[Dime] Proposed security section for DRMP

[Steve Donovan <[e-mail]>]

All,

Here's the proposed security section for DRMP.  It is based heavily on 
Ben's words in the Diameter Overload RFC.

Regards,

Steve

-----

11.  Security Considerations

    DRMP gives Diameter nodes the ability to influence which requests are
    are throttled during overload scenarios.  Improper use of the DRMP
    mechanism could result in the malicious Diameter node gaining
    preferential treatment, by reducing the probability of its requests
    being throttled, over other Diameter nodes.  This would be achieved
    by the malicious node inserting artificially high priority values.

    Diameter does not include features to provide end-to-end
    authentication, integrity protection, or confidentiality.  This opens
    the possibility that agents in the path of a request could modify the
    DRMP AVP to reflect a priority different than that asserted by the
    sender of the request.

11.1.  Potential Threat Modes

    The Diameter protocol involves transactions in the form of requests
    and answers exchanged between clients and servers.  These clients and
    servers may be peers, that is, they may share a direct transport
    (e.g., TCP or SCTP) connection, or the messages may traverse one or
    more intermediaries, known as Diameter Agents.  Diameter nodes use
    TLS, DTLS, or IPsec to authenticate peers, and to provide
    confidentiality and integrity protection of traffic between peers.
    Nodes can make authorization decisions based on the peer identities
    authenticated at the transport layer.

    When agents are involved, this presents an effectively transitive
    trust model.  That is, a Diameter client or server can authorize an
    agent for certain actions, but it must trust that agent to make
    appropriate authorization decisions about its peers, and so on.
    Since confidentiality and integrity protection occurs at the
    transport layer, agents can read, and perhaps modify, any part of a
    Diameter message, including the DRMP AVP.

    There are several ways an attacker might attempt to exploit the DRMP
    mechanism.  A malicious or compromised Diameter node might insert
    invalid priority values resulting in either preferential treatment,



Donovan                   Expires July 4, 2016                 [Page 13]

Internet-Draft                    DOIC                      January 2016


    resulting from higher values, or degraded treatment resulting from
    lower values, for that node.

    A similar attack involves a malicious or compromised Diameter agent
    changing the priority value resulting in the sending Diameter node
    getting either preferential or degraded service.

    The DRMP mechanism can be used to aid in overload throttling
    decisions.  When this is the case then the above attacks are limited
    in scope to when one or more Diameter nodes are in an overloaded
    state.

    The DRMP mechanism can also be used to influence the order in which
    Diameter messages are handled by Diamter nodes.  The above attacks
    have a potentially greater impact in this scenario as the priority
    indication impacts the handling of all requests at all times,
    independent of the overload status of Diameter nodes in the Diameter
    network.

11.2.  Denial of Service Attacks

    The DRMP mechanism does not open direct denial of service attack
    vectors.  Rather, it introduces a mechanism where a node can gain
    unwarranted preferential treatment.  It also introduces a mechanism
    where a node can get degrated service in the scenario where a rogue
    agent changes the priority value included in messages.

11.3.  End-to End-Security Issues

    The lack of end-to-end integrity features makes it difficult to
    establish trust in DRMP AVPs received from non-adjacent nodes. Any
    agents in the message path may insert or modify DRMP AVPs.  Nodes
    must trust that their adjacent peers perform proper checks on
    overload reports from their peers, and so on, creating a transitive-
    trust requirement extending for potentially long chains of nodes.
    Network operators must determine if this transitive trust requirement
    is acceptable for their deployments.  Nodes supporting DRMP MUST give
    operators the ability to select which peers are trusted to deliver
    DRMP AVPs, and whether they are trusted to forward the DRMP AVPs from
    non-adjacent nodes.  Diameter nodes MUST strip DRMP AVPs from
    messages received from peers that are not trusted for DRMP purposes.

    It is expected that work on end-to-end Diameter security might make
    it easier to establish trust in non-adjacent nodes for DRMP purposes.
    Readers should be reminded, however, that the DRMP mechanism allows
    Diameter agents to modify AVPs in existing messages that are
    originated by other nodes.  If end-to-end security is enabled, there
    is a risk that such modification could violate integrity protection.



Donovan                   Expires July 4, 2016                 [Page 14]

Internet-Draft                    DOIC                      January 2016


    The details of using any future Diameter end-to-end security
    mechanism with DRMP will require careful consideration, and are
    beyond the scope of this document.