Abstract:
Various exemplary embodiments relate to a method performed by a DIAMETER network node, the method including: receiving a first DIAMETER message; determining that the first DIAMETER message is not trusted; and rejecting the first DIAMETER message.

Description:
TECHNICAL FIELD 
       [0001]    Various exemplary embodiments disclosed herein relate generally to providing a firewall in DIAMETER networks. 
       BACKGROUND 
       [0002]    DIAMETER networks are widely used today in communication networks. In a DIAMETER network of any significant size, any given device may be typically connected to an agent of some sort (for example, routing, proxying, relay, etc.) and is not connected to the device with which it is interacting. DIAMETER defines the advertising of functionality only to the connected peer. This means that a server does not know whether a device that is requesting service is a legitimate source for such a request. For example, a non-gateway device could send a message pretending to be a gateway in the routing network. By pretending to be something that it is not and by sending invalid requests, a device could wreak havoc in a network. 
       SUMMARY 
       [0003]    A brief summary of various exemplary embodiments is presented below. Some simplifications and omissions may be made in the following summary, which is intended to highlight and introduce some aspects of the various exemplary embodiments, but not to limit the scope of the invention. Detailed descriptions of a preferred exemplary embodiment adequate to allow those of ordinary skill in the art to make and use the inventive concepts will follow in later sections. 
         [0004]    Various exemplary embodiments relate to a method performed by a DIAMETER network node, the method including: receiving a first DIAMETER message; determining that the first DIAMETER message is not trusted; and rejecting the first DIAMETER message. 
         [0005]    Various exemplary embodiments relate to a DIAMETER node, comprising: a DIAMETER interface configured to receive a DIAMETER message; a DIAMETER network information extractor configured to receive DIAMETER firewall information; a diameter stack; a firewall rules engine; and a firewall configured to filter the received DIAMETER messages. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0006]    In order to better understand various exemplary embodiments, reference is made to the accompanying drawings, wherein: 
           [0007]      FIG. 1  illustrates an exemplary DIAMETER network using a DIAMETER firewall; 
           [0008]      FIG. 2  illustrates an embodiment of a DIAMETER node using a DIAMETER firewall; 
           [0009]      FIG. 3  illustrates an exemplary firewall filtering rule for a firewall based upon peer identity; 
           [0010]      FIG. 4  illustrates an exemplary firewall filtering rule for a firewall based upon an input IP address; and 
           [0011]      FIG. 5  illustrates a flow diagram illustrating a method of implementing a DIAMETER firewall. 
       
    
    
       [0012]    To facilitate understanding, identical reference numerals have been used to designate elements having substantially the same or similar structure and/or substantially the same or similar function. 
       DETAILED DESCRIPTION 
       [0013]    The Diameter protocol specification RFC 3588 does not say much about how to defend against invalid requests other than that the route-record attribute value pair (AVP) should be analyzed to confirm that the message travelled an accepted path. Security is typically only done from peer to peer, so any device may be in effect trusting its peers and all of their peers ad infinitum to be trusted. Because of connectivity to roaming partners around the world, use of this method is in effect trusting the entire globe-spanning network. 
         [0014]      FIG. 1  illustrates an exemplary DIAMETER network using a DIAMETER firewall. The DIAMETER network  100  may include an internal network  105 , a gateway network  110 , a partner network  115 , a first routing agent  120 , a second routing agent  125 , an edge agent  130 , and a partner agent  135 . The internal network  105  would generally be trusted as it is under the control of a single network operator. Accordingly, a DIAMETER firewall may not be used within the internal network  105  or for messages received by the first routing agent  120  from the internal network  105 . Alternatively, the DIAMETER firewall may be used with the internal network  105  in order to filter out messages. For example, only certain types of messages may be sent within or by the internal network  105 . When a message of another type is sent by the internal network, this message may be filtered out because it might be in error or malicious if the internal network is compromised. 
         [0015]    The gateway network  110  interfaces with external networks. Accordingly, DIAMETER messages received from the gateway networks  110  may not be trusted. Therefore, the second routing agent  125  may filter out DIAMETER messages from the gateway network  110 . 
         [0016]    The edge agent  135  may communicate with a partner network  115  via a partner agent  135 . Again, because the partner network  115  and the partner agent  135  may not be trusted, the edge agent  130  may filter DIAMETER messages using a DIAMETER firewall. 
         [0017]    The following descriptions provide examples of how the DIAMETER firewall may operate in a DIAMETER network. The edge agent  130  may include a DIAMETER firewall. The DIAMETER firewall may filter DIAMETER messages based upon either the input internet protocol (IP) address or peer identity. The edge agent  130  may include three different input IP address: 192.168.0.10; 192.168.0.11, and 138.120.54.19. For example, the DIAMETER firewall may only allow Gx messages to be received at 192.168.0.10, or any other desired group of DIAMETER applications. Alternatively, the DIAMETER firewall may only filter a specific group of DIAMETER applications and allow all other DIAMETER messages to pass. Further, the firewall may also filter messages based upon DIAMETER commands and even specific AVPs within those commands. Also, the filtering may be done based upon any combination of DIAMETER applications, commands, and/or AVPs. 
         [0018]    Alternatively, DIAMETER filtering based upon peer identity may be used. The peer identity may identity specific devices, networks, or network segments. For example, filtering may done when the peer identity is from any roaming partner. In another example, filtering may be done when the peer identity is from an internal network. Alternatively, filtering may be based upon a specific roaming partner or group of roaming partners. Further, filtering may further be done based upon any combination of DIAMETER applications, commands, and/or AVPs as described above with respect to filtering based upon input IP address. 
         [0019]      FIG. 2  illustrates an embodiment of a DIAMETER node using a DIAMETER firewall. The DIAMETER node  200  may include hardware and/or executable instructions encoded on a machine-readable storage medium configured to implement a DIAMETER firewall. The DIAMETER node  200  may include a plurality of ports  205   a - 205   n,  an I/O interface  210 , a DIAMETER network information extractor  215 , a diameter stack  220 , firewall rules engine  225 , firewall rules storage  230 , and a firewall  235 . 
         [0020]    The I/O interface  210  may include hardware and/or executable instructions encoded on a machine-readable storage medium configured to interface with ports  205   a - 205   n.  The ports  205   a - 205   n  in conjunction with the I/O interface  210  may provide the DIAMETER node  200  connectivity to other DIAMETER nodes in the DIAMETER network. The ports  205   a - 205   n  may receive DIAMETER messages from other DIAMETER nodes in the DIAMETER network. 
         [0021]    The DIAMETER network information extractor  215  may include hardware and/or executable instructions encoded on a machine-readable storage medium configured to extract information used to filter DIAMETER messages by the firewall  235 . The DIAMETER network information extractor  215  may receive DIAMETER messages that advertise the functionality of DIAMETER network peers. The advertised functionality may include the DIAMETER applications and commands that the DIAMETER peer may use. Information related to the advertised functionality may be extracted from the DIAMETER message and stored in the DIAMETER stack  220 . In addition to the DIAMETER applications and commands, the DIAMETER stack  220  may include information indicating the DIAMETER node input IP address at which the DIAMETER message was received and/or information identifying the peer DIAMETER node. 
         [0022]    The DIAMETER stack  220  may be a device that stores information related to DIAMETER peers that interact and communicate with the DIAMETER node  200 . Thus, the DIAMETER stack  220  may include a machine-readable storage medium such as read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and/or similar storage media. 
         [0023]    The firewall rules engine  225  may include hardware and/or executable instructions encoded on a machine-readable storage medium configured to create firewall filtering rules used by the firewall  235 . The firewall rules engine  225  may receive inputs from a user, a network management node, or some other network node that provides information regarding parameters and characteristics related to the type of firewall filtering desired. The firewall rules engine  225  may use these inputs along with information from the diameter stack  220  to create the firewall filtering rules. The firewall engine  225  may also determine what IP addresses are in use by the DIAMETER node  220 , as well as topographical information relating to the networks that include the DIAMETER node  220 . The firewall filtering rules generated by the firewall rules engine  225  may then be stored in the firewall rules storage  230 . 
         [0024]    The firewall rules storage  230  may be a device that stores firewall filter rules. Thus, the firewall rules storage  230  may include a machine-readable storage medium such as read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and/or similar storage media. 
         [0025]    The DIAMETER firewall  235  may include hardware and/or executable instructions encoded on a machine-readable storage medium configured to implement a DIAMETER firewall using firewall filtering rules that filterDIAMETER messages. The firewall  235  may receive DIAMETER messages via the I/O interface  220  from the ports  225   a - 225   n.  The firewall  235  may use information from the received DIAMETER message to determine whether to reject the received DIAMETER message based upon the firewall filtering rules that are in force. 
         [0026]      FIG. 3  illustrates an exemplary firewall filtering rule system for a firewall based upon peer identity. The filtering rule system  300  may include a rule table that represents logic used by the firewall  235  to filter DIAMETER messages received by the DIAMETER node  200 . The firewall rule system  300  may include a rule set that filters DIAMETER requests. First, the firewall rule system  300  may determine if the Diameter Request.Peer-Origin-Host in the received DIAMETER message indicates that the message is from a roaming partner. If so, then the rule may determine if the application of the DIAMETER request is either a Gx or Rx. If so, then the DIAMETER message is rejected by setting the Diameter Answer result code to indicate that the message is rejected along with an error message indicating the same. Further, the firewall rule system  300  may determine if the Diameter Request.Peer-Origin-Host in the received DIAMETER message indicates that the message is from a routing agent in the same realm as the DIAMETER node  200 . If so, the firewall rule  300  may determine if the application of the DIAMETER request is either S9 or Rx. If so, then the DIAMETER message may be rejected by setting the Diameter Answer result code to indicate that the message is rejected along with an error message indicating the same. 
         [0027]      FIG. 4  illustrates an exemplary firewall filtering rule system for a firewall based upon an IP address. The filtering rule system  400  is similar to the filtering rule system  300 , but instead uses the IP address instead of the peer identity. The firewall rule system  400  may include a rule set that filters DIAMETER requests. First, the firewall rule system  400  may determine if the Diameter_Request.Reception-Address in the received DIAMETER message indicates that the message is received on a specific IP address 138.120.54.19. If so, then the rule may determine if the application of the DIAMETER request is either a Gx or Rx. If so, then the DIAMETER message is rejected by setting the Diameter Answer result code to indicate that the message is rejected along with an error message indicating the same. Further, the firewall rule system  400  may determine if the Diameter_Request.Reception-Address in the received DIAMETER message indicates that the message is received on a specific IP address 192.168.0.11. If so, the firewall rule system  400  may determine if the application of the DIAMETER request is either S9 or Rx. If so, then the DIAMETER message may be rejected by setting the Diameter Answer result code to indicate that the message is rejected along with an error message indicating the same. 
         [0028]    The filtering rule system  300  and filtering rule system  400  are just examples of firewall filtering rules that may be implemented. Much more complex rules may be contemplated to carry out more complex filtering schemes. Further, the logic of the rules may also be set to allow receipt of specific types of messages, while rejecting all other types of messages. 
         [0029]      FIG. 5  illustrates a flow diagram illustrating a method of implementing a DIAMETER firewall. The method  500  may start at  505 . Next, the method  500  may receive a DIAMETER firewall application or command information  510 . Such information may be provisioned by an operator because information advertized by a peer DIAMETER node may not be trusted. Further, such information relating to allowable applications/command may be preloaded in the system. This preloading may be done in the factory or in the field at the time of deployment. The received DIAMETER firewall or application information may then be stored in a diameter stack  515 . The method  500  may next create firewall rules based upon the received DIAMETER firewall application or command information  520 . The firewall rules may then be stored  525 . Next, the method  500  may receive a DIAMETER message from a DIAMETER peer  530 . Then the method  500  determines if the DIAMETER message is trusted  535 . This determination may be based upon the firewall rules. Further, the determination may be based upon the IP address where the message is received, the peer identity of the message, the type of application, or any other DIAMETER message characteristic or parameter the may be used to filter DIAMETER messages. 
         [0030]    If the DIAMETER message is not trusted, then the method  500  may reject the DIAMETER message  540  and then stop  550 . If the DIAMETER message is trusted, then the method  500  may accept the DIAMETER message  545  and then stop. The accepted DIAMETER message may be further processed by the DIAMETER node. 
         [0031]    In the description of the various embodiments above, certain examples of filtering of DIAMETER messages are disclosed that use certain types of DIAMETER message information. Filtering may also be done at the AVP level in addition to the application and command level or any combination thereof. Such variations and control allow the DIAMETER node  200  to develop any number of simple and/or complex firewall rules to filter incoming DIAMETER messages. 
         [0032]    It should be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the invention. Similarly, it will be appreciated that any flow charts, flow diagrams, state transition diagrams, pseudo code, and the like represent various processes which may be substantially represented in machine readable media and so executed by a computer or processor, whether or not such computer or processor is explicitly shown. 
         [0033]    Although the various exemplary embodiments have been described in detail with particular reference to certain exemplary aspects thereof, it should be understood that the invention is capable of other embodiments and its details are capable of modifications in various obvious respects. As is readily apparent to those skilled in the art, variations and modifications can be effected while remaining within the spirit and scope of the invention. Accordingly, the foregoing disclosure, description, and figures are for illustrative purposes only and do not in any way limit the invention, which is defined only by the claims.