-
Key: DDSSEC11-81
-
Status: closed
-
Source: THALES ( Cyril Dangerville)
-
Summary:
After two participants are mutually authenticated and authorized, each participant's session with the remote participant (certificate, shared secret, challenge1, challenge2...) may be terminated/removed at a certain time for various reasons such as:
- Automatic termination: sessions should have a max lifetime to follow best security practices, to handle the fact that the remote participant's certificate may expire, be revoked, etc. and therefore no longer trusted (worst case scenario: the issuing CA (or any ancestor) cert expires/is revoked).
- Administrative termination: some administrator decides to force the session termination because of a security alert or for debugging purposes.
If the session is terminated on one side but not on the other, we end up in the same deadlock situation as in
DDSSEC11-43(scenario 1 and 2) except the root cause is not liveliness loss but simple automatic/administrative session termination. -
Reported: DDS-SECURITY 1.0 — Sat, 20 May 2017 16:26 GMT
-
Disposition: Duplicate or Merged — DDS-SECURITY 1.1
-
Disposition Summary:
Close as duplicate of
DDSSEC11-43This will be handled with
DDSSEC11-43 -
Updated: Tue, 19 Dec 2017 20:03 GMT
DDSSEC11 — Non-Recoverable Communication After Authentication Session Terminated
- Key: DDSSEC11-81
- OMG Task Force: DDS Security 1.1 RTF