[Docs] [txt|pdf|xml|html] [Tracker] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01

Delay-Tolerant Networking                                     E. Birrane
Internet-Draft                                               E. DiPietro
Intended status: Experimental                                   D. Linko
Expires: September 12, 2019     Johns Hopkins Applied Physics Laboratory
                                                          March 11, 2019


                  ION Security Application Data Model
                    draft-birrane-dtn-adm-ionsec-01

Abstract

   This document describes the Application Data Model (ADM) for ION
   Security in compliance with the template provided by
   [I-D.birrane-dtn-adm].

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 12, 2019.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.




Birrane, et al.        Expires September 12, 2019               [Page 1]


Internet-Draft                 IONSEC ADM                     March 2019


Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Technical Notes . . . . . . . . . . . . . . . . . . . . .   2
     1.2.  Scope . . . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.3.  Requirements Language . . . . . . . . . . . . . . . . . .   3
   2.  Structure and Design of this ADM  . . . . . . . . . . . . . .   3
   3.  Naming and Identification . . . . . . . . . . . . . . . . . .   4
     3.1.  Namespace and Nicknames . . . . . . . . . . . . . . . . .   4
   4.  IONSEC ADM JSON Encoding  . . . . . . . . . . . . . . . . . .   5
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
     6.1.  Informative References  . . . . . . . . . . . . . . . . .  10
     6.2.  Normative References  . . . . . . . . . . . . . . . . . .  10
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  11

1.  Introduction

   An Application Data Model (ADM) provides a guaranteed interface for
   the management of an application or protocol in accordance with the
   Asynchronous Management Architecture (AMA) defined in
   [I-D.birrane-dtn-ama].  The ADM described in this document complies
   with the ADM Template provided in [I-D.birrane-dtn-adm] as encoded
   using the JSON syntax.

   The IONSEC Admin ADM provides the set of information necessary to
   configure and manage the ION security policy database on the local
   computer that is running ION.  This information includes both
   authentication from Licklider Transmission Protocol (LTP) and Bundle
   Protocol Security (BPSEC).

1.1.  Technical Notes

   o  This document describes Version 0.0 of the IONSEC Admin ADM.

   o  The AMM Resource Identifier (ARI) for this ADM is NOT correctly
      set.  A sample ARI is used in this version of the specification
      and MAY change in future versions of this ADM until an ARI
      registry is established.  This notice will be removed at that
      time.

   o  Agent applications MAY choose to ignore the name, description, or
      other annotative information associated with the component
      definitions within this ADM where such items are only used to
      provide human-readable information or are otherwise not necessary
      to manage a device.





Birrane, et al.        Expires September 12, 2019               [Page 2]


Internet-Draft                 IONSEC ADM                     March 2019


1.2.  Scope

   This ADM specifies those components of the Asynchronous Management
   Model (AMM) common to the manqgement of any instance of an ION node.

   Any Manager software implementing this ADM MUST perform the
   responsibilities of an AMA Manager as outlined in
   [I-D.birrane-dtn-adm] as they relate to the objects included in this
   document.

   Any Agent software implementing this ADM MUST perform the
   responsibilities of an AMA Agent as outlined in [I-D.birrane-dtn-adm]
   as they relate to the objects included in this document.

1.3.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

2.  Structure and Design of this ADM

   The IONSEC Admin ADM's structure is in accordance to
   [I-D.birrane-dtn-adm].  This ADM contains metadata, table templates,
   and controls.  Table Templates are column templates that will be
   followed by any instance of this table available in the network.
   They may not be created dynamically within the network by Managers.
   Controls are predefined and sometimes parameterized opcodes that can
   be run on an Agent.  Controls are preconfigured in Agents and
   Managers as part of ADM support.  There are no variables, report
   templates, macros, edd, constants, or operators in this ADM at this
   time.  The contents of this ADM are derived from the main functions
   and data that are needed to configure the security policy database on
   the local computer that is running ION and includes both Bundle
   Protocol Security and Licklider Transmission Protocol Authentication.

   All ADMs have metadata that includes the name, namespace, and version
   of the ADM as well as the name of the organization that is issuing
   that particular ADM.  This is important for identification purposes
   of the ADMs and to ensure version control.

   The controls that were chosen to be expressed in this document are
   related to adding, deleting, and modifying security keys.  The
   controls also deal with LTP segment authentication and LTP segment
   signing rules.  The table templates expressed in this document show
   all of the keys and rules that are in the security policy database.





Birrane, et al.        Expires September 12, 2019               [Page 3]


Internet-Draft                 IONSEC ADM                     March 2019


3.  Naming and Identification

   This section outlines the namespaces used to uniquely identify ADM
   objects in this specification.

3.1.  Namespace and Nicknames

   In accordance with [I-D.birrane-dtn-adm], every ADM is assigned a
   moderated Namespace.  In accordance with [I-D.birrane-dtn-amp], these
   namespaces may be enumerated for compactness.  The namespace and ADM
   identification for these objects is defined as follows.

                 +-----------------+---------------------+
                 |    Identifier   |        Value        |
                 +-----------------+---------------------+
                 |    Namespace    | DTN/ION/ionsecadmin |
                 |                 |                     |
                 | ADM Enumeration |          8          |
                 +-----------------+---------------------+

                      Table 1: Namespace Information

   Given the above ADM enumeration, in accordance with
   [I-D.birrane-dtn-amp], the following AMP nicknames are defined.



























Birrane, et al.        Expires September 12, 2019               [Page 4]


Internet-Draft                 IONSEC ADM                     March 2019


                +----------+------------------------------+
                | Nickname |          Collection          |
                +----------+------------------------------+
                |   160    |  DTN/ION/ionsecadmin/Const   |
                |          |                              |
                |   161    |   DTN/ION/ionsecadmin/Ctrl   |
                |          |                              |
                |   162    |   DTN/ION/ionsecadmin/Edd    |
                |          |                              |
                |   163    |   DTN/ION/ionsecadmin/Mac    |
                |          |                              |
                |   164    |   DTN/ION/ionsecadmin/Oper   |
                |          |                              |
                |   165    |   DTN/ION/ionsecadmin/Rptt   |
                |          |                              |
                |   167    |   DTN/ION/ionsecadmin/Tblt   |
                |          |                              |
                |   169    |   DTN/ION/ionsecadmin/Var    |
                |          |                              |
                |   170    |   DTN/ION/ionsecadmin/Mdat   |
                |          |                              |
                | 171-179  | DTN/ION/ionsecadmin/Reserved |
                +----------+------------------------------+

                       Table 2: IONSEC ADM Nicknames

4.  IONSEC ADM JSON Encoding

   The following is the JSON encoding of the IONsec Admin ADM:


  {
    "Mdat": [{
        "name": "name",
        "type": "STR",
        "value": "ionsec_admin",
        "description": "The human-readable name of the ADM."
      },
      {
        "name": "namespace",
        "type": "STR",
        "value": "DTN/ION/ionsecadmin",
        "description": "The namespace of the ADM."
      },
      {
        "name": "version",
        "type": "STR",
        "value": "v0.0",



Birrane, et al.        Expires September 12, 2019               [Page 5]


Internet-Draft                 IONSEC ADM                     March 2019


        "description": "The version of the ADM."
      },
      {
        "name": "organization",
        "type": "STR",
        "value": "JHUAPL",
        "description": "The name of the issuing organization of the
                        ADM."
      }
    ],

    "Tblt": [{
        "name": "ltp_rx_rules",
        "columns": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This table lists all LTP segment authentication
                        rules in the security policy database."
      },
      {
        "name": "ltp_tx_rules",
        "columns": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This table lists all LTP segment signing rules
                        in the security policy database."
      }
    ],

    "Ctrl": [{
        "name": "key_add",
        "parmspec": [{
          "type": "STR",
          "name": "key_name"



Birrane, et al.        Expires September 12, 2019               [Page 6]


Internet-Draft                 IONSEC ADM                     March 2019


        }, {
          "type": "BYTESTR",
          "name": "key_value"
        }],
        "description": "This control adds a named key value to the
                         security policy database. The content of
                         file_name is taken as the value of the key.
                         Named keys can be referenced by other elements
                         of the security policy database."
      },
      {
        "name": "key_change",
        "parmspec": [{
          "type": "STR",
          "name": "key_name"
        }, {
          "type": "BYTESTR",
          "name": "key_value"
        }],
        "description": "This control changes the value of the named key,
                        obtaining the new key value from the content of
                        file_name."
      },
      {
        "name": "key_del",
        "parmspec": [{
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This control deletes the key identified by
                        name."
      },
      {
        "name": "ltp_rx_rule_add",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This control adds a rule specifying the manner
                        in which LTP segment authentication will be
                        applied to LTP segmentsrecieved from the
                        indicated LTP engine. A segment from the



Birrane, et al.        Expires September 12, 2019               [Page 7]


Internet-Draft                 IONSEC ADM                     March 2019


                        indicated LTP engine will only be deemed
                        authentic if it contains an authentication
                        extension computed via the ciphersuite
                        identified by ciphersuite_nbr using the
                        applicable key value. If ciphersuite_nbr is 255
                        then the applicable key value is a hard-coded
                        constant and key_name must be omitted; otherwise
                        key_nameis required and the applicable key
                        value is the current value of the key named
                        key_name in the local security policy database.
                        Valid values of ciphersuite_nbr are: 0:
                        HMAC-SHA1-80 1: RSA-SHA256 255: NULL"
      },
      {
        "name": "ltp_rx_rule_change",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This control changes the parameters of the LTP
                        segment authentication rule for the indicated
                        LTP engine."
      },
      {
        "name": "ltp_rx_rule_del",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }],
        "description": "This control deletes the LTP segment
                        authentication rule for the indicated LTP
                        engine."
      },
      {
        "name": "ltp_tx_rule_add",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {



Birrane, et al.        Expires September 12, 2019               [Page 8]


Internet-Draft                 IONSEC ADM                     March 2019


          "type": "STR",
          "name": "key_name"
        }],
        "description": "This control adds a rule specifying the manner
                        in which LTP segments transmitted to the
                        indicated LTP engine mustbe signed. Signing a
                        segment destined for the indicated LTP engine
                        entails computing an authentication extension
                        via the ciphersuite identified by
                        ciphersuite_nbr using the applicable key value.
                        If ciphersuite_nbr is 255 then the applicable
                        key value is a hard-coded constant and key_name
                        must be omitted; otherwise key_nameis required
                        and the applicable key value is the current
                        value of the key named key_name in the local
                        security policy database.Valid values of
                        ciphersuite_nbr are: 0:HMAC_SHA1-80
                        1: RSA_SHA256 255: NULL"
      },
      {
        "name": "ltp_tx_rule_change",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }, {
          "type": "UINT",
          "name": "ciphersuite_nbr"
        }, {
          "type": "STR",
          "name": "key_name"
        }],
        "description": "This control changes the parameters of the LTP
                        segment signing rule for the indicated LTP
                        engine."
      },
      {
        "name": "ltp_tx_rule_del",
        "parmspec": [{
          "type": "UINT",
          "name": "ltp_engine_id"
        }],
        "description": "This control deletes the LTP segment signing
                        rule for the indicated LTP engine."
      },
      {
        "name": "list_keys",
        "description": "This control lists the names of keys available
                        in the key policy database."



Birrane, et al.        Expires September 12, 2019               [Page 9]


Internet-Draft                 IONSEC ADM                     March 2019


      },
      {
        "name": "list_ltp_rx_rules",
        "description": "This control lists all LTP segment
                        authentication rules in the security policy
                        database."
      },
      {
        "name": "list_ltp_tx_rules",
        "description": "This control lists all LTP segment signing
                        rules in the security policy database."
      }
    ]
  }


5.  IANA Considerations

   At this time, this protocol has no fields registered by IANA.

6.  References

6.1.  Informative References

   [I-D.birrane-dtn-ama]
              Birrane, E., "Asynchronous Management Architecture",
              draft-birrane-dtn-ama-07 (work in progress), June 2018.

6.2.  Normative References

   [I-D.birrane-dtn-adm]
              Birrane, E., DiPietro, E., and D. Linko, "AMA Application
              Data Model", draft-birrane-dtn-adm-02 (work in progress),
              June 2018.

   [I-D.birrane-dtn-amp]
              Birrane, E., "Asynchronous Management Protocol", draft-
              birrane-dtn-amp-04 (work in progress), June 2018.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.








Birrane, et al.        Expires September 12, 2019              [Page 10]


Internet-Draft                 IONSEC ADM                     March 2019


Authors' Addresses

   Edward J. Birrane
   Johns Hopkins Applied Physics Laboratory

   Email: Edward.Birrane@jhuapl.edu


   Evana DiPietro
   Johns Hopkins Applied Physics Laboratory

   Email: Evana.DiPietro@jhuapl.edu


   David Linko
   Johns Hopkins Applied Physics Laboratory

   Email: David.Linko@jhuapl.edu

































Birrane, et al.        Expires September 12, 2019              [Page 11]


Html markup produced by rfcmarkup 1.129c, available from https://tools.ietf.org/tools/rfcmarkup/