Subject: how to secure a multicast session ?

From: ORLHAC Christophe <[email-masked]>
Date: Wed, 03 Jun 1998 13:37:57 +0200

Hello,

I want to enable multicast on my private network in order to do
visioconferences but I need some security. Is it possible to deny the
access to a group to a receptor ?

I plan to use  Cisco routers. I am wondering if it is possible to create
an access-list where the access to a group (235.0.0.1 for example) is
forbidden to an unicast ip address (10.0.0.15/255.255.255.0 for
example). I think that in this case, all the multicast traffic for the
235.0.0.1 group wouldn't be forwarded to the  10.0.0.0 network.

I think, please tell me if I am wrong, that the only way to do this is
to secure the transfert at the application level by using a key or
something like that.

I need some help, if you have some good addresses or some advices,
please e-mail me.

Thanks for advance.

Christophe.

---

From: Didier Lamballais <[email-masked]>
Date: Wed, 03 Jun 1998 14:17:57 +0200

ORLHAC Christophe wrote:
> I plan to use  Cisco routers. 

Excerpt from Cisco documentation: 

"You can use 'ip multicast boundary <acl>' to configure an
administratively scoped boundary on an interface, for the multicast
groups in the range defined by <acl>. No multicast packets will be
allowed to flow across the boundary from either directions."
Perhaps not exactly what you want to do?

BTW, I tried to use this feature with no success. When I put a boundary
on my main tunnel to the Mbone, it seemed to be apply an all my
multicast interfaces. Setting a boundary on an other interface than this
one works as expected.

I reported the problem to "[email-masked]", and got some
interest, but they seemed to not understand my explanations. :-) 

--
Didier Lamballais, Irisa/Inria Rennes

---

From: [email-masked] (Vadim Fedukovich)
Date: Wed, 3 Jun 1998 16:52:47 +0000 (GMT)

> access to a group to a receptor ?

One might want to take a look at Germano Carroni and other's paper
"Efficient Security for Large and Dinamic Multicast Groups" at
http://www.tik.ee.ethz.ch/tik/research/publications/Publications.html

Vadim Fedukovich

---

From: Liming Wei <[email-masked]>
Date: Wed, 3 Jun 1998 10:20:49 -0700 (PDT)

> From: Didier Lamballais <[email-masked]>
> 

Didier,

It seems a good time to explain this again to the
[email-masked] list. 

(There are tens, if not hundreds, of sites using this command to set up
boundaries today. So maybe they have an answer for you, but they
are waiting for you to ask again.)

-Liming