Subject: [Isms] proposed charter text with change to add TLS

From: Wes Hardaker <[email-masked]>
Date: Mon, 04 May 2009 15:26:19 -0700

Here's the charter text again with changes to simply add TLS in addition
to the DTLS work.  Looking back over the comments received, there does
seem to be (IMHO) enough interest to warrant it I think.  There have
been a few people state they'd prefer it done within the single document
*IF* it could be done clearly.  I think it can, so I'm adding it to the
text below.

I'll leave it up to Juergen and/or Pasi to make the final call as to
whether they think there is general agreement to include or exclude TLS
from the scope of work.

Integrated Security Model for SNMP (isms)

Last Modified: XXXX

Additional information is available at tools.ietf.org/wg/isms

Chair(s):
* Juergen Schoenwaelder <[email-masked]>

Security Area Director(s):
* Tim Polk <[email-masked]>
* Pasi Eronen <[email-masked]>

Security Area Advisor:
* Pasi Eronen <[email-masked]>

Mailing Lists:

General Discussion: [email-masked]
To Subscribe: [email-masked]
In Body: in body: (un)subscribe
Archive: http://www.ietf.org/mail-archive/working-groups/isms/current/maillist.html

Description of Working Group:

The Simple Network Management Protocol version 3 (SNMPv3) provides
message security services through the security subsystem.  Previously
the ISMS Working Group defined a Transport Subsystem definition, a new
Transport Security Model, and a Secure Shell Transport Model and a
method for authenticating SNMPv3 users via the Remote Authentication
Dial-In User Service (RADIUS).  The initial body of work to be
tackled by the working group involved only these pieces.   Additional
work on other transport models and other security extensions were to
wait until the initial transport architecture and defining documents
were completed.

It is now possible to authenticate SNMPv3 messages via a RADIUS when
those messages are sent over the newly defined SSH transport.  However,
it still remains impossible to centrally authorize a given SNMP
transaction as on-device pre-existing authorization configuration is
still required.  In order to leverage a centralized RADIUS service to
its full extent, the access control decision in the Access Control
Subsystem needs to be based on authorization information received from
RADIUS as well.  The result will be an extension to the View-based
Access Control Model (VACM), to obtain authorization information for an
authenticated principal from RADIUS.  The authorization information will
be limited to mapping the authenticated principal to existing access
control polices, defining session timeouts, and similar session
parameters.  This mechanism will not provision the detailed access
control rules.

Additionally, new work will be undertaken to define TLS and DTLS-based
transports that can offer support for environments that prefer
certificate authentication.  Certificate based authentication is
desirable for many environments with a centralized authentication
service.  DTLS also provides datagram-based transmissions which may be
desired for environments where TCP performance suffers because of
network anomalies (e.g. high packet loss rates).  A combination of TLS
and DTLS-based transports offers solutions that addresses both the need
for certificate-based authentication and for datagram-based delivery.
Operators will be able to chose the transport solution that best meets
their needs.

The current goal of the ISMS working group is two-fold: to develop a
method for allowing for access control decisions to be based on
information provide by an AAA provisioning service and to develop
TLS-based and DTLS-based Transport Models.

The new work must not modify any other aspects of SNMPv3 protocol as
defined in STD 62 (e.g., it must not create new PDU types).

The working group will cover the following work items:

  - Specify a mechanism to support centralization of SNMPv3 Access
    Control decisions by means of a RADIUS-provisioned
    username-to-groupname dynamic mapping, that would provide a binding
    between a user and preconfigured VACM policies via dynamic additions
    to the securityToGroupname table. Additionally, specify a time limit
    for access decisions, and such a time limit should be used to
    garbage collect expired dynamic securityToGroup mappings.

  - Specify TLS and DTLS transports for SNMP.

Goals and Milestones:
Jul 2009        Publish initial documentation on the (D)TLS transports for SNMP
Jul 2009        Publish initial documentation for the centralized access control
Jan 2010        Submit documentation on the (D)TLS transports for SNMP to IESG
Jan 2010        Submit documentation for the centralized access control to IESG

-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 6 May 2009 14:20:45 +0200

On Tue, May 05, 2009 at 12:26:19AM +0200, Wes Hardaker wrote:

> to the DTLS work.

[...]

> * Juergen Schoenwaelder <[email-masked]>

This needs to be marked as TBD since I won't be able to continue
charing ISMS as the only chair of this WG. (I might help as co-chair
if there is a need but it is already pretty clear that I won't be able
to attend the Hiroshima nor the Anaheim IETF and a chair not attending
his WG meetings does not sound right.)

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 06 May 2009 06:38:02 -0700

>>>>> On Wed, 6 May 2009 14:20:45 +0200, Juergen Schoenwaelder <[email-masked]> said:

JS> This needs to be marked as TBD since I won't be able to continue
JS> charing ISMS as the only chair of this WG. (I might help as co-chair
JS> if there is a need but it is already pretty clear that I won't be
JS> able to attend the Hiroshima nor the Anaheim IETF and a chair not
JS> attending his WG meetings does not sound right.)

The chairs listed in the charter are not really subject to WG charter
text discussions; it's there more to show how it would look.  But I
understand your point and appreciate the work you've done to date.  I'm
confident we can find at least a co-chair fortunately.
-- 
Wes Hardaker
Cobham Analytic Solutions