Subject: [MSEC] Multicast security AAA

From: Prashant Pilllai <[email-masked]>
Date: Mon, 16 Jan 2006 16:17:16 +0000

Hi All,

I have been working previously with RADIUS and DIAMETER protocols for AAA.

I wanted to know if there is any work done in the MSEC group for AAA for
multicast security? like MSEC with RADIUS/DIAMETER?

Does the MSEc group look into how the access control is provided for a
multicast group?  e.g. A user wants to join a multicast group. He would send
an IGMP join message (to the routers connected to it...all the way to the
source?). is there a method to know who this user is and validate his
credentials? something like secure extensions for IGMP?

How does the multicast source know that is is a valid new user and that he
should be allowed to join and hence initiate a re-keying mechanisms?

Thanks.

Regards
Prashant Pillai
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: George Gross <[email-masked]>
Date: Thu, 19 Jan 2006 14:19:51 -0500 (EST)

Hi Prashant,

inline below...

> multicast security? like MSEC with RADIUS/DIAMETER?

You may wish to look at the MSEC working group's IETF58 meeting viewgraphs
archived at www.securemulticast.org. I presented an overview of the topic
of MSEC/AAA. However, there was no consensus to develop those concepts
further.

> credentials? something like secure extensions for IGMP?

AFAIK there have not been any (recent) attempts in MAGMA or MSEC to
enhance IGMP along those lines. There has been an AAA multicast
requirements Internet Draft floating in the mboned working group:

draft-ietf-mboned-maccnt-req-02.txt

But that draft's architectural focus seems to be controlling an end
systems's IGMP access to the Service Provider's multicast routing
infrastructure rather than using a MSEC group key management protocol in
combination with AAA to protect the multicasted content. In other words,
the MSEC group key management protocol exchange would occur in parallel
and separate from the IGMP protocol exchange. Of course, any proposed
piggybacking of AAA related payloads onto IGMP would require significant
IGMP protocol changes to be secure...

hth,
	George