Subject: Re: [MSEC] msec spec language ASN issues

From: Hugh Harney <[email-masked]>
Date: Tue, 9 Sep 2003 09:27:32 -0400

George,

I'm open to using Diameter as the specification language, if it is 
possible to construct a high assurance policy engine based on X.509 
certificates. A big hurdle to constructing a high assurance policy 
engine between two specification languages is the need to have high 
assurance translation software.

How does the AAA specification language relate to ASN? If Diameter can 
encapsulate a standard ASN.1 DER encoded structure, then it could be 
used to tie all the security policy specification together - S-Mime 
uses ASN and the certificates are in ASN.

I'm only stuck on ASN because the certificates use ASN. The 
authorization and access control policies will have to relate to the 
ASN.1 DER encoded certificates as mechanisms for enforcement.

I'm particularly concerned with the need to validate rules written in 
Diameter (or anything else) using data that is defined in ASN.1 DER 
encoding. I'm leery of translation code if it must either change the 
parameters that come from the certificates or change the rules that 
come from the policy tokens.

On way around this is if Diameter can specify a subset of rules in 
ASN.1 DER encoding. Then there is a 1-1 mapping of security mechanisms 
to security policy. I then can see how a high assurance policy engine 
can be constructed.

Hugh

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec