NEA Working Group IETF 72
description
Transcript of NEA Working Group IETF 72
NEA Working GroupIETF 72
nea[-request]@ietf.org
http://tools.ietf.org/wg/nea
Co-chairs: Steve Hanna [email protected]
Susan Thomson [email protected]
Agenda Review0900 Administrivia
Blue SheetsJabber & Minute scribesAgenda bashing
0905 WG Status0910 Protocol Overview 0915 Changes in -01 version of PB-TNC and PA-TNC:
http://www.ietf.org/internet-drafts/draft-ietf-nea-pa-tnc-01.txthttp://www.ietf.org/internet-drafts/draft-ietf-nea-pb-tnc-01.txt
0930 Protocol Flows1015 Proposed Changes in -02 version of PB-TNC and PA-TNC 1100 Open Discussion1125 Review Milestones 1130 Adjourn
WG Accomplishments since IETF71
• Consensus Check on PA-TNC, PB-TNC as WG docs (Mar 2008)
• PA-TNC and PB-TNC -00 I-D (April 2008) • WG Last Call for NEA requirements (April 2008)• NEA Requirements published as RFC 5209
(May 2008)• PA-TNC and PB-TNC -01 I-D (July 2008)
http://www.ietf.org/internet-drafts/draft-ietf-nea-pa-tnc-01.txthttp://www.ietf.org/internet-drafts/draft-ietf-nea-pb-tnc-01.txt
NEA Protocol Overview
NEA Reference Modelfrom RFC 5209
Posture Collectors
Posture Validators
PostureTransportServer
Posture Attribute (PA) protocol
Posture Broker (PB) protocol
NEA Client NEA Server
Posture Transport (PT) protocolsPostureTransportClient
PostureBrokerClient
PostureBrokerServer
PA-TNC Within PB-TNCPT
PB-TNC Header
PB-TNC Message (Type=PB-Batch-Type, Batch-Type=CDATA)
PB-TNC Message (Type=PB-PA, PA Vendor ID=0, PA Subtype= OS)
PA-TNC Message
PA-TNC Attribute (Type=Product Info, Product ID=Windows XP)
PA-TNC Attribute (Type=Numeric Version, Major=5, Minor=3, ...)
Changes in PB-TNC , PA-TNC Version -01
Changes in -01 versions ofPB-TNC and PA-TNC
Steve Hanna <[email protected]>
Kaushik Narayan <[email protected]>
IETF 72
Common changes
• Scaled back text on TCG/TNC
• Added Design Considerations
• Added evaluation for Requirement C-11
• Added Appendix A (flows/use cases)
• Added Kaushik Narayan as co-editor
Changes only in PB-TNC -01
• MUST send error if message len < 12
PB-TNC Design Considerations (Section 2)
• Efficiency– Binary TLVs
• Vendor ID– SMI PEN, assigned by IANA– Avoids collisions between vendor-defined values– IETF Standard values use Vendor ID 0
• Two Choices for Message Addressing– PB-TNC Message Type (when EXPL = 0)
• PVs and PCs Subscribe To Message Types• Message Type = PB-TNC Vendor ID + PA Subtype
– Explicit Delivery (when EXPL = 1)• PBC/PBS delivers message only to one PC/PV• PC/PV identified by PC ID or PV ID field
Changes only in PA-TNC -01
• Added Field Types– Defines commonly used primitive types in the value
field of attributes.– Types include
• OctetArray (Binary data)• Integer (32 bit unsigned integer)• String (UTF-8 encoded Octet Array)• IPv4Address • IPv6Address• TimeString (UTC, RFC3339 compliant string)• VersionNum (64 bit value with major & minor version)
PA-TNC Design Considerations (Section 2)
• Standard attribute namespace– Standard PA sub-types and attributes to enable multi-
vendor interoperability.
• Vendor specific namespace– Vendor specific PA sub-types and attributes to enable
vendor differentiation and agility
• TLV encoding– Binary encoding to optimize for bits-on-the-wire and
CPU utilization.
NEA Protocol Flows
Proposed Changes in PB-TNC, PA-TNC Version -02
Proposed updates toPosture Broker protocol
draft-ietf-nea-pb-tnc-01.txt
Ravi SahitaIETF 72 NEA WG
July 31, 2008
Outline of proposed changes to NEA Posture Broker protocol
• Simplification items
• New proposed changes– Protocol changes to allow unsolicited retries– Evaluation results
Simplification: Reduce Message Types
• Move PB-Batch-Type into PB-TNC header– PB-Batch-Type carried with every batch
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|D| Reserved | Batch Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Batch Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Proposed Addition of unsolicited retries to Posture Broker Protocol
• Allow Unsolicited Retry from NEA Client or Server at any time (if PT allows)
• Support matching requests to response messages by adding a Message Id to the protocol
• Update error reporting parameters message to allow indicating erroneous message by specifying Message Id
• See updated state machine on next slide
Posture Broker - Updated State Machine
Proposed Addition of Global Assessment Decision
• Indicates posture assessment result to the posture broker client
• Does not replace Access-Recommendation message type
• Suggested Values• Compliant• Non-compliant• Non-compliant major issue• Error• Don’t Know Result
Proposed updates toPosture Attribute protocol
draft-ietf-nea-pa-tnc-01.txt
Paul SangsterIETF 72 NEA WG
July 31, 2008
PA-TNC Proposed Changes
• New Approach to Attribute Correlation
• Add PA-TNC Assessment Result Attribute
• Add PA-TNC Remediation Attribute
Correlation ID
• Correlation ID– Only used when PC reports posture on
multiple implementations of component– ID allows PV to associate attributes describing
same implementation– Attributes are atomic so PV needs to know
which implementation associated with attribute (e.g. which AV has version 1.2.3?)
• Not expected to be the common case
Proposed New Approach to Correlation
• Proposal– Remove PA-TNC Correlation ID– Integrate semantics into PB-TNC Header’s Posture
Collector ID (PC ID)• PC ID is source identifier for use by PV• Now some PCs might have multiple PC IDs
– Each component implementation needs separate PA-TNC message (with different PC IDs)
• PV doesn’t know that single PC supporting multiple implementations of same component– Both appear as separate PCs
• PC associates different PC IDs with different implementations of same component type
Before Correlation ChangePT
PB-TNC Header
PB-TNC Message TLV (Type=PB-Batch-Type, Batch-Type=CDATA)
PB-TNC Message TLV (Type=PB-PA, PA Vendor=0, PA Subtype=OS)
PB-PA TNC Header
PA-TNC Attribute TLV (Type=Prod Info, Prod ID=Norton AV, C=1)
PA-TNC Attribute TLV (Type=Numeric Version, Maj=5, Min=3, C=1)
PA-TNC Attribute TLV (Type=Prod Info, Prod ID=McAfee AV, C=2)
PA-TNC Attribute TLV (Type=Numeric Version, Maj=1, Min=2, C=2)
After Correlation ChangePT
PB-TNC Header
PB-TNC Message TLV (Type=PB-Batch-Type, Batch-Type=CDATA)
PB-TNC Message TLV (Type=PB-PA, PA Vendor=0, PA Subtype=OS)
PB-PA TNC Header
PA-TNC Attribute TLV (Type=Prod Info, Prod ID=Norton AV)
PA-TNC Attribute TLV (Type=Numeric Version, Maj=5, Min=3)
PB-TNC Message TLV (Type=PB-PA, PA Vendor=0, PA Subtype=OS)
PB-PA TNC Header
PA-TNC Attribute TLV (Type=Prod Info, Prod ID=McAfee AV)
PA-TNC Attribute TLV (Type=Numeric Version, Maj=1, Min=2)
+12B
-4B
-4B
+12B
-4B
-4B
Correlation ID Trade-Off
• Benefit– Simplifies PA-TNC Attribute Header– Removes optional Attribute Header field and flag– Less bits on wire when many attributes sent for same
component (more common case)
• Cost– Attributes about each implementation must be in
separate PB-TNC messages– More bits on wire when fewer attributes for multiple
products reported (less common case)– Potentially more complex PBC, PBS implementation
Proposed Addition of Assessment Result Attribute
• PA Result Attribute conveys PV’s compliance decision about component
• Not mandatory to send• Largely informational for Posture Collector• Posture Collector would learn if
assessment was deemed compliant only for its peer Posture Validator
• Could be accompanied by new Remediation Attribute
Proposed Addition of Remediation Attribute
• PA-TNC Remediation Attribute allows PV to provide repair instructions to PC
• Remediation instructions allows for standard and vendor-defined data formats
• Parallels current PB-Remediation-Parameters TLV
• Exclusive delivery may be required so only one PC performs remediation
Open Mic
Additional Attribute?
• What additional standard attributes should be included in the standard?
• Currently have:– Attribute Request– Product Information– Numeric Version– String Version– Operational Status– Port Filter– Installed Packages– PA-TNC Error
Additional Components?
• What additional standard components should be included in the standard?
• Currently have:– Operating System– Anti-Virus– Anti-Spyware– Anti-Malware– Firewall– Host-based Intrusion Detection/Prevention Software– Virtual Private Network
Milestones
Done Proposals for PA and PB dueDone Review and resolve proposals at IETF 71Done Post first WG version of PA and PBDone Post second version of PA and PBJul 2008 Resolve issues at IETF 72Aug 2008 Post third version of PA and PBSep 2008 WGLC on PA and PBNov 2008 Resolve WGLC comments at IETF 73 Post fourth version of PA and PBDec 2008 IETF LC for PA and PBJan 2009 IESG considers PA and PB for Proposed Standard
Next Steps
• Raise proposed changes on mailing list.
• Submit -02 version of PA-TNC, PB-TNC protocols based on comments received