DIAMETER firewall using reception IP address or peer identity
Various exemplary embodiments relate to a method performed by a DIAMETER network node, the method including: receiving a first DIAMETER message; determining that the first DIAMETER message is not trusted; and rejecting the first DIAMETER message.
1. A DIAMETER node, comprising:
a DIAMETER interface configured to receive a first DIAMETER message;
a DIAMETER network information extractor configured to extract DIAMETER firewall information from the first DIAMETER message;
a DIAMETER stack configured to store the extracted DIAMETER firewall information;
a firewall rules engine configured to create firewall filtering rules from the stored DIAMETER firewall information and store the created firewall filtering rules; and
a firewall configured to filter the first DIAMETER message based upon the stored firewall filtering rules, wherein the first DIAMETER message is rejected when the first DIAMETER message was sent by a roaming partner and has an application of either Gx or Rx.
2. The DIAMETER node of claim 1 , wherein the firewall rules engine is configured to combine the stored DIAMETER firewall information with information regarding parameters and characteristics related to a desired type of firewall filtering to create the firewall filtering rules.
3. The DIAMETER node of claim 2 , wherein filtering the first DIAMETER message further comprises:
determining that the first DIAMETER message is not trusted by applying the created firewall rule to the first DIAMETER message.
4. The DIAMETER node of claim 1 , wherein the extracted DIAMETER firewall information is DIAMETER information advertised by a peer DIAMETER node.
5. The DIAMETER node of claim 1 , wherein filtering the first DIAMETER message further comprises:
filtering based upon an IP address of the DIAMETER node where the first DIAMETER message is received.
6. The DIAMETER node of claim 1 , wherein filtering the first DIAMETER message further comprises:
filtering based upon a peer identity of a peer node sending the first DIAMETER message.
7. The DIAMETER node of claim 1 , wherein the extracted DIAMETER firewall information includes a DIAMETER command.
8. A method performed by a DIAMETER network node, the method comprising:
receiving, in a DIAMETER interface, a first DIAMETER message;
extracting, in a DIAMETER network information extractor, DIAMETER firewall information from the first DIAMETER message;
storing, in a DIAMETER stack, the extracted DIAMETER firewall information;
creating, in a firewall rules engine, firewall filtering rules from the stored DIAMETER firewall information;
storing, in the firewall rules engine, the created firewall filtering rules; and
filtering, in a firewall, the first DIAMETER message based upon the stored firewall filtering rules, wherein the first DIAMETER message is rejected when the first DIAMETER message was sent by a roaming partner and has an application of either Gx or Rx.
9. The method of claim 8 , further comprising:
receiving, in the DIAMETER interface, a second DIAMETER message;
determining, in the firewall, that the second DIAMETER message is trusted; and
accepting the second DIAMETER message.
10. The method of claim 8 , wherein the DIAMETER firewall information includes an input internet protocol (IP) address of the network node and an associated DIAMETER application, and further comprising:
determining that the first DIAMETER message was received at the input IP address of the network node, wherein the first DIAMETER message has an input IP address and a DIAMETER application that both match the IP address and the associated DIAMETER application of the DIAMETER firewall information.
11. The method of claim 8 , wherein the DIAMETER firewall information includes an input internet protocol (IP) address of the network node and an associated DIAMETER application and a DIAMETER command, and further comprising:
determining that the first DIAMETER message was received at the input IP address of the network node, wherein the DIAMETER message has an input IP address, a DIAMETER application, and a DIAMETER command that all match the input IP address and the associated DIAMETER application and the DIAMETER command of the DIAMETER firewall information.
12. The method of claim 8 , wherein the DIAMETER firewall information includes a peer identity of the peer node sending the first DIAMETER message and an associated DIAMETER application, and further comprising:
determining that the first DIAMETER message was received from a peer node having a peer identity and a DIAMETER application that both match the peer identity and the associated DIAMETER application of the DIAMETER firewall information.
13. The method of claim 8 , wherein the DIAMETER firewall information includes a peer identity of the peer node sending the first DIAMETER message and an associated DIAMETER application and a DIAMETER command, and further comprising:
determining that the first DIAMETER message was received from a peer node having a peer identity, a DIAMETER application, and a DIAMETER command that all match the peer identity and the associated DIAMETER application and the DIAMETER command of the DIAMETER firewall information.
14. The method of claim 8 , wherein the received DIAMETER firewall information is produced by an operator.
15. The method of claim 8 , wherein the DIAMETER firewall information includes a DIAMETER command.
16. The method of claim 8 , wherein the DIAMETER firewall information includes a DIAMETER attribute value pair.
17. A DIAMETER node, comprising:
a DIAMETER interface configured to receive a first DIAMETER message;
a DIAMETER network information extractor configured to extract DIAMETER firewall information from the first DIAMETER message;
a DIAMETER stack configured to store the extracted DIAMETER firewall information;
a firewall rules engine configured to create firewall filtering rules from the stored DIAMETER firewall information and store the created firewall filtering rules; and
a firewall configured to filter the first DIAMETER message based upon the stored firewall filtering rules, wherein the first DIAMETER message is rejected when the first DIAMETER message was sent by a routing agent in an identical realm as the DIAMETER node and has an application of either S9 or Rx.
18. A method performed by a DIAMETER network node, the method comprising:
receiving, in a DIAMETER interface, a first DIAMETER message;
extracting, in a DIAMETER network information extractor, DIAMETER firewall information from the first DIAMETER message;
storing, in a DIAMETER stack, the extracted DIAMETER firewall information;
creating, in a firewall rules engine, firewall filtering rules from the stored DIAMETER firewall information;
storing, in the firewall rules engine, the created firewall filtering rules; and
filtering, in a firewall, the first DIAMETER message based upon the stored firewall filtering rules, when the first DIAMETER message was sent by a routing agent in an identical realm as the DIAMETER node and has an application of either S9 or Rx.