Network Working Group H. Tschofenig, Ed.
Request for Comments: 5580 Nokia Siemens Networks
Category: Standards Track F. Adrangi
Intel
M. Jones
A. Lior
Bridgewater
B. Aboba
Microsoft Corporation
August 2009
Network Working Group H. Tschofenig, Ed.
Request for Comments: 5580 Nokia Siemens Networks
Category: Standards Track F. Adrangi
Intel
M. Jones
A. Lior
Bridgewater
B. Aboba
Microsoft Corporation
August 2009
Carrying Location Objects in RADIUS and Diameter
以半径和直径承载定位对象
Abstract
摘要
This document describes procedures for conveying access-network ownership and location information based on civic and geospatial location formats in Remote Authentication Dial-In User Service (RADIUS) and Diameter.
本文档描述了在远程认证拨入用户服务（RADIUS）和Diameter中基于civic和地理空间位置格式传输接入网络所有权和位置信息的过程。
The distribution of location information is a privacy-sensitive task. Dealing with mechanisms to preserve the user's privacy is important and is addressed in this document.
位置信息的分发是一项隐私敏感任务。处理保护用户隐私的机制非常重要，本文档对此进行了阐述。
Status of This Memo
关于下段备忘
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2009 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document.
本文件受BCP 78和IETF信托在本文件出版之日生效的与IETF文件有关的法律规定的约束(http://trustee.ietf.org/license-info). 请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。
Table of Contents
目录
1. Introduction ....................................................3
2. Terminology .....................................................3
3. Delivery Methods for Location Information .......................3
3.1. Location Delivery Based on Out-of-Band Agreements ..........4
3.2. Location Delivery Based on Initial Request .................5
3.3. Location Delivery Based on Mid-Session Request .............6
3.4. Location Delivery in Accounting Messages ..................10
4. Attributes .....................................................11
4.1. Operator-Name Attribute ...................................12
4.2. Location-Information Attribute ............................14
4.3. Location-Data Attribute ...................................16
4.3.1. Civic Location Profile .............................17
4.3.2. Geospatial Location Profile ........................17
4.4. Basic-Location-Policy-Rules Attribute .....................18
4.5. Extended-Location-Policy-Rules Attribute ..................20
4.6. Location-Capable Attribute ................................21
4.7. Requested-Location-Info Attribute .........................23
5. Table of Attributes ............................................28
6. Diameter RADIUS Interoperability ...............................30
7. Security Considerations ........................................31
7.1. Communication Security ....................................31
7.2. Privacy Considerations ....................................32
7.2.1. RADIUS Client ......................................33
7.2.2. RADIUS Server ......................................34
7.2.3. RADIUS Proxy .......................................34
7.3. Identity Information and Location Information .............34
8. IANA Considerations ............................................36
8.1. New Registry: Operator Namespace Identifier ...............36
8.2. New Registry: Location Profiles ...........................37
8.3. New Registry: Location-Capable Attribute ..................38
8.4. New Registry: Entity Types ................................39
8.5. New Registry: Privacy Flags ...............................39
8.6. New Registry: Requested-Location-Info Attribute ...........39
9. Acknowledgments ................................................40
10. References ....................................................42
10.1. Normative References .....................................42
10.2. Informative References ...................................42
Appendix A. Matching with GEOPRIV Requirements ...................45
A.1. Distribution of Location Information at the User's
Home Network ..............................................45
A.2. Distribution of Location Information at the Visited
Network ...................................................46
A.3. Requirements Matching .....................................47
1. Introduction ....................................................3
2. Terminology .....................................................3
3. Delivery Methods for Location Information .......................3
3.1. Location Delivery Based on Out-of-Band Agreements ..........4
3.2. Location Delivery Based on Initial Request .................5
3.3. Location Delivery Based on Mid-Session Request .............6
3.4. Location Delivery in Accounting Messages ..................10
4. Attributes .....................................................11
4.1. Operator-Name Attribute ...................................12
4.2. Location-Information Attribute ............................14
4.3. Location-Data Attribute ...................................16
4.3.1. Civic Location Profile .............................17
4.3.2. Geospatial Location Profile ........................17
4.4. Basic-Location-Policy-Rules Attribute .....................18
4.5. Extended-Location-Policy-Rules Attribute ..................20
4.6. Location-Capable Attribute ................................21
4.7. Requested-Location-Info Attribute .........................23
5. Table of Attributes ............................................28
6. Diameter RADIUS Interoperability ...............................30
7. Security Considerations ........................................31
7.1. Communication Security ....................................31
7.2. Privacy Considerations ....................................32
7.2.1. RADIUS Client ......................................33
7.2.2. RADIUS Server ......................................34
7.2.3. RADIUS Proxy .......................................34
7.3. Identity Information and Location Information .............34
8. IANA Considerations ............................................36
8.1. New Registry: Operator Namespace Identifier ...............36
8.2. New Registry: Location Profiles ...........................37
8.3. New Registry: Location-Capable Attribute ..................38
8.4. New Registry: Entity Types ................................39
8.5. New Registry: Privacy Flags ...............................39
8.6. New Registry: Requested-Location-Info Attribute ...........39
9. Acknowledgments ................................................40
10. References ....................................................42
10.1. Normative References .....................................42
10.2. Informative References ...................................42
Appendix A. Matching with GEOPRIV Requirements ...................45
A.1. Distribution of Location Information at the User's
Home Network ..............................................45
A.2. Distribution of Location Information at the Visited
Network ...................................................46
A.3. Requirements Matching .....................................47
This document defines attributes within RADIUS and Diameter that can be used to convey location-related information within authentication and accounting exchanges.
本文档定义了半径和直径范围内的属性，可用于在身份验证和会计交换中传递位置相关信息。
Location information may be useful in a number of scenarios. Wireless networks (including wireless LAN) are being deployed in public places such as airports, hotels, shopping malls, and coffee shops by a diverse set of operators such as cellular network operators, Wireless Internet Service Providers (WISPs), and fixed broadband operators. In these situations, the home network may need to know the location of the user in order to enable location-aware billing, location-aware authorization, or other location-aware services. Location information can also prove useful in other situations (such as wired networks) where operator-network ownership and location information may be needed by the home network.
位置信息在许多情况下都很有用。无线网络（包括无线局域网）正在机场、酒店、购物中心和咖啡馆等公共场所部署，由蜂窝网络运营商、无线互联网服务提供商（WISP）和固定宽带运营商等多种运营商负责。在这些情况下，家庭网络可能需要知道用户的位置，以便启用位置感知计费、位置感知授权或其他位置感知服务。在家庭网络可能需要运营商网络所有权和位置信息的其他情况下（例如有线网络），位置信息也可以证明是有用的。
In order to preserve user privacy, location information needs to be protected against unauthorized access and distribution. Requirements for access to location information are defined in [RFC3693]. The model includes a Location Generator (LG) that creates location information, a Location Server (LS) that authorizes access to location information, a Location Recipient (LR) that requests and receives information, and a Rule Maker (RM) that provides authorization policies to the LS, which enforces access-control policies on requests to location information. In Appendix A, the requirements for a GEOPRIV using protocol [RFC3693] are compared to the functionality provided by this document.
为了保护用户隐私，需要保护位置信息，防止未经授权的访问和分发。[RFC3693]中定义了访问位置信息的要求。该模型包括创建位置信息的位置生成器（LG）、授权访问位置信息的位置服务器（LS）、请求和接收信息的位置接收者（LR）以及向LS提供授权策略的规则制定者（RM），它对位置信息请求强制执行访问控制策略。在附录A中，使用协议[RFC3693]的GEOPRIV要求与本文件提供的功能进行了比较。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
RADIUS-specific terminology is borrowed from [RFC2865] and [RFC2866].
RADIUS专用术语借用自[RFC2865]和[RFC2866]。
Terminology related to privacy issues, location information, and authorization policy rules is taken from [RFC3693].
与隐私问题、位置信息和授权策略规则相关的术语摘自[RFC3693]。
The following exchanges show how location information is conveyed in RADIUS. In describing the usage scenarios, we assume that privacy policies allow location to be conveyed in RADIUS; however, as noted in Section 6, similar exchanges can also take place within Diameter. Privacy issues are discussed in Section 7.2.
以下交换显示了位置信息在RADIUS中的传输方式。在描述使用场景时，我们假设隐私策略允许在RADIUS中传输位置；然而，如第6节所述，类似的交换也可以在直径范围内进行。第7.2节讨论了隐私问题。
Figure 1 shows an example message flow for delivering location information during the network-access authentication and authorization procedure. Upon a network-authentication request from an access-network client, the Network Access Server (NAS) submits a RADIUS Access-Request message that contains Location-Information Attributes among other required attributes. In this scenario, location information is attached to the Access-Request message without an explicit request from the RADIUS server. Note that such an approach with a prior agreement between the RADIUS client and the RADIUS server is only applicable in certain environments, such as in situations where the RADIUS client and server are within the same administrative domain. The Basic-Location-Policy-Rules Attribute is populated based on the defaults described in Section 4.4, unless it has been explicitly configured otherwise.
图1显示了在网络访问身份验证和授权过程中传递位置信息的示例消息流。根据访问网络客户端的网络身份验证请求，网络访问服务器（NAS）提交RADIUS访问请求消息，其中包含位置信息属性和其他必需属性。在此场景中，位置信息附加到访问请求消息，而无需来自RADIUS服务器的明确请求。请注意，这种事先在RADIUS客户端和RADIUS服务器之间达成协议的方法仅适用于某些环境，例如RADIUS客户端和服务器位于同一管理域内的情况。基本位置策略规则属性是基于第4.4节中描述的默认值填充的，除非已明确配置为其他属性。
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
| Authentication phase | |
| begin | |
|---------------------->| |
| | |
| | Access-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules|
| | + Operator-Name |
| |----------------------------->|
| | |
| | Access-Accept |
| |<-----------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
| Authentication phase | |
| begin | |
|---------------------->| |
| | |
| | Access-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules|
| | + Operator-Name |
| |----------------------------->|
| | |
| | Access-Accept |
| |<-----------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
Figure 1: Location Delivery Based on Out-of-Band Agreements
图1：基于带外协议的位置交付
If the RADIUS client provides a Location-Capable Attribute in the Access-Request, then the RADIUS server MAY request location information from the RADIUS client if it requires that information for authorization and if location information was not provided in the Access-Request. This exchange is shown in Figure 2. The inclusion of the Location-Capable Attribute in an Access-Request message indicates that the NAS is capable of providing location data in response to an Access-Challenge. The subsequent Access-Challenge message sent from the RADIUS server to the NAS provides a hint regarding the type of desired Location-Information Attributes. The NAS treats the Basic-Location-Policy-Rules and Extended-Location-Policy-Rules Attributes as opaque data (e.g., it echoes these rules provided by the server within the Access-Challenge back in the Access-Request). In the shown message flow, the location attributes are then provided in the subsequent Access-Request message. When evaluating this Access-Request message, the authorization procedure at the RADIUS server might be based on a number of criteria, including the newly defined attributes listed in Section 4.
如果RADIUS客户端在访问请求中提供了支持位置的属性，则RADIUS服务器可以从RADIUS客户端请求位置信息，前提是它需要该信息进行授权，并且访问请求中未提供位置信息。此交换如图2所示。在访问请求消息中包含可定位属性表示NAS能够提供位置数据以响应访问质询。从RADIUS服务器发送到NAS的后续访问质询消息提供了有关所需位置信息属性类型的提示。NAS将基本位置策略规则和扩展位置策略规则属性视为不透明数据（例如，它在访问请求中回显服务器在访问质询中提供的这些规则）。在所示的消息流中，位置属性随后在随后的访问请求消息中提供。评估此访问请求消息时，RADIUS服务器上的授权过程可能基于许多标准，包括第4节中列出的新定义属性。
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
| Authentication phase | |
| begin | |
|---------------------->| |
| | |
| | Access-Request |
| | + Location-Capable |
| |--------------------------------->|
| | |
| | Access-Challenge |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| | + Requested-Location-Info |
| |<---------------------------------|
| | |
| | Access-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |--------------------------------->|
| | |
: : :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... :
: : :
| | |
| | Access-Accept |
| |<---------------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
| Authentication phase | |
| begin | |
|---------------------->| |
| | |
| | Access-Request |
| | + Location-Capable |
| |--------------------------------->|
| | |
| | Access-Challenge |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| | + Requested-Location-Info |
| |<---------------------------------|
| | |
| | Access-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |--------------------------------->|
| | |
: : :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... :
: : :
| | |
| | Access-Accept |
| |<---------------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
Figure 2: Location Delivery Based on Initial Request
图2：基于初始请求的位置交付
The on-demand, mid-session location-delivery method utilizes the Change-of-Authorization Request (CoA-Request) message and the CoA-NAK (CoA-Negative Acknowledgement), defined in [RFC5176]. At any time
按需、中间会话位置交付方法利用[RFC5176]中定义的授权请求变更（CoA请求）消息和CoA NAK（CoA否定确认）。随时
during the session, the Dynamic Authorization Client MAY send a CoA-Request containing session-identification attributes to the NAS (i.e., Dynamic Authorization Server).
在会话期间，动态授权客户端可以向NAS（即，动态授权服务器）发送包含会话标识属性的CoA请求。
In order to enable the on-demand, mid-session location-delivery method, the RADIUS server MUST return an instance of the Requested-Location-Info Attribute with the 'FUTURE_REQUESTS' flag set and instances of the Basic-Location-Policy-Rules and Extended-Location-Policy-Rules Attributes in the Access-Accept message for the session. Upon receipt of a CoA-Request message containing a Service-Type Attribute with value "Authorize Only" for the same session, the NAS MUST include location information and echo the previously received Basic-Location-Policy-Rules and Extended-Location-Policy-Rules Attributes in the subsequent Access-Request message.
为了启用按需、中间会话位置传递方法，RADIUS服务器必须在会话的Access Accept消息中返回设置了“FUTURE_REQUESTS”标志的请求位置信息属性的实例，以及基本位置策略规则和扩展位置策略规则属性的实例。在收到包含同一会话值为“仅授权”的服务类型属性的CoA请求消息后，NAS必须包括位置信息，并在后续访问请求消息中回显先前接收到的基本位置策略规则和扩展位置策略规则属性。
Upon receiving the Access-Request message containing the Service-Type Attribute with a value of Authorize-Only from the NAS, the RADIUS server responds with either an Access-Accept or an Access-Reject message.
当从NAS接收到包含值为Authorize Only的Service Type属性的访问请求消息时，RADIUS服务器会以访问接受或访问拒绝消息进行响应。
The use of dynamic authorization [RFC5176] is necessary when location information is needed on-demand and cannot be obtained from accounting information in a timely fashion.
当需要按需提供位置信息且无法及时从会计信息中获取位置信息时，需要使用动态授权[RFC5176]。
Figure 3 shows the above-described approach graphically.
图3以图形方式显示了上述方法。
+---------------+ +---------------+ +------+
| Dynamic | | Dynamic | |RADIUS|
| Authorization | | Authorization | |Server|
| Server/NAS | | Client | | |
+---------------+ +---------------+ +------+
| | |
| Access-Request | |
| + Location-Capable | |
|----------------------------------------------------------->|
| | |
| Access-Challenge | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
| + Requested-Location-Info | |
|<-----------------------------------------------------------|
| | |
| Access-Request | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
+---------------+ +---------------+ +------+
| Dynamic | | Dynamic | |RADIUS|
| Authorization | | Authorization | |Server|
| Server/NAS | | Client | | |
+---------------+ +---------------+ +------+
| | |
| Access-Request | |
| + Location-Capable | |
|----------------------------------------------------------->|
| | |
| Access-Challenge | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
| + Requested-Location-Info | |
|<-----------------------------------------------------------|
| | |
| Access-Request | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
| | |
| | |
: | :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... | :
: | :
| | |
| | |
| Access-Accept | |
| + Requested-Location-Info | |
(FUTURE_REQUESTS,...) | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<-----------------------------------------------------------|
| | |
: : :
: <<Some time later>> : :
: : :
| | |
| CoA + Service-Type "Authorize Only" + State | |
|<--------------------------------------------| |
| | |
| CoA NAK + Service-Type "Authorize Only" | |
| + State | |
| + Error-Cause "Request Initiated" | |
|-------------------------------------------->| |
| | |
| Access-Request | |
| + Service-Type "Authorize Only" | |
| + State | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
| Access-Accept | |
|<-----------------------------------------------------------|
| | |
| | |
| | |
: | :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... | :
: | :
| | |
| | |
| Access-Accept | |
| + Requested-Location-Info | |
(FUTURE_REQUESTS,...) | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<-----------------------------------------------------------|
| | |
: : :
: <<Some time later>> : :
: : :
| | |
| CoA + Service-Type "Authorize Only" + State | |
|<--------------------------------------------| |
| | |
| CoA NAK + Service-Type "Authorize Only" | |
| + State | |
| + Error-Cause "Request Initiated" | |
|-------------------------------------------->| |
| | |
| Access-Request | |
| + Service-Type "Authorize Only" | |
| + State | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
| Access-Accept | |
|<-----------------------------------------------------------|
| | |
Figure 3: Location Delivery Based on CoA with Service-Type 'Authorize Only'
图3：基于CoA的地点交付，服务类型为“仅授权”
When the Dynamic Authorization Client wants to change the values of the requested location information, or set the values of the requested location information for the first time, it may do so without triggering a reauthorization. Assuming that the NAS had previously sent an Access-Request containing a Location-Capable
当动态授权客户端想要更改请求的位置信息的值，或者第一次设置请求的位置信息的值时，它可以在不触发重新授权的情况下这样做。假设NAS先前发送了一个访问请求，其中包含一个支持位置的
Attribute, the Dynamic Authorization Client (DAC) can send a CoA-Request to the NAS without a Service-Type Attribute, but include the NAS identifiers and session identifiers as per [RFC5176] and the Requested-Location-Info, Basic-Location-Policy-Rules, and Extended-Location-Policy-Rules Attributes. The Requested-Location-Info, Basic-Location-Policy-Rules, and Extended-Location-Policy-Rules Attributes MUST NOT be used for session identification.
属性，动态授权客户端（DAC）可以向NAS发送CoA请求，而无需服务类型属性，但包括符合[RFC5176]的NAS标识符和会话标识符以及请求的位置信息、基本位置策略规则和扩展位置策略规则属性。请求的位置信息、基本位置策略规则和扩展位置策略规则属性不得用于会话标识。
Figure 4 shows this approach graphically.
图4以图形方式显示了这种方法。
+---------------+ +---------------+ +------+
| Dynamic | | Dynamic | |RADIUS|
| Authorization | | Authorization | |Server|
| Server/NAS | | Client | | |
+---------------+ +---------------+ +------+
| | |
| | |
| Access-Request | |
| + Location-Capable | |
|----------------------------------------------------------->|
| | |
| Access-Challenge | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
| + Requested-Location-Info | |
|<-----------------------------------------------------------|
| | |
| Access-Request | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
| | |
| | |
: | :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... | :
: | :
| | |
| | |
| Access-Accept | |
| + Requested-Location-Info | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<-----------------------------------------------------------|
+---------------+ +---------------+ +------+
| Dynamic | | Dynamic | |RADIUS|
| Authorization | | Authorization | |Server|
| Server/NAS | | Client | | |
+---------------+ +---------------+ +------+
| | |
| | |
| Access-Request | |
| + Location-Capable | |
|----------------------------------------------------------->|
| | |
| Access-Challenge | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
| + Requested-Location-Info | |
|<-----------------------------------------------------------|
| | |
| Access-Request | |
| + Location-Information | |
| + Location-Data | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|----------------------------------------------------------->|
| | |
| | |
: | :
: Multiple Protocol Exchanges to perform :
: Authentication, Key Exchange, and Authorization :
: ...continued... | :
: | :
| | |
| | |
| Access-Accept | |
| + Requested-Location-Info | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<-----------------------------------------------------------|
| | |
: : :
: <<Some time later>> : :
: : :
| | |
| CoA | |
| + Requested-Location-Info | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<--------------------------------------------| |
| | |
| CoA ACK | |
|-------------------------------------------->| |
| | |
: : :
: <<Further exchanges later>> : :
: : :
| | |
: : :
: <<Some time later>> : :
: : :
| | |
| CoA | |
| + Requested-Location-Info | |
| + Basic-Location-Policy-Rules | |
| + Extended-Location-Policy-Rules | |
|<--------------------------------------------| |
| | |
| CoA ACK | |
|-------------------------------------------->| |
| | |
: : :
: <<Further exchanges later>> : :
: : :
Figure 4: Location Delivery Based on CoA
图4：基于CoA的位置交付
Location information may also be reported in accounting messages. Accounting messages are generated when the session starts, when the session stops, and periodically during the lifetime of the session. Accounting messages may also be generated when the user roams during handoff.
位置信息也可以在记帐消息中报告。记帐消息在会话启动时、会话停止时以及会话生存期内定期生成。当用户在切换期间漫游时，也可以生成记帐消息。
Accounting information may be needed by the billing system to calculate the user's bill. For example, there may be different tariffs or tax rates applied based on the location.
计费系统可能需要会计信息来计算用户账单。例如，可能会根据地点采用不同的关税或税率。
If the RADIUS server needs to obtain location information in accounting messages, then it needs to include a Requested-Location-Info Attribute with the Access-Accept message. The Basic-Location-Policy-Rules and the Extended-Location-Policy-Rules Attributes are to be echoed in the Accounting-Request if indicated in the Access-Accept.
如果RADIUS服务器需要在记帐消息中获取位置信息，则需要在Access Accept消息中包含请求的位置信息属性。基本位置策略规则和扩展位置策略规则属性将在记帐请求中回显（如果在Access Accept中指示）。
Figure 5 shows the message exchange.
图5显示了消息交换。
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
: : :
: Initial Protocol Interaction :
: (details omitted) :
: : :
| | |
| | Access-Accept |
| | + Requested-Location-Info |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |<---------------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
| | Accounting-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |--------------------------------->|
| | |
| | Accounting-Response |
| |<---------------------------------|
| | |
+---------+ +---------+ +---------+
| | | Network | | RADIUS |
| User | | Access | | Server |
| | | Server | | |
+---------+ +---------+ +---------+
| | |
: : :
: Initial Protocol Interaction :
: (details omitted) :
: : :
| | |
| | Access-Accept |
| | + Requested-Location-Info |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |<---------------------------------|
| Authentication | |
| Success | |
|<----------------------| |
| | |
| | Accounting-Request |
| | + Location-Information |
| | + Location-Data |
| | + Basic-Location-Policy-Rules |
| | + Extended-Location-Policy-Rules|
| |--------------------------------->|
| | |
| | Accounting-Response |
| |<---------------------------------|
| | |
Figure 5: Location Delivery in Accounting Messages
图5：记帐消息中的位置传递
It is important to note that the location-specific parts of the attributes defined below are not meant to be processed by the RADIUS server. Instead, a location-server-specific component used in combination with the RADIUS server is responsible for receiving, processing, and further distributing location information (in combination with proper access control and privacy protection). As such, from a RADIUS server point of view, location information is treated as opaque data.
需要注意的是，以下定义的属性的特定于位置的部分并不打算由RADIUS服务器处理。相反，与RADIUS服务器结合使用的特定于位置服务器的组件负责接收、处理和进一步分发位置信息（结合适当的访问控制和隐私保护）。因此，从RADIUS服务器的角度来看，位置信息被视为不透明数据。
This attribute carries the operator namespace identifier and the operator name. The operator name is combined with the namespace identifier to uniquely identify the owner of an access network. The value of the Operator-Name is a non-NULL terminated text whose length MUST NOT exceed 253 bytes.
此属性携带运算符名称空间标识符和运算符名称。操作员名称与名称空间标识符相结合，以唯一标识访问网络的所有者。运算符名称的值是以非空结尾的文本，其长度不得超过253字节。
The Operator-Name Attribute SHOULD be sent in Access-Request and Accounting-Request messages where the Acc-Status-Type is set to Start, Interim, or Stop.
操作员名称属性应在Acc状态类型设置为开始、临时或停止的访问请求和记帐请求消息中发送。
A summary of the Operator-Name Attribute is shown below.
操作员名称属性的摘要如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Text ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Text (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Text ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Text (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
126 - Operator-Name
126-操作员姓名
Length:
长度：
>= 4
>= 4
Text:
正文：
The format is shown below. The data type of this field is a text. All fields are transmitted from left to right:
格式如下所示。此字段的数据类型为文本。所有字段从左向右传输：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace ID | Operator-Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Operator-Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace ID | Operator-Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Operator-Name ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Namespace ID:
命名空间ID:
The value within this field contains the operator namespace identifier. The Namespace ID value is encoded in ASCII.
此字段中的值包含运算符命名空间标识符。名称空间ID值以ASCII编码。
Example: '1' (0x31) for REALM
示例：“1”（0x31）表示领域
Operator-Name:
操作员姓名：
The text field of variable length contains an Access Network Operator Name. This field is a RADIUS-based data type of Text.
可变长度的文本字段包含接入网络运营商名称。此字段是基于半径的文本数据类型。
The Namespace ID field provides information about the operator namespace. This document defines four values for this attribute, which are listed below. Additional namespace identifiers must be registered with IANA (see Section 8.1) and must be associated with an organization responsible for managing the namespace.
Namespace ID字段提供有关运算符命名空间的信息。本文档为此属性定义了四个值，如下所示。其他名称空间标识符必须向IANA注册（见第8.1节），并且必须与负责管理名称空间的组织相关联。
TADIG ('0' (0x30)):
TADIG（'0'（0x30））：
This namespace can be used to indicate operator names based on Transferred Account Data Interchange Group (TADIG) codes, as defined in [GSM]. TADIG codes are assigned by the TADIG Working Group within the Global System for Mobile Communications (GSM) Association. The TADIG code consists of two fields, with a total length of five ASCII characters consisting of a three-character country code and a two-character alphanumeric operator (or company) ID.
此名称空间可用于根据[GSM]中定义的转账账户数据交换组（TADIG）代码指示运营商名称。TADIG代码由全球移动通信系统（GSM）协会内的TADIG工作组分配。TADIG代码由两个字段组成，总长度为五个ASCII字符，由三个字符的国家代码和两个字符的字母数字运算符（或公司）ID组成。
REALM ('1' (0x31)):
领域（'1'（0x31））：
The REALM operator namespace can be used to indicate operator names based on any registered domain name. Such names are required to be unique, and the rights to use a given realm name are obtained coincident with acquiring the rights to use a particular Fully Qualified Domain Name (FQDN). Since this operator is limited to ASCII, any registered domain name that contains non-ASCII characters must be converted to ASCII. The Punycode encoding [RFC3492] is used for this purpose.
域运算符命名空间可用于基于任何注册域名指示运算符名称。这些名称必须是唯一的，使用给定域名的权限与获取使用特定完全限定域名（FQDN）的权限同时获得。由于此运算符仅限于ASCII，因此任何包含非ASCII字符的注册域名都必须转换为ASCII。Punycode编码[RFC3492]用于此目的。
E212 ('2' (0x32)):
E212（'2'（0x32））：
The E212 namespace can be used to indicate operator names based on the Mobile Country Code (MCC) and Mobile Network Code (MNC) defined in [ITU212]. The MCC/MNC values are assigned by the Telecommunications Standardization Bureau (TSB) within the ITU-T
E212名称空间可用于根据[ITU212]中定义的移动国家代码（MCC）和移动网络代码（MNC）指示运营商名称。MCC/MNC值由ITU-T内的电信标准化局（TSB）分配
and by designated administrators in different countries. The E212 value consists of three ASCII digits containing the MCC, followed by two or three ASCII digits containing the MNC.
并由不同国家的指定管理人员执行。E212值由三个包含MCC的ASCII数字组成，然后是两个或三个包含MNC的ASCII数字。
ICC ('3' (0x33)):
ICC（'3'（0x33））：
The ICC namespace can be used to indicate operator names based on International Telecommunication Union (ITU) Carrier Codes (ICC) defined in [ITU1400]. ICC values are assigned by national regulatory authorities and are coordinated by the Telecommunication Standardization Bureau (TSB) within the ITU Telecommunication Standardization Sector (ITU-T). When using the ICC namespace, the attribute consists of three uppercase ASCII characters containing a three-letter alphabetic country code, as defined in [ISO], followed by one to six uppercase alphanumeric ASCII characters containing the ICC itself.
ICC名称空间可用于根据[ITU1400]中定义的国际电信联盟（ITU）载波代码（ICC）指示运营商名称。ICC值由国家监管机构分配，并由ITU电信标准化部门（ITU-T）内的电信标准化局（TSB）协调。使用ICC名称空间时，该属性由三个大写ASCII字符组成，其中包含[ISO]中定义的三个字母的国家代码，然后是一到六个大写字母数字ASCII字符，其中包含ICC本身。
The Location-Information Attribute MAY be sent in the Access-Request message, the Accounting-Request message, both of these messages, or no message. For the Accounting-Request message, the Acc-Status-Type may be set to Start, Interim, or Stop.
位置信息属性可以在访问请求消息、记帐请求消息、这两个消息或无消息中发送。对于记帐请求消息，Acc状态类型可设置为开始、临时或停止。
The Location-Information Attribute provides meta-data about the location information, such as sighting time, time-to-live, location-determination method, etc.
“位置信息”属性提供有关位置信息的元数据，如观察时间、生存时间、位置确定方法等。
The format is shown below.
格式如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
127 - Location-Information
127-位置信息
Length:
长度：
>= 23
>= 23
String:
字符串：
The format is shown below. The data type of this field is a string. All fields are transmitted from left to right:
格式如下所示。此字段的数据类型为字符串。所有字段从左向右传输：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Index | Code | Entity |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sighting Time ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sighting Time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time-to-Live ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time-to-Live |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Method ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Index | Code | Entity |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sighting Time ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sighting Time |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time-to-Live ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time-to-Live |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Method ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Index (16 bits):
索引（16位）：
The 16-bit unsigned integer value allows this attribute to provide information relating to the information included in the Location-Data Attribute to which it refers (via the Index).
16位无符号整数值允许此属性（通过索引）提供与其所引用的位置数据属性中包含的信息相关的信息。
Code (8 bits):
代码（8位）：
This field indicates the content of the location profile carried in the Location-Data Attribute. Two profiles are defined in this document -- namely, a civic location profile (see Section 4.3.1) that uses value (0) and a geospatial location profile (see Section 4.3.2) that uses the value (1).
此字段表示位置数据属性中包含的位置配置文件的内容。本文件中定义了两个纵断面——即使用值（0）的城市位置纵断面（见第4.3.1节）和使用值（1）的地理空间位置纵断面（见第4.3.2节）。
Entity (8 bits):
实体（8位）：
This field encodes which location this attribute refers to as an unsigned 8-bit integer value. Location information can refer to different entities. This document registers two entity values, namely:
此字段将此属性引用的位置编码为无符号8位整数值。位置信息可以引用不同的实体。本文档注册了两个实体值，即：
Value (0) describes the location of the user's client device.
值（0）描述用户客户端设备的位置。
Value (1) describes the location of the RADIUS client.
值（1）描述RADIUS客户端的位置。
The registry used for these values is established by this document, see Section 8.4.
本文件建立了用于这些值的注册表，见第8.4节。
Sighting Time (64 bits)
观察时间（64位）
This field indicates when the location information was accurate. The data type of this field is a string, and the content is expressed in the 64-bit Network Time Protocol (NTP) timestamp format [RFC1305].
此字段指示位置信息的准确时间。此字段的数据类型为字符串，内容以64位网络时间协议（NTP）时间戳格式[RFC1305]表示。
Time-to-Live (64 bits):
生存时间（64位）：
This field gives a hint regarding for how long location information should be considered current. The data type of this field is a string and the content is expressed in the 64-bit Network Time Protocol (NTP) timestamp format [RFC1305]. Note that the Time-to-Live field is different than the Retention Expires field used in the Basic-Location-Policy-Rules Attribute, see Section 4.4. The Retention Expires field indicates the time the recipient is no longer permitted to possess the location information.
此字段提示应将位置信息视为当前信息的时间长度。此字段的数据类型为字符串，内容以64位网络时间协议（NTP）时间戳格式[RFC1305]表示。请注意，“生存时间”字段与“基本位置策略规则”属性中使用的“保留期限”字段不同，请参见第4.4节。Retention Expires字段表示不再允许收件人拥有位置信息的时间。
Method (variable):
方法（变量）：
Describes the way that the location information was determined. This field MUST contain the value of exactly one IANA-registered 'method' token [RFC4119].
描述确定位置信息的方式。此字段必须包含一个IANA注册的“方法”令牌[RFC4119]的值。
The length of the Location-Information Attribute MUST NOT exceed 253 octets.
位置信息属性的长度不得超过253个八位字节。
The Location-Data Attribute MAY be sent in Access-Request and Accounting-Request messages. For the Accounting-Request message, the Acc-Status-Type may be set to Start, Interim, or Stop.
位置数据属性可以在访问请求和记帐请求消息中发送。对于记帐请求消息，Acc状态类型可设置为开始、临时或停止。
The format is shown below.
格式如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
128 - Location-Data
128-位置数据
Length:
长度：
>= 5
>= 5
String:
字符串：
The format is shown below. The data type of this field is a string. All fields are transmitted from left to right:
格式如下所示。此字段的数据类型为字符串。所有字段从左向右传输：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Index | Location ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Location ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Index | Location ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Location ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Index (16 bits):
索引（16位）：
The 16-bit unsigned integer value allows this attribute to associate the Location-Data Attribute with the Location-Information Attributes.
16位无符号整数值允许此属性将位置数据属性与位置信息属性相关联。
Location (variable):
位置（变量）：
The format of the location data depends on the location profile. This document defines two location profiles. Details of the location profiles are described below.
位置数据的格式取决于位置配置文件。本文档定义了两个位置配置文件。位置配置文件的详细信息如下所述。
Civic location is a popular way to describe the location of an entity. This section defines the civic location-information profile corresponding to the value (0) indicated in the Code field of the Location-Information Attribute. The location format is based on the encoding format defined in Section 3.1 of [RFC4776], whereby the first 3 octets are not put into the Location field of the above-described RADIUS Location-Data Attribute (i.e., the code for the DHCP option, the length of the DHCP option, and the 'what' element are not included).
城市位置是描述实体位置的常用方式。本节定义了与“位置信息”属性的“代码”字段中指示的值（0）相对应的城市位置信息配置文件。位置格式基于[RFC4776]第3.1节中定义的编码格式，其中前3个八位字节不放入上述RADIUS位置数据属性的位置字段（即，不包括DHCP选项的代码、DHCP选项的长度和“what”元素）。
This section defines the geospatial location-information profile corresponding to the value (1) indicated in the Code field of the Location-Information Attribute. Geospatial location information is encoded as an opaque object, and the format is based on the Location
本节定义与“位置信息”属性的“代码”字段中指示的值（1）相对应的地理空间位置信息纵断面。地理空间位置信息编码为不透明对象，其格式基于位置
Configuration Information (LCI) format defined in Section 2 of [RFC3825] but starts with the third octet (i.e., the code for the DHCP option and the length field is not included).
[RFC3825]第2节中定义的配置信息（LCI）格式，但以第三个八位字节开始（即，不包括DHCP选项和长度字段的代码）。
The Basic-Location-Policy-Rules Attribute MAY be sent in Access-Request, Access-Accept, Access-Challenge, Change-of-Authorization, and Accounting-Request messages.
基本位置策略规则属性可以在访问请求、访问接受、访问质询、授权更改和记帐请求消息中发送。
Policy rules control the distribution of location information. In order to understand and process the Basic-Location-Policy-Rules Attribute, RADIUS clients are obligated to utilize a default value of Basic-Location-Policy-Rules, unless explicitly configured otherwise, and to echo the Basic-Location-Policy-Rules Attribute that they receive from a server. As a default, the Note Well field does not carry a pointer to human-readable privacy policies, the retransmission-allowed is set to zero (0), i.e., further distribution is not allowed, and the Retention Expires field is set to 24 hours.
策略规则控制位置信息的分布。为了理解和处理“基本位置策略规则”属性，RADIUS客户端必须使用“基本位置策略规则”的默认值，除非另有明确配置，并回显从服务器接收的“基本位置策略规则”属性。默认情况下，Note Well字段不包含指向人类可读隐私策略的指针，allowed retransmission设置为零（0），即不允许进一步分发，Retention Expires字段设置为24小时。
With regard to authorization policies, this document reuses work done in [RFC4119] and encodes those policies in a non-XML format. Two fields ('Sighting Time' and 'Time-to-Live') are additionally included in the Location-Information Attribute to conform to the GEOPRIV requirements [RFC3693], Section 2.7.
关于授权策略，本文档重用[RFC4119]中完成的工作，并以非XML格式对这些策略进行编码。位置信息属性中还包括两个字段（“观测时间”和“生存时间”），以符合GEOPRIV要求[RFC3693]，第2.7节。
The format of the Basic-Location-Policy-Rules Attribute is shown below.
基本位置策略规则属性的格式如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
129 - Basic-Location-Policy-Rules
129-基本位置策略规则
Length:
长度：
>= 12
>= 12
String:
字符串：
The format is shown below. The data type of this field is a string. All fields are transmitted from left to right:
格式如下所示。此字段的数据类型为字符串。所有字段从左向右传输：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Retention Expires ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Retention Expires ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Retention Expires | Note Well ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Note Well ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Retention Expires ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Retention Expires ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Retention Expires | Note Well ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Note Well ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
This document reuses fields from the RFC 4119 [RFC4119] 'usage-rules' element. These fields have the following meaning:
本文档重用RFC 4119[RFC4119]“使用规则”元素中的字段。这些字段具有以下含义：
Flags (16 bits):
标志（16位）：
The Flags field is a bit mask. Only the first bit (R) is defined in this document, and it corresponds to the Retransmission Allowed field:
标志字段是位掩码。本文档中仅定义了第一位（R），它对应于允许重传字段：
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R|o o o o o o o o o o o o o o o|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R|o o o o o o o o o o o o o o o|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R = Retransmission Allowed o = reserved.
R=允许重传o=保留。
All reserved bits MUST be zero. When the value of the Retransmission Allowed field is set to zero (0), then the recipient of this Location Object is not permitted to share the enclosed location information, or the object as a whole, with other parties. The value of '1' allows this attribute to share the location information with other parties by considering the extended policy rules.
所有保留位必须为零。当允许重传字段的值设置为零（0）时，则不允许此位置对象的收件人与其他方共享所包含的位置信息或对象作为一个整体。值“1”允许此属性通过考虑扩展策略规则与其他方共享位置信息。
Retention Expires (64 bits):
保留过期（64位）：
This field specifies an absolute date at which time the Recipient is no longer permitted to possess the location information. The data type of this field is a string and the format is a 64-bit NTP timestamp [RFC1305].
此字段指定收件人不再被允许拥有位置信息的绝对日期。此字段的数据类型为字符串，格式为64位NTP时间戳[RFC1305]。
Note Well (variable):
注：井（变量）：
This field contains a URI that points to human-readable privacy instructions. The data type of this field is a string. This field is useful when location information is distributed to third-party entities, which can include humans in a location-based service. RADIUS entities are not supposed to process this field.
此字段包含一个URI，该URI指向人类可读的隐私说明。此字段的数据类型为字符串。当位置信息分发给第三方实体时，此字段非常有用，第三方实体可以在基于位置的服务中包括人。半径实体不应处理此字段。
Whenever a Location Object leaves the RADIUS ecosystem, the URI in the Note Well Attribute MUST be expanded to the human-readable text. For example, when the Location Object is transferred to a SIP-based environment, then the human-readable text is placed into the 'note-well' element of the 'usage-rules' element contained in the PIDF-LO (Presence Information Data Format - Location Object) document (see [RFC4119]). The Note Well field may be empty.
每当Location对象离开RADIUS生态系统时，必须将Note Well属性中的URI扩展为人类可读的文本。例如，当位置对象被传输到基于SIP的环境中时，人类可读文本被放入PIDF-LO（状态信息数据格式-位置对象）文档中包含的“使用规则”元素的“注释井”元素中（参见[RFC4119]）。注释井字段可能为空。
The Extended-Location-Policy-Rules Attribute MAY be sent in Access-Request, Access-Accept, Access-Challenge, Access-Reject, Change-of-Authorization, and Accounting-Request messages.
扩展位置策略规则属性可以在访问请求、访问接受、访问质询、访问拒绝、授权更改和记帐请求消息中发送。
The Ruleset Reference field of this attribute is of variable length. It contains a URI that indicates where the richer ruleset can be found. This URI SHOULD use the HTTPS URI scheme. As a deviation from [RFC4119], this field only contains a reference and does not carry an attached, extended ruleset. This modification is motivated by the size limitations imposed by RADIUS.
此属性的规则集引用字段长度可变。它包含一个URI，指示在何处可以找到更丰富的规则集。此URI应使用HTTPS URI方案。与[RFC4119]不同的是，此字段仅包含引用，不包含附加的扩展规则集。此修改是由半径施加的尺寸限制引起的。
In order to understand and process the Extended-Location-Policy-Rules Attribute, RADIUS clients are obligated to attach the URI to the Extended-Location-Policy-Rules Attribute when they are explicitly configured to do so, and to echo the Extended-Location-Policy-Rules Attribute that they receive from a server. There is no expectation that RADIUS clients will need to retrieve data at the URL specified in the attribute or to parse the XML policies.
为了理解和处理扩展位置策略规则属性，RADIUS客户端有义务在显式配置时将URI附加到扩展位置策略规则属性，并回显从服务器接收的扩展位置策略规则属性。RADIUS客户端不需要在属性中指定的URL处检索数据或解析XML策略。
The format of the Extended-Location-Policy-Rules Attribute is shown below.
扩展位置策略规则属性的格式如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | String ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| String (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
130 - Extended-Location-Policy-Rules
130-扩展位置策略规则
Length:
长度：
>= 3
>= 3
String:
字符串：
This field is at least two octets in length, and the format is shown below. The data type of this field is a string. The fields are transmitted from left to right:
此字段的长度至少为两个八位字节，格式如下所示。此字段的数据类型为字符串。字段从左向右传输：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ruleset Reference ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ruleset Reference ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Ruleset Reference:
规则集引用：
This field contains a URI that points to the policy rules.
此字段包含指向策略规则的URI。
The Location-Capable Attribute allows an NAS (or client function of a proxy server) to indicate support for the functionality specified in this document. The Location-Capable Attribute with the value for 'Location Capable' MUST be sent with the Access-Request messages, if the NAS supports the functionality described in this document and is capable of sending location information. A RADIUS server MUST NOT challenge for location information unless the Location-Capable Attribute has been sent to it.
“支持位置”属性允许NAS（或代理服务器的客户端功能）表示支持本文档中指定的功能。如果NAS支持本文档中描述的功能并且能够发送位置信息，则必须随访问请求消息一起发送具有“Location Capable”值的Location Capable属性。RADIUS服务器不得质询位置信息，除非已向其发送了支持位置的属性。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Integer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Integer (cont.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Integer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Integer (cont.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
131 - Location-Capable Attribute
131-可定位属性
Length:
长度：
6
6.
Integer:
整数：
The content of the Integer field encodes the requested capabilities. Each capability value represents a bit position.
整数字段的内容对请求的功能进行编码。每个能力值代表一个位位置。
This document specifies the following capabilities.
本文档指定了以下功能。
Name:
姓名：
CIVIC_LOCATION
文娱艺术区
Description:
说明：
The RADIUS client uses the CIVIC_LOCATION to indicate that it is able to return civic location based on the location profile defined in Section 4.3.1.
RADIUS客户端使用CIVIC_位置指示它能够根据第4.3.1节中定义的位置配置文件返回CIVIC位置。
Numerical Value:
数值：
A numerical value of this token is '1'.
此令牌的数值为“1”。
Name:
姓名：
GEO_LOCATION
地理位置
Description:
说明：
The RADIUS client uses the GEO_LOCATION to indicate that it is able to return geodetic location based on the location profile defined in Section 4.3.2.
RADIUS客户端使用GEO_位置表示它能够根据第4.3.2节中定义的位置剖面返回大地测量位置。
Numerical Value:
数值：
A numerical value of this token is '2'.
此令牌的数值为“2”。
Name:
姓名：
USERS_LOCATION
用户位置
Description:
说明：
The numerical value representing USERS_LOCATION indicates that the RADIUS client is able to provide a Location-Information Attribute with the Entity Attribute expressing the value of zero (0), i.e., the RADIUS client is capable of returning the location information of the user's client device.
表示用户位置的数值表示RADIUS客户端能够提供位置信息属性，其中实体属性表示零（0）的值，即RADIUS客户端能够返回用户客户端设备的位置信息。
Numerical Value:
数值：
A numerical value of this token is '4'.
此令牌的数值为“4”。
Name:
姓名：
NAS_LOCATION
NAS_位置
Description:
说明：
The numerical value representing NAS_LOCATION indicates that the RADIUS client is able to provide a Location-Information Attribute that contains location information with the Entity Attribute expressing the value of one (1), i.e., the RADIUS client is capable of returning the location information of the NAS.
表示NAS_位置的数值表示RADIUS客户端能够提供包含位置信息的位置信息属性，实体属性表示1的值，即RADIUS客户端能够返回NAS的位置信息。
Numerical Value:
数值：
A numerical value of this token is '8'.
此令牌的数值为“8”。
The Requested-Location-Info Attribute allows the RADIUS server to indicate which location information about which entity it wants to receive. The latter aspect refers to the entities that are indicated in the Entity field of the Location-Information Attribute.
“请求的位置信息”属性允许RADIUS服务器指示要接收的实体的位置信息。后一个方面是指在位置信息属性的实体字段中指示的实体。
The Requested-Location-Info Attribute MAY be sent in an Access-Accept, Access-Challenge, or Change-of-Authorization packet.
请求的位置信息属性可以在访问接受、访问质询或授权变更分组中发送。
If the RADIUS server wants to dynamically decide on a per-request basis to ask for location information from the RADIUS client, then the following cases need to be differentiated. If the RADIUS client and the RADIUS server have agreed out-of-band to mandate the transfer of location information for every network-access authentication request, then the processing listed below is not applicable.
如果RADIUS服务器希望根据每个请求动态决定从RADIUS客户端请求位置信息，则需要区分以下情况。如果RADIUS客户端和RADIUS服务器已同意在带外强制传输每个网络访问身份验证请求的位置信息，则下面列出的处理不适用。
o If the RADIUS server requires location information for computing the authorization decision and the RADIUS client does not provide it with the Access-Request message, then the Requested-Location-Info Attribute is attached to the Access-Challenge with a hint about what is required.
o 如果RADIUS服务器需要位置信息来计算授权决策，而RADIUS客户端未向其提供访问请求消息，则请求的位置信息属性将附加到访问质询，并提示所需内容。
o If the RADIUS server does not receive the requested information in response to the Access-Challenge (including the Requested-Location-Info Attribute), then the RADIUS server may respond with an Access-Reject message with an Error-Cause Attribute (including the "Location-Info-Required" value).
o 如果RADIUS服务器没有收到响应访问质询的请求信息（包括请求的位置信息属性），则RADIUS服务器可能会使用带有错误原因属性（包括“需要位置信息”值）的访问拒绝消息进行响应。
o If the RADIUS server would like location information in the Accounting-Request message but does not require it for computing an authorization decision, then the Access-Accept message MUST include a Required-Info Attribute. This is typically the case when location information is used only for billing. The RADIUS client SHOULD attach location information, if available, to the Accounting-Request (unless authorization policies dictate something different).
o 如果RADIUS服务器希望会计请求消息中包含位置信息，但不需要它来计算授权决策，则Access Accept消息必须包含必需的信息属性。当位置信息仅用于计费时，通常会出现这种情况。RADIUS客户端应将位置信息（如果可用）附加到记帐请求（除非授权策略规定了不同的内容）。
If the RADIUS server does not send a Requested-Location-Info Attribute, then the RADIUS client MUST NOT attach location information to messages towards the RADIUS server. The user's authorization policies, if available, MUST be consulted by the RADIUS server before requesting location information delivery from the RADIUS client.
如果RADIUS服务器未发送请求的位置信息属性，则RADIUS客户端不得将位置信息附加到指向RADIUS服务器的消息中。从RADIUS客户端请求位置信息传递之前，RADIUS服务器必须咨询用户的授权策略（如果可用）。
Figure 6 shows a simple protocol exchange where the RADIUS server indicates the desire to obtain location information, namely civic location information of the user, to grant access. Since the Requested-Location-Info Attribute is attached to the Access-Challenge, the RADIUS server indicates that location information is required for computing an authorization decision.
图6显示了一个简单的协议交换，其中RADIUS服务器表示希望获得位置信息，即用户的公民位置信息，以授予访问权。由于请求的位置信息属性附加到访问质询，RADIUS服务器指示计算授权决策需要位置信息。
+---------+ +---------+
| RADIUS | | RADIUS |
| Client | | Server |
+---------+ +---------+
| |
| |
| Access-Request |
| + Location-Capable |
| ('CIVIC_LOCATION', |
| 'GEO_LOCATION', |
| 'NAS_LOCATION', |
| 'USERS_LOCATION') |
|--------------------------------->|
| |
| Access-Challenge |
| + Requested-Location-Info |
| ('CIVIC_LOCATION', |
| 'USERS_LOCATION') |
| + Basic-Location-Policy-Rules |
| + Extended-Location-Policy-Rules |
|<---------------------------------|
| |
| Access-Request |
| + Location-Information |
| + Location-Data |
| + Basic-Location-Policy-Rules |
| + Extended-Location-Policy-Rules |
|--------------------------------->|
| |
| .... |
+---------+ +---------+
| RADIUS | | RADIUS |
| Client | | Server |
+---------+ +---------+
| |
| |
| Access-Request |
| + Location-Capable |
| ('CIVIC_LOCATION', |
| 'GEO_LOCATION', |
| 'NAS_LOCATION', |
| 'USERS_LOCATION') |
|--------------------------------->|
| |
| Access-Challenge |
| + Requested-Location-Info |
| ('CIVIC_LOCATION', |
| 'USERS_LOCATION') |
| + Basic-Location-Policy-Rules |
| + Extended-Location-Policy-Rules |
|<---------------------------------|
| |
| Access-Request |
| + Location-Information |
| + Location-Data |
| + Basic-Location-Policy-Rules |
| + Extended-Location-Policy-Rules |
|--------------------------------->|
| |
| .... |
Figure 6: RADIUS Server Requesting Location Information
图6:RADIUS服务器请求位置信息
The Requested-Location-Info Attribute MUST be sent by the RADIUS server, in the absence of an out-of-band agreement, if it wants the RADIUS client to return location information and if authorization policies permit it. This Requested-Location-Info Attribute MAY appear in the Access-Accept or in the Access-Challenge message.
如果RADIUS服务器希望RADIUS客户端返回位置信息，并且授权策略允许，则在没有带外协议的情况下，请求的位置信息属性必须由RADIUS服务器发送。此请求的位置信息属性可能出现在访问接受或访问质询消息中。
A summary of the attribute is shown below.
该属性的摘要如下所示。
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Integer ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Integer (cont.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Integer ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Integer (cont.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type:
类型：
132 - Requested-Location-Info Attribute
132-请求的位置信息属性
Length:
长度：
6
6.
Integer:
整数：
The content of the Integer field encodes the requested information attributes. Each capability value represents a bit position.
整数字段的内容对请求的信息属性进行编码。每个能力值代表一个位位置。
This document specifies the following capabilities:
本文件规定了以下功能：
Name:
姓名：
CIVIC_LOCATION
文娱艺术区
Description:
说明：
The RADIUS server uses the Requested-Location-Info Attribute with the value set to CIVIC_LOCATION to request specific location information from the RADIUS client. The numerical value representing CIVIC_LOCATION requires the RADIUS client to attach civic location attributes. CIVIC_LOCATION refers to the location profile defined in Section 4.3.1.
RADIUS服务器使用值设置为CIVIC_Location的Requested Location Info属性从RADIUS客户端请求特定的位置信息。表示CIVIC_位置的数值要求RADIUS客户端附加CIVIC位置属性。CIVIC_位置指第4.3.1节中定义的位置剖面。
Numerical Value:
数值：
A numerical value of this token is '1'.
此令牌的数值为“1”。
Name:
姓名：
GEO_LOCATION
地理位置
Description:
说明：
The RADIUS server uses the Requested-Location-Info Attribute with the value set to GEO_LOCATION to request specific location information from the RADIUS client. The numerical value representing GEO_LOCATION requires the RADIUS client to attach geospatial location attributes. GEO_LOCATION refers to the location profile described in Section 4.3.2.
RADIUS服务器使用值设置为GEO_Location的“请求的位置信息”属性从RADIUS客户端请求特定的位置信息。表示地理位置的数值要求RADIUS客户端附加地理空间位置属性。地理位置指第4.3.2节所述的位置剖面。
Numerical Value:
数值：
A numerical value of this token is '2'.
此令牌的数值为“2”。
Name:
姓名：
USERS_LOCATION
用户位置
Description:
说明：
The numerical value representing USERS_LOCATION indicates that the RADIUS client MUST send a Location-Information Attribute with the Entity Attribute expressing the value of zero (0). Hence, there is a one-to-one relationship between the USERS_LOCATION token and the value of zero (0) of the Entity Attribute inside the Location-Information Attribute. A value of zero indicates that the location information in the Location-Information Attribute refers to the user's client device.
表示用户位置的数值表示RADIUS客户端必须发送位置信息属性，实体属性表示值为零（0）。因此，用户_位置标记与位置信息属性内的实体属性的值零（0）之间存在一对一的关系。值为零表示位置信息属性中的位置信息指的是用户的客户端设备。
Numerical Value:
数值：
A numerical value of this token is '4'.
此令牌的数值为“4”。
Name:
姓名：
NAS_LOCATION
NAS_位置
Description:
说明：
The numerical value representing NAS_LOCATION indicates that the RADIUS client MUST send a Location-Information Attribute that contains location information with the Entity Attribute expressing the value of one (1). Hence, there is a one-to-one relationship between the NAS_LOCATION token and the value of one (1) of the Entity Attribute inside the Location-Information Attribute. A value of one indicates that the location information in the Location-Information Attribute refers to the RADIUS client.
表示NAS_位置的数值表示RADIUS客户端必须发送包含位置信息的位置信息属性，实体属性表示一（1）的值。因此，NAS_位置标记与位置信息属性内的实体属性的一（1）个值之间存在一对一关系。值为1表示“位置信息”属性中的位置信息指的是RADIUS客户端。
Numerical Value:
数值：
A numerical value of this token is '8'.
此令牌的数值为“8”。
Name:
姓名：
FUTURE_REQUESTS
未来的请求
Description:
说明：
The numerical value representing FUTURE_REQUESTS indicates that the RADIUS client MUST provide future Access-Requests for the same session with the same type of information as returned in the initial Access-Request message.
表示将来的_请求的数值表示RADIUS客户端必须为同一会话提供将来的访问请求，其信息类型与初始访问请求消息中返回的信息类型相同。
Numerical Value:
数值：
A numerical value of this token is '16'.
此令牌的数值为“16”。
Name:
姓名：
NONE
没有一个
Description:
说明：
The RADIUS server uses this token to request that the RADIUS client stop sending location information.
RADIUS服务器使用此令牌请求RADIUS客户端停止发送位置信息。
Numerical Value:
数值：
A numerical value of this token is '32'.
此令牌的数值为“32”。
If neither the NAS_LOCATION nor the USERS_LOCATION bit is set, then per-default the location of the user's client device is returned (if authorization policies allow it). If both the NAS_LOCATION and the USERS_LOCATION bits are set, then the returned location information has to be put into separate attributes. If neither the CIVIC_LOCATION nor the GEO_LOCATION bit is set in the Requested-Location-Info Attribute, then no location information is returned. If both the CIVIC_LOCATION and the GEO_LOCATION bits are set, then the location information has to be put into separate attributes. The value of NAS_LOCATION and USERS_LOCATION refers to the location information requested via CIVIC_LOCATION and GEO_LOCATION.
如果未设置NAS_位置或USERS_位置位，则默认情况下会返回用户客户端设备的位置（如果授权策略允许）。如果同时设置了NAS_位置和用户_位置位，则返回的位置信息必须放入单独的属性中。如果在“请求的位置信息”属性中未设置CIVIC_位置或GEO_位置位，则不会返回任何位置信息。如果同时设置了CIVIC_位置和GEO_位置位，则必须将位置信息放入单独的属性中。NAS_LOCATION和USERS_LOCATION的值是指通过CIVIC_LOCATION和GEO_LOCATION请求的位置信息。
As an example, if the bits for NAS_LOCATION, USERS_LOCATION, and GEO_LOCATION are set, then the location information of the RADIUS client and the users' client device are returned in a geospatial-location format.
例如，如果设置了NAS_位置、用户_位置和地理位置的位，则RADIUS客户端和用户客户端设备的位置信息将以地理空间位置格式返回。
The following table provides a guide to which attributes may be found in which RADIUS messages, and in what quantity.
下表提供了可在哪些RADIUS消息中找到哪些属性以及数量的指南。
Request Accept Reject Challenge Accounting # Attribute Request 0-1 0-1 0 0 0+ 126 Operator-Name 0+ 0 0 0 0+ 127 Location-Information 0+ 0 0 0 0+ 128 Location-Data 0-1 0-1 0-1 0-1 0-1 129 Basic-Location-Policy-Rules 0-1 0-1 0-1 0-1 0-1 130 Extended-Location-Policy-Rules 0-1 0 0 0 0 131 Location-Capable 0 0-1 0 0-1 0 132 Requested-Location-Info 0 0 0-1 0 0 101 Error-Cause (*)
请求接受拒绝质询会计#属性请求0-10-10 0+126操作员姓名0+0 0 0+127位置信息0+0 0 0+128位置数据0-10-1 0-1 0-1 0-1 0-1 129基本位置策略规则0-1 0-1 0-1 130扩展位置策略规则0-1 0 0 0 0 0 131位置支持0-1 0-1 0-1 0 132请求的位置信息00-1 0 101错误原因（*）
(*) Note: The Error-Cause Attribute contains the value for the 'Location-Info-Required' error.
（*）注意：错误原因属性包含“所需位置信息”错误的值。
Change-of-Authorization Messages
更改授权信息
Request ACK NAK # Attribute 0-1 0 0 129 Basic-Location-Policy-Rules 0-1 0 0 130 Extended-Location-Policy-Rules 0-1 0 0 132 Requested-Location-Info
请求确认NAK#属性0-1 0 0 129基本位置策略规则0-1 0 0 130扩展位置策略规则0-1 0 0 132请求的位置信息
Legend:
图例：
0 This attribute MUST NOT be present. 0+ Zero or more instances of this attribute MAY be present. 0-1 Zero or one instance of this attribute MAY be present. 1 Exactly one instance of this attribute MUST be present. 1+ One or more of these attributes MUST be present.
0此属性不能存在。此属性可能存在0+零个或多个实例。0-1此属性可能存在零个或一个实例。1此属性必须仅存在一个实例。1+必须存在这些属性中的一个或多个。
Figure 7: Table of Attributes
图7：属性表
The Error-Cause Attribute is defined in [RFC5176].
错误原因属性在[RFC5176]中定义。
The Location-Information and the Location-Data Attribute MAY appear more than once. For example, if the server asks for civic and geospatial location information, two Location-Information Attributes need to be sent.
位置信息和位置数据属性可能会出现多次。例如，如果服务器请求公民和地理空间位置信息，则需要发送两个位置信息属性。
The attributes defined in this document are not used in any messages other than the ones listed in Figure 7.
除图7中列出的消息外，本文档中定义的属性不用于任何消息。
IANA allocated a new value (509) from the Error-Cause registry with the semantics of 'Location-Info-Required'.
IANA从错误原因注册表中分配了一个新值（509），语义为“需要位置信息”。
When used in Diameter, the attributes defined in this specification can be used as Diameter attribute-value pairs (AVPs) from the code space 1-255 (RADIUS attribute-compatibility space). No additional Diameter code values are therefore allocated. The data types and flag rules, as defined in [RFC3588], for the Diameter AVPs are as follows:
在直径中使用时，本规范中定义的属性可以用作代码空间1-255（半径属性兼容性空间）中的直径属性值对（AVP）。因此，不分配其他直径代码值。[RFC3588]中定义的直径AVP的数据类型和标记规则如下：
+---------------------+
| AVP Flag rules |
+----+-----+------+-----+----+
| | |SHOULD| MUST| |
Attribute Name Value Type |MUST| MAY | NOT | NOT|Encr|
+---------------------------------+----+-----+------+-----+----+
|Operator-Name OctetString| | P | | V,M | Y |
|Location-Information OctetString| | P | | V,M | Y |
|Location-Data OctetString| | P | | V,M | Y |
|Basic-Location- | | | | | |
| Policy-Rules OctetString| | P | | V,M | Y |
|Extended-Location- | | | | | |
| Policy-Rules OctetString| | P | | V,M | Y |
|Requested- | | | | | |
| Location-Info OctetString| | P | | V,M | Y |
|Location-Capable OctetString| | P | | V,M | Y |
+---------------------------------+----+-----+------+-----+----+
+---------------------+
| AVP Flag rules |
+----+-----+------+-----+----+
| | |SHOULD| MUST| |
Attribute Name Value Type |MUST| MAY | NOT | NOT|Encr|
+---------------------------------+----+-----+------+-----+----+
|Operator-Name OctetString| | P | | V,M | Y |
|Location-Information OctetString| | P | | V,M | Y |
|Location-Data OctetString| | P | | V,M | Y |
|Basic-Location- | | | | | |
| Policy-Rules OctetString| | P | | V,M | Y |
|Extended-Location- | | | | | |
| Policy-Rules OctetString| | P | | V,M | Y |
|Requested- | | | | | |
| Location-Info OctetString| | P | | V,M | Y |
|Location-Capable OctetString| | P | | V,M | Y |
+---------------------------------+----+-----+------+-----+----+
The RADIUS attributes in this specification have no special translation requirements for Diameter-to-RADIUS or RADIUS-to-Diameter gateways; they are copied as is, except for changes relating to headers, alignment, and padding. See also Section 4.1 of [RFC3588] and Section 9 of [RFC4005].
本规范中的半径属性对于直径到半径或半径到直径网关没有特殊的转换要求；它们按原样复制，但与标题、对齐和填充相关的更改除外。另见[RFC3588]第4.1节和[RFC4005]第9节。
What this specification says about the applicability of the attributes for RADIUS Access-Request packets applies in Diameter to AA-Request [RFC4005] or Diameter-EAP-Request [RFC4072]. What is said about Access-Challenge applies in Diameter to AA-Answer [RFC4005] or Diameter-EAP-Answer [RFC4072] with the Result-Code AVP set to DIAMETER_MULTI_ROUND_AUTH. What is said about Access-Accept applies in Diameter to AA-Answer or Diameter-EAP-Answer messages that indicate success. Similarly, what is said about RADIUS Access-Reject packets applies in Diameter to AA-Answer or Diameter-EAP-Answer messages that indicate failure.
本规范所述的RADIUS访问请求数据包属性的适用性适用于Diameter中的AA请求[RFC4005]或Diameter EAP请求[RFC4072]。关于访问质询的内容适用于Diameter中的AA应答[RFC4005]或Diameter EAP应答[RFC4072]，结果代码AVP设置为Diameter\u MULTI\u ROUND\u AUTH。关于Access Accept的内容在Diameter中适用于表示成功的AA应答或Diameter EAP应答消息。类似地，关于RADIUS访问拒绝数据包的内容在Diameter中适用于指示失败的AA应答或Diameter EAP应答消息。
What is said about CoA-Request applies in Diameter to Re-Auth-Request [RFC4005].
有关CoA请求的说明适用于重新验证请求[RFC4005]。
What is said about Accounting-Request applies in Diameter to Accounting-Request [RFC4005] as well.
关于会计请求的内容同样适用于会计请求[RFC4005]。
Note that these AVPs may be used by Diameter applications other than RFC 4005 [RFC4005] and RFC 4072 [RFC4072]. The above-mentioned applications are, however, likely to be relevant in the context of this document.
注意，这些AVP可用于除RFC 4005[RFC4005]和RFC 4072[RFC4072]以外的直径应用。然而，上述申请可能与本文件相关。
A number of security aspects are relevant for the distribution of location information via RADIUS. These aspects are discussed in separate subsections.
许多安全方面与通过RADIUS分发位置信息有关。这些方面将在单独的小节中讨论。
Requirements for the protection of a Location Object are defined in [RFC3693] -- namely, mutual end-point authentication, data object integrity, data object confidentiality, and replay protection.
[RFC3693]中定义了位置对象的保护要求，即相互端点身份验证、数据对象完整性、数据对象机密性和重播保护。
If no authentication, integrity, and replay protection between the participating RADIUS entities is provided, then adversaries can spoof and modify transmitted attributes. Two security mechanisms are proposed for RADIUS:
如果参与的RADIUS实体之间未提供身份验证、完整性和重播保护，则对手可以欺骗和修改传输的属性。针对RADIUS提出了两种安全机制：
o [RFC2865] proposes the usage of a static key that raised concerns regarding the lack of dynamic key management. At the time of writing, work is ongoing to address some shortcomings of the [RFC2865] attribute regarding security protection.
o [RFC2865]建议使用静态密钥，这引起了人们对缺乏动态密钥管理的担忧。在撰写本文时，正在努力解决[RFC2865]属性在安全保护方面的一些缺陷。
o RADIUS over IPsec [RFC3579] enables the use of standard key-management mechanisms, such as Kerberized Internet Negotiation of Keys (KINK), the Internet Key Exchange Protocol (IKE), and IKEv2 [RFC4306], to establish IPsec security associations. Confidentiality protection MUST be used to prevent an eavesdropper from gaining access to location information. Confidentiality protection is already present for other reasons in many environments, such as for the transport of keying material in the context of Extensible Authentication Protocol (EAP) authentication and authorization. Hence, this requirement is, in many environments, already fulfilled. Mutual authentication MUST be provided between neighboring RADIUS entities to prevent man-in-the-middle attacks. Since mutual authentication is already required for key transport within RADIUS messages, it does not represent a deployment obstacle. Since IPsec protection is already suggested as a mechanism to protect RADIUS, no additional considerations need to be addressed beyond those described in [RFC3579].
o IPsec上的RADIUS[RFC3579]支持使用标准密钥管理机制，如密钥的Kerberized Internet协商（KINK）、Internet密钥交换协议（IKE）和IKEv2[RFC4306]，以建立IPsec安全关联。必须使用保密保护来防止窃听者获取位置信息。在许多环境中，由于其他原因，例如在可扩展身份验证协议（EAP）身份验证和授权的上下文中传输密钥材料，已经存在机密性保护。因此，在许多环境中，这一要求已经得到满足。相邻RADIUS实体之间必须提供相互认证，以防止中间人攻击。由于RADIUS消息中的密钥传输已经需要相互身份验证，因此这并不表示部署障碍。由于IPsec保护已被建议作为保护RADIUS的一种机制，因此除[RFC3579]中所述的注意事项外，无需考虑其他注意事项。
In case IPsec protection is not available for some reason and RADIUS-specific security mechanisms have to be used, then the following considerations apply. The Access-Request message is not integrity protected. This would allow an adversary to change the contents of the Location Object or to insert, modify, and delete attributes or individual fields. To address these problems, the Message-Authenticator (80) can be used to integrity protect the entire Access-Request packet. The Message-Authenticator (80) is also required when EAP is used and, hence, is supported by many modern RADIUS servers.
如果由于某种原因IPsec保护不可用，并且必须使用特定于RADIUS的安全机制，则应考虑以下事项。访问请求消息未受完整性保护。这将允许对手更改位置对象的内容，或插入、修改和删除属性或单个字段。为了解决这些问题，消息验证器（80）可用于完整性保护整个接入请求分组。使用EAP时还需要消息验证器（80），因此许多现代RADIUS服务器都支持消息验证器。
Access-Request packets including location attribute(s) without a Message-Authenticator (80) Attribute SHOULD be silently discarded by the RADIUS server. A RADIUS server supporting location attributes MUST calculate the correct value of the Message-Authenticator (80) and MUST silently discard the packet if it does not match the value sent.
RADIUS服务器应无声地丢弃包含位置属性但没有消息验证器（80）属性的访问请求数据包。支持位置属性的RADIUS服务器必须计算消息验证器（80）的正确值，如果数据包与发送的值不匹配，则必须自动丢弃数据包。
Access-Accept messages, including location attribute(s), without a Message-Authenticator (80) Attribute SHOULD be silently discarded by the NAS. An NAS supporting location attributes MUST calculate the correct value of a received Message-Authenticator (80) and MUST silently discard the packet if it does not match the value sent.
NAS应自动丢弃不带消息身份验证程序（80）属性的访问接受消息，包括位置属性。支持位置属性的NAS必须计算接收到的消息验证器（80）的正确值，如果数据包与发送的值不匹配，则必须自动丢弃该数据包。
RADIUS and Diameter make some assumptions about the trust between traversed RADIUS entities in the sense that object-level security is not provided by either RADIUS or Diameter. Hence, some trust has to be placed on the RADIUS entities to behave according to the defined rules. Furthermore, the RADIUS protocol does not involve the user in their protocol interaction except for tunneling authentication information (such as EAP messages) through their infrastructure. RADIUS and Diameter have even become a de facto protocol for key distribution for network-access authentication applications. Hence, in the past there were some concerns about the trust placed into the infrastructure -- particularly from the security area -- when it comes to keying. The EAP keying infrastructure is described in [RFC4282].
RADIUS和Diameter对遍历的RADIUS实体之间的信任进行了一些假设，因为RADIUS或Diameter都不提供对象级别的安全性。因此，必须对RADIUS实体施加一些信任，以根据定义的规则进行操作。此外，RADIUS协议不涉及用户在其协议交互中的行为，除了通过其基础设施传输身份验证信息（如EAP消息）之外。RADIUS和Diameter甚至已经成为网络访问认证应用程序密钥分发的事实协议。因此，在过去，当涉及到键控时，对基础设施的信任（特别是安全领域的信任）存在一些担忧。[RFC4282]中描述了EAP密钥基础结构。
This section discusses privacy implications for the distribution of location information within RADIUS. Note also that it is possible for the RADIUS server to obtain some amount of location information from the NAS identifier. This document, however, describes procedures to convey more accurate location information about the end host and/or the network. In a number of deployment environments, location information about the network also reveals the current
本节讨论RADIUS内位置信息分布的隐私影响。还请注意，RADIUS服务器可以从NAS标识符获取一定数量的位置信息。然而，本文档描述了传递有关终端主机和/或网络的更准确位置信息的过程。在许多部署环境中，有关网络的位置信息也会显示当前
location of the user with a certain degree of precision, depending on the location-determination mechanism used, the update frequency, the size of the network, and other factors, such as movement traces.
用户的位置具有一定的精度，这取决于所使用的位置确定机制、更新频率、网络大小和其他因素，如移动轨迹。
Three types of use cases have to be differentiated:
必须区分三种类型的用例：
o The RADIUS server does not want to receive location information from the RADIUS client.
o RADIUS服务器不希望从RADIUS客户端接收位置信息。
o In case there is an out-of-band agreement between the entity responsible for the NAS and the entity operating the RADIUS server, location information may be sent without an explicit request from the RADIUS server.
o 如果负责NAS的实体与操作RADIUS服务器的实体之间存在带外协议，则无需RADIUS服务器的明确请求即可发送位置信息。
o The RADIUS server dynamically requests location information from the NAS.
o RADIUS服务器从NAS动态请求位置信息。
The RADIUS client MUST behave according to the following guidelines:
RADIUS客户端必须按照以下准则操作：
o If neither an out-of-band agreement exists nor location information is requested by the RADIUS server, then location information is not disclosed by the RADIUS client.
o 如果既不存在带外协议，也没有RADIUS服务器请求位置信息，则RADIUS客户端不会披露位置信息。
o The RADIUS client MUST pass location information to other entities (e.g., when information is written to a local database or to the log files) only together with the policy rules. The entity receiving the location information (together with the policies) MUST follow the guidance given with these rules.
o RADIUS客户端必须将位置信息与策略规则一起传递给其他实体（例如，当信息写入本地数据库或日志文件时）。接收位置信息（以及政策）的实体必须遵循这些规则给出的指导。
o A RADIUS client MUST include Basic-Location-Policy-Rules and Extended-Location-Policy-Rules Attributes that are configured within an Access-Request packet.
o RADIUS客户端必须包括在访问请求数据包中配置的基本位置策略规则和扩展位置策略规则属性。
o NAS implementations supporting this specification, which are configured to provide location information, MUST echo Basic-Location-Policy-Rules and Extended-Location-Policy-Rules Attributes unmodified within a subsequent Access-Request packet. In addition, an Access-Request packet sent with a Service-Type value of "Authorize Only" MUST include the Basic-Location-Policy-Rules or Extended-Location-Policy-Rules Attributes that were received in a previous Access-Accept if the FUTURE_REQUESTS flag was set in the Requested-Location-Info Attribute.
o 支持此规范的NAS实施（配置为提供位置信息）必须在后续访问请求数据包中回显基本位置策略规则和扩展位置策略规则属性（未修改）。此外，如果在“请求的位置信息”属性中设置了“未来_请求”标志，则发送的服务类型值为“仅授权”的访问请求数据包必须包含在先前访问接受中接收的基本位置策略规则或扩展位置策略规则属性。
The RADIUS server is a natural place for storing authorization policies since the user typically has some sort of trust relationship with the entity operating the RADIUS server. Once the infrastructure is deployed and location-aware applications are available, there might be a strong desire to use location information for other purposes as well.
RADIUS服务器是存储授权策略的自然场所，因为用户通常与操作RADIUS服务器的实体有某种信任关系。一旦部署了基础架构，位置感知应用程序可用，人们可能会强烈希望将位置信息用于其他目的。
The Common Policy framework [RFC4745] that was extended for geolocation privacy [GEO-POLICY] is tailored for this purpose. The Extensible Markup Language (XML) Configuration Access Protocol (XCAP) [RFC4825] gives users the ability to change their privacy policies using a standardized protocol. These policies are an important tool for limiting further distribution of the user's location to other location-based services.
为地理位置隐私[GEO-Policy]而扩展的通用策略框架[RFC4745]正是为此而定制的。可扩展标记语言（XML）配置访问协议（XCAP）[RFC4825]使用户能够使用标准化协议更改其隐私策略。这些策略是将用户位置进一步分发到其他基于位置的服务的重要工具。
The RADIUS server MUST behave according to the following guidelines:
RADIUS服务器必须按照以下准则运行：
o The RADIUS server MUST attach available rules to the Access-Accept, Access-Reject, or Access-Challenge message when the RADIUS client is supposed to provide location information.
o 当RADIUS客户端应提供位置信息时，RADIUS服务器必须将可用规则附加到访问接受、访问拒绝或访问质询消息。
o When location information is made available to other entities (e.g., writing to stable storage for later billing processing), then the RADIUS server MUST attach the privacy rules to location information.
o 当位置信息可供其他实体使用时（例如，写入稳定存储以便以后进行计费处理），RADIUS服务器必须将隐私规则附加到位置信息。
A RADIUS proxy, behaving as a combined RADIUS client and RADIUS server, MUST follow the rules described in Sections 7.2.1 and 7.2.2.
RADIUS代理作为RADIUS客户端和RADIUS服务器的组合，必须遵循第7.2.1节和第7.2.2节中描述的规则。
For the envisioned usage scenarios, the identity of the user and his device is tightly coupled to the transfer of location information. If the identity can be determined by the visited network or RADIUS brokers, then it is possible to correlate location information with a particular user. As such, it allows the visited network and brokers to learn the movement patterns of users.
对于设想的使用场景，用户及其设备的身份与位置信息的传输紧密耦合。如果身份可以由访问的网络或RADIUS代理确定，则可以将位置信息与特定用户关联起来。因此，它允许访问的网络和代理了解用户的移动模式。
The user's identity can be "leaked" to the visited network or RADIUS brokers in a number of ways:
用户的身份可以通过多种方式“泄露”给访问的网络或RADIUS代理：
o The user's device may employ a fixed Media Access Control (MAC) address or base its IP address on such an address. This enables the correlation of the particular device to its different
o 用户的设备可采用固定媒体访问控制（MAC）地址或基于该地址的其IP地址。这使得特定设备与其不同设备的关联成为可能
locations. Techniques exist to avoid the use of an IP address that is based on a MAC address [RFC4941]. Some link layers make it possible to avoid MAC addresses or change them dynamically.
位置。存在避免使用基于MAC地址的IP地址的技术[RFC4941]。某些链路层可以避免MAC地址或动态更改它们。
o Network-access authentication procedures, such as the PPP Challenge Handshake Authentication Protocol (CHAP) [RFC1994] or EAP [RFC4187], may reveal the user's identity as a part of the authentication procedure. Techniques exist to avoid this problem in EAP methods, for instance by employing private Network Access Identifiers (NAIs) [RFC4282] in the EAP Identity Response message and by method-specific private identity exchanges in the EAP method (e.g., [RFC4187], [RFC5281], [PEAP], and [RFC5106]). Support for identity privacy within CHAP is not available.
o 网络接入认证过程，例如PPP质询握手认证协议（CHAP）[RFC1994]或EAP[RFC4187]，可以作为认证过程的一部分揭示用户的身份。存在用于在EAP方法中避免该问题的技术，例如，通过在EAP标识响应消息中采用专用网络接入标识符（NAI）[RFC4282]，以及通过在EAP方法中进行特定于方法的专用标识交换（例如，[RFC4187]、[RFC5281]、[PEAP]和[RFC5106]）。CHAP中不支持身份隐私。
o RADIUS may return information from the home network to the visited one in a manner that makes it possible to either identify the user or at least correlate his session with other sessions, such as the use of static data in a Class Attribute [RFC2865] or in some accounting attribute usage scenarios [RFC4372].
o RADIUS可以将信息从家庭网络返回到到访网络，其方式使得能够识别用户或至少将其会话与其他会话相关联，例如在类属性[RFC2865]或某些记帐属性使用场景[RFC4372]中使用静态数据。
o Mobility protocols may reveal some long-term identifier, such as a home address.
o 移动协议可以揭示一些长期标识符，例如家庭地址。
o Application-layer protocols may reveal other permanent identifiers.
o 应用层协议可以揭示其他永久标识符。
To prevent the correlation of identities with location information, it is necessary to prevent leakage of identity information from all sources, not just one.
为了防止身份与位置信息的关联，有必要防止身份信息从所有来源泄漏，而不仅仅是一个来源。
Unfortunately, most users are not educated about the importance of identity confidentiality, and some protocols lack support for identity-privacy mechanisms. This problem is made worse by the fact that users may be unable to choose particular protocols, as the choice is often dictated by the type of network operator they use, the type of network they wish to access, the kind of equipment they have, or the type of authentication method they are using.
不幸的是，大多数用户没有受到关于身份保密重要性的教育，一些协议缺乏对身份保密机制的支持。用户可能无法选择特定的协议，这一事实使问题更加严重，因为选择通常取决于他们使用的网络运营商类型、他们希望访问的网络类型、他们拥有的设备类型或他们使用的身份验证方法类型。
A scenario where the user is attached to the home network is, from a privacy point of view, simpler than a scenario where a user roams into a visited network, since the NAS and the home RADIUS server are in the same administrative domain. No direct relationship between the visited and the home network operator may be available, and some RADIUS brokers need to be consulted. With subscription-based network access as used today, the user has a contractual relationship with the home network provider that could (theoretically) allow higher
从隐私角度来看，用户连接到家庭网络的场景比用户漫游到访问网络的场景简单，因为NAS和家庭RADIUS服务器位于同一管理域中。受访用户和家庭网络运营商之间可能没有直接关系，需要咨询一些RADIUS代理。如今使用基于订阅的网络访问，用户与家庭网络提供商之间存在合同关系，理论上可以允许更高的价格
privacy considerations to be applied (including policy rules stored at the home network itself, for the purpose of restricting further distribution).
要应用的隐私注意事项（包括为了限制进一步分发而存储在家庭网络本身的策略规则）。
In many cases it is necessary to secure the transport of location information along the RADIUS infrastructure. Mechanisms to achieve this functionality are discussed in Section 7.1.
在许多情况下，必须确保沿RADIUS基础设施传输位置信息的安全。第7.1节讨论了实现此功能的机制。
The Attribute Types and Attribute Values defined in this document have been registered by the Internet Assigned Numbers Authority (IANA) from the RADIUS namespaces as described in the "IANA Considerations" section of RFC 3575 [RFC3575], in accordance with BCP 26 [RFC5226]. Additionally, the Attribute Type has been registered in the Diameter namespace. For RADIUS attributes and registries created by this document, IANA placed them in the Radius Types registry.
本文件中定义的属性类型和属性值已由互联网分配号码管理局（IANA）根据BCP 26[RFC5226]在RFC 3575[RFC3575]的“IANA注意事项”部分所述的RADIUS名称空间中注册。此外，属性类型已在Diameter命名空间中注册。对于本文档创建的RADIUS属性和注册表，IANA将它们放在RADIUS类型注册表中。
This document defines the following attributes:
本文档定义了以下属性：
Operator-Name Location-Information Location-Data Basic-Location-Policy-Rules Extended-Location-Policy-Rules Location-Capable Requested-Location-Info
操作员姓名位置信息位置数据基本位置策略规则扩展位置策略规则支持位置请求的位置信息
Please refer to Section 5 for the registered list of numbers.
请参阅第5节，了解注册号码列表。
IANA has also assigned a new value (509) for the Error-Cause Attribute [RFC5176] of "Location-Info-Required" according to this document.
IANA还根据本文件为“所需位置信息”的错误原因属性[RFC5176]分配了一个新值（509）。
Additionally, IANA created the following new registries listed in the subsections below.
此外，IANA还创建了以下各小节中列出的新注册中心。
This document also defines an Operator Namespace Identifier registry (used in the Namespace ID field of the Operator-Name Attribute). Note that this document requests IANA only to maintain a registry of existing namespaces for use in this identifier field, and not to establish any namespaces or place any values within namespaces.
本文档还定义了操作员名称空间标识符注册表（在操作员名称属性的名称空间ID字段中使用）。请注意，本文档仅要求IANA维护现有名称空间的注册表，以便在此标识符字段中使用，而不要求IANA在名称空间中建立任何名称空间或放置任何值。
IANA added the following values to the Operator Namespace Identifier registry using a numerical identifier (allocated in sequence), a token for the operator namespace, and a contact person for the registry.
IANA使用数字标识符（按顺序分配）、操作员名称空间令牌和注册表联系人向操作员名称空间标识符注册表添加了以下值。
+----------+--------------------+------------------------------------+
|Identifier| Operator Namespace | Contact Person |
| | Token | |
+----------+--------------------+------------------------------------+
| 0x30 | TADIG | TD.13 Coordinator |
| | | (td13@gsm.org) |
| 0x31 | REALM | IETF O&M Area Directors |
| | | (ops-ads@ietf.org) |
| 0x32 | E212 | ITU Director |
| | | (tsbdir@itu.int) |
| 0x33 | ICC | ITU Director |
| | | (tsbdir@itu.int) |
+----------+--------------------+------------------------------------+
+----------+--------------------+------------------------------------+
|Identifier| Operator Namespace | Contact Person |
| | Token | |
+----------+--------------------+------------------------------------+
| 0x30 | TADIG | TD.13 Coordinator |
| | | (td13@gsm.org) |
| 0x31 | REALM | IETF O&M Area Directors |
| | | (ops-ads@ietf.org) |
| 0x32 | E212 | ITU Director |
| | | (tsbdir@itu.int) |
| 0x33 | ICC | ITU Director |
| | | (tsbdir@itu.int) |
+----------+--------------------+------------------------------------+
Note that the above identifier values represent the ASCII value '0' (decimal 48 or hex 0x30), '1' (decimal 49, or hex 0x31), '2' (decimal 50, or hex 0x32), and '3' (decimal 51, or hex 0x33). This encoding was chosen to simplify parsing.
请注意，上述标识符值表示ASCII值“0”（十进制48或十六进制0x30）、“1”（十进制49或十六进制0x31）、“2”（十进制50或十六进制0x32）和“3”（十进制51或十六进制0x33）。选择这种编码是为了简化解析。
Requests to IANA for a new value for a Namespace ID, i.e., values from 0x34 to 0xFE, will be approved by Expert Review. A designated expert will be appointed by the IESG.
向IANA请求命名空间ID的新值，即0x34到0xFE的值，将由专家评审批准。IESG将任命一名指定专家。
The Expert Reviewer should ensure that a new entry is indeed required or could fit within an existing database, e.g., whether there is a real requirement to provide a token for a Namespace ID because one is already up and running, or whether the REALM identifier plus the name should be recommended to the requester. In addition, the Expert Reviewer should ascertain to some reasonable degree of diligence that a new entry is a correct reference to an operator namespace whenever a new one is registered.
专家审阅者应确保确实需要一个新条目，或者可以在现有数据库中容纳一个新条目，例如，是否真的需要为名称空间ID提供一个令牌，因为名称空间ID已经启动并正在运行，或者是否应该向请求者推荐域标识符加上名称。此外，专家评审员应尽一定努力确定，无论何时注册新条目，新条目都是对操作员名称空间的正确引用。
Section 4.2 defines the Location-Information Attribute and a Code field that contains an 8-bit integer value. Two values, zero and one, are defined in this document, namely:
第4.2节定义了位置信息属性和包含8位整数值的代码字段。本文件中定义了两个值，零和一，即：
Value (0): Civic location profile described in Section 4.3.1
值（0）：第4.3.1节所述的市政位置剖面图
Value (1): Geospatial location profile described in Section 4.3.2
值（1）：第4.3.2节中描述的地理空间位置纵断面
The remaining values are reserved for future use.
其余值保留供将来使用。
Following the policies outlined in [RFC3575], the available bits with a description of their semantics will be assigned after the Expert Review process. Updates can be provided based on expert approval only. Based on expert approval, it is possible to mark entries as "deprecated". A designated expert will be appointed by the IESG.
按照[RFC3575]中概述的策略，在专家评审过程后，将分配带有语义描述的可用位。只能在专家批准的基础上提供更新。根据专家批准，可以将条目标记为“已弃用”。IESG将任命一名指定专家。
Each registration must include the value and the corresponding semantics of the defined location profile.
每个注册必须包括已定义位置配置文件的值和相应语义。
Section 4.6 defines the Location-Capable Attribute that contains a bit map. 32 bits are available, from which 4 bits are defined by this document. This document creates a new IANA registry for the Location-Capable Attribute. IANA added the following values to this registry:
第4.6节定义了包含位图的可定位属性。32位可用，其中4位由本文档定义。本文档为“支持位置”属性创建一个新的IANA注册表。IANA将以下值添加到此注册表：
+----------+----------------------+
| Value | Capability Token |
+----------+----------------------+
| 1 | CIVIC_LOCATION |
| 2 | GEO_LOCATION |
| 4 | USERS_LOCATION |
| 8 | NAS_LOCATION |
+----------+----------------------+
+----------+----------------------+
| Value | Capability Token |
+----------+----------------------+
| 1 | CIVIC_LOCATION |
| 2 | GEO_LOCATION |
| 4 | USERS_LOCATION |
| 8 | NAS_LOCATION |
+----------+----------------------+
Following the policies outlined in [RFC3575], the available bits with a description of their semantics will be assigned after the Expert Review process. Updates can be provided based on expert approval only. Based on expert approval, it is possible to mark entries as "deprecated". A designated expert will be appointed by the IESG.
按照[RFC3575]中概述的策略，在专家评审过程后，将分配带有语义描述的可用位。只能在专家批准的基础上提供更新。根据专家批准，可以将条目标记为“已弃用”。IESG将任命一名指定专家。
Each registration must include:
每次注册必须包括：
Name:
姓名：
Capability Token (i.e., an identifier of the capability)
能力令牌（即，能力的标识符）
Description:
说明：
Brief description indicating the meaning of the 'info' element.
指示“info”元素含义的简要说明。
Numerical Value:
数值：
A numerical value that is placed into the Capability Attribute representing a bit in the bit-string of the Requested-Location-Info Attribute.
放置在Capability属性中的数值，表示请求的Location Info属性的位字符串中的位。
Section 4.2 defines the Location-Information Attribute that contains an 8-bit Entity field. Two values are registered by this document, namely:
第4.2节定义了包含8位实体字段的位置信息属性。本文件登记了两个值，即：
Value (0) describes the location of the user's client device.
值（0）描述用户客户端设备的位置。
Value (1) describes the location of the RADIUS client.
值（1）描述RADIUS客户端的位置。
All other values are reserved for future use.
所有其他值保留供将来使用。
Following the policies outlined in [RFC3575], the available bits with a description of their semantics will be assigned after the Expert Review process. Updates can be provided based on expert approval only. Based on expert approval, it is possible to mark entries as "deprecated". A designated expert will be appointed by the IESG.
按照[RFC3575]中概述的策略，在专家评审过程后，将分配带有语义描述的可用位。只能在专家批准的基础上提供更新。根据专家批准，可以将条目标记为“已弃用”。IESG将任命一名指定专家。
Each registration must include the value and a corresponding description.
每个注册必须包括值和相应的描述。
Section 4.4 defines the Basic-Location-Policy-Rules Attribute that contains flags indicating privacy settings. 16 bits are available, from which a single bit, bit (0), indicating 'retransmission allowed' is defined by this document. Bits 1-15 are reserved for future use.
第4.4节定义了基本位置策略规则属性，该属性包含指示隐私设置的标志。16位可用，其中一位表示“允许重传”的位（0）由本文件定义。位1-15保留供将来使用。
Following the policies outline in [RFC3575], the available bits with a description of their semantics will be assigned after the Expert Review process. Updates can be provided based on expert approval only. Based on expert approval, it is possible to mark entries as "deprecated". A designated expert will be appointed by the IESG.
按照[RFC3575]中的政策大纲，在专家评审过程后，将分配带有语义描述的可用位。只能在专家批准的基础上提供更新。根据专家批准，可以将条目标记为“已弃用”。IESG将任命一名指定专家。
Each registration must include the bit position and the semantics of the bit.
每个注册必须包括位位置和位的语义。
Section 4.7 defines the Requested-Location-Info Attribute that contains a bit map. 32 bits are available, from which 6 bits are defined by this document. This document creates a new IANA registry for the Requested-Location-Info Attribute. IANA added the following values to this registry:
第4.7节定义了包含位图的请求位置信息属性。32位可用，其中6位由本文档定义。此文档为请求的位置信息属性创建新的IANA注册表。IANA将以下值添加到此注册表：
+----------+----------------------+
| Value | Capability Token |
+----------+----------------------+
| 1 | CIVIC_LOCATION |
| 2 | GEO_LOCATION |
| 4 | USERS_LOCATION |
| 8 | NAS_LOCATION |
| 16 | FUTURE_REQUESTS |
| 32 | NONE |
+----------+----------------------+
+----------+----------------------+
| Value | Capability Token |
+----------+----------------------+
| 1 | CIVIC_LOCATION |
| 2 | GEO_LOCATION |
| 4 | USERS_LOCATION |
| 8 | NAS_LOCATION |
| 16 | FUTURE_REQUESTS |
| 32 | NONE |
+----------+----------------------+
The semantics of these values are defined in Section 4.7.
第4.7节定义了这些值的语义。
Following the policies outlined in [RFC3575], new Capability Tokens, with a description of their semantics for usage with the Requested-Location-Info Attribute, will be assigned after the Expert Review process. Updates can be provided based on expert approval only. Based on expert approval, it is possible to mark entries as "deprecated". A designated expert will be appointed by the IESG.
按照[RFC3575]中概述的策略，在专家评审过程后，将分配新的功能令牌，并说明其与请求的位置信息属性一起使用的语义。只能在专家批准的基础上提供更新。根据专家批准，可以将条目标记为“已弃用”。IESG将任命一名指定专家。
Each registration must include:
每次注册必须包括：
Name:
姓名：
Capability Token (i.e., an identifier of the capability)
能力令牌（即，能力的标识符）
Description:
说明：
Brief description indicating the meaning of the 'info' element.
指示“info”元素含义的简要说明。
Numerical Value:
数值：
A numerical value that is placed into the Capability Attribute representing a bit in the bit-string of the Requested-Location-Info Attribute.
放置在Capability属性中的数值，表示请求的Location Info属性的位字符串中的位。
The authors would like to thank the following people for their help with an initial version of this document and for their input: Chuck Black, Paul Congdon, Jouni Korhonen, Sami Ala-luukko, Farooq Bari, Ed Van Horne, Mark Grayson, Jukka Tuomi, Jorge Cuellar, and Christian Guenther.
作者要感谢以下人员对本文件初始版本的帮助和他们的投入：Chuck Black、Paul Congdon、Jouni Korhonen、Sami Ala luukko、Farooq Bari、Ed Van Horne、Mark Grayson、Jukka Tuomi、Jorge Cuellar和Christian Guenther。
Henning Schulzrinne provided the civic location information content found in this document. The geospatial location-information format is based on work done by James Polk, John Schnizlein, and Marc Linsner. The authorization policy format is based on the work done by Jon Peterson.
Henning Schulzrinne提供了本文件中的城市位置信息内容。地理空间位置信息格式基于James Polk、John Schnizlein和Marc Linsner的工作。授权策略格式基于Jon Peterson所做的工作。
The authors would like to thank Victor Lortz, Anthony Leibovitz, Jose Puthenkulam, Bernrad Aboba, Jari Arkko, Parviz Yegani, Serge Manning, Kuntal Chowdury, Pasi Eronen, Blair Bullock and Eugene Chang for their feedback to an initial version of this document. We would like to thank Jari Arkko for his textual contributions. Lionel Morand provided detailed feedback on numerous issues. His comments helped to improve the quality of this document. Jouni Korhonen, Victor Fajardo, Tolga Asveren, and John Loughney helped us with the Diameter RADIUS interoperability section. Andreas Pashalidis reviewed a later version document and provided a number of comments. Alan DeKok, Lionel Morand, Jouni Korhonen, David Nelson, and Emile van Bergen provided guidance on the Requested-Location-Info Attribute and participated in the capability-exchange discussions. Allison Mankin, Jouni Korhonen, and Pasi Eronen provided text for the Operator Namespace Identifier registry. Jouni Korhonen interacted with the GSMA to find a contact person for the TADIG operator namespace, and Scott Bradner consulted the ITU-T to find a contact person for the E212 and the ICC operator namespace.
作者感谢Victor Lortz、Anthony Leibovitz、Jose Puthenkulam、Bernrad Aboba、Jari Arkko、Parviz Yegani、Serge Manning、Kuntal Chowdury、Pasi Eronen、Blair Bullock和Eugene Chang对本文件初始版本的反馈。我们要感谢Jari Arkko的文字贡献。莱昂内尔·莫兰德就许多问题提供了详细的反馈。他的评论有助于提高这份文件的质量。Jouni Korhonen、Victor Fajardo、Tolga Asveren和John Loughney为我们提供了直径-半径互操作性部分的帮助。安德烈亚斯·帕沙利迪斯（Andreas Pashalidis）审查了一份较新版本的文件，并提出了一些意见。Alan DeKok、Lionel Morand、Jouni Korhonen、David Nelson和Emile van Bergen就请求的位置信息属性提供了指导，并参与了能力交换讨论。Allison Mankin、Jouni Korhonen和Pasi Eronen为操作符名称空间标识符注册表提供了文本。Jouni Korhonen与GSMA互动，为TADIG运营商名称空间寻找联系人，Scott Bradner咨询ITU-T，为E212和ICC运营商名称空间寻找联系人。
This document is based on the discussions within the IETF GEOPRIV Working Group. Therefore, the authors thank Henning Schulzrinne, James Polk, John Morris, Allison Mankin, Randall Gellens, Andrew Newton, Ted Hardie, and Jon Peterson for their time discussing a number of issues with us. We thank Stephen Hayes for aligning this work with 3GPP activities.
本文件基于IETF GEOPRIV工作组内的讨论。因此，作者感谢Henning Schulzrinne、James Polk、John Morris、Allison Mankin、Randall Gellens、Andrew Newton、Ted Hardie和Jon Peterson花时间与我们讨论一些问题。我们感谢Stephen Hayes将这项工作与3GPP活动结合起来。
We would like to thank members of the Wimax Forum Global Roaming Working Group (GRWG) for their feedback on the Operator-Name attribute. Ray Jong Kiem helped us with his detailed description to correct the document.
我们要感谢Wimax论坛全球漫游工作组（GRWG）成员对运营商名称属性的反馈。Ray Jong-Kiem用他的详细描述帮助我们更正了文件。
The RADEXT Working Group chairs, David Nelson and Bernard Aboba, provided several draft reviews and we would like to thank them for the help and their patience.
RADEXT工作组主席David Nelson和Bernard Aboba提供了几份审查草案，我们要感谢他们的帮助和耐心。
Finally, we would like to thank Dan Romascanu, Glen Zorn, Russ Housley, Jari Arkko, Ralph Droms, Adrial Farrel, Tim Polk, and Lars Eggert for the IETF Last Call comments; Derek Atkins for his security area directorate review; and Yoshiko Chong for spotting a bug in the IANA Considerations section.
最后，我们要感谢Dan Romascanu、Glen Zorn、Russ Housley、Jari Arkko、Ralph Droms、Adrial Farrel、Tim Polk和Lars Eggert对IETF最后通话的评论；德里克·阿特金斯的安全区域董事会审查；和Yoshiko Chong在IANA注意事项部分发现了一个bug。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 2000.
[RFC2865]Rigney，C.，Willens，S.，Rubens，A.，和W.Simpson，“远程认证拨入用户服务（RADIUS）”，RFC 28652000年6月。
[RFC3492] Costello, A., "Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA)", RFC 3492, March 2003.
[RFC3492]Costello，A.，“Punycode：应用程序中国际化域名的Unicode引导字符串编码（IDNA）”，RFC 3492，2003年3月。
[RFC3575] Aboba, B., "IANA Considerations for RADIUS (Remote Authentication Dial In User Service)", RFC 3575, July 2003.
[RFC3575]Aboba，B.“RADIUS（远程认证拨入用户服务）的IANA注意事项”，RFC 3575，2003年7月。
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
[RFC3588]Calhoun，P.，Loughney，J.，Guttman，E.，Zorn，G.，和J.Arkko，“直径基础协议”，RFC 3588，2003年9月。
[RFC3825] Polk, J., Schnizlein, J., and M. Linsner, "Dynamic Host Configuration Protocol Option for Coordinate-based Location Configuration Information", RFC 3825, July 2004.
[RFC3825]Polk，J.，Schnizlein，J.，和M.Linsner，“基于坐标的位置配置信息的动态主机配置协议选项”，RFC 38252004年7月。
[RFC4776] Schulzrinne, H., "Dynamic Host Configuration Protocol (DHCPv4 and DHCPv6) Option for Civic Addresses Configuration Information", RFC 4776, November 2006.
[RFC4776]Schulzrinne，H.，“Civic地址配置信息的动态主机配置协议（DHCPv4和DHCPv6）选项”，RFC 4776，2006年11月。
[RFC5176] Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B. Aboba, "Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)", RFC 5176, January 2008.
[RFC5176]Chiba，M.，Dommety，G.，Eklund，M.，Mitton，D.，和B.Aboba，“远程认证拨号用户服务（RADIUS）的动态授权扩展”，RFC 51762008年1月。
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
[RFC5226]Narten，T.和H.Alvestrand，“在RFCs中编写IANA注意事项部分的指南”，BCP 26，RFC 5226，2008年5月。
[GEO-POLICY] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., and J. Polk, "Geolocation Policy: A Document Format for Expressing Privacy Preferences for Location Information", Work in Progress, February 2009.
[地理政策]Schulzrinne，H.，Tschofenig，H.，Morris，J.，Cuellar，J.，和J.Polk，“地理位置政策：表达位置信息隐私偏好的文件格式”，正在进行的工作，2009年2月。
[GMLv3] "Open Geography Markup Language (GML) Implementation Specification", OGC 02-023r4, January 2003, <http://www.opengis.org/techno/implementation.htm>.
[GMLv3]“开放地理标记语言（GML）实现规范”，OGC 02-023r4，2003年1月<http://www.opengis.org/techno/implementation.htm>.
[GSM] "TADIG Naming Conventions", Version 4.1, GSM Association Official Document TD.13, June 2006.
[GSM]“TADIG命名约定”，版本4.1，GSM协会官方文件TD.13，2006年6月。
[ISO] "Codes for the representation of names of countries and their subdivisions - Part 1: Country codes", ISO 3166-1, 1997.
[ISO]“国家及其分支机构名称表示代码——第1部分：国家代码”，ISO 3166-11997。
[ITU1400] "Designations for interconnections among operators' networks", ITU-T Recommendation M.1400, January 2004.
[ITU1400]“运营商网络互连的指定”，ITU-T建议M.1400，2004年1月。
[ITU212] "The international identification plan for mobile terminals and mobile users", ITU-T Recommendation E.212, May 2004.
[ITU212]“移动终端和移动用户国际识别计划”，ITU-T建议E.212，2004年5月。
[PEAP] Josefsson, S., Palekar, A., Simon, D., and G. Zorn, "Protected EAP Protocol (PEAP) Version 2", Work in Progress, October 2004.
[PEAP]Josefsson，S.，Palekar，A.，Simon，D.，和G.Zorn，“受保护的EAP协议（PEAP）版本2”，正在进行的工作，2004年10月。
[RFC1305] Mills, D., "Network Time Protocol (Version 3) Specification, Implementation", RFC 1305, March 1992.
[RFC1305]Mills，D.，“网络时间协议（版本3）规范，实施”，RFC1305，1992年3月。
[RFC1994] Simpson, W., "PPP Challenge Handshake Authentication Protocol (CHAP)", RFC 1994, August 1996.
[RFC1994]辛普森，W.，“PPP挑战握手认证协议（CHAP）”，RFC 1994，1996年8月。
[RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[RFC2866]Rigney，C.，“半径会计”，RFC 28662000年6月。
[RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP)", RFC 3579, September 2003.
[RFC3579]Aboba，B.和P.Calhoun，“RADIUS（远程认证拨入用户服务）对可扩展认证协议（EAP）的支持”，RFC 3579，2003年9月。
[RFC3693] Cuellar, J., Morris, J., Mulligan, D., Peterson, J., and J. Polk, "Geopriv Requirements", RFC 3693, February 2004.
[RFC3693]Cuellar，J.，Morris，J.，Mulligan，D.，Peterson，J.，和J.Polk，“地质驱动要求”，RFC 3693，2004年2月。
[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton, "Diameter Network Access Server Application", RFC 4005, August 2005.
[RFC4005]Calhoun，P.，Zorn，G.，Spence，D.，和D.Mitton，“Diameter网络访问服务器应用”，RFC 4005，2005年8月。
[RFC4017] Stanley, D., Walker, J., and B. Aboba, "Extensible Authentication Protocol (EAP) Method Requirements for Wireless LANs", RFC 4017, March 2005.
[RFC4017]Stanley，D.，Walker，J.，和B.Aboba，“无线局域网的可扩展认证协议（EAP）方法要求”，RFC 401712005年3月。
[RFC4072] Eronen, P., Hiller, T., and G. Zorn, "Diameter Extensible Authentication Protocol (EAP) Application", RFC 4072, August 2005.
[RFC4072]Eronen，P.，Hiller，T.，和G.Zorn，“直径可扩展认证协议（EAP）应用”，RFC 4072，2005年8月。
[RFC4119] Peterson, J., "A Presence-based GEOPRIV Location Object Format", RFC 4119, December 2005.
[RFC4119]Peterson，J.，“一种基于状态的GEOPRIV定位对象格式”，RFC41192005年12月。
[RFC4187] Arkko, J. and H. Haverinen, "Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA)", RFC 4187, January 2006.
[RFC4187]Arkko，J.和H.Haverinen，“第三代认证和密钥协议（EAP-AKA）的可扩展认证协议方法”，RFC 4187，2006年1月。
[RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The Network Access Identifier", RFC 4282, December 2005.
[RFC4282]Aboba，B.，Beadles，M.，Arkko，J.，和P.Erenen，“网络访问标识符”，RFC 42822005年12月。
[RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.
[RFC4306]Kaufman，C.，“互联网密钥交换（IKEv2）协议”，RFC43062005年12月。
[RFC4372] Adrangi, F., Lior, A., Korhonen, J., and J. Loughney, "Chargeable User Identity", RFC 4372, January 2006.
[RFC4372]Adrangi，F.，Lior，A.，Korhonen，J.，和J.Loughney，“收费用户身份”，RFC 4372，2006年1月。
[RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., Polk, J., and J. Rosenberg, "Common Policy: A Document Format for Expressing Privacy Preferences", RFC 4745, February 2007.
[RFC4745]Schulzrinne，H.，Tschofenig，H.，Morris，J.，Cuellar，J.，Polk，J.，和J.Rosenberg，“共同政策：表达隐私偏好的文件格式”，RFC 47452007年2月。
[RFC4825] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, May 2007.
[RFC4825]Rosenberg，J.，“可扩展标记语言（XML）配置访问协议（XCAP）”，RFC4825，2007年5月。
[RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 4941, September 2007.
[RFC4941]Narten，T.，Draves，R.，和S.Krishnan，“IPv6中无状态地址自动配置的隐私扩展”，RFC 49412007年9月。
[RFC5106] Tschofenig, H., Kroeselberg, D., Pashalidis, A., Ohba, Y., and F. Bersani, "The Extensible Authentication Protocol-Internet Key Exchange Protocol version 2 (EAP-IKEv2) Method", RFC 5106, February 2008.
[RFC5106]Tschofenig，H.，Kroeselberg，D.，Pashalidis，A.，Ohba，Y.，和F.Bersani，“可扩展认证协议互联网密钥交换协议版本2（EAP-IKEv2）方法”，RFC 5106，2008年2月。
[RFC5281] Funk, P. and S. Blake-Wilson, "Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0)", RFC 5281, August 2008.
[RFC5281]Funk，P.和S.Blake Wilson，“可扩展认证协议隧道传输层安全认证协议版本0（EAP-TTLSv0）”，RFC 52812008年8月。
This section compares the requirements for a GEOPRIV using protocol, described in [RFC3693], against the approach of distributing Location Objects with RADIUS.
本节比较了[RFC3693]中描述的使用协议的GEOPRIV的要求与使用半径分布位置对象的方法。
In Appendices A.1 and A.2, we discuss privacy implications when RADIUS entities make location information available to other parties. In Appendix A.3, the requirements are matched against these two scenarios.
在附录A.1和A.2中，我们讨论了RADIUS实体向其他方提供位置信息时的隐私影响。在附录A.3中，要求与这两种情况相匹配。
When location information is conveyed from the RADIUS client to the RADIUS server, then it might subsequently be made available for different purposes. This section discusses the privacy implications for making location information available to other entities.
当位置信息从RADIUS客户端传输到RADIUS服务器时，随后可能会将其用于不同的目的。本节讨论向其他实体提供位置信息的隐私含义。
To use a more generic scenario, we assume that the visited RADIUS and the home RADIUS server belong to different administrative domains. The Location Recipient obtains location information about a particular Target via protocols specified outside the scope of this document (e.g., SIP, HTTP, or an API).
为了使用更通用的场景，我们假设访问的RADIUS和主RADIUS服务器属于不同的管理域。位置接收者通过本文档范围外指定的协议（如SIP、HTTP或API）获取特定目标的位置信息。
The subsequent figure shows the interacting entities graphically.
下图以图形方式显示了交互实体。
visited network | home network
|
| +----------+
| | Rule |
| | Holder |
| +----+-----+
| |
| rule|interface
+----------+ | V +----------+
|Location | | +----------+ notification |Location |
|Generator | | |Location |<------------->|Recipient |
+----------+ publication |Server | interface | |
|RADIUS |<------------->+----------+ +----------+
|Client | interface |RADIUS | E.g., SIP/HTTP
+----------+ | |Server |
| +----------+
E.g., NAS RADIUS
|
|
visited network | home network
|
| +----------+
| | Rule |
| | Holder |
| +----+-----+
| |
| rule|interface
+----------+ | V +----------+
|Location | | +----------+ notification |Location |
|Generator | | |Location |<------------->|Recipient |
+----------+ publication |Server | interface | |
|RADIUS |<------------->+----------+ +----------+
|Client | interface |RADIUS | E.g., SIP/HTTP
+----------+ | |Server |
| +----------+
E.g., NAS RADIUS
|
|
Figure 8: Location Server at the Home Network
图8：家庭网络中的位置服务器
The term 'Rule Holder' in Figure 8 denotes the entity that creates the authorization ruleset.
图8中的术语“规则持有者”表示创建授权规则集的实体。
This section describes a scenario where location information is made available to Location Recipients by a Location Server in the visited network. Some identifier needs to be used as an index within the location database. One possible identifier is the Network Access Identifier. RFC 4282 [RFC4282] and RFC 4372 [RFC4372] provide background regarding whether entities in the visited network can obtain the user's NAI in cleartext.
本节描述一个场景，其中位置信息由访问网络中的位置服务器提供给位置收件人。某些标识符需要用作位置数据库中的索引。一个可能的标识符是网络访问标识符。RFC 4282[RFC4282]和RFC 4372[RFC4372]提供了关于访问网络中的实体是否能够以明文形式获取用户的NAI的背景信息。
The visited network provides location information to a Location Recipient (e.g., via SIP or HTTP). This document enables the NAS to obtain the user's privacy policy via the interaction with the RADIUS server. Otherwise, only default policies, which are very restrictive, are available. This allows the Location Server in the visited network to ensure they act according to the user's policies.
所访问的网络向位置接收者提供位置信息（例如，通过SIP或HTTP）。本文档使NAS能够通过与RADIUS服务器的交互获得用户的隐私策略。否则，只有非常严格的默认策略可用。这允许访问网络中的位置服务器确保它们根据用户的策略进行操作。
The subsequent figure shows the interacting entities graphically.
下图以图形方式显示了交互实体。
visited network | home network
|
+----------+ |
|Location | |
|Recipient | |
| | |
+----------+ |
^ | +----------+
| | | Rule |
notification | | Holder |
interface | | |
| | +----+-----+
| | |
| | rule|interface
v | |
+----------+ | |
|Location | | v
|Server | | +----------+
+----------+ Rule Transport|RADIUS |
|RADIUS |<------------->|Server |
|Client | RADIUS +----------+
+----------+ |
|Location | |
|Generator |
+----------+
visited network | home network
|
+----------+ |
|Location | |
|Recipient | |
| | |
+----------+ |
^ | +----------+
| | | Rule |
notification | | Holder |
interface | | |
| | +----+-----+
| | |
| | rule|interface
v | |
+----------+ | |
|Location | | v
|Server | | +----------+
+----------+ Rule Transport|RADIUS |
|RADIUS |<------------->|Server |
|Client | RADIUS +----------+
+----------+ |
|Location | |
|Generator |
+----------+
Figure 9: Location Server at the Visited Network
图9：访问网络上的位置服务器
Location information always travels with privacy policies. This document enables the RADIUS client to obtain these policies. The Location Server can subsequently act according to these policies to provide access control using the Extended-Location-Policy-Rules and to adhere to the privacy statements in the Basic-Location-Policy-Rules.
位置信息始终与隐私策略一起传播。此文档使RADIUS客户端能够获取这些策略。位置服务器随后可以根据这些策略采取行动，使用扩展位置策略规则提供访问控制，并遵守基本位置策略规则中的隐私声明。
Section 7.1 of [RFC3693] details the requirements of a "Location Object". We discuss these requirements in the subsequent list.
[RFC3693]第7.1节详细说明了“位置对象”的要求。我们将在后面的列表中讨论这些要求。
Req. 1. (Location Object generalities):
请求。1.（位置对象概述）：
* Regarding requirement 1.1, the syntax and semantics of the Location Object are taken from [RFC3825] and [RFC4776]. It is furthermore possible to convert it to the format used in the Geography Markup Language (GMLv3) [GMLv3], as used with PIDF-LO [RFC4119].
* 关于要求1.1，位置对象的语法和语义取自[RFC3825]和[RFC4776]。此外，还可以将其转换为地理标记语言（GMLv3）[GMLv3]中使用的格式，与PIDF-LO[RFC4119]一起使用。
* Regarding requirement 1.2, a number of fields in the civic location-information format are optional.
* 关于要求1.2，市政位置信息格式中的许多字段是可选的。
* Regarding requirement 1.3, the inclusion of type of place item (CAtype 29) used in the DHCP civic format gives a further classification of the location. This attribute can be seen as an extension.
* 关于要求1.3，包含DHCP civic格式中使用的地点项目类型（CAtype 29）给出了位置的进一步分类。这个属性可以看作是一个扩展。
* Regarding requirement 1.4, this document does not define the format of the location information.
* 关于要求1.4，本文件未定义位置信息的格式。
* Regarding requirement 1.5, location information is only sent from the RADIUS client to the RADIUS server.
* 关于要求1.5，位置信息仅从RADIUS客户端发送到RADIUS服务器。
* Regarding requirement 1.6, the Location Object contains both location information and privacy rules. Location information is described in Sections 4.2, 4.3.1, and 4.3.2. The corresponding privacy rules are detailed in Sections 4.4 and 4.5.
* 关于要求1.6，位置对象包含位置信息和隐私规则。第4.2节、第4.3.1节和第4.3.2节描述了位置信息。第4.4节和第4.5节详细介绍了相应的隐私规则。
* Regarding requirement 1.7, the Location Object is usable in a variety of protocols. The format of the object is reused from other documents, as detailed in Sections 4.2, 4.3.1, 4.3.2, 4.4, and 4.5.
* 关于要求1.7，位置对象可用于各种协议。如第4.2节、第4.3.1节、第4.3.2节、第4.4节和第4.5节所述，从其他文档中重用对象的格式。
* Regarding requirement 1.8, the encoding of the Location Object has an emphasis on a lightweight encoding format to be used with RADIUS.
* 关于要求1.8，位置对象的编码强调与RADIUS一起使用的轻量级编码格式。
Req. 2. (Location Object fields):
请求。2.（位置对象字段）：
* Regarding requirement 2.1, the target identifier is carried within the network-access authentication protocol (e.g., within the EAP-Identity Response when EAP is used and/or within the EAP method itself). As described in Section 7.2 of this document, it has a number of advantages if this identifier is not carried in clear. This is possible with certain EAP methods whereby the identity in the EAP-Identity Response only contains information relevant for routing the response to the user's home network. The user identity is protected by the authentication and key exchange protocol.
* 关于要求2.1，目标标识符在网络接入认证协议中携带（例如，在使用EAP时在EAP标识响应中和/或在EAP方法本身中携带）。如本文件第7.2节所述，如果该标识符不清晰，则具有许多优点。这在某些EAP方法中是可能的，其中EAP标识响应中的标识仅包含与将响应路由到用户的家庭网络相关的信息。用户身份受身份验证和密钥交换协议保护。
* Regarding requirement 2.2, the Location Recipient is, in the main scenario, the home RADIUS server. For a scenario where the Location Recipient is obtaining location information from the Location Server via HTTP or SIP, the respective mechanisms
* 关于要求2.2，在主场景中，位置接收者是主RADIUS服务器。对于位置接收者通过HTTP或SIP从位置服务器获取位置信息的场景，相应的机制
defined in these protocols are used to identify the recipient. The Location Generator cannot, a priori, know the recipients if they are not defined in this protocol.
这些协议中的定义用于识别收件人。如果此协议中未定义收件人，则位置生成器无法预先知道收件人。
* Regarding requirement 2.3, the credentials of the Location Recipient are known to the RADIUS entities based on the security mechanisms defined in the RADIUS protocol itself. Section 7 of this document describes these security mechanisms offered by the RADIUS protocol. The same is true for requirement 2.4.
* 关于要求2.3，基于RADIUS协议本身中定义的安全机制，RADIUS实体知道位置接收者的凭据。本文件第7节描述了RADIUS协议提供的这些安全机制。要求2.4也是如此。
* Regarding requirement 2.5, Sections 4.2, 4.3.1, and 4.3.2 describe the content of the Location fields. Since the location format itself is not defined in this document, motion and direction vectors as listed in requirement 2.6 are not defined.
* 关于要求2.5，第4.2、4.3.1和4.3.2节描述了位置字段的内容。由于本文件中未定义位置格式本身，因此未定义要求2.6中列出的运动和方向矢量。
* Regarding requirement 2.6, this document provides the capability for the RADIUS server to indicate what type of location information it would like to see from the RADIUS client.
* 关于要求2.6，本文件为RADIUS服务器提供了指示其希望从RADIUS客户端看到的位置信息类型的功能。
* Regarding requirement 2.7, timing information is provided with the 'Sighting Time' and 'Time-to-Live' fields defined in Section 4.2.
* 关于要求2.7，时间信息与第4.2节中定义的“观察时间”和“生存时间”字段一起提供。
* Regarding requirement 2.8, a reference to an external (more detailed ruleset) is provided with the Extended-Location-Policy-Rules Attribute in Section 4.5.
* 关于要求2.8，第4.5节中的“扩展位置策略规则”属性提供了对外部（更详细的规则集）的引用。
* Regarding requirement 2.9, security headers and trailers are provided as part of the RADIUS protocol or even as part of IPsec.
* 关于要求2.9，安全标头和尾部作为RADIUS协议的一部分，甚至作为IPsec的一部分提供。
* Regarding requirement 2.10, a version number in RADIUS is provided with the IANA registration of the attributes. New attributes are assigned a new IANA number.
* 关于要求2.10，RADIUS中的版本号随属性的IANA注册一起提供。新属性被分配一个新的IANA编号。
Req. 3. (Location Data Types):
请求。3.（位置数据类型）：
* Regarding requirement 3.1, this document reuses civic and geospatial location information as described in Sections 4.3.2 and 4.3.1.
* 关于要求3.1，本文件重用了第4.3.2节和第4.3.1节所述的城市和地理空间位置信息。
* With the support of civic and geospatial location information, support of requirement 3.2 is fulfilled.
* 在城市和地理空间位置信息的支持下，满足了要求3.2的支持。
* Regarding requirement 3.3, the geospatial location information used by this document only refers to absolute coordinates. However, the granularity of the location information can be reduced with the help of the AltRes, LoRes, and LaRes fields described in [RFC3825].
* 关于要求3.3，本文件使用的地理空间位置信息仅指绝对坐标。但是，可以借助[RFC3825]中描述的AltRes、LoRes和LaRes字段来降低位置信息的粒度。
* Regarding requirement 3.4, further Location Data Types can be added via new coordinate reference systems (CRSs -- see the Datum field in [RFC3825]) and via extensions to [RFC3825] and [RFC4776].
* 关于要求3.4，可通过新的坐标参考系（CRS——参见[RFC3825]中的基准字段）和[RFC3825]和[RFC4776]的扩展添加更多的位置数据类型。
Section 7.2 of [RFC3693] details the requirements of a "using protocol". These requirements are listed below.
[RFC3693]第7.2节详细说明了“使用协议”的要求。以下列出了这些要求。
Req. 4.: The using protocol has to obey the privacy and security instructions coded in the Location Object (LO) regarding the transmission and storage of the LO. This document requires that entities that aim to make location information available to third parties be required to obey the privacy instructions.
请求。4.：使用协议必须遵守位置对象（LO）中编码的有关LO传输和存储的隐私和安全说明。本文件要求旨在向第三方提供位置信息的实体必须遵守隐私说明。
Req. 5.: The using protocol will typically facilitate that the keys associated with the credentials are transported to the respective parties, that is, key establishment is the responsibility of the using protocol. Section 7 of this document specifies how security mechanisms are used in RADIUS and how they can be reused to provide security protection for the Location Object. Additionally, the privacy considerations (see Section 7.2) are also relevant for this requirement.
请求。5.：使用协议通常将有助于将与凭证相关联的密钥传输到各当事方，也就是说，密钥建立是使用协议的责任。本文档的第7节指定了如何在RADIUS中使用安全机制，以及如何重用这些机制为Location对象提供安全保护。此外，隐私注意事项（见第7.2节）也与此要求相关。
Req. 6. (Single Message Transfer): In particular, for tracking of small target devices, the design should allow a single message/ packet transmission of location as a complete transaction. The encoding of the Location Object is specifically tailored towards the inclusion into a single message that even respects the (Path) MTU size.
请求。6.（单一消息传输）：特别是对于跟踪小型目标设备，设计应允许将位置的单一消息/数据包传输为完整事务。位置对象的编码专门针对包含在单个消息中而定制，该消息甚至考虑（路径）MTU大小。
Section 7.3 of [RFC3693] details the requirements of a "Rule-based Location Data Transfer". These requirements are listed below.
[RFC3693]第7.3节详细说明了“基于规则的位置数据传输”的要求。以下列出了这些要求。
Req. 7. (LS Rules): With the scenario shown in Figure 8, the decision of a Location Server to provide a Location Recipient access to location information is based on Rule Maker-defined privacy rules that are stored at the home network. With regard to the scenario shown in Figure 9, the Rule Maker-defined privacy rules are sent from the RADIUS server to the NAS (see Sections 4.4, 4.5, and 7.2 for more details).
请求。7.（LS规则）：在图8所示的场景中，位置服务器向位置接收者提供位置信息访问权的决定基于存储在家庭网络中的规则制定者定义的隐私规则。关于图9所示的场景，规则制定者定义的隐私规则从RADIUS服务器发送到NAS（有关更多详细信息，请参阅第4.4、4.5和7.2节）。
Req. 8. (LG Rules): For all usage scenarios, it is possible to consider the privacy rule before transmitting location information from the NAS to the RADIUS server or even to third parties. In the case of an out-of-band agreement between the owner of the NAS and the owner of the RADIUS server, privacy might be applied on a higher granularity. For the scenario shown in Figure 8, the visited network is already in possession of the user's location information prior to the authentication and authorization of the user. A correlation between the location and the user identity might, however, still not be possible for the visited network (as explained in Section 7.2). A Location Server in the visited network has to evaluate available rulesets.
请求。8.（LG规则）：对于所有使用场景，在从NAS向RADIUS服务器或甚至第三方发送位置信息之前，可以考虑隐私规则。在NAS所有者和RADIUS服务器所有者之间签订带外协议的情况下，可以在更高的粒度上应用隐私。对于图8所示的场景，在用户的身份验证和授权之前，访问的网络已经拥有用户的位置信息。然而，对于访问的网络，位置和用户身份之间的关联可能仍然不可能（如第7.2节所述）。访问网络中的位置服务器必须评估可用的规则集。
Req. 9. (Viewer Rules): The Rule Maker might define (via mechanisms outside the scope of this document) which policy rules are disclosed to other entities.
请求。9（查看器规则）：规则制定者可以定义（通过本文档范围之外的机制）向其他实体披露哪些策略规则。
Req. 10. (Full Rule language): GEOPRIV has defined a rule language capable of expressing a wide range of privacy rules that is applicable in the area of the distribution of Location Objects. A basic ruleset is provided with the Basic-Location-Policy-Rules Attribute (Section 4.4). A reference to the extended ruleset is carried in Section 4.5. The format of these rules is described in [RFC4745] and [GEO-POLICY].
请求。10（完整规则语言）：GEOPRIV定义了一种规则语言，能够表达适用于位置对象分布领域的广泛隐私规则。基本规则集具有基本位置策略规则属性（第4.4节）。第4.5节对扩展规则集进行了引用。[RFC4745]和[GEO-POLICY]中描述了这些规则的格式。
Req. 11. (Limited Rule language): A limited (or basic) ruleset is provided by the Policy-Information Attribute in Section 4.4 (and as introduced with PIDF-LO [RFC4119]).
请求。11（受限规则语言）：受限（或基本）规则集由第4.4节中的“策略信息”属性提供（如PIDF-LO[RFC4119]所述）。
Section 7.4 of [RFC3693] details the requirements of a "Location Object Privacy and Security". These requirements are listed below.
[RFC3693]第7.4节详细说明了“位置对象隐私和安全”的要求。以下列出了这些要求。
Req. 12 (Identity Protection): Support for unlinkable pseudonyms is provided by the usage of a corresponding authentication and key-exchange protocol. Such protocols are available, for example, with the support of EAP as network-access authentication methods. Some EAP methods support passive user-identity confidentiality, whereas others even support active user-identity confidentiality. This issue is further discussed in Section 7. The importance for user-identity confidentiality and identity protection has already been recognized as an important property (see, for example, a document on EAP method requirements for wireless LANs [RFC4017]).
请求。12（身份保护）：通过使用相应的身份验证和密钥交换协议，可以提供对无法链接的假名的支持。例如，在EAP的支持下，这些协议可用作网络访问认证方法。一些EAP方法支持被动用户身份保密，而其他方法甚至支持主动用户身份保密。第7节将进一步讨论这个问题。用户身份保密性和身份保护的重要性已被视为一项重要属性（例如，请参阅关于无线局域网EAP方法要求的文件[RFC4017]）。
Req. 13. (Credential Requirements): As described in Section 7 , RADIUS signaling messages can be protected with IPsec. This allows a number of authentication and key exchange protocols to be used as part of IKE, IKEv2, or KINK.
请求。13（凭证要求）：如第7节所述，RADIUS信令消息可以使用IPsec进行保护。这允许许多身份验证和密钥交换协议用作IKE、IKEv2或KINK的一部分。
Req. 14. (Security Features): GEOPRIV defines a few security requirements for the protection of Location Objects, such as mutual end-point authentication, data object integrity, data object confidentiality, and replay protection. As described in Section 7, these requirements are fulfilled with the usage of IPsec if mutual authentication refers to the RADIUS entities (acting as various GEOPRIV entities) that directly communicate with each other.
请求。14（安全功能）：GEOPRIV为位置对象的保护定义了一些安全要求，如相互端点身份验证、数据对象完整性、数据对象机密性和重播保护。如第7节所述，如果相互认证指的是彼此直接通信的RADIUS实体（充当各种GEOPRIV实体），则使用IPsec可满足这些要求。
Req. 15. (Minimal Crypto): A minimum of security mechanisms are mandated by the usage of RADIUS. Communication security for Location Objects between RADIUS infrastructure elements is provided by the RADIUS protocol (including IPsec and its dynamic key-management framework), rather than relying on object security via S/SIME (which is not available with RADIUS).
请求。15（最小加密）：RADIUS的使用要求最少的安全机制。RADIUS基础设施元素之间位置对象的通信安全由RADIUS协议（包括IPsec及其动态密钥管理框架）提供，而不是依赖于通过S/SIME的对象安全性（RADIUS不提供）。
Authors' Addresses
作者地址
Hannes Tschofenig (editor) Nokia Siemens Networks Linnoitustie 6 Espoo 02600 Finland
Hannes Tschofenig（编辑）芬兰诺基亚西门子网络公司Linnoitustie 6 Espoo 02600
Phone: +358 (50) 4871445
EMail: Hannes.Tschofenig@gmx.net
URI: http://www.tschofenig.priv.at
Phone: +358 (50) 4871445
EMail: Hannes.Tschofenig@gmx.net
URI: http://www.tschofenig.priv.at
Farid Adrangi Intel Corporatation 2111 N.E. 25th Avenue Hillsboro OR USA
Farid Adrangi Intel Corporation 2111美国希尔斯堡第25大道东北
EMail: farid.adrangi@intel.com
EMail: farid.adrangi@intel.com
Mark Jones Bridgewater Systems Corporation 303 Terry Fox Drive Ottawa, Ontario K2K 3J1 CANADA
加拿大安大略省渥太华Terry Fox大道303号马克·琼斯布里奇沃特系统公司K2K 3J1
EMail: mark.jones@bridgewatersystems.com
EMail: mark.jones@bridgewatersystems.com
Avi Lior Bridgewater Systems Corporation 303 Terry Fox Drive Ottawa, Ontario K2K 3J1 CANADA
加拿大安大略省渥太华Terry Fox大道303号Avi Lior Bridgewater系统公司K2K 3J1
EMail: avi@bridgewatersystems.com
EMail: avi@bridgewatersystems.com
Bernard Aboba Microsoft Corporation One Microsoft Way Redmond, WA 98052 USA
伯纳德·阿博巴微软公司美国华盛顿州雷德蒙微软大道一号，邮编：98052
EMail: bernarda@microsoft.com
EMail: bernarda@microsoft.com