Subject: [AAA-WG]: DCCA Draft 05: Event Time Stamp

From: "Mark Grayson (mgrayson)" <[email-masked]>
Date: Mon, 24 May 2004 22:28:58 +0200

Can someone clarify whether event-timestamp AVP is mandatory or not. I
cannot seem to find a MUST (or even SHOULD)defined.
 
Many thanks,
Mark

---

From: <[email-masked]>
Date: Tue, 25 May 2004 13:21:22 +0300

Hi Mark,
 
>Can someone clarify whether event-timestamp AVP is mandatory or not. I cannot seem to find a MUST (or even SHOULD)
>defined.
 
The intention was that event-timestamp SHOULD be present in CCR command. The AVP is defined in the base.
The text concerning this AVP was written at the time when the DCC was still at individual draft level, since then 
it has never been updated.
 
Event-timestamp use is described for first, intermediate and final interrogations as well as for one-time event
direct debiting, but the text is not consistent. The folowing sentences can be found:
 
   The Event-Timestamp AVP contains the time when the service event is 
   requested in the service element. 

   The Event-Timestamp AVP contains the time of the event that triggered 
   the sending of the new Credit-Control-Request.  

   The Event-Timestamp AVP MAY contain the time of the session was 
   terminated.   
 
   The Event-Timestamp AVP contains the time when the service event is requested 
   in the service element.
 
The right sentences should be
 
  The Event-Timestamp AVP SHOULD be included in the request and contains the time 
   when the service event is requested in the service element.

   The Event-Timestamp AVP SHOULD be included in the request and contains the time of the 
   event that triggered the sending of the new Credit-Control-Request.  

   The Event-Timestamp AVP SHOULD be included in the request and contains the time 
   when the session was terminated.   
 
   The Event-Timestamp AVP SHOULD be included in the request and contains the time 
    when the service event is requested in the service element.
 
I think we need to update this during the IESG review round.
 
Regards
Marco

---

From: "Mark Grayson (mgrayson)" <[email-masked]>
Date: Tue, 25 May 2004 17:48:12 +0200

Marco
 
thanks for that! 
 
Another question I have concerns the handling of subscription ID AVP in
the CCA. What happens if this differs from the value in the CCR. Should
the DCCA client use the returned ID in subseqent CCR messages? Could
this be used by an attacker to charge a third party's account?
 
Thanks,
Mark
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 25 May 2004 06:21
To: Mark Grayson (mgrayson)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

	Hi Mark,
	 
	>Can someone clarify whether event-timestamp AVP is mandatory or
not. I cannot seem to find a MUST (or even SHOULD)
	>defined.
	 
	The intention was that event-timestamp SHOULD be present in CCR
command. The AVP is defined in the base.
	The text concerning this AVP was written at the time when the
DCC was still at individual draft level, since then 
	it has never been updated.
	 
	Event-timestamp use is described for first, intermediate and
final interrogations as well as for one-time event
	direct debiting, but the text is not consistent. The folowing
sentences can be found:
	 
	   The Event-Timestamp AVP contains the time when the service
event is 
	   requested in the service element. 

	   The Event-Timestamp AVP contains the time of the event that
triggered 
	   the sending of the new Credit-Control-Request.  

	   The Event-Timestamp AVP MAY contain the time of the session
was 
	   terminated.   
	 
	   The Event-Timestamp AVP contains the time when the service
event is requested 
	   in the service element.

	  The Event-Timestamp AVP SHOULD be included in the request and
contains the time 
	   when the service event is requested in the service element.

	   The Event-Timestamp AVP SHOULD be included in the request and
contains the time of the 
	   event that triggered the sending of the new
Credit-Control-Request.  

	   The Event-Timestamp AVP SHOULD be included in the request and
contains the time 
	   when the session was terminated.   
	 
	   The Event-Timestamp AVP SHOULD be included in the request and
contains the time 
	    when the service event is requested in the service element.

	Regards
	Marco

---

From: <[email-masked]>
Date: Wed, 26 May 2004 15:29:43 +0300

Hi Mark,
 
>Another question I have concerns the handling of subscription ID AVP in the CCA. What happens if this differs from the 
>value in the CCR. Should the DCCA client use the returned ID in subseqent CCR messages? Could this be used by an 
>attacker to charge a third party's account?
 
An authenticated identity must always be used in a Subscription-Id AVP in all the CCR messages, authentication is
not performed with the DCC application but e.g. with NASREQ or EAP. The Subscription-id(s) to be used may also be 
returned by the AAA server in the successful AA-answer that authenticated the user, this is to be used in CCR messages sent thereafter.
The security section discusses recommendations how to prevent an attacker to modify CCR/CCA messages, basically
using TLS or IPSec.
 
Regards
Marco

---

From: "Mark Grayson (mgrayson)" <[email-masked]>
Date: Wed, 26 May 2004 14:32:49 +0200

so what is the rationale for having the subscription ID returned in the
CCA?
 
Cheers,
Mark

	-----Original Message-----
	From: [email-masked] [mailto:[email-masked]] 
	Sent: 26 May 2004 08:30
	To: Mark Grayson (mgrayson)
	Cc: [email-masked]
	Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

	Hi Mark,
	 
	>Another question I have concerns the handling of subscription
ID AVP in the CCA. What happens if this differs from the 
	>value in the CCR. Should the DCCA client use the returned ID in
subseqent CCR messages? Could this be used by an 
	>attacker to charge a third party's account?
	 
	An authenticated identity must always be used in a
Subscription-Id AVP in all the CCR messages, authentication is
	not performed with the DCC application but e.g. with NASREQ or
EAP. The Subscription-id(s) to be used may also be 
	returned by the AAA server in the successful AA-answer that
authenticated the user, this is to be used in CCR messages sent
thereafter.
	The security section discusses recommendations how to prevent an
attacker to modify CCR/CCA messages, basically
	using TLS or IPSec.
	 
	Regards
	Marco

---

From: <[email-masked]>
Date: Wed, 26 May 2004 15:55:45 +0300

>so what is the rationale for having the subscription ID returned in the CCA?
 
Good question!
 
I cannot recall the reason why is in CCA, I tried to dig out in the aaa mail archive
but I didn't find any hint. My opinion is that it shouldn't be there, there is actually
no use for it.
 
Marco

-----Original Message-----
From: ext Mark Grayson (mgrayson) [mailto:[email-masked]]
Sent: 26 May, 2004 15:33
To: Stura Marco (Nokia-NET/Helsinki)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

so what is the rationale for having the subscription ID returned in the CCA?
 
Cheers,
Mark

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 26 May 2004 08:30
To: Mark Grayson (mgrayson)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Hi Mark,

 
Regards
Marco

---

From: "Harri Hakala (JO/LMF)" <[email-masked]>
Date: Wed, 26 May 2004 15:10:01 +0200

Hi,
 
We do not need the subscription-id in the CCA command, so it may be better 
to remove it, since it cause confusion.
 
regards....Harri

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of [email-masked]
Sent: 26. toukokuuta 2004 15:56
To: [email-masked]
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Good question!

Marco

-----Original Message-----
From: ext Mark Grayson (mgrayson) [mailto:[email-masked]]
Sent: 26 May, 2004 15:33
To: Stura Marco (Nokia-NET/Helsinki)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Cheers,
Mark

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 26 May 2004 08:30
To: Mark Grayson (mgrayson)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Hi Mark,

 
Regards
Marco

---

From: "Mark Grayson (mgrayson)" <[email-masked]>
Date: Wed, 26 May 2004 16:04:37 +0200

ok sounds good - also FYI, a typo exists on page 17 -
multiple-service-credit-control, should be
multiple-services-credit-control
 
Cheers,
Mark

	-----Original Message-----
	From: Harri Hakala (JO/LMF) [mailto:[email-masked]] 
	Sent: 26 May 2004 09:10
	To: [email-masked]'; Mark Grayson (mgrayson)
	Cc: [email-masked]
	Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

	Hi,

	We do not need the subscription-id in the CCA command, so it may
be better 
	to remove it, since it cause confusion.
	 
	regards....Harri

		-----Original Message-----
		From: [email-masked]
[mailto:[email-masked]]On Behalf Of [email-masked]
		Sent: 26. toukokuuta 2004 15:56
		To: [email-masked]
		Cc: [email-masked]
		Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

		Good question!
		 
		I cannot recall the reason why is in CCA, I tried to dig
out in the aaa mail archive
		but I didn't find any hint. My opinion is that it
shouldn't be there, there is actually
		no use for it.
		 
		Marco

			-----Original Message-----
			From: ext Mark Grayson (mgrayson)
[mailto:[email-masked]]
			Sent: 26 May, 2004 15:33
			To: Stura Marco (Nokia-NET/Helsinki)
			Cc: [email-masked]
			Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time
Stamp

			so what is the rationale for having the
subscription ID returned in the CCA?
			 
			Cheers,
			Mark

				-----Original Message-----
				From: [email-masked]
[mailto:[email-masked]] 
				Sent: 26 May 2004 08:30
				To: Mark Grayson (mgrayson)
				Cc: [email-masked]
				Subject: RE: [AAA-WG]: DCCA Draft 05:
Event Time Stamp

				Hi Mark,
				 
				>Another question I have concerns the
handling of subscription ID AVP in the CCA. What happens if this differs
from the 
				>value in the CCR. Should the DCCA
client use the returned ID in subseqent CCR messages? Could this be used
by an 
				>attacker to charge a third party's
account?
				 
				An authenticated identity must always be
used in a Subscription-Id AVP in all the CCR messages, authentication is
				not performed with the DCC application
but e.g. with NASREQ or EAP. The Subscription-id(s) to be used may also
be 
				returned by the AAA server in the
successful AA-answer that authenticated the user, this is to be used in
CCR messages sent thereafter.
				The security section discusses
recommendations how to prevent an attacker to modify CCR/CCA messages,
basically
				using TLS or IPSec.
				 
				Regards
				Marco

---

From: "Christopher Richards" <[email-masked]>
Date: Wed, 26 May 2004 12:17:24 -0400

I agree.

Cheers, 
Chris. 

-----Original Message-----
From: Harri Hakala (JO/LMF) [mailto:[email-masked]] 
Sent: Wednesday, May 26, 2004 8:10 AM
To: [email-masked]'; [email-masked]
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Hi,

regards....Harri

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
[email-masked]
Sent: 26. toukokuuta 2004 15:56
To: [email-masked]
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

CCA?
 
Good question!
 
I cannot recall the reason why is in CCA, I tried to dig out in the aaa mail
archive
but I didn't find any hint. My opinion is that it shouldn't be there, there
is actually
no use for it.
 
Marco

-----Original Message-----
From: ext Mark Grayson (mgrayson) [mailto:[email-masked]]
Sent: 26 May, 2004 15:33
To: Stura Marco (Nokia-NET/Helsinki)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Cheers,
Mark

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 26 May 2004 08:30
To: Mark Grayson (mgrayson)
Cc: [email-masked]
Subject: RE: [AAA-WG]: DCCA Draft 05: Event Time Stamp

Hi Mark,
 
>Another question I have concerns the handling of subscription ID AVP in the
CCA. What happens if this differs from the 
>attacker to charge a third party's account?
 
An authenticated identity must always be used in a Subscription-Id AVP in
all the CCR messages, authentication is
not performed with the DCC application but e.g. with NASREQ or EAP. The
Subscription-id(s) to be used may also be 
returned by the AAA server in the successful AA-answer that authenticated
the user, this is to be used in CCR messages sent thereafter.
The security section discusses recommendations how to prevent an attacker to
modify CCR/CCA messages, basically
using TLS or IPSec.
 
Regards
Marco