Subject: RE: [MSEC] De-registration protocol?

From: Ran Canetti <[email-masked]>
Date: Fri, 6 Jul 2001 11:48:03 -0400

Carl,

> From [email-masked] Fri Jul  6 08:33:52 2001

[...]

> 
> Having not seen an API for the MSEC module, I can't comment on 
> whether the addition of a resignation interaction is a problem for 
> the user or not. I thought that one aim of the current MSEC approach 
> is to closely follow the IPSEC APIs. I guess we could map a "delete 
> key" to a "resign" at the interface, though "delete key" is local, 
> and "resign" has network traffic implications.

See my previous note...

> 
> Now that I start thinking about it. How are we to deal with a group 
> whose natural life has ended? A content application finishes, and 
> notifies all subscribing members (i.e. broadcasts) that "the 
> broadcast day has ended", will each application issue a "delete key" 
> to the local MSEC, causing a flood of resignations? Is that what we 
> want?

Good question... has to be taken into consideration when designing the msec
API.

> 
> In the "pay-until-you-say-enough" model, it should be the using 
> application which notifies the sending application that it's had 
> enough, I would put the burden on the sending application to key-out 
> any folks who it wants to ensure are off the air. Alternatively, as I 
> mention above, if it is monitoring the leaves and joins it can leave 
> the key in place (make it easy for the customer to "tune in" again) 
> and start charging when he sees them re-join the multicast group.

Indeed, the member application should be the one that invokes the 
instruction to leave. But it should be msec that does the work for the
application. How can the sender application key-out people? the sender
application has no access to the keys. the keys are part of the msec
module. Keying somebody out must be done by msec.
 
Ran

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: "Carl F. Muckenhirn" <[email-masked]>
Date: Fri, 6 Jul 2001 12:04:31 -0400

Ran,

see below,

>module. Keying somebody out must be done by msec.

Actually the GCKS keys the member out, under the direction of the group owner.

We may be over using the term MSEC, I see MSEC as the underlying 
security for the data transport (analogous to IPSEC), the GCKS/KDC 
plays a role in group management, akin to that provided in IPSEC by 
ISAKMP/IKE. The GCKS/KDC participates in members setting up their 
MSEC modules, much like IKE is used to set up IPSEC for use.

carl.

-- 
Carl F. Muckenhirn
Division Manager
SPARTA, Inc.
Security Engineering Division
9861 Broken Land Parkway, Suite 300
Columbia, Maryland  21046
410.381.9400 x208
410.381.5559 (fax)