Chargeable User Identity
Extracted elements (20)
CUI is designed as a temporary alias to the real user identity to satisfy billing and fraud-prevention business requirements of roaming partners while preserving user anonymity. The binding lifetime of the CUI reference should be long enough to be useful (e.g., one billing period) but short enough to prevent long-term user identification.
The RADIUS Class(25) attribute cannot carry CUI because RFC 2865 requires clients to not interpret it locally, and multiple Class attributes may be present in a packet, making it impossible for entities outside the home network to determine which contains the CUI.
The RADIUS User-Name(1) attribute cannot reliably carry CUI because intermediaries may rewrite it in Access-Request packets for routing purposes, and the Access-Request and Accounting-Request packets may follow different paths, so a separate attribute is required to convey a stable identity.
Diameter requires an identical CUI attribute with the same Type value (89) to be defined. The CUI should be made available as part of the Diameter NASREQ application defined in RFC 4005.
A NAS that received a CUI during re-authentication MUST include the value of that CUI in all Accounting Messages.
A RADIUS client that wishes to receive the CUI attribute in an Access-Accept MUST include a CUI attribute in the Access-Request packet; for initial authentication the CUI string is set to a single NUL character.
If a CUI attribute was included in an Access-Accept packet, RADIUS clients supporting CUI MUST ensure the CUI attribute appears in all RADIUS Accounting-Request packets (Start, Interim, and Stop), regardless of whether the client originally requested the CUI.
If a home RADIUS server supporting CUI receives an Access-Request containing a CUI attribute (nul or non-nul), it MUST include the CUI attribute in the Access-Accept packet. Conversely, if the Access-Request does not contain a CUI, the home server SHOULD NOT include CUI in the Access-Accept.
If an Access-Accept packet without a CUI attribute is received by a RADIUS client that had requested CUI, the client MAY treat the Access-Accept as an Access-Reject.
RADIUS clients (proxy or NAS) outside the home network MUST NOT modify the CUI attribute.
RADIUS entities other than the home RADIUS server MUST treat the CUI content as an opaque token and SHOULD NOT perform operations on its content other than a binary equality comparison between two CUI instances.
RADIUS entities outside the home network MUST NOT insert a CUI into an Access-Accept packet.
To prevent a man-in-the-middle from stripping the CUI from an Access-Request (a denial-of-service vector), the NAS SHOULD include a Message-Authenticator(80) attribute within Access-Request packets that contain a CUI attribute.
Upon receiving a non-nul CUI in an Access-Request, the home RADIUS server MAY verify the CUI matches the one from the previous Access-Accept. If verification fails, the server SHOULD respond with an Access-Reject.
A nul CUI is a CUI attribute whose String field contains a single NUL character (0x00), used by a RADIUS client in an initial Access-Request to signal support for and request a CUI from the home RADIUS server. During re-authentication, a previously received non-nul CUI value is sent instead.
The Chargeable-User-Identity (CUI) attribute is a RADIUS attribute that serves as an alias or handle to the user's real identity, assigned by the home network. It may represent an individual user or a group, and is passed to roaming partners for billing and fraud prevention. RADIUS clients and proxies outside the home network MUST NOT modify it.
IANA assigned RADIUS attribute type number 89 to the Chargeable-User-Identity (CUI) attribute in the RADIUS Types namespace at http://www.iana.org/assignments/radius-types.
A man-in-the-middle may attempt to insert, modify, or remove the CUI in Access-Accept and Accounting packets to commit theft-of-service. RADIUS Access-Accept and Accounting packets already provide integrity protection, which mitigates but does not fully prevent this attack since there is no way to detect or prevent CUI modification by a proxy.
The CUI format used SHOULD NOT reveal the real user identity. Where a CUI is a reference to a real user identity, the binding lifetime SHOULD be kept as short as possible to limit the window during which the CUI could be used to identify the user.
The CUI attribute has Type=89, Length>=3 (one octet each for Type and Length, plus at least one octet for String). The String field is an opaque token whose format and content are determined by the home RADIUS server; a single NUL character indicates a request for CUI.