Subject: RE: [AAA-WG]: Issue: Unnecessary service assumptions

From: "Mark Watson" <[email-masked]>
Date: Fri, 6 Feb 2004 11:39:39 -0000

All,

Apologies for making comments on my own issue! Three improvements below
(marked ******) I can provide complete updated issue text if you prefer.

Regards...Mark

-----Original Message-----
From: Watson, Mark [MOP:EP10:EXCH] 
Sent: 28 January 2004 17:04
To: [email-masked]'
Subject: [AAA-WG]: Issue: Unnecessary service assumptions

...not the one you are waiting for - this in uncontraversial, I hope. 
...Mark 

Issue number: 15
Description of issue: Unnecessary service assumptions 
Submitter name: Mark Watson/Chris Richards 
Date first submitted: 28.01.2004 
Reference: 
Document: draft-ietf-aaa-diameter-cc-02.txt 
Comment type: T 
Priority: ['S' Must fix | '1' Should fix | '2' May fix ] 
Section: Various 
Rationale/Explanation of issues: 

The draft refers in various places to services which are 'zero-rated' or
'free-of-charge'. However, in general this is used to refer to services
which will not be under control of the credit control server. It is not
necessarily the case that such services are free-of-charge - for example,
they may be charged offline, on a subscription basis or the user may be
allowed limited access 'on credit'.

****** there is an unstated assumption that TERMINATE action implies all
packets for the service are dropped (or at least this could be
mis-understood if not intended). We should clarify that service-specific
actions may be configured at the client for terminated flows.

Requested change: 
- Section 5.5, first paragraph: 
FROM: 
   When the user's account runs out of money the user must be denied to 
   compile additional chargeable events. However, the home service 
   provider may offer free access services, for instance access to a 
   service portal where it is possible to top-up the account, for which 
   the user is allowed to benefit for a limited amount of time. This time 
   is usually dependant on the home service provider policy. 
TO: 
   When the user's account runs out of money the user must be denied to

****** Change above 'must' to 'may' - operator policy decision
 
   compile additional chargeable events. However, the home service 
   provider may offer some services, for instance access to a 
   service portal where it is possible to top-up the account, for which 
   the user is allowed to benefit for a limited amount of time. This time 
   is usually dependant on the home service provider policy. 

- Section 5.5, third paragraph: 
FROM: 
    
   In some service environments (e.g. NAS) the graceful service 
   termination may be used to redirect the subscriber to a service portal 
   for online balance top-up or other zero-rated services offered by the 
   home service provider. In this case the graceful termination process 
   installs a set of packet filters to restrict the user's access 
   capability only to/from the specified destinations, all the IP packets 
   not matching the filters will be dropped or possibly re-directed to 
   the service portal. The user may also be displayed an appropriate 
   notification why the access has been limited. 
TO: 
   In some service environments (e.g. NAS) the graceful service 
   termination may be used to redirect the subscriber to a service portal 
   for online balance top-up or other services offered by the 
   home service provider. In this case the graceful termination process 
   installs a set of packet filters to restrict the user's access 
   capability only to/from the specified destinations, all the IP packets 
   not matching the filters will be dropped or possibly re-directed to 
   the service portal. The user may also be displayed an appropriate 
   notification why the access has been limited.

****** add: "These actions may be communicated explicitly from the server to
client or may be configured per-service at the client. Explicitly signalled
redirect or restrict instructions always take precedence over configured
ones."

- Section 5.5.2, third paragraph: 
FROM: 
   In addition to the Redirect-Server AVP, the credit control server MAY 
   include one or more Restriction-Filter-Rule AVP or one or more Filter- 
   Id AVP in the Credit-Control-Answer message in order to enable the 
   user to access other zero-rated services. In such a case the access 
   device MUST drop all the packets not matching the IP filters specified 
   in the Credit-Control-Answer message and redirect the user to the 
   destination specified in the Redirect-Server AVP, if possible. 
TO: 
   In addition to the Redirect-Server AVP, the credit control server MAY 
   include one or more Restriction-Filter-Rule AVP or one or more Filter- 
   Id AVP in the Credit-Control-Answer message in order to enable the 
   user to access other services (for example zero-rated services). In such
a 
   case the access device MUST drop all the packets not matching the IP 
   filters specified in the Credit-Control-Answer message and redirect the 
   user to the destination specified in the Redirect-Server AVP, if
possible. 
- Section 5.5.2, sixth paragraph: 
FROM: 
   At the expiry of Validity-Time the credit control client sends a 
   Credit-Control-Request (UPDATE_REQUEST) as usual. This message does 
   not include the Used-Service-Unit AVP since there is no allotted quota 
   to report. The credit control server processes the request and MUST 
   perform the credit reservation. If during this time the subscriber did 
   not replenish his/her account whether he/she will be disconnected or 
   will be granted access to zero-rated services for unlimited time is 
   dependent on the home service provider policy (note: the latter option 
   implies that the service element should not remove the restriction 
   filters upon termination of the credit control session). The server 
   will return the appropriate Result-Code (see section 9.1) in the 
   Credit-Control-Answer message in order to close the credit control 
   session and implement the policy-defined action. Otherwise new quota 
   will be returned, the service element MUST remove all the possible 
   restrictions activated by the graceful service termination process and 
   continue the credit control session and the service session as usual. 
TO: 
   At the expiry of Validity-Time the credit control client sends a 
   Credit-Control-Request (UPDATE_REQUEST) as usual. This message does 
   not include the Used-Service-Unit AVP since there is no allotted quota 
   to report. The credit control server processes the request and MUST 
   perform the credit reservation. If during this time the subscriber did 
   not replenish his/her account whether he/she will be disconnected or 
   will be granted access to services not controlled by the credit control 
   server for unlimited time is dependent on the home service provider
policy 
   (note: the latter option implies that the service element should not
remove 
   the restriction filters upon termination of the credit control session). 
   The server will return the appropriate Result-Code (see section 9.1) in
the 
   Credit-Control-Answer message in order to close the credit control 
   session and implement the policy-defined action. Otherwise new quota 
   will be returned, the service element MUST remove all the possible 
   restrictions activated by the graceful service termination process and 
   continue the credit control session and the service session as usual. 
- section 5.5.3, second paragraph: 
FROM: 
   Another entity than the credit control server may provision the access 
   device with appropriate IP packet filters to be used in conjunction 
   with the Diameter credit control application. Such an entity, for 
   instance, may configure the access device with "zero-rated" IP flows 
   that are to be passed when the Diameter credit control application 
   indicates RESTRICT_ACCESS or REDIRECT. The access device passes IP 
   packets according to the filter rules possibly received in the Credit- 
   Control-Answer message in addition to the filter rules possibly 
   configured by the other entity. However, the action to be taken when 
   the user's account cannot cover the cost of the requested service is 
   the responsibility of the credit control server that controls the 
   prepaid subscriber. 
TO: 
   Another entity than the credit control server may provision the access 
   device with appropriate IP packet filters to be used in conjunction 
   with the Diameter credit control application. Such an entity, for 
   example, may configure the access device with IP flows 
   that are to be passed when the Diameter credit control application 
   indicates RESTRICT_ACCESS or REDIRECT. The access device passes IP 
   packets according to the filter rules possibly received in the Credit- 
   Control-Answer message in addition to the filter rules possibly 
   configured by the other entity. However, the action to be taken when 
   the user's account cannot cover the cost of the requested service is 
   the responsibility of the credit control server that controls the 
   prepaid subscriber. 
- Section 8.15, sixth paragraph: 
FROM: 
   If the Final-Unit-Action AVP is set to REDIRECT at least the Redirect- 
   Server AVP MUST be present. The Restriction-Filter-Rule AVP or the 
   Filter-Id AVP MAY be present in the Credit-Control-Answer message if 
   the user is allowed to access also other zero-rated services not 
   accessible through the address given in the Redirect-Server AVP. 
TO: 
   If the Final-Unit-Action AVP is set to REDIRECT at least the Redirect- 
   Server AVP MUST be present. The Restriction-Filter-Rule AVP or the 
   Filter-Id AVP MAY be present in the Credit-Control-Answer message if 
   the user is allowed to access also other services not 
   accessible through the address given in the Redirect-Server AVP. 
- Section 8.16, fifth paragraph: 
FROM: 
   In contrast, a value of max type granted service unit (e.g. max 
   Unsigned 32 is FFFFFFFF) associated to a Service-Identifier(s) or 
   Rating-Group indicates that the corresponding traffic is free-of- 
   charge. With unit type money, the value of the Exponent AVP is set to 
   0 (zero) when free-of-charge is indicated. With unit type service 
   specific, the value of the CC-Service-Specific-Units AVP is set to 
   FFFFFFFF to indicate free-of-charge. 
TO: 
   In contrast, a value of max type granted service unit (e.g. max 
   Unsigned 32 is FFFFFFFF) associated to a Service-Identifier(s) or 
   Rating-Group indicates that usage of the corresponding traffic is
unlimited. 
   With unit type money, the value of the Exponent AVP is set to 
   0 (zero) when unlimited usage is indicated. With unit type service 
   specific, the value of the CC-Service-Specific-Units AVP is set to 
   FFFFFFFF to indicate unlimited usage. 

- Section 8.22, first paragraph: 
FROM: 
   The Restriction-Filter-Rule AVP (AVP Code 438) is of type IPFilterRule 
   and provides filter rules corresponding to zero-rated services offered 
   by the home service provider. The access device need to configure the 
   specified filter rules for the subscriber and MUST drop all the 
   packets not matching these filters. Zero, one or more such AVPs MAY be 
   present in a Credit-Control-Answer message or in an AA answer message. 
TO: 
   The Restriction-Filter-Rule AVP (AVP Code 438) is of type IPFilterRule 
   and provides filter rules corresponding to services which are to remain 
   accessible despite there being no more service units granted. The access 
   device need to configure the specified filter rules for the subscriber
and 
   MUST drop all the packets not matching these filters. Zero, one or more 
   such AVPs MAY be present in a Credit-Control-Answer message or in an AA 
   answer message. 

- end of changes