Subject: [Spud] Crypto-security of SPUD Properties?

From: Dave Dolson <[email-masked]>
Date: Tue, 24 Nov 2015 21:46:28 +0000

I was just reading the property binding section of
https://tools.ietf.org/html/draft-trammell-spud-req-01.html#section-7.2

(Sorry, if this has been discussed)

Is it intended that properties could be used to authoritatively indicate things to the network?

E.g., could network elements know with crypto-grade confidence that the server is an example.com server?

I'm thinking of a use-case in which an server (at example.com) wants to pay for a mobile user to receive content. The idea is that the user does not pay for the bits; the server pays.
There are several reasons why the server might want to do so:
- the price of purchased digital content (music, book, video) includes "free delivery"
- reversed-charges communication (along the lines of North American  1-800 phone numbers)
- delivery of advertising and promotional content.

Obviously the mobile operator's charging device in the network wants to be sure this property cannot be spoofed by other servers.

I have some ideas about how the crypto would work. I don't know if those details matter to SPUD, provided a property can crypto-sign a packet or tunnel, something like an AH header.

I think it might be possible to attach a property that is meaningless to any network device that a key hasn't been shared with.

Does this seem like a reasonable thing to pursue in the context of SPUD? Is there interest in adding this to the list of use-cases?

David Dolson
Senior Software Architect, Sandvine Inc.

---

From: 🔓Dan Wing <[email-masked]>
Date: Tue, 24 Nov 2015 16:08:31 -0800

On 24-Nov-2015 01:46 pm, Dave Dolson <[email-masked]> wrote: 
> https://tools.ietf.org/html/draft-trammell-spud-req-01.html#section-7.2 <https://tools.ietf.org/html/draft-trammell-spud-req-01.html#section-7.2>
>  
> E.g., could network elements know with crypto-grade confidence that the server is an example.com <http://example.com/> server?
>  
> I’m thinking of a use-case in which an server (at example.com <http://example.com/>) wants to pay for a mobile user to receive content. The idea is that the user does not pay for the bits; the server pays.
> - the price of purchased digital content (music, book, video) includes “free delivery”
> Obviously the mobile operator’s charging device in the network wants to be sure this property cannot be spoofed by other servers.
>  
> I have some ideas about how the crypto would work. I don’t know if those details matter to SPUD, provided a property can crypto-sign a packet or tunnel, something like an AH header.
>  
> I think it might be possible to attach a property that is meaningless to any network device that a key hasn’t been shared with.
>  

This can be done with oauth, where the oauth "resource" is the network resource such as bandwidth (to download a file) or performance (low jitter or low delay for a game).  Typically oauth is used when the "resource" is your pictures stored on cloud service A and being made accessible to cloud service B.

-d