Re: [Dime] Route-Record in any Diameter anwer (was: CCA)

[Ravi <nrs2712 at gmail.com>]

IMO there are two things which we are discussing

 

1) ABNF defined for some answer messages in some RFCs has Route-Record AVP present in it

       for example CCA in 4006

                  The common understanding that we have now is that this is needed for path authorization by the diameter home realm, though this is not explicitly mentioned in the RFC. The procedures that need to be performed at the diameter server are not defined in this case. Was this the original intent of having a Route-Record AVP in the CCA message?

            
2) Extending the Route-Record AVP mechanism for path authorization by the home realm. Do we need to add this to the 3588 bis?

 

I hope the experts can provide their opinions on this.

 

On Thu, Mar 19, 2009 at 6:59 AM, Sebastien Decugis <sdecugis at nict.go.jp> wrote:

Hi,

> Does anyone have any opinion on the following points?
I agree that Route-Record in a Diameter Answer would bring additional
security (via tracability).

When the server sends the answer with a success result code, it
implicitly indicates that it trusts the path of the request (same as the
path of the answer).
When the local agent receive the answers, it contains the identity of
the sender.

One could assume that indirect trust is established:  local agent ->
home server -> path.

Anyway, if an untrusted relay receives the request and forges an answer,
it can fake the Origin-Host of the reply. The local agent has no mean to
detect this if no Route-Record is in the answer.

IMHO, the question is: in what extent do we trust the hop-by-hop
security mechanism (TLS or IPsec)?

Best regards,
Sebastien.

--
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)