Next Generation ESNet Arch Requirements - ATIS

7.2 Connection Negotiation MessagesConnection Negotiation messages facilitate the connection of a given CESE to anappropriate RG. In doing this they facilitate authentication of both the CESE and RG andcreate a relationship between the two that is persistent for some period of time. ConnectionNegotiation messages verify, at the application level, that the CESE and RG are availableand able to submit or service application requests. They also manage the relationshipbetween the CESE and the RG such that the dynamic nature of the Emergency ServicesNetwork can be gracefully accommodated. Specifically, ESNet endpoints may be placedinto service, leave service for maintenance reasons, etc. without impact to the network as awhole and without impacting the service provided to CESEs.7.2.1 Connection Set UpA persistent, managed connection between the CESE and an ESNet gateway (i.e. an RG)is crucial. Accordingly, a CESE will use some resource discovery technique (e.g., DNS)and a connection determination mechanism embedded in the ESNet to find an appropriateResource Gateway to connect to. The CESE negotiates with the Connection Manager,including an exchange of credentials to guarantee that the application session is properlyauthenticated and authorized, for a connection to a Resource Gateway. The CESE andthe RG negotiate appropriate application connection parameters and establish anadministrable time period based persistent connection over a TCP/IP socket. Once theapplication session is established, the CESE and the RG begin exchanging applicationmessages.As a result of the authentication, the ESNet gives the CESE an “Authentication SessionIdentifier” to be included in messages from the CESE to the RG. The AuthenticationSession Identifier is used as a surrogate for the authentication process on a message bymessage basis, but it’s most important role comes when rotating connections, as in theacquiescence scenario discussed below. Instead of the entire re-authentication process,which entails presenting certificates and obtaining further credentials (e.g., some fob value)directly from a PSAP operator, the Authentication Session Identifier can be used to set up anew connection without direct operator intervention. This saves the operator the oneroustask of personal authentication every time a connection is acquiesced.Figure 7-12 illustrates this connectivity.21 Version 1 9/23/04