1 / 9

Minimally Integrated Access Security Module Application

This proposal outlines the goals, extensions to MIB modules, and elements of procedure for the MIASMA application. MIASMA aims to maximize compatibility with existing specifications, minimize changes to the SNMP engine code, and support key management and user management in SNMP. It also addresses shortcomings in current security measures and offers a solution for managing expired keys and unknown users. The MIASMA application runs on behalf of a security administrator, uses existing protocols to interact with user and key management infrastructure, and updates keys and expiration dates using SNMPv3.

jonathanmendez
Download Presentation

Minimally Integrated Access Security Module Application

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. isms BOF IETF-60, San Diego, California Randy Presuhn randy_presuhn@mindspring.com Minimally Integrated Access Security Module Application miasma

  2. Outline • Goals • Proposal • Extensions to MIB modules • Extensions to Elements of Procedure • SNMP Engine Configuration • Security Administrator Assistant Application • Operation • Shortcomings miasma

  3. Goals • Specification and implementation goals: • Maximize compatibility with existing specs • Minimize changes to SNMP engine code • Minimize MIB extensions required • Avoid re-opening STD 62 • Operational goals: • Allow key lifetimes to be limited • Support “on-demand” update of keys • Coexist with existing SNMP key & user mgmt. • Integrate existing non-SNMP key & user mgmt. • No changes to any protocols on the wire miasma

  4. Extensions to MIB modules • OBJECT-TYPE “usmUserKeyExpirationDate” • AUGMENTS usmUserTable • DEFVAL is a sentinel value with semantic of “never expires” (which is existing semantic of table entries) • OBJECT-TYPE “usmExpiredUserName” • MAX-ACCESS accessible-for-notify • OBJECT-TYPE “usmExpiredUserEngineID” • NOTIFICATION-TYPE “usmExpiredUserNotification” • OBJECTS list includes usmStatsUnknownUserNames, usmExpiredUserName, and usmExpiredUserEngineID • Generated whenever usmStatsUnknownUserNames is incremented, or a user with an expired key is encountered miasma

  5. Extensions to Elements of Procedure • Whenever usmStatsUnknownUserNames would be incremented, generate a usmExpiredUserNotification • Whenever a PDU arrives and the user’s usmUserKeyExpirationDate indicates that the keys are stale, generate a usmExpiredUserNotification • Whenever a PDU would be sent using expired keying material miasma

  6. SNMP Engine Configuration • Configure VACM to allow security administrator to update keys and the usmUserKeyExpirationDate; prohibit access by others. • Configure VACM to allow secured delivery of the usmExpiredUserNotification to the security administrator. • Configure SNMP-TARGET-MIB and SNMP-NOTIFICATION-MIB to securely deliver any usmExpiredUserNotification to a security administrator assistant application (next slide) miasma

  7. Security Administrator Assistant Application • Runs on behalf of Security Administrator • Processes received usmExpiredUserNotification • Uses existing user and key management protocols to interact with existing user and key management infrastructure to determine what the new keys and key expiration date should be • Uses SNMPv3 to update the keys and the usmUserKeyExpirationDate for the user /SNMP Engine combination named in the usmExpiredUserNotification on the SNMP engine which generated the notification. miasma

  8. Operation SNMP Engine SNMP Engine SNMP Notify Update Existing Protocols Security Administrator Assistance Application Legacy Key and User Management miasma

  9. Shortcomings • Other than key expiry, no improvement to security • Only works with key management protocols that provide sufficient information to the SAAA to generate a USM key update • Coordination of multiple SAAAs could be complicated; a single SAAA is an inviting target • Should separate unknown user & expired key aspects of operation • Much more, I’m sure.  miasma

More Related