Subject: Re: [Isms] A picture is worth a 1000 words

From: "Tom Petch" <[email-masked]>
Date: Sun, 8 May 2005 21:24:06 +0200

Many thanks for a most prompt response, and for the ASCII; I didn't say but it
was my preference.

Tom Petch

----- Original Message -----
From: "David B Harrington" <[email-masked]>
To: "'Tom Petch'" <[email-masked]>; <[email-masked]>
Sent: Sunday, May 08, 2005 7:09 PM
Subject: RE: [Isms] A picture is worth a 1000 words

> Hi,
>
> I hate doing ASCII art, but here you go.
>
> USM approach:
>
> The security model is encapsulated by the messaging model, because the
> messaging model needs to (for incoming messages)
> 1) decode the ASN.1 (messaging model)
> 2) determine the SNMP security model and parameters (messaging model)
> 3) decrypt the encrypted portions of the message (security model)
> 4) translate parameters to model-independent parameters (security
> model)
> 5) determine which application should get the decrypted portions
> (messaging model), and
> 6) pass on the decrypted portions with model-independent parameters.
> This is largely dependent on having SNMP-specific message security and
> parameters.
>
> --------------------------------------------------
> |                                                |
> | ---------------------      ------------------  |
> | | SNMP applications | <--> | access control |  |
> | ---------------------      ------------------  |
> |         ^
> |         |
> |         v
> | ---------------------------------------------  |
> |                            ------------------  |
> |   SNMP messaging      <--> | decryption +   |  |
> |                            | translation    |  |
> |                            ------------------  |
> | ---------------------------------------------  |
> |         ^
> |         |
> |         v
> | -----------------------------------------------|
> | | transport mapping                            |
> | -----------------------------------------------|
> |         ^
> |         |
> |         v
> | -----------------------------------------------|
> | | transport layer                              |
> | -----------------------------------------------|
>
>
> TLSM approach:
>
> The order of the steps differ and may be handled by different
> subsystems:
> 1) decrypt the encrypted portions of the message (transport layer)
> 2) determine the SNMP security model and parameters (transport
> mapping)
> 3*) translate parameters to model-independent parameters (transport
> mapping)
> 4) decode the ASN.1 (messaging model)
> 5) determine which application should get the decrypted portions
> (messaging model)
> 6*) translate parameters to model-independent parameters (security
> model)
> 7) pass on the decrypted portions with model-independent security
> parameters
> This is largely based on having non-SNMP-specific message security and
> parameters.
>
> The transport mapping model might provide the translation from (e.g.)
> TLS user to securityName in step 3, OR
> The TLS user might be passed to the messaging model to pass to a
> TLSM/TMSM security model to do the translation in step 6, if the WG
> decides all translations should use the same translation table (e.g.
> the USM MIB).
>
> --------------------------------------------------
> |                                                |
> | ---------------------      ------------------  |
> | | SNMP applications | <--> | access control |  |
> | ---------------------      ------------------  |
> |         ^
> |         |
> |         v
> | ---------------------------------------------  |
> |                            ------------------  |
> |   SNMP messaging     <--> | translation*    |  |
> |                            ------------------  |
> |----------------------------------------------  |
> |         ^
> |         |
> |         v
> | -----------------------------------------------|
> |                            ------------------  |
> |  transport mapping   <--> | translation*    |  |
> |                            ------------------  |
> | -----------------------------------------------|
> |         ^
> |         |
> |         v
> | -----------------------------------------------|
> |                            ------------------  |
> |   transport layer     <--> | decryption     |  |
> |                            ------------------  |
> | -----------------------------------------------|
>
> Hope this helps,
> David Harrington
> [email-masked]
>
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Tom Petch
> > Sent: Sunday, May 08, 2005 5:38 AM
> > To: [email-masked]
> > Subject: [Isms] A picture is worth a 1000 words
> >
> > I would find it most helpful at this stage to have a picture
> > of the way
> > TLSM/TMSM fits in with the
> > architecture of SNMP (as in RFC 3411 s3.1.3) ie a follow up to
> >
> > "TODO: Insert drawing here..."
> >
> > from
> >
> > SNMPv3 Transport Mapping Security Model  section 3.2
> >
> > Tom Petch
> >
> >
> > _______________________________________________
> > Isms mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/isms
> >
>
>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms