RFC 7966
Security at the Attribute-Value Pair (AVP) Level for Non-neighboring Diameter Nodes: Scenarios and Requirements
RFC 7966: Security at the Attribute-Value Pair (AVP) Level for Non-neighboring Diameter Nodes: Scenarios and Requirements ✨
okay bestie, this one is RFC 7966 🎀 It's an Informational doc (so not a Standards Track spec 💅), written by H. Tschofenig, J. Korhonen (Ed.) from Broadcom Limited, G. Zorn from Network Zen, and K. Pillay from Internet Solutions. It was published in September 2016 as ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so it's standing on its own 🧚
Abstract
okay so the whole point of this spec is to lay out the requirements for getting Diameter security down to the level of individual Attribute-Value Pairs (AVPs) 🦋 That's the big goal, iykyk 💜
Status of This Memo
not gonna lie, this section is kind of a formality, but it matters 🙈 This document is not an Internet Standards Track specification. It's published for informational purposes 🌸
It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 7841 if you want the deets 🍓
For the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7966 ✨
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🔥
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read those carefully, bestie, because they spell out your rights and restrictions for this document 📜 Code Components extracted from this document have to include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes 💅
Table of Contents
Here's the map so you can find your way around 🗺️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Security Threats . . . . . . . . . . . . . . . . . . . . . . 5
4. Scenarios for Diameter AVP-Level Protection . . . . . . . . . 7
5. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 8
6. Security Considerations . . . . . . . . . . . . . . . . . . . 9
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
7.1. Normative References . . . . . . . . . . . . . . . . . . 10
7.2. Informative References . . . . . . . . . . . . . . . . . 10
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 111. Introduction ✨
okay so the Diameter base protocol spec [2] handles security between neighboring Diameter peers 🫶 Diameter says peer connections have to be protected by Transport Layer Security (TLS) [6] for TCP, by Datagram TLS (DTLS) [7] for the Stream Control Transmission Protocol (SCTP), or by security mechanisms that work independently of Diameter (like IPsec [5]) 🔐
These security protocols are super powerful. They cover entity authentication, data-origin authentication, integrity protection, confidentiality protection, and replay protection. They also support a huge pile of cryptographic algorithms, algorithm negotiation, and different kinds of credentials 🌈
BUT here's the tea 🍵 TLS/DTLS/IPsec in the Diameter context does not give you end-to-end security unless the Diameter nodes are direct peers, meaning neighbors. Right now, Diameter security is realized hop by hop 🦋 So it's not the full story, bestie 💅
The need to protect AVPs between non-neighboring Diameter nodes was spotted super early on in Diameter work 👀 That led to work on Diameter security using the Cryptographic Message Syntax (CMS) [3]. Sadly, there wasn't much deployment interest back then (and the solution was pretty complex), so that spec was never finished 💀
Meanwhile, Diameter got a lot of love from the cellular operator community 🥹 Because those deployments are so sophisticated, the need to protect AVPs between non-neighboring nodes came right back. Since the early 2000s, when work on [3] stopped, the Internet community has seen advances in cryptographic algorithms (like authenticated encryption algorithms), and new security building blocks have shown up too ✨ Main character energy for crypto 👑
This document lays out the requirements for building a solution that protects Diameter AVPs between non-neighboring Diameter nodes 🎀
2. Terminology 🧚
okay so here's the vocab check. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be read as described in RFC 2119 [1] 💖
This doc also reuses terminology from the Diameter base specification [2] 🍓
In the figures below, AVP means an unprotected AVP, and {AVP}k means an AVP that gets security protection using key "k", without saying whether it's integrity or confidentiality protection 🔑
The following terms show up here too:
AAA broker
An entity that manages Authentication, Authorization, and Accounting (AAA) traffic between roaming partner networks. 🌸
AAA broker network
A network run by an AAA broker. It has the necessary AAA functions to provide AAA brokering services for its customer AAA networks 🦋
Diameter firewall
A Diameter firewall is a proxy (or a relay) agent that acts a lot like a regular IP traffic firewall, but only at the Diameter AVP and command level 🔥 For example, it can discard AVPs that break security policy, so they can't get through the firewall. It can even discard entire Diameter messages based on security policy 🙅♀️
3. Security Threats 💀
okay this section is the "why do we even need this" part 🙈 It covers the security threats that make protecting Diameter Attribute-Value Pairs (AVPs) necessary. Figure 1 shows an example of a Diameter-based roaming setup, where Diameter clients in the visited networks need to talk to Diameter servers in the home domain 🌍 The AAA domains are connected through a Diameter-based AAA interconnection network, labeled "AAA broker network" 🕸️
+oooooooooooooooooo+ +====================+
| Example.net | | |
| | | |
+--------+ +--------+ +--------+ +--------+
|Diameter| |Diameter+--------+Diameter| |Diameter|
|Client 1| |Proxy A1| |Proxy B | |Proxy C |
| (NAS) +------+ | +------+ +--------+ |----+
+--------+ +--------+ | +--------+ +--------+ |
| | | | | |
| Visited Domain 1 | | | AAA Broker Network | |
+oooooooooooooooooo+ | +====================+ |
| |
| |
| |
| +\\\\\\\\\\\\\\\\\\\\+ |
| +--------+ Example.com | |
| |Diameter| | |
+oooooooooooooooooo+ | |Server X+--+ +--------+ |
| Example.org | | +--------+ | |Diameter| |
| | | +--------+ +---------+Proxy D |-+
+--------+ +--------+ | |Diameter| | +--------+
|Diameter| |Diameter| | |Server Y+--+ |
|Client 2+------+Proxy A2+-+ +--------+ Home Domain |
| (NAS) | | | +////////////////////+
+--------+ +--------+
| |
| Visited Domain 2 |
+oooooooooooooooooo+Figure 1: Example Diameter Deployment 🗺️
Eavesdropping: some Diameter applications carry info that's only meant for the endpoints, either the Diameter client or the Diameter server, and not for the middlemen 👀 For example, the Diameter Extensible Authentication Protocol (EAP) application [4] lets keying material get transported from the Diameter server to the Diameter client (using the EAP-Master-Session-Key AVP). That keying material protects the air interface (the wireless link) between the end device (like a mobile phone, not shown in the figure) and the Network Access Server (NAS) 📱 The content of the EAP-Master-Session-Key AVP really ought to get protection against eavesdropping by intermediaries 🙈 Other AVPs (like the ones listed in Section 13.3 of [2]) might also carry sensitive personal data that, if collected by intermediaries, could allow traffic analysis 😬
In the Figure 1 deployment, the adversary could, for example, be sitting in the AAA broker network 🕵️♀️
Injection and Manipulation: the Diameter base protocol spec requires security protection between neighboring nodes, but Diameter agents can be compromised or misconfigured, and then they can inject or manipulate AVPs 😱 To catch that kind of stuff, extra security protection needs to be applied at the Diameter layer 🛡️
Any Diameter agent along the end-to-end communication path could launch this kind of attack 🫣
Impersonation: imagine a Diameter message from Example.net that claims to be from Example.org 🎭 To stop a successful impersonation attack, you'd need either strict verification at the edge of the AAA broker network, or cryptographic assurance at the Diameter layer 🔐
Any Diameter realm could launch this kind of attack, aiming for financial benefits or to disrupt service availability 💸
4. Scenarios for Diameter AVP-Level Protection ✨
okay so this section lays out a bunch of different ways you could deploy security on individual Diameter AVPs 🎀 let's go!
Scenario one (Figure 2) is end-to-end. Protection runs between the Diameter client and the Diameter server, with any number of intermediate Diameter agents chilling in the middle. AVPs swapped between those two nodes can be protected end to end (written as {AVP}k) or left unprotected (written as AVP). 🫶
+--------+ +--------+
|Diameter| AVP, {AVP}k |Diameter|
|Client +-----------------........... -------------------+Server |
+--------+ +--------+
Figure 2: End-to-End Diameter AVP Security ProtectionScenario two (Figure 3) is giving proxy energy 💅 A Diameter proxy handles security protection on behalf of the Diameter client. It protects outgoing AVPs and checks incoming ones. Usually, the proxy doing the protecting lives in the same domain as the client/server pair, which doesn't have end-to-end security features. It's like having a bodyguard who does the security checks for you 🧚
+--------+ +--------+ +--------+
|Diameter| AVP |Diameter| AVP, {AVP}k |Diameter|
|Client +-----+Proxy A +---------- .......... -----------+Server |
+--------+ +--------+ +--------+
Figure 3: Middle-to-End Diameter AVP Security ProtectionScenario three (Figure 4) flips it. This time the Diameter proxy acts on behalf of the Diameter server 🦋
+--------+ +--------+ +--------+
|Diameter| AVP, {AVP}k |Diameter| AVP |Diameter|
|Client +-----------------........... ----+Proxy D +-----+Server |
+--------+ +--------+ +--------+
Figure 4: End-to-Middle Diameter AVP Security ProtectionScenario four is the final boss 👑 (see Figure 5). It's a combo of the middle-to-end and end-to-middle scenarios from Figures 3 and 4. Deployment-wise it's actually the easiest one, and there are two reasons. First, the Diameter clients and servers stay unmodified, so the installed Diameter infrastructure needs no changes except for the security-enabled proxies, obvs. Second, key management gets simpler too, because way fewer keys need to be negotiated and provisioned. The assumption here is that the security-enabled proxies would be significantly outnumbered by the unprotected Diameter nodes already out in the installed base 🌸
+--------+ +--------+ +--------+ +--------+
|Diameter| AVP |Diameter| AVP, {AVP}k |Diameter| AVP |Diameter|
|Client +-----+Proxy A +-- .......... ----+Proxy D +-----+Server |
+--------+ +--------+ +--------+ +--------+
Figure 5: Middle-to-Middle Diameter AVP Security Protection5. Requirements 🍓
Here are the non-negotiables, bestie 🔥
Requirement #1: The solution MUST support an extensible set of cryptographic algorithms.
Motivation: Solutions MUST be able to evolve to keep up with new cryptographic algorithms and security requirements. That can mean a modular mechanism so algorithms can get updated without wrecking deployed implementations. 🧚
Requirement #2: The solution MUST support confidentiality, integrity, and data-origin authentication. Solutions for integrity protection MUST work in a backwards-compatible way with existing Diameter applications, so they can traverse legacy proxy and relay agents. Main character energy for backwards compatibility 💖
Requirement #3: The solution MUST support replay protection. 🔁
Requirement #4: The solution MUST support the ability to delegate security functionality to another entity.
Motivation: As described in Section 4, letting a Diameter proxy do security services on behalf of all clients in the same administrative domain matters a lot for incremental deployability. The same goes for the other side, where a load balancer terminates security services for the servers it sits in front of 🦋
Requirement #5: The solution MUST be able to selectively apply its cryptographic protection to certain Diameter AVPs.
Motivation: Some Diameter applications assume that certain AVPs get added, removed, or modified by intermediaries. So it has to be possible to apply security protection selectively 🎀 Also, some AVPs must not be confidentiality protected but may still be integrity protected, like the ones needed for Diameter message routing. 🗺️
Requirement #6: The solution MUST define a mandatory-to-implement cryptographic algorithm.
Motivation: For interoperability, it's super helpful to have a mandatory-to-implement cryptographic algorithm specified (unless profiles for specific usage environments say otherwise) ✨
Requirement #7: The solution MUST support symmetric keys and asymmetric keys.
Motivation: Symmetric and asymmetric cryptographic algorithms give you different security services. Asymmetric algorithms, for example, let you offer non-repudiation services 🔑
Requirement #8: A solution for dynamic key management MUST be included in the overall solution framework.
However, it's assumed that no "new" key management protocol needs to be developed. Instead, existing ones get reused, if at all possible. Rekeying could be triggered by (a) management actions and (b) expiring keying material. 🌈
6. Security Considerations 🔐
Okay, serious moment, but make it iconic 💅 This entire document is focused on new functionality for securing Diameter AVPs selectively between non-neighboring nodes.
Various security threats get mitigated by selectively applying security protection to individual Diameter AVPs. Without protection, there's a real possibility of password sniffing, confidentiality violation, and AVP insertion, deletion, or modification 😭 Applying a digital signature also gives you non-repudiation, which today's Diameter deployments don't have yet. Modification of certain AVPs isn't always malicious, though. It could just be misconfiguration. An over-aggressive firewalling Diameter proxy might also remove certain AVPs, which is a whole mess 💀
In most cases, data-origin authentication and integrity protection of AVPs give existing deployments the biggest benefits, with minimal overhead, and they can (potentially) operate in a fully backwards-compatible way. Protect your AVPs, babe 🛡️
7. References 📚
7.1. Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[2] Fajardo, V., Ed., Arkko, J., Loughney, J., and G. Zorn,
Ed., "Diameter Base Protocol", RFC 6733,
DOI 10.17487/RFC6733, October 2012,
<http://www.rfc-editor.org/info/rfc6733>.7.2. Informative References
[3] Calhoun, P., Farrell, S., and W. Bulley, "Diameter CMS
Security Application", Work in Progress,
draft-ietf-aaa-diameter-cms-sec-04, March 2002.
[4] Eronen, P., Ed., Hiller, T., and G. Zorn, "Diameter
Extensible Authentication Protocol (EAP) Application",
RFC 4072, DOI 10.17487/RFC4072, August 2005,
<http://www.rfc-editor.org/info/rfc4072>.
[5] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, DOI 10.17487/RFC4301,
December 2005, <http://www.rfc-editor.org/info/rfc4301>.
[6] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246,
DOI 10.17487/RFC5246, August 2008,
<http://www.rfc-editor.org/info/rfc5246>.
[7] Tuexen, M., Seggelmann, R., and E. Rescorla, "Datagram
Transport Layer Security (DTLS) for Stream Control
Transmission Protocol (SCTP)", RFC 6083,
DOI 10.17487/RFC6083, January 2011,
<http://www.rfc-editor.org/info/rfc6083>.Acknowledgments 💜
We would like to thank Guenther Horn, Martin Dolly, Steve Donovan, Lionel Morand, and Tom Taylor (rest in peace, Tom) for their review comments 🕊️
The authors also thank Qin Wu, Christer Holmberg, Ben Campbell, and Radia Perlman, who gave additional reviews during the Last Call 🫶
Authors' Addresses ✉️
Hannes Tschofenig
Hall in Tirol 6060
Austria
Email: Hannes.tschofenig@gmx.net
URI: http://www.tschofenig.priv.at
Jouni Korhonen (editor)
Broadcom Limited
3151 Zanker Rd.
San Jose, CA 95134
United States of America
Email: jouni.nospam@gmail.com
Glen Zorn
Network Zen
227/358 Thanon Sanphawut
Bang Na, Bangkok 10260
Thailand
Email: glenzorn@gmail.com
Kervin Pillay
Internet Solutions
South Africa
Email: kervin.pillay@gmail.com📦 where this page comes from
- ietf: rfc7966 2016-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms