release the associated resources. If an Access-Challenge is sent to the P-GW when an Access-Request message is pending, the P-GW shall silently discard the Access-Challenge message and it shall treat an Access-Challenge as though it had received an Access-Reject instead RFC 2865 [38]. For example, figure 25a.1 represents the RADIUS message flows between a P-GW and an Authentication, Authorization and Accounting (AAA) server, which is applicable for GTP based S5/S8: NOTE 1: If some external applications require RADIUS Accounting request (Start) information before they can process user packets, then the selected APN (P-GW) may be configured in such a way that the P-GW drops user data until the Accounting Response (START) is received from the AAA server. The P-GW may wait for the Accounting Response (START) before sending the Create Session Response. The P-GW may reject the bearer if the Accounting Response (START) is not received. NOTE 2: Separate accounting and authentication servers may be used. Figure 25a.1: An example of RADIUS message flow on Sgi interface for GTP-based S5/S8 (successful user authentication case)