Network Working Group T. Zseby
Request for Comments: 3334 S. Zander
Category: Experimental G. Carle
Fraunhofer FOKUS
October 2002
Network Working Group T. Zseby
Request for Comments: 3334 S. Zander
Category: Experimental G. Carle
Fraunhofer FOKUS
October 2002
Policy-Based Accounting
政策性会计
Status of this Memo
本备忘录的状况
This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.
这份备忘录为互联网社区定义了一个实验性协议。它没有规定任何类型的互联网标准。要求进行讨论并提出改进建议。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2002). All Rights Reserved.
版权所有（C）互联网协会（2002年）。版权所有。
Abstract
摘要
This document describes policy-based accounting which is an approach to provide flexibility to accounting architectures. Accounting policies describe the configuration of an accounting architecture in a standardized way. They are used to instrument the accounting architecture and can be exchanged between Authentication, Authorization and Accounting (AAA) entities in order to share configuration information.
本文档描述了基于策略的会计，这是一种为会计体系结构提供灵活性的方法。会计政策以标准化的方式描述会计体系结构的配置。它们用于为记帐体系结构提供工具，并且可以在身份验证、授权和记帐（AAA）实体之间交换，以共享配置信息。
This document describes building blocks and message sequences for policy-based accounting in the generic AAA architecture (RFC 2903). Examples are given for the usage of accounting policies in different scenarios. It is also shown how accounting components can be integrated into the AAA authorization framework (RFC 2904). This document does not propose a language for the description of accounting policies. Rather, it is assumed that a suitable policy language can be chosen from existing or upcoming standards.
本文档描述了通用AAA体系结构（RFC 2903）中基于策略的计费的构建块和消息序列。举例说明了会计政策在不同情况下的使用。还展示了如何将会计组件集成到AAA授权框架（RFC 2904）中。本文件未提出会计政策的描述语言。相反，假设可以从现有或即将出台的标准中选择合适的政策语言。
Table of Contents
目录
1. Introduction...............................................2
1.1 Motivation.................................................2
1.2 Document Scope.............................................3
2. Terminology................................................4
3. Impact of Provider Network Characteristics on Accounting...7
4. Business roles and relations...............................8
5. Reference Model and Building Blocks.......................11
1. Introduction...............................................2
1.1 Motivation.................................................2
1.2 Document Scope.............................................3
2. Terminology................................................4
3. Impact of Provider Network Characteristics on Accounting...7
4. Business roles and relations...............................8
5. Reference Model and Building Blocks.......................11
6. Accounting Policies.......................................14
6.1 Accounting Policy Condition...............................15
6.2 Accounting Policy Action..................................16
6.3 Example for Meter Configuration...........................17
7. Accounting Services.......................................19
7.1 Integrated Accounting.....................................19
7.2 Discrete Accounting.......................................21
7.3 Intra-Domain Accounting...................................22
7.4 Inter-Domain Accounting...................................23
8. Accounting with different Authorization Models............25
8.1 Agent Sequence............................................25
8.2 Pull Sequence.............................................26
8.3 Push Sequence.............................................27
8.4 Roaming...................................................28
9. Examples..................................................29
9.1 Printing Service Example..................................29
9.1.1 Intra-Domain Accounting...................................29
9.1.2 Inter-Domain Accounting...................................30
9.1.3 User Accounting Indication................................31
9.2 Mobile/Roaming Example....................................31
9.3 Diffserv Example..........................................33
9.4 User Accounting Indication Example........................37
10. Security Considerations...................................39
11. References................................................41
12. Acknowledgments...........................................42
Author's Addresses..............................................43
Full Copyright Statement........................................44
6. Accounting Policies.......................................14
6.1 Accounting Policy Condition...............................15
6.2 Accounting Policy Action..................................16
6.3 Example for Meter Configuration...........................17
7. Accounting Services.......................................19
7.1 Integrated Accounting.....................................19
7.2 Discrete Accounting.......................................21
7.3 Intra-Domain Accounting...................................22
7.4 Inter-Domain Accounting...................................23
8. Accounting with different Authorization Models............25
8.1 Agent Sequence............................................25
8.2 Pull Sequence.............................................26
8.3 Push Sequence.............................................27
8.4 Roaming...................................................28
9. Examples..................................................29
9.1 Printing Service Example..................................29
9.1.1 Intra-Domain Accounting...................................29
9.1.2 Inter-Domain Accounting...................................30
9.1.3 User Accounting Indication................................31
9.2 Mobile/Roaming Example....................................31
9.3 Diffserv Example..........................................33
9.4 User Accounting Indication Example........................37
10. Security Considerations...................................39
11. References................................................41
12. Acknowledgments...........................................42
Author's Addresses..............................................43
Full Copyright Statement........................................44
Even if we will have much more bandwidth in the future than now, the control of network resource utilization remains essential for the support of applications with special demands and for the prevention of (malicious or accidental) waste of bandwidth. Charging provides a possibility to control utilization and sharing of network resources. Charging in multi-service networks can be done based on the reserved or the actual used resources. Charging on reserved resources is an important concept since reservation usually precludes other users from using the reserved resources. Nevertheless, if charging is limited to reservation parameters only, the applied charge depends on the ability of the user to give a good prediction of the expected traffic characteristics. This can be extenuated by using a charging scheme that is based on both the reserved and the used resources. In order to support usage-based charging, the collection of information about the resource reservation and utilization is required. The collection of data about resource usage is called accounting.
即使将来我们的带宽比现在多得多，但控制网络资源利用率对于支持有特殊需求的应用程序和防止（恶意或意外）浪费带宽仍然至关重要。收费提供了控制网络资源利用和共享的可能性。在多业务网络中，可以根据保留的或实际使用的资源进行计费。对保留资源收费是一个重要的概念，因为保留通常会阻止其他用户使用保留资源。然而，如果收费仅限于预定参数，则所应用的收费取决于用户对预期业务特性进行良好预测的能力。这可以通过使用基于保留和使用的资源的计费方案来实现。为了支持基于使用情况的计费，需要收集有关资源保留和使用情况的信息。有关资源使用情况的数据集合称为记帐。
Service providers have various options for service differentiation, charging schemes and the provisioning of accounting services. The applied charging schemes for the provided services are one significant feature used by providers to distinguish themselves from competitors. Therefore, providers use different charging schemes and may change the schemes in accordance with their business plan. Providers can also offer different accounting services (e.g. standard, comprehensive, etc.) in order to allow customers/users to choose one scheme that meets the customers/users needs. Furthermore, it may be advantageous for a provider to outsource accounting functionality to a third party. Users introduce various traffic profiles and may have individual preferences regarding accounting services (like itemized invoices, accounting indications, spending limits etc.).
服务提供商在服务差异化、收费方案和提供会计服务方面有多种选择。所提供服务的适用收费方案是供应商用来区别于竞争对手的一个重要特征。因此，供应商使用不同的收费方案，并可能根据其业务计划更改方案。供应商还可以提供不同的会计服务（如标准、综合等），以便客户/用户选择一个满足客户/用户需求的方案。此外，提供商将会计功能外包给第三方可能是有利的。用户介绍各种流量概况，并可能对会计服务有个人偏好（如逐项发票、会计指示、支出限额等）。
One further challenge for the configuration of accounting services are heterogeneous metering and accounting infrastructures within provider domains. Also, the usage of different accounting and metering solutions used in different provider networks complicates the sharing of configuration parameters (e.g. in roaming scenarios).
会计服务配置的另一个挑战是提供者域中的异构计量和会计基础设施。此外，在不同的提供商网络中使用不同的计费和计量解决方案会使配置参数的共享变得复杂（例如在漫游场景中）。
The configuration and dynamic adaptation of the accounting process to the business model and specific user demands requires a flexible configurable accounting infrastructure. The utilization of standardized policies for the expression of conditions and related configuration actions also allows the configuration of heterogeneous infrastructures. For this purpose we propose to use accounting policies to configure the accounting infrastructure and use the Authentication, Authorization and Accounting (AAA) architecture to exchange and to deploy these policies.
根据业务模型和特定用户需求配置和动态调整会计流程需要灵活的可配置会计基础架构。利用标准化策略来表达条件和相关配置操作也允许配置异构基础设施。为此，我们建议使用会计策略来配置会计基础架构，并使用身份验证、授权和会计（AAA）体系结构来交换和部署这些策略。
This document describes the structure and usage of accounting policies. It shows how the characteristics of the provider network influence the requirements for accounting. The relations between the different roles that are involved in the accounting process and the required building blocks for an accounting architecture are introduced. This document describes an architecture and mechanisms to configure the accounting service. It proposes to use the AAA protocol for the exchange of accounting configuration information expressed in policies. It does not propose a specific protocol for the accounting configuration itself. The configuration itself can be done by existing protocols (e.g. Common Open Policy Service Protocol for Support of Policy Provisioning - COPS-PR, Simple Network Management Protocol - SNMP, etc.). Furthermore, it is shown how different accounting services can be provided in intra- and inter-domain scenarios. Examples are given for the usage of accounting
本文件描述了会计政策的结构和使用。它显示了提供商网络的特征如何影响会计要求。介绍了会计流程中涉及的不同角色与会计体系结构所需构建块之间的关系。本文档描述了配置记帐服务的体系结构和机制。它建议使用AAA协议交换策略中表示的记帐配置信息。它没有为记帐配置本身提出特定的协议。配置本身可以通过现有协议完成（例如，用于支持策略设置的公共开放策略服务协议-COPS-PR、简单网络管理协议-SNMP等）。此外，还展示了如何在域内和域间场景中提供不同的会计服务。举例说明了会计的用法
policies in different scenarios. They show how accounting components can be integrated into the authorization framework proposed in [RFC2904].
不同场景中的策略。它们展示了如何将会计组件集成到[RFC2904]中提出的授权框架中。
Accounting management architectures and objectives as well as the transport of accounting records are discussed in [RFC2975] and are not further explained here. This document focuses on the configuration of the accounting architecture and measurement devices.
会计管理体系结构和目标以及会计记录的传输在[RFC2975]中进行了讨论，此处不再作进一步解释。本文档重点介绍会计体系结构和计量设备的配置。
The policy-based accounting architecture represented in this document describes policy-based accounting from the perspective of a Generic AAA Server [RFC2903]. Such a server combines into a single entity the functions of managing accounting policy, together with the functions of managing user-specific authentication, authorization and service provisioning. Some service providers may choose to implement an approach that does not combine these functions into a single entity or protocol, in which case that particular aspect of this architecture does not apply.
本文档中描述的基于策略的记帐体系结构从通用AAA服务器的角度描述了基于策略的记帐[RFC2903]。这样的服务器将管理记帐策略的功能与管理用户特定的身份验证、授权和服务提供的功能结合到一个实体中。一些服务提供商可能会选择实现一种方法，该方法不会将这些功能组合到单个实体或协议中，在这种情况下，该体系结构的特定方面不适用。
This document does not propose a language for the description of accounting policies. It is rather assumed that a suitable policy language can be chosen from existing or upcoming standards.
本文件未提出会计政策的描述语言。而是假设可以从现有或即将出台的标准中选择合适的政策语言。
Accounting Indication/Confirmation Accounting indication messages are pushed from the originating AAA server (the server where the accounting information was generated) to the recipient which can be an AAA server or a customer/user application. Accounting indications contain accounting records which describe the resource consumption for a service. Accounting indication messages can also contain aggregated information for multiple services. There can be interim and end-of-session accounting indication messages. Interim indications are delivered in specified intervals to the recipient during the service session while end-of-session indications are given to the recipient at the end of the session only. Accounting indications may be acknowledged by accounting confirmations to provide application layer reliability.
会计指示/确认会计指示消息从原始AAA服务器（生成会计信息的服务器）推送到收件人，收件人可以是AAA服务器或客户/用户应用程序。会计指示包含描述服务资源消耗的会计记录。记帐指示消息还可以包含多个服务的聚合信息。可以有临时和会话结束记帐指示消息。临时指示在服务会话期间以指定的间隔发送给接收方，而会话结束指示仅在会话结束时发送给接收方。会计指示可以通过会计确认来确认，以提供应用层可靠性。
Accounting Policy Indication/Confirmation Accounting policy indication messages contain accounting policies and are sent from a customer/user or a AAA server to another AAA server. Accounting policy indications may be acknowledged by accounting policy confirmations to provide application layer reliability.
会计政策指示/确认会计政策指示消息包含会计政策，并从客户/用户或AAA服务器发送到另一个AAA服务器。会计政策指示可以通过会计政策确认来确认，以提供应用层可靠性。
Accounting Request/Answer Accounting requests are sent by an AAA server to another AAA server to request the current accounting information for a particular session set (polling). The request is answered with an accounting answer which contains the accounting records.
记帐请求/应答记帐请求由AAA服务器发送到另一台AAA服务器，以请求特定会话集的当前记帐信息（轮询）。该请求由包含会计记录的会计回答回答。
Accounting Policy Request/Answer Accounting policy requests are sent by an AAA server to another AAA server or a customer/user to request accounting policies for a service. The request is answered by an accounting policy answer that contains the accounting policy.
会计策略请求/应答会计策略请求由AAA服务器发送到另一个AAA服务器或客户/用户，以请求服务的会计策略。该请求由包含该会计政策的会计政策回答来回答。
Accounting Policies Accounting policies describe rules for generation, transport and storage of accounting data. These rules are used for the configuration of the accounting process.
会计政策会计政策描述会计数据的生成、传输和存储规则。这些规则用于会计流程的配置。
Application Specific Module (ASM) An ASM provides the functionalities required for the user configuration of a service to an authenticated and authorized user. It gets application specific information (ASI) (e.g. for user configuration) from the AAA server, either in a generic format or in an application specific format, encapsulated in a standard message sent to the ASM. The ASM either extracts the ASI from the message or converts information given in a generic format into the appropriate application specific format. Further information on how the ASM is used can be found in [RFC2903].
应用程序特定模块（ASM）ASM向经过身份验证和授权的用户提供服务的用户配置所需的功能。它以通用格式或应用程序特定格式从AAA服务器获取应用程序特定信息（ASI）（例如，用于用户配置），并封装在发送给ASM的标准消息中。ASM从消息中提取ASI，或将以通用格式提供的信息转换为适当的应用程序特定格式。有关如何使用ASM的更多信息，请参见[RFC2903]。
Charging Schemes A charging scheme is an instruction for calculating a charge. Usually, a charging scheme is represented by a formula that consists of charging variables (e.g. volume, time, reserved peak rate) and charging coefficients (e.g. price per time unit). The charging variables are usually filled by information from accounting data.
充电方案充电方案是用于计算充电的指令。通常，收费方案由一个公式表示，该公式由收费变量（例如，容量、时间、预留峰值费率）和收费系数（例如，每时间单位的价格）组成。收费变量通常由会计数据中的信息填充。
Classifier This document uses the definition of classifier as given in [RFC2475]. Since this document assumes that meters already include classification functions, the term classifier is only used for entities that perform additional classification (e.g. as part of data post processing).
分类器本文件使用[RFC2475]中给出的分类器定义。由于本文件假设仪表已包含分类功能，因此术语分类器仅用于执行额外分类的实体（例如，作为数据后处理的一部分）。
Meter This document uses the definition of meter as given in [RFC2722]. This meter definition already includes the classification of packets. It differs from the DiffServ model [RFC2475] where classifier and meter are considered as separate entities.
仪表本文件使用[RFC2722]中给出的仪表定义。此仪表定义已经包括数据包的分类。它与DiffServ模型[RFC2475]不同，后者将分类器和仪表视为单独的实体。
Meter Reader/Collector This document uses the definition of meter reader and collector as given in [RFC2722].
抄表器/采集器本文件使用[RFC2722]中给出的抄表器和采集器的定义。
Meter Manager This document uses the definition of meter manager as given in [RFC2722].
仪表管理器本文件使用[RFC2722]中给出的仪表管理器定义。
Policy, policy condition, policy action The terms policy, policy condition and policy action are used as defined in [RFC3198].
策略、策略条件、策略操作术语策略、策略条件和策略操作的定义见[RFC3198]。
QoS Auditing Quality of Service (QoS) Auditing is the process of evaluating whether a given quality of service guarantee (e.g. thresholds for QoS parameters given in a Service Level Agreement - SLA) has been met during the service provisioning.
QoS审计服务质量（QoS）审计是评估在服务提供期间是否满足给定的服务质量保证（例如，服务水平协议（SLA）中给定的QoS参数阈值）的过程。
Service Class A service class specifies the handling of a service (as defined in [RFC3198]) belonging to that class by the service provider. A service class has some kind of identifier (e.g. name) and the handling of the service is defined by a Service Level Specification (SLS) as described in [RFC3198].
服务类服务类指定服务提供者对属于该类的服务（如[RFC3198]中所定义）的处理。服务类具有某种标识符（例如名称），服务的处理由[RFC3198]中所述的服务级别规范（SLS）定义。
User Configuration We refer to User Configuration as the process of configuring a service for a user which has been authenticated and authorized by the AAA architecture. Although an AAA architecture is not directly responsible for this user-dependent configuration, it may be responsible for triggering the process.
用户配置我们将用户配置称为为为已通过AAA体系结构验证和授权的用户配置服务的过程。尽管AAA体系结构不直接负责此依赖于用户的配置，但它可能负责触发该流程。
Further definitions of service related terms (Service, Service Subscriber, Service User, Network Provider, Service Provider, Broker) can be found in section 4 (business roles and their relations).
服务相关术语（服务、服务订户、服务用户、网络提供商、服务提供商、代理）的进一步定义见第4节（业务角色及其关系）。
There are many options for future service providers for the realization of service differentiation and provisioning. Therefore, provider networks can vary with respect to several characteristics that impact accounting and charging:
对于未来的服务提供商来说，有许多实现服务差异化和资源调配的选项。因此，提供商网络可能因影响计费和收费的几个特征而有所不同：
- Size and Purpose A small ISP that deals with individual customers may charge individual users based on single flows. Backbone operators often have small ISPs and large corporations as customers, and usually charge based on traffic aggregates instead of individual flows.
- 规模和用途与个人客户打交道的小型ISP可能会根据单个流量向个人用户收费。骨干运营商通常以小型ISP和大型公司为客户，通常根据流量聚合而不是单个流量收费。
- QoS provisioning technique Diffserv accounting requirements differ from Intserv accounting requirements (e.g. meter granularity).
- QoS供应技术区分服务计费要求不同于Intserv计费要求（例如，仪表粒度）。
- Service classes The definition of service classes within a network and the degree of freedom that customers are given (e.g. gold/silver/bronze service vs. a free choice of individual traffic profile parameters) is important, e.g. for the flow classification within the network, and influences the accounting functions required.
- 服务类别网络内服务类别的定义和客户获得的自由度（例如金/银/铜服务与自由选择单个流量配置文件参数）非常重要，例如对于网络内的流量分类，并影响所需的会计功能。
- Charging scheme There exists a wide variety of charging schemes using tariff variables based on different technical and/or economic models. The chosen charging scheme(s) influence the accounting requirements for the provider. While some charging schemes lead to zero or only few accounting requirements, other charging schemes may be highly demanding. For instance, flat rate charging schemes require no accounting infrastructure at all. In contrast to this, volume-based charging schemes require the measurement of the transmitted volume and, with this, increases the complexity for accounting. Tariffs that introduce variable prices may require to provide the users regularly with accounting information (e.g. by interim accounting indications).
- 收费方案基于不同的技术和/或经济模型，使用电价变量的收费方案种类繁多。选择的收费方案会影响供应商的会计要求。虽然一些收费方案导致零或只有很少的会计要求，但其他收费方案可能要求很高。例如，统一费率收费方案根本不需要会计基础设施。与此相反，基于容量的计费方案需要测量传输容量，因此增加了计费的复杂性。引入可变价格的关税可能需要定期向用户提供会计信息（例如，通过临时会计指示）。
- Accounting Services Providers may offer different accounting services (e.g. accounting indication, itemized invoice, etc.)
- 会计服务提供商可以提供不同的会计服务（例如会计指示、明细发票等）
- Accounting agreements with other providers Providers may have agreements with other providers in order to share accounting tasks and distribute accounting data so that, e.g., metering need only be done once. If so, it may be useful if providers can not only exchange accounting data, but also information on the configuration of accounting modules (e.g. meters). It is
- 与其他供应商签订的会计协议供应商可能与其他供应商签订协议，以便共享会计任务和分发会计数据，例如，计量只需进行一次。如果是这样，如果供应商不仅可以交换会计数据，还可以交换会计模块（如仪表）配置的信息，则可能会很有用。它是
important for providers to agree beforehand how accounting data will be collected and monitored, and how disputes concerning accounting data will be resolved. In order to minimize disputes between providers, it is important for them to agree that either both will collect accounting data - and will compare it with the other's data at regular intervals, e.g. monthly - or both will use a single source of accounting data provided by one of them (or by a trusted third party).
重要的是，供应商应事先商定如何收集和监控会计数据，以及如何解决有关会计数据的争议。为了最大限度地减少供应商之间的争议，重要的是双方同意，要么收集会计数据，并定期（如每月）将其与另一方的数据进行比较，要么使用其中一方（或受信任的第三方）提供的单一会计数据来源。
- Exploiting Capabilities of Existing Infrastructure (meters, data collection points) Providers may already have functions within the network that can provide accounting functions (e.g. MIB objects, profile meters, proprietary accounting solutions). In order to avoid duplicated functionality, it should be possible to use these accounting resources. Therefore, the configuration of different types of accounting modules (e.g. meters) should be possible. A common language to express accounting module configurations would be useful for this purpose.
- 利用现有基础设施（仪表、数据采集点）的功能，供应商可能已经在网络中拥有可以提供记帐功能的功能（例如MIB对象、配置文件仪表、专有记帐解决方案）。为了避免重复的功能，应该可以使用这些记帐资源。因此，应能够配置不同类型的计费模块（例如，仪表）。为此，使用一种通用语言来表示记帐模块配置将非常有用。
In investigating service provisions in the current and forthcoming Internet, we identified different business roles which are part of the service usage lifecycle. In this section we first define the term service. Afterwards, the different roles and their relationships are defined. The business roles in this model are used in the later examples.
在调查当前和即将到来的Internet中的服务条款时，我们确定了不同的业务角色，它们是服务使用生命周期的一部分。在本节中，我们首先定义术语服务。然后，定义了不同的角色及其关系。该模型中的业务角色将在后面的示例中使用。
- Service A service is a set of capabilities offered by a provider to a customer. In this definition, provider and customer can be one of the business roles defined later. Different kinds of services have to be recognized.
- 服务服务是提供商向客户提供的一组功能。在此定义中，提供者和客户可以是稍后定义的业务角色之一。必须承认不同种类的服务。
- Information services handle the delivery of information to the customer on top of transport services. In content-based services, the service subscriber pays for the content (e.g. for a file, an image, a video, etc.). In communication-based services, the service subscriber pays for the provisioning of a certain form of communication (e.g. video conferencing or IP telephony).
- 信息服务在运输服务的基础上向客户传递信息。在基于内容的服务中，服务订户为内容付费（例如，文件、图像、视频等）。在基于通信的服务中，服务订户为提供某种形式的通信（如视频会议或IP电话）付费。
- Transport services describe the provisioning of pure transportation of IP packets. At the IP layer, this may include the differentiation of packets (e.g. number of packets with a certain DSCP), Intserv based reservation or other methods for QoS enhancement (e.g. Automatic Repeat reQuest - ARQ, Forward
- 传输服务描述IP数据包的纯传输的供应。在IP层，这可能包括分组的区分（例如，具有特定DSCP的分组数量）、基于Intserv的保留或用于QoS增强的其他方法（例如，自动重复请求-ARQ、转发）
Error Correction - FEC). A transport service might also include mechanisms on other layers for improving the transport (e.g. MPLS).
纠错（FEC）。传输服务还可以包括其他层上用于改进传输的机制（例如MPLS）。
- Management services are responsible for the management of resources (e.g. configuration, accounting, security). Accounting services describe the provisioning of data about the current or previous resource reservation and usage. Accounting services are needed by providers to generate a bill or by users to monitor their resource usage.
- 管理服务部门负责管理资源（如配置、会计、安全）。会计服务描述有关当前或以前的资源保留和使用情况的数据供应。提供商需要会计服务来生成账单，用户需要会计服务来监控其资源使用情况。
- Service Subscriber The service subscriber is the entity that has subscribed to a service and thus has a contractual relationship with a service provider and a network provider which provides the underlying transport service. A service subscriber can also act as a service user. The service subscriber might have a relationship with a broker that provides service relevant information.
- 服务订户服务订户是已订阅服务的实体，因此与提供基础传输服务的服务提供商和网络提供商存在合同关系。服务订户也可以充当服务用户。服务订户可能与提供服务相关信息的代理有关系。
- Service User The service user is the entity that uses the service. The service user can be identical to the service subscriber. In cases where subscriber and user are not identical, the service subscriber should be able to control the service usage for all service users she is responsible for.
- 服务用户服务用户是使用该服务的实体。服务用户可以与服务订户相同。在订户和用户不相同的情况下，服务订户应能够控制其负责的所有服务用户的服务使用。
- Network Provider A network provider is the entity that provides the underlying network infrastructure for the service user, service subscriber, service provider and broker. A network provider provides transport services. The services are delivered on top of the network infrastructure. The service provider has a contractual relationship with the service subscriber and service provider (and the broker). The transport network of a network provider is probably not a global network which connects all subscribers, providers and brokers. The transport network is segmented into a number of sub-networks or domains controlled by different network providers with business relations existing between them. Each domain is responsible for intra-domain management and accounting. For inter-domain management and accounting, appropriate communication interfaces between network providers must exist.
- 网络提供商网络提供商是为服务用户、服务订户、服务提供商和代理提供基础网络基础设施的实体。网络提供商提供传输服务。这些服务是在网络基础设施之上提供的。服务提供商与服务订户和服务提供商（以及经纪人）存在合同关系。网络提供商的传输网络可能不是连接所有订户、提供商和代理的全球网络。传输网络被分割成若干子网络或域，这些子网络或域由不同的网络提供商控制，它们之间存在业务关系。每个域负责域内管理和记帐。对于域间管理和记帐，网络提供商之间必须存在适当的通信接口。
- Service Provider A service provider entity provides a service. A service provider can offer a service directly to the service subscriber/user. A service provider can also act like a wholesaler selling a service to another service provider (retailer) which re-sells the service to the service subscriber. The service provider has contractual relationships with
- 服务提供者服务提供者实体提供服务。服务提供商可以直接向服务订户/用户提供服务。服务提供商也可以像批发商一样向另一个服务提供商（零售商）出售服务，后者将服务重新出售给服务订户。服务提供商与客户之间存在合同关系
other service providers, subscribers, brokers and network providers. A service provider provides information services on top of transport services provided by network providers.
其他服务提供商、订户、经纪人和网络提供商。服务提供商在网络提供商提供的传输服务的基础上提供信息服务。
- Broker The broker entity allows the other roles to access the information controlled by the broker. The broker can provide different information to different business roles. For example, a service subscriber can get references to appropriate service providers and/or network providers (e.g. a broker gives the subscriber a reference to a network provider which can provide bandwidth as required by the subscriber). A broker can also interact with other brokers to complete their information. In this case, broker-to-broker business relationships exist.
- 代理代理实体允许其他角色访问代理控制的信息。代理可以为不同的业务角色提供不同的信息。例如，服务订户可以获得对适当服务提供商和/或网络提供商的引用（例如，代理向订户提供对网络提供商的引用，该网络提供商可以根据订户的要求提供带宽）。代理还可以与其他代理交互以完成其信息。在这种情况下，存在经纪人与经纪人之间的业务关系。
Figure 1 depicts the different roles and the business relations between them.
图1描述了不同的角色以及它们之间的业务关系。
+----+
V |
+---------------+ |
| Broker |<-+
+------>| |<-----------------+
| +---------------+ |
| ^ |
| | |
| V V
| +------------------+ +---------------+
| | Service | | Service |
| | Subscriber |<------>| Provider |
| | | | |<-+
| | +--------------+ | +---------------+ |
| | | Service User | | ^ ^ |
| | +--------------+ | | +----+
| +------------------+ |
| ^ |
| | |
| V |
| +---------------+ |
+------>| Network |<-----------------+
| Provider |<-+
+---------------+ |
^ |
+----+
+----+
V |
+---------------+ |
| Broker |<-+
+------>| |<-----------------+
| +---------------+ |
| ^ |
| | |
| V V
| +------------------+ +---------------+
| | Service | | Service |
| | Subscriber |<------>| Provider |
| | | | |<-+
| | +--------------+ | +---------------+ |
| | | Service User | | ^ ^ |
| | +--------------+ | | +----+
| +------------------+ |
| ^ |
| | |
| V |
| +---------------+ |
+------>| Network |<-----------------+
| Provider |<-+
+---------------+ |
^ |
+----+
Figure 1: Roles and business relations
图1：角色和业务关系
The following examples show how this business relationship model can be applied to different services.
下面的示例显示了如何将此业务关系模型应用于不同的服务。
Example 1: This example describes an Internet printing scenario according to the "print-by-reference" model [RFC2566]. The subscriber is a company and the users are the employees of that company. The file server and print server belong to two different service providers. The company subscribes to the print server service which acts as reseller for the file service. The file server service chooses the appropriate transport service (maybe based on user preference), thus the file server has a contract with a network provider using the offered transport service for downloading the data from the given location and sending them to the print server.
示例1：该示例描述了根据“参照打印”模型[RFC2566]的互联网打印场景。订户是一家公司，用户是该公司的员工。文件服务器和打印服务器属于两个不同的服务提供商。公司订阅打印服务器服务，该服务充当文件服务的经销商。文件服务器服务选择适当的传输服务（可能基于用户偏好），因此文件服务器与使用提供的传输服务的网络提供商签订合同，用于从给定位置下载数据并将其发送到打印服务器。
Example 2: A company (service subscriber) has a contract with a video archive (service provider). An employee can download clips in different qualities from the archive. The employee can use different transport mechanisms for the download. In order to get the appropriate transport, the user contacts an agency (broker) that returns a reference to a network provider which provides the required transport service. As an alternative, the content (video) can be delivered in different qualities via different transport mechanisms by the service provider. The service provider chooses an appropriate network provider which provides a transport service compliant with the conditions the service provider offers to the subscribers. In this case the service provider can use the facilities of a broker to get a reference to appropriate network providers.
示例2：公司（服务订户）与视频存档（服务提供商）签订了合同。员工可以从存档中下载不同质量的剪辑。员工可以使用不同的传输机制进行下载。为了获得适当的传输，用户联系一个代理（代理），该代理返回对提供所需传输服务的网络提供商的引用。作为替代方案，服务提供商可以通过不同的传输机制以不同的质量交付内容（视频）。服务提供商选择适当的网络提供商，该网络提供商提供符合服务提供商向用户提供的条件的传输服务。在这种情况下，服务提供商可以使用代理的工具获取对适当网络提供商的引用。
We have developed a reference model for describing the interactions between the different metering, accounting and charging processes and their configuration via policies. This reference model is shown in Figure 2. At the right side, five layers show the different building blocks. The blocks are layered according to the processing of the data from the bottom level metering via accounting, up to the final billing process. Data aggregation is not only done at the collection layer, it can also be done at the other layers. The building blocks on the different layers are configured through the policies shown on the left side. Higher layer policies can be translated into lower layer policies. The configuration parameters are extracted from the policy and passed to the corresponding building block. The tasks of the different building blocks are as follows:
我们开发了一个参考模型，用于描述不同计量、会计和收费流程之间的相互作用及其通过策略的配置。该参考模型如图2所示。在右侧，五个层显示了不同的构建块。根据从底层计量到最终计费流程的数据处理过程，对数据块进行分层。数据聚合不仅在收集层完成，还可以在其他层完成。不同层上的构建块通过左侧显示的策略进行配置。高层策略可以转换为下层策略。配置参数从策略中提取并传递到相应的构建块。不同构建块的任务如下所示：
- Metering Meters are needed for capturing data about resource consumption in the network (e.g. transmitted volume). They will probably be placed at the edges of the network. Two types of meters can be
- 需要计量仪表来捕获网络中资源消耗的数据（例如传输量）。它们可能会被放置在网络的边缘。可以使用两种类型的仪表
distinguished: Static meters and configurable meters. In the case of static meters, all flows are measured with a fixed granularity, not distinguishing if a subsequent charging process needs the specific meter data or not. In most cases the large amount of captured data makes filtering and/or aggregation after the metering necessary. In case of a configurable meter, the meter collects meter data only for flows specified by metering policies.
区别：静态仪表和可配置仪表。对于静态仪表，所有流量均以固定粒度测量，不区分后续充电过程是否需要特定仪表数据。在大多数情况下，大量捕获的数据使得计量后的过滤和/或聚合成为必要。对于可配置仪表，仪表仅收集计量策略指定流量的仪表数据。
For configuration of the meter process, the following issues must be addressed: (a) metering scope (whether to meter all flows or only selected flows), (b) flow granularity (e.g. micro flows or traffic aggregates) (c) metered flow attributes (i.e. which data is to be collected for a specific flow), and (d) meter accuracy (measurement intervals etc.).
对于流量计流程的配置，必须解决以下问题：（a）计量范围（是对所有流量进行计量还是仅对选定流量进行计量），（b）流量粒度（例如微流量或流量聚合），（c）计量流量属性（即针对特定流量收集哪些数据），以及（d）流量计精度（测量间隔等）。
- Collection The data gathered by the meter(s) has to be collected for further processing. Collection of meter data can be initiated by the meter itself (push model) or by a collector entity (pull model). Collected data can be aggregated before being passed to the accounting layer. Metering policies define how collection and aggregation is done.
- 收集必须收集仪表收集的数据以进行进一步处理。仪表数据的收集可以由仪表本身（推送模式）或收集器实体（拉送模式）启动。收集的数据可以在传递到记帐层之前进行聚合。计量策略定义如何进行收集和聚合。
POLICY CONFIGURATION BUILDING BLOCKS
策略配置构建块
+---------------+ +-------------------------+
| |------------------>| Billing |
| Billing & | +-------------------------+
| Charging | ^ charging
| | | data
| | +-------------------------+
| |------------------>| Charging |
+---------------+ +-------------------------+
| ^ acct
V | data
+---------------+ +-------------------------+
| Accounting | | |
| |------------------>| Accounting |
+---------------+ +-------------------------+
| ^ aggr. meter
V | data
+---------------+ +-------------------------+
| |------------------>| Collection |
| Metering | | |
| | +-------------------------+
| | ^ meter
| | | data
| | +-------------------------+
| |------------------>| Metering |
+---------------+ +-------------------------+
+---------------+ +-------------------------+
| |------------------>| Billing |
| Billing & | +-------------------------+
| Charging | ^ charging
| | | data
| | +-------------------------+
| |------------------>| Charging |
+---------------+ +-------------------------+
| ^ acct
V | data
+---------------+ +-------------------------+
| Accounting | | |
| |------------------>| Accounting |
+---------------+ +-------------------------+
| ^ aggr. meter
V | data
+---------------+ +-------------------------+
| |------------------>| Collection |
| Metering | | |
| | +-------------------------+
| | ^ meter
| | | data
| | +-------------------------+
| |------------------>| Metering |
+---------------+ +-------------------------+
Figure 2: Reference Model
图2：参考模型
- Accounting Accounting describes the collection of data about resource consumption. This includes the control of data gathering (via metering), transport and storage of accounting data. For subsequent charging, the metered data must be associated with a user that is the initiator of a flow and a customer (service subscriber) that is responsible for payment. For initiation of an accounting process, a user or foreign provider must be authenticated and authorized. These three functions can be performed by the AAA server. The accounting process is configured through accounting policies.
- 会计描述有关资源消耗的数据收集。这包括控制数据收集（通过计量）、传输和存储会计数据。对于后续计费，计量数据必须与作为流发起方的用户和负责支付的客户（服务订户）相关联。对于会计流程的启动，用户或外国提供商必须经过认证和授权。这三个功能可由AAA服务器执行。会计流程通过会计政策进行配置。
- Charging Charging derives non-monetary costs for accounting data sets based on service and customer specific tariff parameters. Different cost metrics may be applied to the same accounting records even in parallel. Charging policies define the tariffs and parameters which are applied.
- 收费根据服务和特定于客户的费率参数为会计数据集衍生非货币成本。不同的成本指标甚至可以并行应用于相同的会计记录。收费政策规定了适用的费率和参数。
- Billing Billing translates costs calculated by the Charging into monetary units and generates a final bill for the customer. Billing policies define among others the type (e.g. invoice, credit card), the form of the bill (e.g. itemized or not, partial anyomization, etc.) and the time for billing (e.g. weekly, monthly, etc.).
- 计费将通过计费计算的成本转换为货币单位，并为客户生成最终账单。除其他外，账单政策规定了账单类型（如发票、信用卡）、账单形式（如是否逐项列出、部分分类等）和账单时间（如每周、每月等）。
We propose to use policies expressed in a standardized way to appropriately configure the meter, meter data collection and accounting processes.
我们建议使用以标准化方式表示的策略来适当配置电表、电表数据收集和记帐流程。
Accounting policies describe rules for generation, transport and storage of accounting data. They can be exchanged between AAA instances at the user or provider premises. They provide a standardized representation of configuration information that can be converted into the appropriate settings for different elements of the accounting infrastructures (e.g. different meters).
会计政策描述会计数据的生成、传输和存储规则。它们可以在用户或提供商场所的AAA实例之间交换。它们提供了配置信息的标准化表示，可将配置信息转换为会计基础设施不同元素（例如不同仪表）的适当设置。
As shown in Figure 2, accounting policies configure the accounting process. Policies for the configuration of the metering and collection process can be derived from accounting policies. Accounting policies are not used to configure the charging or billing process. Accounting policies reside in the AAA server (local policies) or are received from other AAA servers (extra-domain policies) or customers/users. Two different models of obtaining accounting policies can be differentiated: push and pull model.
如图2所示，会计政策配置会计流程。计量和收集流程的配置策略可以从会计策略派生。会计政策不用于配置收费或计费流程。会计策略驻留在AAA服务器（本地策略）中，或从其他AAA服务器（额外域策略）或客户/用户接收。获取会计政策的两种不同模式可以区分：推式和拉式模式。
Push Model In the push model, accounting policies are pushed from another AAA server or customer/user in order to establish the policies in the local accounting infrastructure. The acceptance and use of pushed policies requires special security considerations. The evaluation of the policy should not take place without an appropriate security check of the policy in advance. Also, the evaluation of the condition can lead to unwanted actions in the AAA server if the condition contains critical data either intentionally (to attack the system) or by accident. Even the evaluation of the condition can cause problems (e.g. DoS). Therefore, not only the action, but also the condition, has to be checked for potential security hazards before it is evaluated.
推送模型在推送模型中，会计策略从另一台AAA服务器或客户/用户推送，以便在本地会计基础结构中建立策略。接受和使用推送策略需要特殊的安全考虑。未事先对策略进行适当的安全检查，不得对策略进行评估。此外，如果条件包含故意（攻击系统）或意外的关键数据，则条件评估可能会导致AAA服务器中出现不必要的操作。即使是对条件的评估也可能导致问题（例如DoS）。因此，在评估之前，不仅要检查行动，还要检查条件是否存在潜在的安全隐患。
Pull Model In the pull model, the AAA server requests the policy from a remote AAA server or customer/user by sending an accounting policy request. The remote AAA server sends an accounting policy reply as an answer that contains the appropriate policy.
拉动模式在拉动模式中，AAA服务器通过发送记帐策略请求，从远程AAA服务器或客户/用户请求策略。远程AAA服务器发送一个会计策略应答，作为包含适当策略的应答。
Accounting policies are enforced by the network elements that are configured in accordance with the policies. They influence the following settings in the accounting architecture:
记帐策略由根据策略配置的网络元素强制执行。它们影响会计体系结构中的以下设置：
- meter configuration - data collection and aggregation - accounting record distribution and storage
- 仪表配置-数据收集和聚合-会计记录分发和存储
An accounting policy consists of one or more rules, each having a condition part and an action part. The condition part expresses under which condition the policy should be enforced. The following attributes are examples for variables in a policy condition statement.
会计政策由一个或多个规则组成，每个规则都有一个条件部分和一个行动部分。条件部分表示应在何种条件下执行策略。以下属性是策略条件语句中变量的示例。
- customer/user ID The customer/user ID identifies the customer or user of the service. It can be used in a policy condition in order to select a customer or user specific accounting configuration (as policy action). For example, it can be user-dependent whether accounting indications are sent to the user or not.
- 客户/用户ID客户/用户ID标识服务的客户或用户。它可以在策略条件中使用，以便选择特定于客户或用户的会计配置（作为策略操作）。例如，会计指示是否发送给用户可能取决于用户。
- IP address IP addresses specify the devices or networks from which the service usage takes place. The address of specific hosts or subnets can be used to select accounting strategies specific to the customer or a user group associated with this address (e.g. all customers of an ISP, all public terminals etc.).
- IP地址IP地址指定服务使用的设备或网络。特定主机或子网的地址可用于选择特定于客户或与此地址相关联的用户组（例如，ISP的所有客户、所有公共终端等）的计费策略。
- time of day The time of day can be used, for instance, to configure the level of detail for the accounting record, the report interval and the destination.
- 一天中的时间例如，可以使用一天中的时间来配置会计记录、报告间隔和目标的详细级别。
- service class Service classes are defined by the provider. They describe different levels or different kinds of services that are offered by the provider and are usually defined based on a business model. Customers/users select a service class. This selected class can be used in accounting policies to define appropriate accounting settings per class. With this it is possible, for instance, to provide more detailed accounting records for higher prioritized services than for standard services.
- 服务类服务类由提供者定义。它们描述了提供商提供的不同级别或不同种类的服务，通常是基于业务模型定义的。客户/用户选择服务类别。此选定类可在会计政策中用于为每个类定义适当的会计设置。例如，有了这一点，就可以为优先级更高的服务提供比标准服务更详细的会计记录。
- accounting type Accounting types combine multiple accounting settings under one keyword. Like service classes, the offered accounting types are defined by the provider in accordance with the business model. With this, providers can offer, for instance, different accounting types for one service and allow the customer/user to select one. The combination of settings under one keyword simplifies the selection for users. An example is the combination of high granular accounting records with short report intervals under a keyword (e.g. "comprehensive accounting"), or less frequent generation of less detailed records accessed by another keyword ("standard accounting"). The definition of accounting types can also help in inter-domain scenarios if providers agree on accounting types.
- 会计类型会计类型将多个会计设置合并到一个关键字下。与服务类别一样，提供的会计类型由提供商根据业务模型定义。这样，提供商可以为一项服务提供不同的会计类型，并允许客户/用户选择一种。一个关键字下的设置组合简化了用户的选择。例如，高粒度会计记录与关键字（例如“综合会计”）下的短报告间隔相结合，或者由另一个关键字（“标准会计”）访问的不太详细的记录生成频率较低。如果提供者同意记帐类型，则记帐类型的定义在域间场景中也会有所帮助。
The action part defines the action that takes place if the condition is true. The action for an accounting policy is usually the configuration of the accounting infrastructure. This can already include settings for meters and collection entities. The following list gives examples for parameters of the accounting infrastructure that can be configured by an accounting policy action:
动作部分定义了条件为真时发生的动作。会计政策的操作通常是会计基础结构的配置。这可能已经包括仪表和采集实体的设置。以下列表给出了可通过会计策略操作配置的会计基础结构参数的示例：
- accounting record type/structure The required accounting data depends on the charging scheme. Therefore, different accounting records should be supported. There are two possibilities: Either different record types are defined, or a flexible record is used that consists of a variable set of accounting attributes. Accounting policies can be used to communicate to neighbor providers which kind of accounting record is needed to provide appropriate data for the charging scheme. The specification of the required accounting attributes can influence the settings of different components of the accounting architecture (e.g. which attributes have to be measured). An overview of accounting attributes and records can be found in [RFC2924].
- 会计记录类型/结构所需的会计数据取决于收费方案。因此，应支持不同的会计记录。有两种可能性：要么定义不同的记录类型，要么使用由一组可变会计属性组成的灵活记录。会计政策可用于向相邻提供商传达需要哪种会计记录才能为收费方案提供适当的数据。所需会计属性的规范可能会影响会计体系结构不同组件的设置（例如，必须测量哪些属性）。有关会计属性和记录的概述，请参见[RFC2924]。
- accounting record destination The accounting record destination describes to which entities accounting records are sent. The accounting record destination can be a charging entity, a neighbor provider, a user entity or a specific database. In these cases, authentication and authorization mechanisms have to be applied in order to ensure that unauthorized entities cannot get access to confidential data.
- 会计记录目的地会计记录目的地描述将会计记录发送到哪些实体。记帐记录目的地可以是计费实体、邻居提供商、用户实体或特定数据库。在这些情况下，必须应用身份验证和授权机制，以确保未经授权的实体无法访问机密数据。
- report interval The report interval specifies in what time intervals accounting records are generated and sent. This influences the configuration of meters and collectors in the accounting architecture.
- 报告间隔报告间隔指定生成和发送会计记录的时间间隔。这会影响会计体系结构中仪表和收集器的配置。
- storage time If the accounting record destination is a database or a log file, the storage time specifies how long the accounting records have to be stored.
- 存储时间如果记帐记录目标是数据库或日志文件，则存储时间指定必须存储记帐记录的时间。
- access list The access list specifies who has the permissions to read the stored accounting records.
- 访问列表访问列表指定谁有权读取存储的会计记录。
- flow granularity The flow granularity determines how fine grained (in coverage) the flows in the network are measured. The granularity usually is configured by installing specific classification rules in the meter. It is also possible to set a specific granularity by configuring aggregation schemes that are applied after the metering process. The granularity can range from individual micro flows (e.g. determined by the quintuple <src, dest, proto, src-port, dest-port>) up to coarse granular traffic aggregates (e.g. all traffic from one network).
- 流粒度流粒度确定如何测量网络中的细粒度（覆盖范围）流。粒度通常通过在仪表中安装特定的分类规则来配置。还可以通过配置计量过程之后应用的聚合方案来设置特定的粒度。粒度可以从单个微流（例如，由五元组<src，dest，proto，src-port，dest-port>确定）到粗粒度流量聚合（例如，来自一个网络的所有流量）。
- meter accuracy The parameters for the meter accuracy can determine, for instance, how often measurements take place at the meter, how accurate timestamps should be, etc. Meter accuracy parameters can also be used to configure sampling schemes.
- 仪表精度仪表精度的参数可确定，例如，仪表上的测量频率、时间戳的准确度等。仪表精度参数也可用于配置采样方案。
Note: In the following examples, the use of NeTraMet or NetFlow to collect accounting information does not guarantee exact accounting data, so it is not recommended for use in situations where exact accounting data are needed.
注意：在以下示例中，使用NetRame或NetFlow收集会计信息并不保证会计数据的准确性，因此不建议在需要准确会计数据的情况下使用。
The following two examples show how accounting policies can be used to configure different meters. The accounting policy is sent from the AAA server to the ASM and there converted to the appropriate configuration information for the used meter.
以下两个示例说明如何使用会计政策配置不同的仪表。记帐策略从AAA服务器发送到ASM，并在那里转换为所用仪表的适当配置信息。
If the meter NeTraMet [RFC2123] is used, the policy is converted into a NeTraMet ruleset that contains the relevant flows, attributes and reader instructions for the data collection. This information is passed to the NeTraMet manager that configures the meter and meter reader in accordance with the given configuration.
如果使用meter NeTraMet[RFC2123]，则策略将转换为NeTraMet规则集，其中包含数据收集的相关流、属性和读取器指令。该信息被传递到NeTraMet管理器，该管理器根据给定配置配置仪表和仪表读取器。
+------------------+
| AAA |
| |
+------------------+
| ^
Policy | | Accounting Records
V |
+------------------+
| ASM |
| |
+------------------+
| ^
| |
| config +-----------------+
| |
+-------------------------------+ |
| | Accounting | |
| V | |
| +----------------+ | |
| | Meter Manager | | | Accounting Records
| +----------------+ | |
| | | | |
| SNMP V | |
| (conf)+---------------+ | |
| | | Meter Reader |---------+
| | +---------------+ |
| | ^ |
| V | |
| +-----------+ | |
| | Meter |-----+ |
| +-----------+ SNMP(DATA) |
| |
+-------------------------------+
+------------------+
| AAA |
| |
+------------------+
| ^
Policy | | Accounting Records
V |
+------------------+
| ASM |
| |
+------------------+
| ^
| |
| config +-----------------+
| |
+-------------------------------+ |
| | Accounting | |
| V | |
| +----------------+ | |
| | Meter Manager | | | Accounting Records
| +----------------+ | |
| | | | |
| SNMP V | |
| (conf)+---------------+ | |
| | | Meter Reader |---------+
| | +---------------+ |
| | ^ |
| V | |
| +-----------+ | |
| | Meter |-----+ |
| +-----------+ SNMP(DATA) |
| |
+-------------------------------+
Figure 3: Policy based Accounting with NeTraMet
图3:NeTraMet基于策略的会计
If the meter NetFlow [NetFlow] is used, the meter policies are translated by the ASM into filter instructions for the flow collector. The meter itself is static and therefore is not affected by the configuration information.
如果使用流量计NetFlow[NetFlow]，ASM会将流量计策略转换为流量收集器的过滤器指令。仪表本身是静态的，因此不受配置信息的影响。
+------------------+
| AAA |
| |
+------------------+
| ^
Policy | | Accounting Records
V |
+------------------+
| ASM |
| |
+------------------+
| ^
| |
| config | Accounting Records
| |
+-------------------------------+
| | Accounting |
| | |
| | +---------------------+ |
| | | Flow Collector | |
| | | +------------+ | |
| | | | Classifier | | |
| | | | Aggregator | | |
| +->| +------------+ | |
| +---------------------+ |
| ^ |
| | |
| +-----------+ | |
| | Meter |-----+ |
| +-----------+ UDP (DATA) |
| |
+-------------------------------+
+------------------+
| AAA |
| |
+------------------+
| ^
Policy | | Accounting Records
V |
+------------------+
| ASM |
| |
+------------------+
| ^
| |
| config | Accounting Records
| |
+-------------------------------+
| | Accounting |
| | |
| | +---------------------+ |
| | | Flow Collector | |
| | | +------------+ | |
| | | | Classifier | | |
| | | | Aggregator | | |
| +->| +------------+ | |
| +---------------------+ |
| ^ |
| | |
| +-----------+ | |
| | Meter |-----+ |
| +-----------+ UDP (DATA) |
| |
+-------------------------------+
Figure 4: Policy based Accounting with NetFlow
图4：使用NetFlow的基于策略的会计
Accounting can be seen as part of the service provisioning process (integrated accounting) or as a separate service (discrete accounting). The different views and their impact on the accounting architecture are described below.
记帐可以被视为服务提供过程（集成记帐）的一部分，也可以被视为单独的服务（离散记帐）。不同的观点及其对会计体系结构的影响如下所述。
In the integrated accounting model, the accounting is seen as part of the provisioned service. That means the accounting is coupled with a specific service. Therefore, the accounting process is tailored to the specific service and might collect accounting information by
在集成会计模型中，会计被视为供应服务的一部分。这意味着会计与特定的服务相结合。因此，会计流程是针对特定服务定制的，可能通过以下方式收集会计信息：
directly exploiting some service specific entities. For example, accounting for IP telephony could use call signaling information from a SIP server. The configuration of the accounting architecture is done as part of the user configuration of the service equipment. Accounting policies are defined as part of the contractual agreement. The ASM converts the instructions from the AAA server into the appropriate user configuration including settings for the accounting architecture.
直接利用某些特定于服务的实体。例如，IP电话计费可以使用来自SIP服务器的呼叫信令信息。会计体系结构的配置作为服务设备用户配置的一部分完成。会计政策被定义为合同协议的一部分。ASM将AAA服务器的指令转换为适当的用户配置，包括记帐体系结构的设置。
+---------------------+
<---1--->| Generic AAA Server |<---1--->
| | ............
| Rule based engine |<----|----->: Policy :
| | 3| :..........:
+---------------------+<----|--+ ............
^ +-->: Events :
| :..........:
2
|
V
+----------------------+ ...............
| Application specific |<--3-->: Acct Policy :
| Module | :.............:
+----------------------+
^
|
5
|
V
+-------------------------------------+
| Service |
| +-----------+ +----------------+ | ..............
| | Service |<-->| Accounting/ |<--3-->: Accounting :
| | Provision | | Metering | | : Data :
| +-----------+ +----------------+ | :............:
+-------------------------------------+
+---------------------+
<---1--->| Generic AAA Server |<---1--->
| | ............
| Rule based engine |<----|----->: Policy :
| | 3| :..........:
+---------------------+<----|--+ ............
^ +-->: Events :
| :..........:
2
|
V
+----------------------+ ...............
| Application specific |<--3-->: Acct Policy :
| Module | :.............:
+----------------------+
^
|
5
|
V
+-------------------------------------+
| Service |
| +-----------+ +----------------+ | ..............
| | Service |<-->| Accounting/ |<--3-->: Accounting :
| | Provision | | Metering | | : Data :
| +-----------+ +----------------+ | :............:
+-------------------------------------+
Figure 5: AAA Server with Integrated Accounting
图5：具有集成计费功能的AAA服务器
Data about the resource consumption is sent back to the AAA server via the ASM. The accounting process within the service converts the metered data into accounting records which are sent to the AAA server. For generating accounting records data conversion, aggregation and filtering of data might be performed.
有关资源消耗的数据通过ASM发送回AAA服务器。服务中的记帐过程将计量数据转换为记帐记录，并发送到AAA服务器。为了生成会计记录，可以执行数据转换、聚合和过滤。
In contrast to the integrated accounting approach, accounting can also be seen as a separate or discrete service on its own. In this case the accounting does not have to be coupled with a specific service. Discrete Accounting can be used for outsourcing the accounting task. The accounting service can be provided by a general accounting system which is able to account for different services.
与综合会计方法不同，会计本身也可以被视为一项独立或离散的服务。在这种情况下，会计不必与特定的服务结合在一起。离散会计可用于外包会计任务。会计服务可以由通用会计系统提供，该系统能够对不同的服务进行核算。
For example, a generalized meter can do accounting for web traffic, FTP traffic and voice over IP traffic. If accounting is a separate service, one provider can do the accounting (charging and billing) for several other service providers. Accounting is offered just like any other service. This means authentication and authorization might be required prior to the accounting service provisioning. Furthermore, it is important that the involved parties agree beforehand how the accounting service is provided, what parameters can be set and how disputes will be resolved. After the accounting service has been configured, the AAA server can do the user configuration of the service.
例如，通用的流量表可以计算web流量、FTP流量和IP语音流量。如果记帐是一项单独的服务，则一个提供商可以为其他几个服务提供商记帐（收费和计费）。会计服务与其他服务一样提供。这意味着在提供记帐服务之前可能需要身份验证和授权。此外，重要的是，有关各方应事先商定如何提供会计服务、可以设定哪些参数以及如何解决争议。配置记帐服务后，AAA服务器可以对该服务进行用户配置。
+---------------------+
<---1--->| Generic AAA Server |<---1--->
| | ............
| Rule based engine |<----|----->: Policy :
| | 3| :..........:
+---------------------+<----|--+ ............
^ ^ +-->: Events :
| | :..........:
2 2
| |
V V
+-------------+ +--------------+ ...............
| Application | | Application |<--3-->: Acct Policy :
| Specific | | Specific | :.............:
| Module | | Module |
+-------------+ +--------------+
^ ^
| |
5 5
| |
V V
+-------------+ +---------------+ ..............
| Service | | Accounting/ |<--3-->: Accounting :
| | | Metering | : Data :
+-------------+ +---------------+ :............:
+---------------------+
<---1--->| Generic AAA Server |<---1--->
| | ............
| Rule based engine |<----|----->: Policy :
| | 3| :..........:
+---------------------+<----|--+ ............
^ ^ +-->: Events :
| | :..........:
2 2
| |
V V
+-------------+ +--------------+ ...............
| Application | | Application |<--3-->: Acct Policy :
| Specific | | Specific | :.............:
| Module | | Module |
+-------------+ +--------------+
^ ^
| |
5 5
| |
V V
+-------------+ +---------------+ ..............
| Service | | Accounting/ |<--3-->: Accounting :
| | | Metering | : Data :
+-------------+ +---------------+ :............:
Figure 6: AAA Server with Discrete Accounting
图6：带离散记帐的AAA服务器
A service provider that has outsourced the accounting service has to request this service from an accounting service provider. The generated accounting records are sent from the accounting provider to the service provider who may make modifications to the records before sending them to the final destination. Having such a general accounting service might speed up the creation of new services - especially specialized content services - in the Internet. This separation is also beneficial to support special accounting services (e.g. sending accounting indications to users) that are not directly coupled to a network service. Furthermore, this separation is useful if the same set of accounting strategies can be applied to different services (e.g. different tariffs which can be used for a set of services).
外包会计服务的服务提供商必须向会计服务提供商申请该服务。生成的会计记录从会计提供商发送到服务提供商，服务提供商可以在将记录发送到最终目的地之前对记录进行修改。拥有这样一个通用的会计服务可能会加速在互联网上创建新的服务，特别是专门的内容服务。这种分离也有利于支持不直接耦合到网络服务的特殊记帐服务（例如，向用户发送记帐指示）。此外，如果同一套会计策略可应用于不同的服务（例如，可用于一套服务的不同费率），则这种分离是有用的。
Another option is to outsource only the metering service. The meter service provider generates meter data and sends them to the service provider who has requested them. The service provider then generates accounting records based on the received meter data. A separate accounting or metering service provider can be used to validate the accounting data generated by a service provider. If the customer does not trust a service provider, or in the case of a legal action, a trusted accounting or metering provider is able to validate the correctness of the accounting data generated by the service provider.
另一种选择是仅外包计量服务。电表服务提供商生成电表数据并将其发送给请求电表数据的服务提供商。然后，服务提供商根据收到的电表数据生成会计记录。可以使用单独的会计或计量服务提供商来验证服务提供商生成的会计数据。如果客户不信任服务提供商，或者在法律诉讼的情况下，受信任的会计或计量提供商能够验证服务提供商生成的会计数据的正确性。
In Intra-Domain accounting [RFC2975], the data about resource consumption is collected in one administrative domain for usage in that domain. Accounting policies are enforced locally. Since no exchange of accounting data with other domains is required in this scenario, accounting policies do not need to be exchanged with other entities.
在域内记帐[RFC2975]中，有关资源消耗的数据收集在一个管理域中，以便在该域中使用。会计政策在当地执行。由于在此场景中不需要与其他域交换会计数据，因此会计政策不需要与其他实体交换。
+-------------+
| Billing |
+-------------+
^
|
+-------------+
| ASM |
+-------------+
^
| ..............
+--------------+ : Accounting :
| AAA |<--->: Policies :
+--------------+ :............:
| ^
| |
V |
+--------------+
| ASM |
+--------------+
| ^
config | | Accounting Records
V |
+------------+ +-----------|----------+
| | Service usage | +--------+-------+ |
| End System |-------------->| | Accounting | |
| | | +----------------+ |
+------------+ | |
| Service |
+----------------------+
User Provider
+-------------+
| Billing |
+-------------+
^
|
+-------------+
| ASM |
+-------------+
^
| ..............
+--------------+ : Accounting :
| AAA |<--->: Policies :
+--------------+ :............:
| ^
| |
V |
+--------------+
| ASM |
+--------------+
| ^
config | | Accounting Records
V |
+------------+ +-----------|----------+
| | Service usage | +--------+-------+ |
| End System |-------------->| | Accounting | |
| | | +----------------+ |
+------------+ | |
| Service |
+----------------------+
User Provider
Figure 7: Intra-Domain Accounting
图7：域内记帐
For Inter-Domain Accounting, at least two administratively separated networks are involved in the accounting process. These can be a Home- and a Foreign-Provider in a Roaming/Mobile IP Scenario [RFC2002] or a chain of providers if service provisioning involves data transfer and/or services from different domains. In these scenarios, the exchange of accounting policies between providers is necessary if accounting tasks are delegated to one provider or shared among multiple providers. The exchange of accounting policies is done by the AAA servers as shown in the figure below.
对于域间记帐，记帐过程中至少涉及两个管理上分离的网络。它们可以是漫游/移动IP场景[RFC2002]中的本地和外国提供商，如果服务提供涉及数据传输和/或来自不同域的服务，则可以是一系列提供商。在这些场景中，如果会计任务委托给一个提供者或在多个提供者之间共享，则提供者之间需要交换会计策略。会计政策的交换由AAA服务器完成，如下图所示。
| +-----------+
| | Billing |
| +-----------+
| ^
| |
| +-----------+
| | ASM |
| +-----------+
| ^
| |
+------------------+ 1. AccPolInd +-----------+
| |<-------------| |
| | | | |
| AAAF | 2.AccPolConf | AAAH |
| |------------->| |
| | | | |
| | 3. AccRec | |
| |------------->| |
+------------------+ | +-----------+
config | ^ | ^
| | | |
V | | V
+--------------+ | .............
| ASM | | : Acct. :
+--------------+ | : Policies :
| ^ | :...........:
| | |
| | Acct. Records |
Service V | |
+------------+ usage +-----------|----------+ |
| | | +--------+-------+ | |
| End System |------>| | Accounting | | |
| | | +----------------+ | |
+------------+ | | |
| Service | |
+----------------------+ |
| +-----------+
| | Billing |
| +-----------+
| ^
| |
| +-----------+
| | ASM |
| +-----------+
| ^
| |
+------------------+ 1. AccPolInd +-----------+
| |<-------------| |
| | | | |
| AAAF | 2.AccPolConf | AAAH |
| |------------->| |
| | | | |
| | 3. AccRec | |
| |------------->| |
+------------------+ | +-----------+
config | ^ | ^
| | | |
V | | V
+--------------+ | .............
| ASM | | : Acct. :
+--------------+ | : Policies :
| ^ | :...........:
| | |
| | Acct. Records |
Service V | |
+------------+ usage +-----------|----------+ |
| | | +--------+-------+ | |
| End System |------>| | Accounting | | |
| | | +----------------+ | |
+------------+ | | |
| Service | |
+----------------------+ |
User Foreign-Provider Home-Provider
用户外部提供程序本地提供程序
Figure 8: Inter-Domain Accounting (Roaming Example)
图8：域间计费（漫游示例）
In this example, the foreign provider takes over the collection of accounting data. The home provider is responsible for applying a charging scheme and sending the bill. Therefore, the home provider needs accounting data from the foreign provider. In order to instruct the foreign provider about the desired accounting record type and report frequency, the home AAA server sends an accounting policy indication to the foreign AAA server. The indication contains
在本例中，外部提供者接管会计数据的收集。家庭供应商负责申请收费方案并发送账单。因此，国内供应商需要国外供应商提供的会计数据。为了向国外供应商指示所需的会计记录类型和报告频率，国内AAA服务器向国外AAA服务器发送会计策略指示。指示包含
the accounting policy. Instead of sending an indication, the accounting policies could also be piggy backed onto an authorization reply. If the foreign AAA server is able to configure devices in a way to enforce the desired policy (e.g. the meters are capable of metering the requested attributes) the accounting policy indication is acknowledged. In case the requested policy cannot be enforced, the accounting service is denied. Reasons to deny the enforcement of a specific accounting policy could be, e.g. because the meter is not capable of measuring the requested attributes or the frequency of records cannot be provided, or the home provider is not authorized to get the requested detailed data. In this case procedures would be useful to negotiate the smallest common denominator for the involved AAA servers regarding the provisioning of accounting data.
会计政策。会计政策也可以通过授权回复来代替发送指示。如果外部AAA服务器能够以某种方式配置设备以强制执行所需的策略（例如，仪表能够计量所请求的属性），则确认记帐策略指示。如果无法执行请求的策略，则会计服务将被拒绝。拒绝执行特定会计政策的原因可能是，例如，由于电表无法测量要求的属性，或无法提供记录频率，或家庭供应商无权获得要求的详细数据。在这种情况下，程序将有助于协商有关提供会计数据的AAA服务器的最小公分母。
The AAA authorization framework [RFC2904] introduces different message sequences for authorization. The integration of configurable accounting services for the message sequences can be done as described in the following sections.
AAA授权框架[RFC2904]为授权引入了不同的消息序列。消息序列的可配置会计服务的集成可以按照以下部分所述完成。
The appropriate accounting policy for the authorized service is either stored together with the authorization policy or in a separate repository. The configuration of the accounting infrastructure can be done together with the user configuration of the service equipment (messages 2 and 3 in Figure 9). User-specific configuration of the service equipment and the accounting infrastructure configuration might involve the transfer of configuration data to multiple entities in the network (e.g. to different routers for setting up QoS provisioning or to dedicated accounting meters).
授权服务的相应记帐策略与授权策略一起存储，或存储在单独的存储库中。会计基础设施的配置可以与服务设备的用户配置一起完成（图9中的消息2和3）。服务设备的用户特定配置和计费基础设施配置可能涉及将配置数据传输到网络中的多个实体（例如，传输到用于设置QoS供应的不同路由器或专用计费仪表）。
+-------------------------+
+------+ | Service Provider |
| | 1 | +-------------------+ |
| |------+->| AAA Server | |
| |<-----+--| | |
| | 4 | +-------------------+ |
| User | | | ^ ^ |
| | | |2 |3 |AcctRec |
| | | V | | |
| | | +-------------------+ |
| | | | Service | |
| | | | Equipment | |
| | | +-------------------+ |
+------+ | |
+-------------------------+
+-------------------------+
+------+ | Service Provider |
| | 1 | +-------------------+ |
| |------+->| AAA Server | |
| |<-----+--| | |
| | 4 | +-------------------+ |
| User | | | ^ ^ |
| | | |2 |3 |AcctRec |
| | | V | | |
| | | +-------------------+ |
| | | | Service | |
| | | | Equipment | |
| | | +-------------------+ |
+------+ | |
+-------------------------+
Figure 9: Accounting and Agent Sequence
图9：会计和代理顺序
In the agent sequence, it is possible to allow the user to send accounting policies (e.g. for accounting indications) together with the authorization request to the AAA server. Figure 9 shows the agent sequence authorization and accounting messages.
在代理序列中，可以允许用户将记帐策略（例如用于记帐指示）与授权请求一起发送到AAA服务器。图9显示了代理序列授权和记帐消息。
The configuration of the accounting infrastructure can be done similar to the agent sequence during the user configuration of the service equipment. Since the pull sequence does not involve the sending of a specific authorization request (e.g. if the service equipment is a Network Access Server (NAS) and the authorization sequence simply starts with the dial-in process), it would need additional communication to support accounting policy indications from users.
会计基础设施的配置可以类似于服务设备的用户配置期间的代理序列。由于拉取序列不涉及特定授权请求的发送（例如，如果服务设备是网络访问服务器（NAS），且授权序列仅从拨入过程开始），因此需要额外的通信来支持用户的记帐策略指示。
+-------------------------+
+------+ | Service Provider |
| |AccPolInd +-------------------+ |
| |.........>| AAA Server | |
| |<.........| | |
| | | +-------------------+ |
| User | | ^ | ^ |
| | | |2 |3 |AcctRec |
| | | | V | |
| | 1 | +-------------------+ |
| |-------+->| Service | |
| |<------+--| Equipment | |
| | 4 | +-------------------+ |
+------+ | |
+-------------------------+
+-------------------------+
+------+ | Service Provider |
| |AccPolInd +-------------------+ |
| |.........>| AAA Server | |
| |<.........| | |
| | | +-------------------+ |
| User | | ^ | ^ |
| | | |2 |3 |AcctRec |
| | | | V | |
| | 1 | +-------------------+ |
| |-------+->| Service | |
| |<------+--| Equipment | |
| | 4 | +-------------------+ |
+------+ | |
+-------------------------+
Figure 10: Accounting and Pull Sequence
图10：记帐和拉取顺序
This can be, for instance, achieved by a hybrid model of agent and pull sequence where the user sends an accounting policy indication to the AAA server in addition to the messages exchange for the pull sequence. Figure 10 shows the pull sequence authorization and accounting messages.
例如，这可以通过代理和拉序列的混合模型实现，其中用户除了为拉序列交换消息之外，还向AAA服务器发送记帐策略指示。图10显示了pull序列授权和记帐消息。
In the push sequence, there is no direct connection between the AAA server and the service equipment. In this sequence there are three possibilities for setting up the accounting infrastructure:
在推送序列中，AAA服务器和服务设备之间没有直接连接。在此顺序中，有三种可能设置会计基础架构：
a) A standard fixed accounting procedure that has been assigned in advance for the specific combination of authorized user and service is used.
a) 使用预先为授权用户和服务的特定组合指定的标准固定会计程序。
b) The ticket (message 3 in Figure 11) contains information about the accounting policies used (e.g. different tickets for the same service with different accounting policies).
b) 票证（图11中的消息3）包含有关所用会计政策的信息（例如，相同服务的不同票证具有不同的会计政策）。
c) The ticket acts as a kind of digital coin and no further accounting is needed. This model also supports the anonymous usage of a service.
c) 这张票就像一种数字硬币，不需要进一步记账。此模型还支持匿名使用服务。
Figure 11 shows push sequence authorization and accounting messages.
图11显示了推送序列授权和记帐消息。
+-------------------------+
+------+ | Service Provider |
| | 1 | +-------------------+ |
| |------+->| AAA Server | |
| |<-----+--| | |
| | 2 | +-------------------+ |
| User | | ^ |
| | | | AcctRec |
| | | | |
| | 3 | +-------------------+ |
| |------+->| Service | |
| |<-----+--| Equipment | |
| | 4 | +-------------------+ |
+------+ | |
+-------------------------+
+-------------------------+
+------+ | Service Provider |
| | 1 | +-------------------+ |
| |------+->| AAA Server | |
| |<-----+--| | |
| | 2 | +-------------------+ |
| User | | ^ |
| | | | AcctRec |
| | | | |
| | 3 | +-------------------+ |
| |------+->| Service | |
| |<-----+--| Equipment | |
| | 4 | +-------------------+ |
+------+ | |
+-------------------------+
Figure 11: Accounting and Push Sequence
图11：记帐和推送顺序
If the provisioning of the service and the final authentication/ authorization process is done by different organizations, accounting is rather coupled to the service provisioning process than to the authentication/authorization process. Since the data doesn't have to traverse the home providers network, the home provider has no possibility of collecting data about the resource consumption. Therefore, accounting will usually take place in the foreign provider domain (i.e. in the domain that does the service provisioning). Nevertheless, in order to ensure consistency of the authentication, authorization and accounting processes (e.g. allocation of user IDs to accounting records) and the production of a bill, a connection between the accounting process in the service provisioning domain and the deciding authentication/authorization process (e.g. at the home provider) is needed.
如果服务的提供和最终的身份验证/授权过程是由不同的组织完成的，那么会计与服务提供过程而不是身份验证/授权过程耦合。由于数据不必遍历家庭提供者网络，家庭提供者不可能收集有关资源消耗的数据。因此，记帐通常在外国提供商域中进行（即，在进行服务提供的域中）。然而，为了确保身份验证、授权和会计流程（例如，将用户ID分配给会计记录）和账单生成的一致性，服务提供域中的会计流程与决定性的身份验证/授权流程（例如，在家庭提供商处）之间的连接这是需要的。
A possible way of doing this is if the foreign provider gets the accounting policies from the home provider and sets up the accounting architecture in accordance to the given policies, the foreign provider can generate accounting records and send them back to the home provider. The home provider then can apply charging and can produce a bill. An example for this is given in section 9.2. This scenario requires a prior agreement between the involved providers about the possible policies and parameters that are allowed to be set.
一种可能的方法是，如果外国供应商从本国供应商处获得会计政策，并根据给定的政策设置会计体系结构，则外国供应商可以生成会计记录并将其发送回本国供应商。然后，家庭供应商可以申请收费并出具账单。第9.2节给出了一个例子。此场景要求相关提供商事先就允许设置的可能策略和参数达成一致。
The following examples illustrate the use of policy-based accounting. Please note that the services used in the examples are used only for illustration purposes and their use in reality requires different messages and parameters.
以下示例说明了基于政策的会计的使用。请注意，示例中使用的服务仅用于说明目的，实际使用时需要不同的消息和参数。
The Internet Printing Protocol (IPP) [RFC2566], and especially the "print-by-reference" model, provides a very interesting example scenario for accounting and the interaction between authorization and accounting. We will describe possible solutions for the accounting of this service and how the accounting is triggered by the authorization. We will show how the model presented above can be used for this example.
Internet打印协议（IPP）[RFC2566]，特别是“参照打印”模型，为记帐以及授权和记帐之间的交互提供了一个非常有趣的示例场景。我们将描述此服务记帐的可能解决方案，以及授权如何触发记帐。我们将展示如何将上述模型用于此示例。
IPP "print-by-reference" allows a user to request a print service to print a particular file. The file to be printed is not on the client system but rather on a public server. That is, the clients print request can contain a reference, or pointer, to the document instead of the actual document itself. The print service must then read the file to a file server (used for spooling) prior to the printing. There are two possible setups: The file and print server either belong to a single organization (Intra-Domain Accounting) or to two different organizations (Inter-Domain Accounting). In the first case, the user must be authorized by a single service provider for service usage. In the second case, two different possibilities for establishing a trust relationships between the involved entities have to be distinguished [RFC2905].
IPP“参照打印”允许用户请求打印服务打印特定文件。要打印的文件不在客户端系统上，而是在公共服务器上。也就是说，客户端打印请求可以包含指向文档的引用或指针，而不是实际文档本身。然后，打印服务必须在打印之前将文件读取到文件服务器（用于后台打印）。有两种可能的设置：文件和打印服务器要么属于单个组织（域内记帐），要么属于两个不同的组织（域间记帐）。在第一种情况下，用户必须由单个服务提供商授权才能使用服务。在第二种情况下，必须区分在相关实体之间建立信任关系的两种不同可能性[RFC2905]。
In the case of a single organization, the file and print service is provided by a single service provider. The service subscriber and user role are either one entity (e.g. private home user) or different entities (e.g. company as subscriber, employee as user). For data transport via the underlying network, the transportation service of a network provider is used. In this case, the AAA server of the provider controls the access to the file and the print server. This means the AAA server enforces the accounting policies and collects accounting data for both servers.
对于单个组织，文件和打印服务由单个服务提供商提供。服务订户和用户角色可以是一个实体（例如，私人家庭用户）或不同的实体（例如，公司作为订户，员工作为用户）。对于通过基础网络的数据传输，使用网络提供商的传输服务。在这种情况下，提供商的AAA服务器控制对文件和打印服务器的访问。这意味着AAA服务器执行记帐策略并收集两台服务器的记帐数据。
If two different organizations are involved there are two possibilities for trust relationships as shown in [RFC2905]:
如果涉及两个不同的组织，则有两种可能的信任关系，如[RFC2905]所示：
1. The user has an agreement with the print server; the print server has an agreement with the file server. 2. The user has agreements with both print and file server.
1. 用户与打印服务器有协议；打印服务器与文件服务器有协议。2.用户与打印服务器和文件服务器都有协议。
In case 1, the user is first authorized by the print service and the request is forwarded to the file server. The file server authorizes the print server and determines if the printer is allowed to access the file. In this case which is shown in Figure 12, the accounting policies from the user arrive at the print service AAA server.
在案例1中，用户首先由打印服务授权，请求被转发到文件服务器。文件服务器授权打印服务器，并确定是否允许打印机访问文件。在这种情况下，如图12所示，来自用户的记帐策略到达打印服务AAA服务器。
USER DOMAIN PRINT SERVICE DOMAIN FILE SERVICE DOMAIN
| |
+------+ | |
| | | |
| | | |
| | | +--------------------+ | +-------------------+
| User |---1-->| Print Service |---1-->| File Service |
| |<--2---| AAA Server |<--2---| AAA Server |
| | | +--------------------+ | +-------------------+
| | | | Print Server | | | File Server |
| | | | and Printer | | | |
+------+ | +--------------------+ | +-------------------+
USER DOMAIN PRINT SERVICE DOMAIN FILE SERVICE DOMAIN
| |
+------+ | |
| | | |
| | | |
| | | +--------------------+ | +-------------------+
| User |---1-->| Print Service |---1-->| File Service |
| |<--2---| AAA Server |<--2---| AAA Server |
| | | +--------------------+ | +-------------------+
| | | | Print Server | | | File Server |
| | | | and Printer | | | |
+------+ | +--------------------+ | +-------------------+
1: AccPolInd, 2: AccPolConf
1:AccPolInd，2:accpoliconf
Figure 12: Inter-Domain Accounting and Printing Service
图12：域间会计和打印服务
The print service AAA server has to decide which policies can be enforced locally and which must be passed further to the file service AAA server. The print service can add additional accounting policies. In case the file server does not support the desired accounting policies, the print server must notify the user's AAA server and some policy conflict resolution must occur. After the file server has transferred the file to the print service, it generates an accounting record according to the accounting policy and passes it to the print service. The print service generates the final accounting record for the service session based on its own and the file service data after finishing printing. This record will be used for the later billing process. Additionally, the print server can send the final record to the user's AAA server. There it can be used for later authorization decisions based on used resources, i.e. if the customer is a company and the user is an employee.
打印服务AAA服务器必须决定哪些策略可以在本地实施，哪些策略必须进一步传递给文件服务AAA服务器。打印服务可以添加其他会计政策。如果文件服务器不支持所需的记帐策略，打印服务器必须通知用户的AAA服务器，并且必须进行一些策略冲突解决。文件服务器将文件传输到打印服务后，会根据会计政策生成会计记录并将其传递给打印服务。打印服务在完成打印后，根据自身和文件服务数据生成服务会话的最终会计记录。此记录将用于以后的计费过程。此外，打印服务器可以将最终记录发送到用户的AAA服务器。在那里，它可以用于以后根据使用的资源做出的授权决策，即如果客户是公司，用户是员工。
In case 2, the customer AAA server has an agreement with file and print server. In this case, the user's AAA server sends accounting policies to the file and the print server. After finishing the service, both servers generate accounting records for the delivered services which are used for later billing. As in the former case, the accounting data can be sent to the user's AAA server for use in later authorization decisions. The user's AAA server can tie both accounting records together and assign them to the user using audited session information (authorization and accounting messages for a particular session could be coupled via a session ID) and policies that define which activities a certain session is composed of.
在案例2中，客户AAA服务器与文件和打印服务器有协议。在这种情况下，用户的AAA服务器向文件和打印服务器发送记帐策略。完成服务后，两台服务器都会为交付的服务生成记帐记录，用于以后的计费。与前一种情况一样，记帐数据可以发送到用户的AAA服务器，以便在以后的授权决策中使用。用户的AAA服务器可以使用经审核的会话信息（特定会话的授权和记帐消息可以通过会话ID耦合）和定义特定会话由哪些活动组成的策略，将两个记帐记录绑定在一起并分配给用户。
For the printing service, there are a number of possible options for sending accounting indications to the user. Accounting indications give the user an indication of how much resources have been used until the time of the indication. A user can receive accounting indications or not depending on the accounting policy for the user.
对于打印服务，有许多可能的选项可用于向用户发送记帐指示。会计指示为用户提供指示，说明在指示之前使用了多少资源。用户可以接收会计指示，也可以不接收，这取决于用户的会计政策。
For Internet printing with the "print-by-reference" model, such indications would be very helpful for the user. Since the file is not on the clients site, the user might not have information on the file size or the number of pages that will be printed. This means the user has no idea of the costs of the service usage. If user and subscriber are a single entity, accounting indications would help users to avoid exceeding their spending limit. Additionally, accounting indications give the user a hint as to which resource usage has caused the charges. This can be compared to an itemized telephony bill where not only the monetary sum per month is printed but, in addition, information for every call (start time, duration, distance etc.) and its corresponding charge.
对于采用“参照打印”模式的互联网打印，此类指示将对用户非常有帮助。由于文件不在客户端站点上，用户可能没有关于文件大小或将要打印的页数的信息。这意味着用户不知道服务使用的成本。如果用户和订户是一个实体，会计指示将帮助用户避免超出其支出限额。此外，记帐指示会提示用户哪些资源使用导致了费用。这可以与逐项列出的电话账单相比较，其中不仅打印每月的金额，而且还打印每个通话的信息（开始时间、持续时间、距离等）及其相应的费用。
In this section, the "Dial-in with Roaming" example from the authorization examples [RFC2905], [RFC2002] is used to show how accounting functions could interact with authorization functions. The accounting modules (e.g. collectors and meters) are seen here as part of the service equipment which is, in this example, located at the visited ISP premises. The basic configuration of the accounting modules is probably done by the visited ISP itself, but the visited ISP can allow the home ISP to influence certain parameters (like report interval or accounting record format). This is useful if the home provider generates the invoice and therefore needs appropriate accounting records to calculate the prices.
在本节中，使用授权示例[RFC2905]、[RFC2002]中的“带漫游的拨号”示例来说明记帐功能如何与授权功能交互。计费模块（如收集器和仪表）在此被视为服务设备的一部分，在本例中，服务设备位于访问的ISP场所。计费模块的基本配置可能由访问的ISP自己完成，但访问的ISP可以允许家庭ISP影响某些参数（如报告间隔或计费记录格式）。如果家庭供应商生成发票，因此需要适当的会计记录来计算价格，则此功能非常有用。
User | Visited ISP | Home ISP
| |
| | +-----------+ ..........
<--------------------12-------------------| Charging, |<-:charging:
| | | Billing | :policies:
| | +-----------+ :........:
| | ^
| | |
| | +-----------+
| | | ASM |
| | +-----------+
| | ^
| | |11
| | |
| +------------+ | +-------------+
| | | | | |
| | |---10---->| |
| | | | | |
Acct. Records | AAAF Server|----3---->| AAAH Server |
<-----------------| |<---4-----| |
| | | | | |
| | | | | |
| +------------+ | +-------------+
| ^ | ^ |
| | | | |
| | 5 9 |
| | | | |
| | V | |
| | +----------------+|
| | | ASM ||
| 2 | ||
| | +----------------+|
| | | ^ |
| | | | |
| | 6 8 |
| | | | |
| +------------+------+-------+ |
7 | | Service | | | |
<--------| Equipment | +----------+| |
1 | | |->|Accounting|| |
-------->| | +----------+| |
| | config | | | |
| | | +---------+ | |
| | +->| Meters | | |
| | +---------+ | |
| +---------------------------+ |
| |
Figure 13: Roaming Example
User | Visited ISP | Home ISP
| |
| | +-----------+ ..........
<--------------------12-------------------| Charging, |<-:charging:
| | | Billing | :policies:
| | +-----------+ :........:
| | ^
| | |
| | +-----------+
| | | ASM |
| | +-----------+
| | ^
| | |11
| | |
| +------------+ | +-------------+
| | | | | |
| | |---10---->| |
| | | | | |
Acct. Records | AAAF Server|----3---->| AAAH Server |
<-----------------| |<---4-----| |
| | | | | |
| | | | | |
| +------------+ | +-------------+
| ^ | ^ |
| | | | |
| | 5 9 |
| | | | |
| | V | |
| | +----------------+|
| | | ASM ||
| 2 | ||
| | +----------------+|
| | | ^ |
| | | | |
| | 6 8 |
| | | | |
| +------------+------+-------+ |
7 | | Service | | | |
<--------| Equipment | +----------+| |
1 | | |->|Accounting|| |
-------->| | +----------+| |
| | config | | | |
| | | +---------+ | |
| | +->| Meters | | |
| | +---------+ | |
| +---------------------------+ |
| |
Figure 13: Roaming Example
The exchange of authorization data corresponds to the example in [RFC2905]. As an additional component, we introduce an ASM between home AAA and service equipment for the user configuration which happens after successful authorization. The extended roaming example is shown in Figure 13. Steps (1), (2) and (3) describe the forwarding of an authentication/authorization request from the user via the AAA sever of the visited ISP to the home AAA server. In step (4), user specific service parameters are given to the visited ISP's AAA server and are forwarded to the service equipment (5) where the user configuration is done. The user-specific service parameters could additionally include the desired policies for the configuration of the accounting infrastructure of the visited ISP. An accounting policy could be, for instance, "for user X one accounting record of type Y has to be generated every 30 seconds". This accounting policy is used by the visited ISP to configure his modules (e.g. metering, data collection).
授权数据的交换对应于[RFC2905]中的示例。作为一个附加组件，我们在家庭AAA和服务设备之间引入一个ASM，用于成功授权后的用户配置。扩展漫游示例如图13所示。步骤（1）、（2）和（3）描述了用户通过访问的ISP的AAA服务器向家庭AAA服务器转发认证/授权请求。在步骤（4）中，特定于用户的服务参数被提供给所访问的ISP的AAA服务器，并被转发到服务设备（5），在那里完成用户配置。用户特定的服务参数还可以包括所访问ISP的计费基础设施配置所需的策略。例如，会计政策可以是“对于用户X，必须每30秒生成一条Y类型的会计记录”。访问的ISP使用此记帐策略来配置其模块（例如，计量、数据采集）。
User-dependent service parameters are converted by the ASM into the appropriate configuration information (6). Then the user is informed about the completed authentication/authorization process (7). The accounting architecture starts metering the resource usage and sends metering records to the ASM (8). The ASM uses the metered data to fill the required accounting records and sends them to the visited ISP's AAA server (9). The visited ISP can either post-process the data or directly forward them to the home ISP (10). With this data as input, an invoice is generated by the charging and billing modules within the home providers domain (11) by using charging policies (tariff formulas), and then sent to the user/customer (12).
ASM将依赖于用户的服务参数转换为相应的配置信息（6）。然后通知用户已完成的认证/授权过程（7）。记帐体系结构开始计量资源使用情况，并将计量记录发送给ASM（8）。ASM使用计量数据填写所需的记帐记录，并将其发送到访问的ISP的AAA服务器（9）。访问的ISP可以对数据进行后处理，也可以直接将数据转发给家庭ISP（10）。使用该数据作为输入，家庭提供商域（11）内的计费和计费模块通过使用计费策略（费率公式）生成发票，然后发送给用户/客户（12）。
As an additional option, accounting records can also be offered to the user (accounting indication) as a special service. For this special service a separate authorization is required.
作为附加选项，会计记录也可以作为特殊服务提供给用户（会计指示）。对于这种特殊服务，需要单独授权。
This example explains how integrated accounting is configured via policies for a Diffserv service [RFC2475] based on bandwidth brokers [I2-BB]. The service is the transport of packets with a higher priority and the service includes accounting and QoS auditing. Figure 14 shows the service setup. The user issues a Service Request (SR) for a Diffserv service to the AAA server. The request contains a user ID and the parameter for the desired service class.
此示例说明如何通过基于带宽代理[I2-BB]的Diffserv服务[RFC2475]的策略配置集成记帐。该服务是具有较高优先级的数据包的传输，该服务包括记帐和QoS审计。图14显示了服务设置。用户向AAA服务器发出区分服务服务的服务请求（SR）。该请求包含所需服务类的用户ID和参数。
User->AAA: user-x@nw-a, service=diffserv, class=gold,
amount=2Mbit, dest= nw-b
User->AAA: user-x@nw-a, service=diffserv, class=gold,
amount=2Mbit, dest= nw-b
In this example, user-x is located at network A (nw-a) and requests a gold class service for all flows from this network to the destination network B (nw-b). After authentication and authorization has been completed successfully, the AAA server extracts the ASI from the request and passes them to the ASM of the Diffserv service.
在该示例中，用户x位于网络A（nw-A）处，并为从该网络到目的地网络B（nw-B）的所有流请求黄金级服务。成功完成身份验证和授权后，AAA服务器从请求中提取ASI，并将其传递给Diffserv服务的ASM。
AAA->ASM: service=diffserv, class=gold, amount=2Mbit, src=nw-a
dest=nw-b
AAA->ASM: service=diffserv, class=gold, amount=2Mbit, src=nw-a
dest=nw-b
The ASM takes over the task of translating the application specific information into appropriate user configuration information for the service equipment. For the given Diffserv example, the service equipment consists of three components: accounting equipment, the QoS auditing equipment and the bandwidth broker architecture. The ASM has to address all three components to set up the requested service for the user. The translation of the ASI into configuration information for the components can be done by evaluating service provisioning policies. For example, the ASM could have the following service provisioning policy:
ASM负责将特定于应用程序的信息转换为服务设备的适当用户配置信息。对于给定的Diffserv示例，服务设备由三个组件组成：记帐设备、QoS审核设备和带宽代理体系结构。ASM必须解决所有三个组件，以便为用户设置请求的服务。可以通过评估服务供应策略将ASI转换为组件的配置信息。例如，ASM可以具有以下服务配置策略：
if class==gold {
set bw-request.class = gold
set accounting.type = comprehensive
set qos-audit.metric = one-way-delay
...
}
if class==gold {
set bw-request.class = gold
set accounting.type = comprehensive
set qos-audit.metric = one-way-delay
...
}
This results in sending a bandwidth request to the BB which asks for a gold service with the given parameters. Furthermore, the ASM issues a request to the accounting equipment for comprehensive accounting and a request to the QoS auditing equipment for a one-way-delay measurement between the given networks.
这导致向BB发送带宽请求，BB请求具有给定参数的gold服务。此外，ASM向记帐设备发出请求以进行综合记帐，并向QoS审核设备发出请求以进行给定网络之间的单向延迟测量。
ASM->BB: BW-request(gold, src=nw-a, dest=nw-b, amount=2Mbit)
ASM->BB: BW-request(gold, src=nw-a, dest=nw-b, amount=2Mbit)
ASM->Acct: Acct-request(comprehensive, src=nw-a)
ASM->Acct: Acct-request(comprehensive, src=nw-a)
ASM->QoS: QoS-audit-request(one-way-delay, src=nw-a, dest=nw-b)
ASM->QoS: QoS-audit-request(one-way-delay, src=nw-a, dest=nw-b)
The bandwidth broker then sets up the Diffserv infrastructure to provide the prioritized forwarding according to the definition of a gold class. This is done in accordance with the actual bandwidth broker's architecture and is not further considered here. For the Accounting Configuration and the QoS Audit Control, local configuration policies exist for setting up the service.
然后，带宽代理建立区分服务基础设施，根据黄金类的定义提供优先转发。这是根据实际带宽代理的体系结构完成的，这里不再进一步考虑。对于记帐配置和QoS审核控制，存在用于设置服务的本地配置策略。
Accounting-Policy:
if type==comprehensive {
set meter-location = access-point(nw-a)
set record type =detailed
set report interval = 120 s
set report target = 193.175.12.8
^ indent of last two lines
}
Accounting-Policy:
if type==comprehensive {
set meter-location = access-point(nw-a)
set record type =detailed
set report interval = 120 s
set report target = 193.175.12.8
^ indent of last two lines
}
QoS-Measurement-Policy:
if metric==one-way-delay {
set method = passive
set timestampsize = 48 bit
set ingress-meter-location = access-point(nw-a)
set egress-meter-location = access-point(nw-b)
}
QoS-Measurement-Policy:
if metric==one-way-delay {
set method = passive
set timestampsize = 48 bit
set ingress-meter-location = access-point(nw-a)
set egress-meter-location = access-point(nw-b)
}
In this case, the local accounting policy sets the meter location to the network access point of network A. It states that for comprehensive accounting, a detailed record type is required with a report interval of 120 s. The resulting records have to be sent to the given report target. The QoS measurement policy sets the measurement method to passive measurement. It sets the size used for timestamp representation to 48 bits. As meter locations, the meters at the access points of network A and network B are used.
在这种情况下，本地计费策略将电表位置设置为网络A的网络接入点。它指出，对于综合计费，需要详细的记录类型，报告间隔为120秒。结果记录必须发送到给定的报告目标。QoS测量策略将测量方法设置为被动测量。它将用于时间戳表示的大小设置为48位。作为电表位置，使用网络A和网络B的接入点处的电表。
After evaluating these policies, the instructions for the meter configuration are passed down to the measurement infrastructure. In our example, the accounting configuration instructs the meter at the first measurement point (MP1) to add a new rule with the given flow attributes and settings for storage and reporting of results.
评估这些策略后，仪表配置的说明将传递给测量基础设施。在我们的示例中，记帐配置指示第一个测量点（MP1）处的仪表添加具有给定流属性和设置的新规则，以存储和报告结果。
Acct->MI: MP1: add rule dscp=23, src=a.a.a/24, dest=b.b.b.b/24
save volume
set report interval = 120 s
set report target = 193.175.12.8
Acct->MI: MP1: add rule dscp=23, src=a.a.a/24, dest=b.b.b.b/24
save volume
set report interval = 120 s
set report target = 193.175.12.8
SR +-------+
User ----------------->| AAA |
+-------+
|
| ASI
V
+-------+
+-----------------| ASM |--------------+--------------+
| Policy +-------+ Policy | BW Request |
| Parameters Parameters | |
| | |
-----|----------------------------------------|--------------|-----
| Service Equipment | |
V V V
+---------------+ .............. +-----------+ +-----------+
| Accounting |<-->: Local :<-->| QoS | | Bandwidth |
| | : Policies : | Auditing | | Broker |
+---------------+ :............: +-----------+ +-----------+
| |
| Meter Instructions | Measurement Setup
V V
+--------------------------------------------------+
| Measurement |
| Infrastructure |
+--------------------------------------------------+
SR +-------+
User ----------------->| AAA |
+-------+
|
| ASI
V
+-------+
+-----------------| ASM |--------------+--------------+
| Policy +-------+ Policy | BW Request |
| Parameters Parameters | |
| | |
-----|----------------------------------------|--------------|-----
| Service Equipment | |
V V V
+---------------+ .............. +-----------+ +-----------+
| Accounting |<-->: Local :<-->| QoS | | Bandwidth |
| | : Policies : | Auditing | | Broker |
+---------------+ :............: +-----------+ +-----------+
| |
| Meter Instructions | Measurement Setup
V V
+--------------------------------------------------+
| Measurement |
| Infrastructure |
+--------------------------------------------------+
Figure 14: Diffserv Service Provision Setup
图14：Diffserv服务提供设置
The QoS audit control instructs two meters (at MP1 and MP2) to set up a passive one-way-delay measurement.
QoS审计控制指示两个仪表（在MP1和MP2处）设置被动单向延迟测量。
QoS->MI: MP1: add rule dscp=23, src=a.a.a.a/24 dest=b.b.b.b/24,
save timestamp-48
MP2: add rule dscp=23, src=a.a.a.a/24, dest=b.b.b.b/24,
save timestamp-48
QoS->MI: MP1: add rule dscp=23, src=a.a.a.a/24 dest=b.b.b.b/24,
save timestamp-48
MP2: add rule dscp=23, src=a.a.a.a/24, dest=b.b.b.b/24,
save timestamp-48
This example explains how discrete accounting can be used to provide accounting indications for the user. Accounting indications are sent to the user in order to inform the user about current resource consumption. The accounting indication is a special accounting service that can be provided in addition to the standard accounting performed by the provider. Like for any other service, an authorization should take place before the accounting indication service provisioning. Therefore, the accounting here is seen as a separate service. That means the accounting service is independent of the main service and therefore can be applied to different services. It might be used as an addition to an integrated accounting that is part of the service. The authorization process for the accounting service is out of the scope of this document and therefore is not further explained here.
此示例说明如何使用离散记帐为用户提供记帐指示。会计指示被发送给用户，以便通知用户当前的资源消耗情况。会计指示是一种特殊的会计服务，可在供应商执行的标准会计之外提供。与任何其他服务一样，授权应该在记帐指示服务提供之前进行。因此，这里的会计被视为一项独立的服务。这意味着会计服务独立于主服务，因此可以应用于不同的服务。它可以用作作为服务一部分的集成记帐的一个附加项。会计服务的授权流程不在本文件范围内，因此在此不再作进一步解释。
Figure 15 illustrates the configuration message sequence for setting up the accounting service. First, the user sends an Accounting Service Request (ASR) to the AAA server which includes desired parameters for the provisioning of the accounting service (e.g. report interval).
图15说明了设置记帐服务的配置消息序列。首先，用户向AAA服务器发送记帐服务请求（ASR），其中包括用于提供记帐服务的所需参数（例如，报告间隔）。
user->AAA: user-x@nw-a, service= accounting indications,
report interval= 60 s
user->AAA: user-x@nw-a, service= accounting indications,
report interval= 60 s
The AAA server passes the ASI to the ASM of the accounting service after the user has been authenticated and authorized for the service usage.
AAA服务器将ASI传递给记帐服务的ASM，前提是用户已获得服务使用的身份验证和授权。
AAA->ASM: user-x@nw-a, service=accounting indications,
report interval= 60 s
AAA->ASM: user-x@nw-a, service=accounting indications,
report interval= 60 s
The ASM generates an accounting policy based on the ASI and passes this policy to the Accounting Configuration.
ASM基于ASI生成记帐策略，并将此策略传递给记帐配置。
ASM->Acct: If src=a.a.a.x {
acc-indication = on
report interval = 60s
report target= a.a.a.x
}
ASM->Acct: If src=a.a.a.x {
acc-indication = on
report interval = 60s
report target= a.a.a.x
}
ASR +-------+
User --------------->| AAA |
+-------+
|
| ASI
V
+-------+
| ASM |
+-------+
|
-------------------------|---------------------------
Service Equipment | Accounting Policy
V
+-----------------+ ..............
| Accounting |<---->: Local Acct :
| | : Policies :
+-----------------+ :............:
|
| Meter Instructions
V
+-----------------+
| Measurement |
| Infrastructure |
+-----------------+
ASR +-------+
User --------------->| AAA |
+-------+
|
| ASI
V
+-------+
| ASM |
+-------+
|
-------------------------|---------------------------
Service Equipment | Accounting Policy
V
+-----------------+ ..............
| Accounting |<---->: Local Acct :
| | : Policies :
+-----------------+ :............:
|
| Meter Instructions
V
+-----------------+
| Measurement |
| Infrastructure |
+-----------------+
Figure 15: Accounting Indication Configuration
图15：记帐指示配置
The Accounting Configuration generates meter instructions according to the accounting policies from the ASM and local accounting policies and passes them to the measurement infrastructure.
会计配置根据来自ASM和本地会计政策的会计政策生成仪表指令，并将其传递给计量基础设施。
local Acct-Policy: if acc-indication {
record type = compact
}
local Acct-Policy: if acc-indication {
record type = compact
}
Acct->MI: MP1: set report interval = 60 s
add report target = a.a.a.x
Acct->MI: MP1: set report interval = 60 s
add report target = a.a.a.x
Accounting services provide the basis for billing. Therefore, the incentives (mainly saving money) and potential for fraud is extremely high in the field of configuration of the accounting architecture and the collection of accounting data. In the presented framework, two types of data communications are required, the exchange of accounting policies and the collection of accounting records. Both communications introduce potential security hazards.
会计服务是计费的基础。因此，在会计体系结构的配置和会计数据的收集方面，诱因（主要是省钱）和欺诈的可能性极高。在所提出的框架中，需要两种类型的数据通信，即交换会计政策和收集会计记录。这两种通信都会带来潜在的安全隐患。
The following potential security hazards can be identified:
可以识别以下潜在的安全隐患：
- Forgery of accounting policies and accounting record information Both accounting policies and accounting records can be the target of forgery of information. Accounting policies contain configuration information. Modifying this information can lead to a mal-configured accounting and metering system which either allows data to traverse the accounting system undetected (without being accounted for, e.g. by changing the classification rules of a meter) or produces bogus accounting records. Accounting records contain data about resource consumption and provide the basis for billing. Modifying accounting records may lead to erroneous bills. Furthermore, it is important that policies or accounting records are not redirected or removed and that forged policies or records are not inserted.
- 会计政策和会计记录信息的伪造会计政策和会计记录都可能成为信息伪造的目标。记帐策略包含配置信息。修改此信息可能会导致错误配置的会计和计量系统，该系统允许数据在未被检测到的情况下通过会计系统（例如，通过更改仪表的分类规则而不进行会计处理），或者生成虚假的会计记录。会计记录包含有关资源消耗的数据，并为计费提供依据。修改会计记录可能会导致错误的账单。此外，不重定向或删除保单或会计记录以及不插入伪造保单或记录也很重要。
- Eavesdropping It may be required to keep accounting policies and accounting records confidential between the involved parties.
- 窃听可能要求相关方对会计政策和会计记录保密。
- Denial of Service (DoS) attacks Both the AAA server and the accounting/metering subsystem can be the target of denial of service attacks. A denial of service attack against the AAA server may lead to malfunction and even breakdown of the server. This means the server will not be able to provide proper authentication, authorization and accounting functionality. The service provided by the AAA server will become unavailable or unusable. An attack to the server can be worse than an attack to the service equipment itself, especially if multiple services use one AAA server. An attack against the accounting/metering system will cause loss of metering data and/or loss of accounting records.
- 拒绝服务（DoS）攻击AAA服务器和计费/计量子系统都可能成为拒绝服务攻击的目标。针对AAA服务器的拒绝服务攻击可能会导致服务器出现故障甚至崩溃。这意味着服务器将无法提供正确的身份验证、授权和记帐功能。AAA服务器提供的服务将变得不可用或不可用。对服务器的攻击可能比对服务设备本身的攻击更严重，尤其是在多个服务使用一个AAA服务器的情况下。对会计/计量系统的攻击将导致计量数据丢失和/或会计记录丢失。
This leads to the following security requirements:
这导致了以下安全要求：
- Secrecy of accounting policies and accounting data Unauthorized entities should not be able to read or modify accounting policies or accounting records. This can be achieved with standard encryption methods.
- 会计政策和会计数据的保密未经授权的实体不得阅读或修改会计政策或会计记录。这可以通过标准加密方法实现。
- Authentication of accounting data and accounting policy sources It should be ensured that the data is originated by the original source. Source-authentication can be achieved by using digital signatures.
- 会计数据和会计政策来源的认证应确保数据来源于原始来源。源身份验证可以通过使用数字签名来实现。
- Protection of the integrity of accounting policies and records It should be ensured that the data was not modified on the way from sender to receiver. Data-authentication can also be achieved with digital signatures.
- 保护会计政策和记录的完整性应确保数据在从发送方到接收方的过程中未被修改。数据认证也可以通过数字签名实现。
- Verify correctness of generated accounting data It must be ensured that the accounting data generated by the service provider is correct. A provider may generate incorrect accounting records either deliberately (i.e. forging) or unintentionally (e.g. faulty configuration). These incorrect accounting records probably have the consequence of incorrect bills. Customers can verify the correctness of the accounting data through their measurements and/or through data collected by a trusted third party. A trusted third party can be an independent accounting service provider as described in section 7.2 or a more general entity providing an auditing service.
- 验证生成的会计数据的正确性必须确保服务提供商生成的会计数据是正确的。提供商可能会故意（如伪造）或无意（如错误配置）生成错误的会计记录。这些不正确的会计记录可能是不正确的账单造成的。客户可以通过测量和/或通过可信第三方收集的数据来验证会计数据的正确性。受信任的第三方可以是第7.2节所述的独立会计服务提供商，也可以是提供审计服务的更一般的实体。
- Prevention and protection against Denial of Service attacks The AAA protocol and all building blocks should be designed and implemented in a way as resistant as possible to denial of service attacks. An additional strategy to defend against DoS attacks is to add a component to the meter system that is able to detect suspicious traffic patterns. Upon detection, further actions can be taken according to a pre-defined policy.
- 防止和防止拒绝服务攻击AAA协议和所有构建块的设计和实现应尽可能抵抗拒绝服务攻击。防御DoS攻击的另一个策略是在仪表系统中添加一个能够检测可疑流量模式的组件。一旦检测到，可以根据预定义的策略采取进一步的操作。
The prevention of these hazards has to be considered for the protocols used for accounting policy exchange and the transportation of accounting records. Since the security requirements for authentication, transmission level security, data object confidentiality and integrity are addressed in the criteria for AAA protocol evaluation [RFC2989], we assume that the future AAA protocol(s) will be suited for secure accounting record transfer and probably also for secure accounting policy transport. Furthermore, we assume that existing or upcoming solutions for secure transportation and enforcement of policies can be used. Real prevention of DoS attacks is quite difficult. A selective dropping of the attackers packets is impossible if the malicious packets cannot be separated from the valid customer traffic. Dropping of all packets of a certain type may prevent authorized customers from using the service and therefore help the attacker to achieve her goal.
对于会计政策交换和会计记录传输所使用的协议，必须考虑预防这些危害。由于认证、传输级安全、数据对象机密性和完整性的安全要求在AAA协议评估标准[RFC2989]中得到了解决，我们假设未来的AAA协议将适用于安全的会计记录传输，也可能适用于安全的会计政策传输。此外，我们假设可以使用现有或即将推出的安全运输和政策执行解决方案。真正防止拒绝服务攻击是相当困难的。如果恶意数据包无法与有效的客户流量分离，则攻击者数据包的选择性丢弃是不可能的。丢弃特定类型的所有数据包可能会阻止授权客户使用该服务，从而帮助攻击者实现其目标。
[I2-BB] Internet2-QBone Bandwidth Broker,
http://www.merit.edu/working.groups/i2-qbone-bb
[I2-BB] Internet2-QBone Bandwidth Broker,
http://www.merit.edu/working.groups/i2-qbone-bb
[NetFlow] NetFlow Services and Applications, White Paper, Cisco Systems, 1999
[NetFlow]NetFlow服务和应用，白皮书，思科系统，1999年
[RFC2002] Perkins, C., "IP Mobility Support", RFC 3220, October 1996.
[RFC2002]Perkins，C.，“IP移动支持”，RFC3220，1996年10月。
[RFC2123] Brownlee, N., "Traffic Flow Measurement: Experiences with NeTraMet", RFC 2123, March 1997.
[RFC2123]布朗利，N.，“交通流测量：网络框架的经验”，RFC2123，1997年3月。
[RFC2475] Blake, S., Black, D., Carlson, M., Davies, E., Wang Z. and W. Weiss, "An Architecture for Differentiated Services", RFC 2475, December 1998.
[RFC2475]Blake，S.，Black，D.，Carlson，M.，Davies，E.，Wang Z.和W.Weiss，“差异化服务的架构”，RFC 24751998年12月。
[RFC2566] DeBry, R., "Internet Printing Protocol/1.0: Model and Semantics", RFC 2911, April 1999.
[RFC2566]DeBry，R.，“互联网打印协议/1.0：模型和语义”，RFC 29111999年4月。
[RFC2722] Brownlee, N., Mills, C. and G. Ruth, "Traffic Flow Measurement: Architecture", RFC 2722, October 1999.
[RFC2722]北布朗利，米尔斯，C.和G.鲁斯，“交通流测量：体系结构”，RFC22721999年10月。
[RFC2903] de Laat, C., Gross, G., Gommans, L., Vollbrecht, J. and D. Spence, "Generic AAA Architecture", RFC 2903, August 2000.
[RFC2903]de Laat，C.，Gross，G.，Gommans，L.，Vollbrecht，J.和D.Spence，“通用AAA架构”，RFC 2903，2000年8月。
[RFC2904] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Framework", RFC 2904, August 2000.
[RFC2904]Vollbrecht，J.，Calhoun，P.，Farrell，S.，Gommans，L.，Gross，G.，de Bruijn，B.，de Laat，C.，Holdrege，M.和D.Spence，“AAA授权框架”，RFC 29042000年8月。
[RFC2905] Vollbrecht, J., Calhoun, P., Farrell, S., Gommans, L., Gross, G., de Bruijn, B., de Laat, C., Holdrege, M. and D. Spence, "AAA Authorization Application Examples", RFC 2905, August 2000.
[RFC2905]Vollbrecht，J.，Calhoun，P.，Farrell，S.，Gommans，L.，Gross，G.，de Bruijn，B.，de Laat，C.，Holdrege，M.和D.Spence，“AAA授权应用示例”，RFC 2905，2000年8月。
[RFC2924] Brownlee, N. and A. Blount, "Accounting Attributes and Record Formats", RFC 2924, September 2000.
[RFC2924]Brownlee，N.和A.Blount，“会计属性和记录格式”，RFC 29242000年9月。
[RFC2975] Aboba, B., Arkko, J. and D. Harrington, "Introduction to Accounting Management", RFC 2975, October 2000.
[RFC2975]Aboba，B.，Arkko，J.和D.Harrington，“会计管理导论”，RFC 29752000年10月。
[RFC2989] Aboba, B., Calhoun, P., Glass, S., Hiller, T., McCann, P., Shiino, H., Walsh, P., Zorn, G., Dommety, G., Perkins, C., Patil, B., Mitton, D., Manning, S., Beadles, M., Chen, X., Sivalingham, S., Hameed, A., Munson, M., Jacobs, S., Lim, B., Hirschman, B., Hsu, R., Koo, H., Lipford, M., Campbell, E., Xu, Y., Baba, S. and E. Jaques, "Criteria for Evaluating AAA Protocols for Network Access", RFC 2989, November 2000.
[RFC2989]Aboba，B.，Calhoun，P.，Glass，S.，Hiller，T.，McCann，P.，Shiino，H.，Walsh，P.，Zorn，G.，Dommety，G.，Perkins，C.，Patil，B.，Mitton，D.，Manning，S.，Beadles，M.，Chen，X.，Sivalingham，S.，Hameed，A.，Munson，M.，Jacobs，S.，Lim，B.，Hirschman，B.，Hsu，R.，Koo，H.，Lipford，M.，Campbell，E.，Xu，Y.，Baba，S.和E.Jaques，“评估网络接入AAA协议的标准”，RFC 2989，2000年11月。
[RFC3198] Westerinen, A., Schnizlein, J., Strassner, J., Scherling, M., Quinn, B., Herzog, S., Huynh, A., Carlson, M., Perry, J. and S. Waldbusser, "Terminology for Policy-Based Management", RFC 3198, November 2001.
[RFC3198]Westerinen，A.，Schnizlein，J.，Strassner，J.，Scherling，M.，Quinn，B.，Herzog，S.，Huynh，A.，Carlson，M.，Perry，J.和S.Waldbusser，“基于政策的管理术语”，RFC 3198，2001年11月。
The authors would like to thank the members of the AAAARCH research group and in particular, the chairs, John Vollbrecht and Cees de Laat, for the fruitful discussions and comments. Special thanks are to Bernard Aboba, Nevil Brownlee and Ed Ellesson for their review and valuable input to this document.
作者要感谢AAARCH研究小组的成员，特别是主席John Vollbrecht和Cees de Laat，他们进行了富有成效的讨论并发表了评论。特别感谢Bernard Aboba、Nevil Brownlee和Ed Ellsson对本文件的审查和宝贵意见。
Author's Addresses
作者地址
Tanja Zseby Fraunhofer Institute for Open Communication Systems Kaiserin-Augusta-Allee 31 10589 Berlin Germany Phone: +49-30-34 63 7153 Fax: +49-30-34 53 8153 EMail: zseby@fokus.fhg.de
Tanja Zseby Fraunhofer开放通信系统研究所Kaiserin Augusta Allee 31 10589柏林德国电话：+49-30-34 63 7153传真：+49-30-34 53 8153电子邮件：zseby@fokus.fhg.de
Sebastian Zander Fraunhofer Institute for Open Communication Systems Kaiserin-Augusta-Allee 31 10589 Berlin Germany Phone: +49-30-34 63 7287 Fax: +49-30-34 63 8287 EMail: zander@fokus.fhg.de
Sebastian Zander Fraunhofer开放通信系统研究所Kaiserin Augusta Allee 31 10589柏林德国电话：+49-30-34 63 7287传真：+49-30-34 63 8287电子邮件：zander@fokus.fhg.de
Georg Carle Fraunhofer Institute for Open Communication Systems Kaiserin-Augusta-Allee 31 10589 Berlin Germany Phone: +49-30-34 63 7149 Fax: +49-30-34 63 8149 EMail: carle@fokus.fhg.de
格奥尔格·卡尔·弗劳恩霍夫开放通信系统研究所Kaiserin Augusta Allee 31 10589德国柏林电话：+49-30-34 63 7149传真：+49-30-34 63 8149电子邮件：carle@fokus.fhg.de
Full Copyright Statement
完整版权声明
Copyright (C) The Internet Society (2002). All Rights Reserved.
版权所有（C）互联网协会（2002年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。