RFC 4372

Chargeable User Identity

📅 published January 2006, from ietf

RFC 4372: Chargeable User Identity 🎀✨

okay bestie, this one is a whole vibe 💅 It's a Standards Track doc from the Network Working Group, so it's an actual Internet protocol spec, not just a fun idea. It's dated January 2006 and has four authors: F. Adrangi (Intel), A. Lior (Bridgewater Systems), J. Korhonen (Teliasonera), and J. Loughney (Nokia). The header doesn't list anything it obsoletes or updates, so it stands on its own 🦋

Status of This Memo ✨

ok so this part is the official legal-ish stuff 🙈 It says this doc specifies an Internet standards track protocol for the Internet community, and it wants people to talk about it and suggest improvements 🫶 If you want to know where this protocol sits in the official standards list, you check the current edition of "Internet Official Protocol Standards" (STD 1). And distribution of this memo is unlimited, so share away 🌸

Copyright Notice

Abstract ✨

so the main character here is a new RADIUS attribute called Chargeable-User-Identity 🧚 The home network can use it to identify a user for roaming transactions that happen outside of the home network. Iconic behaviour 👑

Table of Contents 🍓

   1. Introduction ....................................................2
      1.1. Motivation .................................................3
      1.2. Terminology ................................................4
   2. Operation .......................................................5
      2.1. Chargeable-User-Identity (CUI) Attribute ...................5
      2.2. CUI Attribute ..............................................6
   3. Attribute Table .................................................7
   4. Diameter Consideration ..........................................7
   5. IANA Considerations .............................................7
   6. Security Considerations .........................................7
   7. Acknowledgements ................................................8
   8. References ......................................................8
      8.1. Normative References .......................................8
      8.2. Informative References .....................................8

1. Introduction 🌈

okay so here's the tea ☕ Some auth methods, like EAP-PEAP, EAP-TTLS, EAP-SIM, and EAP-AKA, can hide who the user really is from RADIUS servers outside the user's home network 🙈 In those cases, the User-Name(1) attribute holds an anonymous identity (something like @example.com). That's just enough info to route the RADIUS packets back home, but it doesn't actually tell anyone who the user is. It's good practice in some situations, but it gets messy when local and intermediate networks need a stand-in identity to tie the current session together 🫠

So this document introduces an attribute that works as an alias or handle for the real user's identity. We're calling it Chargeable-User-Identity 💖 It can be used outside the home network in situations that used to depend on User-Name(1) to link a session to a user 🦋

Here's why that matters. Local or intermediate networks might want to cap how many sessions one person can run at once. They might also want a Chargeable-User-Identity to show that someone is willing to pay, or just to cut down on fraud 💅

This also means a unique identity from the home network should be able to reach every party in a roaming transaction, so they can match up the authentication and accounting packets 🧚

Now, providing a unique identity, Chargeable-User-Identity (CUI), to intermediaries is necessary for certain business needs, and it shouldn't wreck the user's anonymity 🎀 The mechanism here lets the home operator meet those business needs by handing out a temporary identity that stands for the user, while still keeping the user anonymous 🫶

When the home network gives the CUI a value, it's basically saying "this value represents a user in my network." That claim should be temporary 🕰️ It should last long enough to be useful to the external applications, but not so long that someone could use it to figure out who the user is 👀

Several organizations, including WISPr, GSMA, 3GPP, Wi-Fi Alliance, and IRAP, have been working on ways to do roaming services with RADIUS. The missing pieces are mechanisms for billing and fraud prevention 💀

The CUI attribute is meant to close operational loopholes in the RADIUS specs that have been hurting roaming solutions 😭 It's mostly aimed at EAP methods that support privacy, like PEAP and EAP-TTLS, which are, for the most part, pretty recent deployments. In roaming situations like that, the home network needs a chargeable identity that reflects the user's profile 🌸

1.1. Motivation 🍓

people have proposed other mechanisms instead of the CUI attribute, but they're either not enough or they cause other problems 🙃 One idea was to use the standard RADIUS Class(25) or User-Name(1) attributes to carry the CUI. The catch is that in a messy global roaming setup, where there might be one or more intermediaries between the NAS [RFC4282] and the home RADIUS server, using those attributes can cause the problems I'm about to list 💅

On the use of the RADIUS Class(25) attribute:

[RFC2865] says: "This Attribute is available to be sent by the server to the client in an Access-Accept packet and SHOULD be sent unmodified by the client to the accounting server as part of the Accounting-Request packet if accounting is supported. The client MUST NOT interpret the attribute locally." So RADIUS clients or intermediaries MUST NOT interpret the Class(25) attribute, which means they can't work out whether it holds a CUI 😩 On top of that, a RADIUS packet can contain more than one class attribute. Since clients aren't supposed to read the contents of Class(25), it's hard for entities outside the home network to figure out which one has the CUI 🙈

On the use of the RADIUS User-Name(1) attribute:

The User-Name(1) attribute in the Access-Request packet can be used to route that packet, and in the process, intermediaries may rewrite it. So a RADIUS server that gets an Access-Request relayed by a proxy can't assume the User-Name(1) attribute is still unmodified 😬

It's a bit different in Access-Accept packets. Rewriting a User-Name(1) there happens less often, because a Proxy-State(33) attribute can route the Access-Accept packet without anyone parsing User-Name(1). But that also means a RADIUS server can't assume that a proxy which strips routing info from User-Name(1) in an Access-Request will put that info back into the User-Name(1) in the Access-Accept 🤷‍♀️ The outcome is that the Access-Request and the Accounting-Request packets might take different paths. When that's a problem, the RADIUS client should use the original User-Name(1) in its accounting packets. So another mechanism is needed to get a CUI to the RADIUS client inside an Access-Accept packet, so the CUI can be included in the accounting packets 🫠

The CUI attribute solves all of the problems above 🎀 It also means we don't have to overload User-Name(1) or change how the existing Class(25) attribute gets used. That makes the CUI a standard approach to billing and fraud prevention when privacy-supporting EAP methods are in use. It doesn't fix every related problem, but it does give billing and fraud prevention a solid foundation 💖

1.2. Terminology 💜

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶

Here are the acronyms used in this doc 🧚

      3GPP - Third Generation Partnership Project
      AAA - Authentication, Authorization, and Accounting
      AKA - Authentication and Key Agreement
      CUI - Chargeable-User-Identity
      GSMA - GSM Association
      IRAP - International Roaming Access Protocols Program
      NAS - Network Access Server
      PEAP - Protected Extensible Authentication Protocol
      SIM - Subscriber Identity Modules
      TTLS - Tunneled Transport Layer Security
      WISPr - Wireless ISP Roaming
      WPA - Wi-Fi Protected Access

2. Operation 🦋

so this doc assumes that RADIUS works the way it's specified in [RFC2865] and [RFC2866], that dynamic authorization works the way it's specified in [RFC3576], and that the Diameter protocol works the way it's specified in [RFC3588] 🌸

2.1. Chargeable-User-Identity (CUI) Attribute ✨

okay so the CUI attribute is basically an alias for the user's real identity 🎀 It's a chargeable identity that the home network defines and provides, and it shows up as extra (or alternative) info next to User-Name(1). Usually it's the actual user, but it can also point at other chargeable identities, like a group of users 🫶 Heads up: RADIUS clients outside the home network (proxy or NAS) MUST NOT modify the CUI attribute 🙈

The RADIUS server (a RADIUS proxy or the home RADIUS server) can put the CUI attribute in an Access-Accept packet heading to a roaming partner 💅 Whether CUI actually gets used depends on the business deals between roaming entities, so a RADIUS server that supports this spec can totally choose not to send CUI in reply to an Access-Request from a NAS, even if that NAS said it supports CUI. no drama, just business 💼

If a RADIUS client asked for the CUI attribute and gets an Access-Accept without one, that Access-Accept MAY be treated as an Access-Reject 😭

If the CUI was included in an Access-Accept, RADIUS clients that support the CUI attribute MUST make sure it shows up in the RADIUS Accounting-Request (Start, Interim, and Stop) 🌸 This applies even if the client never asked for CUI in the first place. the vibe is "if it was given, it gets carried" 🔥

RFC 2865 has some things to say about how clients and servers handle attributes they don't recognise, and it says:

"A RADIUS client MAY ignore Attributes with an unknown Type." "A RADIUS server MAY ignore Attributes with an unknown Type."

So RADIUS clients or servers that don't support CUI can just ignore the attribute 🦋

A RADIUS client that wants the CUI attribute in an Access-Accept MUST include a CUI attribute in the Access-Request 💖 For the initial authentication, that CUI attribute carries a single NUL character (called a nul CUI). During re-authentication, the CUI attribute carries a CUI value that was received before (called a non-nul CUI value), and that's what comes back in the Access-Accept 🧚

When a home RADIUS server gets a non-nul CUI value in an Access-Request, it MAY verify that the CUI matches the CUI from the previous Access-Accept 🕵️‍♀️ If that check fails, the RADIUS server SHOULD respond with an Access-Reject message 💀

If a home RADIUS server that supports CUI gets an Access-Request containing a CUI (nul or otherwise), it MUST include the CUI attribute in the Access-Accept 👑 But if the Access-Request has no CUI at all, the home RADIUS server SHOULD NOT include the CUI attribute in the Access-Accept. The Access-Request can come in during the initial authentication or during re-authentication, either one works 🌈

A NAS that asked for the CUI during re-authentication (by putting the CUI in the Access-Request) will get the CUI back in the Access-Accept ⭐ The NAS MUST include the value of that CUI in all Accounting Messages 💜

2.2. CUI Attribute

Here's a quick summary of the RADIUS CUI attribute, so you can see the whole shape at a glance 🍓

  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |     Type      |    Length     | String...
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type: 89 for Chargeable-User-Identity.

Length: >= 3

String:

The string identifies the CUI of the end-user 🫶 It's a reference to one particular user, and the home RADIUS server decides what the format and content look like. How long that reference stays bound to the user is decided by business agreements. For example, the lifetime could be set to one billing period 📅

RADIUS entities other than the home RADIUS server MUST treat the CUI content as an opaque token 🔒 They SHOULD NOT do anything with its content except a binary equality comparison between two instances of CUI. And when the attribute is being used to show that a NAS supports CUI, the string value contains a nul character 🙈

3. Attribute Table ✨

This table is your guide to which attributes can show up in which kinds of packets, and how many of each 💅

   Request Accept Reject Challenge Accounting #     Attribute
                                    Request
     0-1    0-1     0        0        0-1    89 Chargeable-User-Identity

Note: If the Access-Accept packet contains CUI, then the NAS MUST include the CUI in Accounting Requests (Start, Interim, and Stop) packets. no skipping this one bestie 🚨

4. Diameter Consideration 🌸

Diameter needs to define an identical attribute with the same Type value. The CUI should be available as part of the NASREQ application [RFC4005] 🦋

5. IANA Considerations 💜

This document uses the RADIUS [RFC2865] namespace, which you can check out at http://www.iana.org/assignments/radius-types. IANA has assigned a new RADIUS attribute number for the CUI attribute 🎉

CUI 89

6. Security Considerations 🔐

It is strongly recommended that the CUI format used is such that the real user identity is not revealed. And if a reference points at a real user identity, it is recommended that the binding lifetime of that reference to the real user be kept as short as possible. This part is serious, babe 😭

RADIUS entities outside the home network (RADIUS proxies and clients) MUST NOT modify the CUI or insert a CUI in an Access-Accept. However, there is no way to detect or prevent this. 💀

Attempting theft of service, a man-in-the-middle may try to insert, modify, or remove the CUI in the Access-Accept packets and Accounting packets. However, RADIUS Access-Accept and Accounting packets already provide integrity protection 🛡️

If the NAS includes CUI in an Access-Request packet, a man-in-the-middle may remove it. This will cause the Access-Accept packet to not include a CUI attribute, which may cause the NAS to reject the session. To prevent such a denial of service (DoS) attack, the NAS SHOULD include a Message-Authenticator(80) attribute within Access-Request packets containing a CUI attribute 🚫

7. Acknowledgements 🫶

The authors would like to thank Jari Arkko, Bernard Aboba, David Nelson, Barney Wolff, Blair Bullock, Sami Ala-Luukko, Lothar Reith, David Mariblanca, Eugene Chang, Greg Weber, and Mark Grayson for their feedback and guidance. Iconic squad 👑

8. References 📚

8.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
           "Remote Authentication Dial In User Service (RADIUS)",
           RFC 2865, June 2000.

[RFC2866]  Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.

[RFC4005]  Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
           "Diameter Network Access Server Application", RFC 4005,
           August 2005.

[RFC4282]  Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
           Network Access Identifier", RFC 4282, December 2005.

8.2. Informative References

[RFC3576]  Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
           Aboba, "Dynamic Authorization Extensions to Remote
           Authentication Dial In User Service (RADIUS)", RFC 3576,
           July 2003.

[RFC3588]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
           Arkko, "Diameter Base Protocol", RFC 3588, September 2003.

Authors' Addresses 🧚

Farid Adrangi
Intel Corporation
2111 N.E. 25th Avenue
Hillsboro, OR  97124
USA

Phone: +1 503-712-1791
EMail: farid.adrangi@intel.com


Avi Lior
Bridgewater Systems Corporation
303 Terry Fox Drive
Ottawa, Ontario  K2K 3J1
Canada

Phone: +1 613-591-9104
EMail: avi@bridgewatersystems.com


Jouni Korhonen
Teliasonera Corporation
P.O.Box 970
FIN-00051,   Sonera
Finland

Phone: +358405344455
EMail: jouni.korhonen@teliasonera.com


John Loughney
Nokia
Itamerenkatu 11-13
FIN-00180,   Helsinki
Finland

Phone: +358504836342
EMail: john.loughney@nokia.com

Full Copyright Statement ⚖️

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🪪

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 💖

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). ✨

📦 where this page comes from

ietf: rfc4372 2006-01
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms