X-Header Enrichment Anti Spoofing - Cisco ASR 5000 Series Administration Manual

Enhanced Charging Service Overview
 msisdn-no-cc
 radius-calling-station-id
 session-id
 sn-rulebase
 subscriber-ip-address
 username
 user-profile
 uli
The following HTTP-related x-headers are supported:
 host
 url
In addition, ECS also allows string constants to be inserted as an x-header. For more information on configuring the x-
header formats, see the insert command section in the ACS x-Header Format Configuration Mode Commands chapter of
the Command Line Interface Reference.

X-Header Enrichment Anti Spoofing

This section provides an overview of the x-Header Enrichment Anti Spoofing feature.
The Header Enrichment feature allows operators to encrypt and insert subscriber-specific fields as x-headers in to the
HTTP headers of URL requests. However, this might leave the header open to spoofing by malicious external devices.
The Anti Spoofing feature enables deletion and modification of the existing x-header fields to protect the operators and
subscribers from spoofing, and provides a fraud detection mechanism when an external portal is used for a subscriber or
content authorization.
The feature detects and removes user-generated HTTP headers if the header name is similar to the header name used in
the x-header format, and when multiple entries of the same field exist in the header, all the similar entries are removed
and one with a modified value is inserted at the end of the HTTP header.
When anti spoofing is enabled, and if the HTTP header in the GET or POST request spawns across more than one
packet, the packets with incomplete HTTP header will be buffered. The buffered packets are sent out once the HTTP
header is completed.
The Anti Spoofing feature is disabled by default and can be enabled/disabled at a field level in the CLI.
Limitations to the Anti-Spoofing Feature:
 Header enrichment does not occur if a route to the MMS analyzer exist in the rulebase.
 Header enrichment works only for the first request of a packet with concatenated requests, when the packets are
buffered at DCCA.
 If a packet is buffered by ICAP, header insertion will not occur for that packet.
 ECS will not be able to perform header enrichment when all fragments are not received before reassembly
timeout in the case of IP fragments packets.
 ECS does not perform more than one flow action which modifies the inbound packet before sending it on the
outbound interface.
 If the HTTP GET or POST header is not completed in three packets, anti spoofing will occur only for the last
packet in which the header completes, as buffering supported only up to a maximum of two packets.
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
Enhanced Features and Functionality ▀
63