Subject: [Isms] Latest Proposed Charter Text

From: Wes Hardaker <[email-masked]>
Date: Thu, 30 Apr 2009 13:33:46 -0700

Enclosed is the last charter text (which received no comments after the
last submission).

The only outstanding question I can think of is whether there was
agreement to include TLS into the DTLS draft or not.  Everyone in the
discussion seemed to be "on the fence" so I didn't include it in the
text below, taking that as "not consensus at this time".  If people wish
TLS to be taken into account, now is the time to speak up.

Integrated Security Model for SNMP (isms)

Last Modified: XXXX

Additional information is available at tools.ietf.org/wg/isms

Chair(s):
* Juergen Schoenwaelder <[email-masked]>

Security Area Director(s):
* Tim Polk <[email-masked]>
* Pasi Eronen <[email-masked]>

Security Area Advisor:
* Pasi Eronen <[email-masked]>

Mailing Lists:

General Discussion: [email-masked]
To Subscribe: [email-masked]
In Body: in body: (un)subscribe
Archive: http://www.ietf.org/mail-archive/working-groups/isms/current/maillist.html

Description of Working Group:

The Simple Network Management Protocol version 3 (SNMPv3) provides
message security services through the security subsystem.  Previously
the ISMS Working Group defined a Transport Subsystem definition, a new
Transport Security Model, and a Secure Shell Transport Model and a
method for authenticating SNMPv3 users via the Remote Authentication
Dial-In User Service (RADIUS).  The initial body of work to be
tackled by the working group involved only these pieces.   Additional
work on other transport models and other security extensions were to
wait until the initial transport architecture and defining documents
were completed.

It is now possible to authenticate SNMPv3 messages via a RADIUS when
those messages are sent over the newly defined SSH transport.  However,
it still remains impossible to centrally authorize a given SNMP
transaction as on-device pre-existing authorization configuration is
still required.  In order to leverage a centralized RADIUS service to
its full extent, the access control decision in the Access Control
Subsystem needs to be based on authorization information received from
RADIUS as well.  The result will be an extension to the View-based
Access Control Model (VACM), to obtain authorization information for an
authenticated principal from RADIUS.  The authorization information will
be limited to mapping the authenticated principal to existing access
control polices, defining session timeouts, and similar session
parameters.  This mechanism will not provision the detailed access
control rules.

Additionally, new work will be undertaken to define a DTLS-based
transport that can offer support for environments that prefer
certificate authentication and/or datagram-based transmissions.
Certificate based authentication is desirable for many environments with
a centralized authentication service.  Datagram based transports may be
desired for environments where TCP performance suffers because of
network anomalies (e.g. high packet loss rates).  A DTLS-based transport
would offer a solution that addresses both of these situations.

The current goal of the ISMS working group is two-fold: to develop a
method for allowing for access control decisions to be based on
information provide by an AAA provisioning service and to develop a
DTLS-based Transport Model.

The new work must not modify any other aspects of SNMPv3 protocol as
defined in STD 62 (e.g., it must not create new PDU types).

The working group will cover the following work items:

  - Specify a mechanism to support centralization of SNMPv3 Access
    Control decisions by means of a RADIUS-provisioned
    username-to-groupname dynamic mapping, that would provide a binding
    between a user and preconfigured VACM policies via dynamic additions
    to the securityToGroupname table. Additionally, specify a time limit
    for access decisions, and such a time limit should be used to
    garbage collect expired dynamic securityToGroup mappings.

  - Specify the DTLS transport for SNMP.

Goals and Milestones:
Jul 2009        Publish initial documentation on the DTLS transport for SNMP
Jul 2009        Publish initial documentation for the centralized access control
Jan 2010        Submit documentation on the DTLS transport for SNMP to IESG
Jan 2010        Submit documentation for the centralized access control to IESG

-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Ira McDonald <[email-masked]>
Date: Thu, 30 Apr 2009 21:34:29 -0400

Hi,

I favor including TLS.

I think the commonality of DTLS and TLS (by design)
trumps keeping them separate topics (and I-Ds).

For long sessions in healthy networks, TLS is better.

For sticky times and quick fixes, DTLS has advantages.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Chair - Linux Foundation Open Printing WG
Blue Roof Music/High North Inc
email: [email-masked]
winter:
 579 Park Place  Saline, MI  48176
 734-944-0094
summer:
 PO Box 221  Grand Marais, MI 49839
 906-494-2434

On Thu, Apr 30, 2009 at 4:33 PM, Wes Hardaker <[email-masked]> wrote:

> Archive:
> http://www.ietf.org/mail-archive/working-groups/isms/current/maillist.html
>
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isms
>