| Delay-Tolerant Networking | E. Birrane |
| Internet-Draft | Johns Hopkins Applied Physics Laboratory |
| Intended status: Experimental | June 18, 2016 |
| Expires: December 20, 2016 |
Bundle Protocol Security Application Data Model
draft-birrane-dtn-adm-bpsec-00
This document describes an Application Data Model (ADM) for the Bundle Security Protocol (BPSEC). This ADM identifies the Primitive Values, Computed values, Reports, Controls, Macros, Literals, Operators, and meta-data associated with the monitoring and management of BPSEC security primitives. The information outlined in this document MUST be supported by any software claiming to manage a BPSEC implementation through the Asynchronous Management Protocol (AMP).
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 20, 2016.
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
An Application Data Model (ADM) provides a guaranteed interface for the management of an application or protocol over the Asynchronous Management Protocol [AMP] that is independent of the nuances of its software implementation. In this respect, the ADM is conceptually similar to the Managed Information Base (MIB) used by SNMP, but contains additional information relating to command opcodes and more expressive syntax for automated behavior.
Agents within the Asynchronous Management Architecture [AMA] represent applications running on managed devices that are responsible for implementing the AMA services of configuration, reporting, control, and administration. These agents provide the mechnism through which applications and protocols are managed through the AMP.
The BPSEC ([BPSEC]) protocol defines integrity and confidentiality mechanisms for securing extension blocks within Bundle Protocol bundle. The BPSEC ADM provides the set of information used to monitor and configure common aspects of any BPSEC software implementation.
This ADM specifies the globally unique identifiers and descriptions for all Values, Controls, Literals, and Operators associated with BPSEC management via an AMP Agent.
Any BPSEC implementation claiming compliance with the BPSEC ADM MUST compute all identified primitive data when requested by an AMP Agent. Also, any BPA implementation claiming compliance with the BPA ADM MUST execute all identified controls when requested by an AMP Agent.
Any AMP Agent claiming to support the BPSEC ADM must compute all identifier data, perform identified controls/operators, and understand identified literals/metadata.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
The Managed Identifiers (MIDs) used with this ADM encapsulate OIDs within a globally managed OID tree. The OID node from which all of the MIDs in this specification derive is called the "BPSEC ADM OID Root". This section identifies this root in the overall OID tree.
NOTE: This version of the BPSEC ADM uses a proxy BPSEC ADM Root that has NOT been assigned. The BPSEC ADM Root in this version of the document is only used for experimental purposes and MAY change before the final release of this specification.
| BPSEC ADM OID ROOT STRING | iso.identified-organization.dod.internet.mgmt.amp.bpsec |
| BPSEC ADM ROOT ID STRING | 1.3.6.1.2.3.9 |
| BPSEC ADM ROOT OID (octets) | 2B 06 01 02 03 09 |
BPSEC ADM ROOT
(1.3.6.1.2.3.9)
|
Meta- Primitive Computed |
Data Data Data Rpts | Ctrls Literals Macros Ops
(.0) (.1) (.2) (.3) | (.4) (.5) (.6) (.7)
+-------+---------+------+---------+------+----------+---------+
Figure 1: BPSEC ADM OID Subtree
The subtree under the BPSEC ADM OID ROOT contains eight subbranches that capture metadata, Primitive Values, Computed Values, Reports, Controls, Literals, Macros, and Operators as illustrated in Figure 1.
The following managed nicknames are provided to generate compressed OIDs within the AMP. Compressed OIDs enable shortening of common subtrees into a single numerical identifier to avoid the significant repetition incumbent with using OIDs from a common subtree. The nicknames defined by this ADM are given in Table 1.
| Unique ID | Label | OID as ASN.1 BER |
|---|---|---|
| 40 | BPSEC Metadata | 0x2B060102030900 |
| 41 | BPSEC Primitive Values | 0x2B060102030901 |
| 42 | BPSEC Computed Values | 0x2B060102030902 |
| 43 | BPSEC Reports | 0x2B060102030903 |
| 44 | BPSEC Controls | 0x2B060102030904 |
| 45 | BPSEC Literals | 0x2B060102030905 |
| 46 | BPSEC Macros | 0x2B060102030906 |
| 47 | BPSEC Operators | 0x2B060102030907 |
| 49 | BPSEC Root | 0x2B0601020309 |
The components in this specification are identified by their AMP MID value. However, for easier traceability back to the OIDs encapsulated in MIDs, an OID string is also provided for each component. These OID strings are provided in a shorthand that makes use of the nicknames defined in Table 1 and uses the form [nickname].relative-oid.
For example, the OID String [44].3.2.1 corresponds to the OID 2B060102030904030201, with 2B060102030904 being the expansion of nickname 44 and 030201 being the relative OID.
ADM metadata consists of the items necessary to uniquely identify the ADM to Managers within the AMA. This includes items such as the name of the ADM, its version, and any nicknames used within the ADM.
| Name | MID (Hex) | OID (Str) | Description | Type | Value |
|---|---|---|---|---|---|
| Label | 0x80280100 | [40].0 | The human-readable ADM name. | STR | BPSEC ADM |
| Version | 0x80280101 | [40].1 | The ADM version. | STR | 2016_05_16 |
Primitive Value definitions represent those values that MUST be collected by the BPSEC protocol handler. Changing or updating Primitive Value definitions requires making changes to the BPSEC protocol handler and/ or its supporting firmware.
| MID | OID | Decription | Type | Parms |
|---|---|---|---|---|
| 80290100 | [41].0 | Total Successfully Tx BCB blocks | UINT | None |
| 80290101 | [41].1 | Total Unsuccessfully Tx BCB blocks | UINT | None |
| 80290102 | [41].2 | Total Successfully Rx BCB blocks | UINT | None |
| 80290103 | [41].3 | Total Unsuccessfully Rx BCB blocks | UINT | None |
| 80290104 | [41].4 | Total Missing-on-Rx BCB blocks | UINT | None |
| 80290105 | [41].5 | Total Forwarded BCB blocks | UINT | None |
| 80290106 | [41].6 | Total Successfully Tx BCB bytes | UINT | None |
| 80290107 | [41].7 | Total Unsuccessfully Tx BCB bytes | UINT | None |
| 80290108 | [41].8 | Total Successfully Rx BCB bytes | UINT | None |
| 80290109 | [41].9 | Total Unsuccessfully Rx BCB bytes | UINT | None |
| 8029010A | [41].A | Total Missing-on-Rx BCB bytes | UINT | None |
| 8029010B | [41].B | Total Forwarded BCB bytes | UINT | None |
| 8029010C | [41].C | Total Successfully Tx BIB blocks | UINT | None |
| 8029010D | [41].D | Total Unsuccessfully Tx BIB blocks | UINT | None |
| 8029010E | [41].E | Total Successfully Rx BIB blocks | UINT | None |
| 8029010F | [41].F | Total Unsuccessfully Rx BIB blocks | UINT | None |
| 80290110 | [41].10 | Total Missing-on-Rx BIB blocks | UINT | None |
| 80290111 | [41].11 | Total Forwarded BIB blocks | UINT | None |
| 80290112 | [41].12 | Total Successfully Tx BIB bytes | UINT | None |
| 80290113 | [41].13 | Total Unsuccessfully Tx BIB bytes | UINT | None |
| 80290114 | [41].14 | Total Successfully Rx BIB bytes | UINT | None |
| 80290115 | [41].15 | Total Unsuccessfully Rx BIB bytes | UINT | None |
| 80290116 | [41].16 | Total Missing-on-Rx BIB bytes | UINT | None |
| 80290117 | [41].17 | Total Forwarded BIB bytes | UINT | None |
| 80290118 | [41].18 | Last BPSEC Update | TS | None |
| 80290119 | [41].19 | Number of Known Keys | UINT | None |
| 8029011A | [41].1A | Known Key Names (CSV) | STRING | None |
| 8029011B | [41].1B | Known Ciphersuite Names (CSV) | STRING | None |
| 8029011C | [41].1C | Known Rule Sources (CSV) | STRING | None |
| C029011D | [41].1D | Successfully Tx BCB blocks from SRC | UINT | STR Src |
| C029011E | [41].1E | Failed Tx BCB blocks from SRC | UINT | STR Src |
| C029011F | [41].1F | Successfully Rx BCB blocks from SRC | UINT | STR Src |
| C0290120 | [41].20 | Failed Rx BCB blocks from SRC | UINT | STR Src |
| C0290121 | [41].21 | Missing-on-Rx BCB blocks from SRC | UINT | STR Src |
| C0290122 | [41].22 | Forwarded BCB blocks from SRC | UINT | STR Src |
| C0290123 | [41].23 | Successfully Tx BCB bytes from SRC | UINT | STR Src |
| C0290124 | [41].24 | Failed Tx BCB bytes from SRC | UINT | STR Src |
| C0290125 | [41].25 | Successfully Rx BCB bytes from SRC | UINT | STR Src |
| C0290126 | [41].26 | Failed Rx BCB bytes from SRC | UINT | STR Src |
| C0290127 | [41].27 | Missing-on-Rx BCB bytes from SRC | UINT | STR Src |
| C0290128 | [41].28 | Forwarded BCB bytes from SRC | UINT | STR Src |
| C0290129 | [41].29 | Successfully Tx BIB blocks from SRC | UINT | STR Src |
| C029012A | [41].2A | Failed Tx BIB blocks from SRC | UINT | STR Src |
| C029012B | [41].2B | Successfully Rx BIB blocks from SRC | UINT | STR Src |
| C029012C | [41].2C | Failed Rx BIB blocks from SRC | UINT | STR Src |
| C029012D | [41].2D | Missing-on-Rx BIB blocks from SRC | UINT | STR Src |
| C029012E | [41].2E | Forwarded BIB blocks from SRC | UINT | STR Src |
| C029012F | [41].2F | Successfully Tx BIB bytes from SRC | UINT | STR Src |
| C0290130 | [41].30 | Failed Tx BIB bytes from SRC | UINT | STR Src |
| C0290131 | [41].31 | Successfully Rx BIB bytes from SRC | UINT | STR Src |
| C0290132 | [41].32 | Failed Rx BIB bytes from SRC | UINT | STR Src |
| C0290133 | [41].33 | Missing-on-Rx BIB bytes from SRC | UINT | STR Src |
| C0290134 | [41].34 | Forwarded BIB bytes from SRC | UINT | STR Src |
| C0290135 | [41].35 | Last BPSEC Update from SRC | TS | STR Src |
| C0290136 | [41].36 | Last Reset | TS | STR Src |
The BPSEC ADM defines no computed values.
A Report is a listing of data items including Primitive Value definitions, Computed Value definitions, and other Reports returned from an AMP Agent. Similar to Computed Values, Report definitions are captured as a MID Collection (MC), which is the ordered set of MIDs identifying individual data items that comprise the report.
+----------+------------+-------+----------------------------+------+
| Name | MID | OID | Description | Type |
+----------+------------+-------+----------------------------+------+
| Full | 822B0100 |[43].0 | All known Meta-Data, | RPT |
| Report | | | Primitive, and Computed | |
| | | | Values. | |
+----------+------------+-------+----------------------------+------+
| Definition |
+-------------------------------------------------------------------+
| 0x1D 0x80290100 0x80290101 0x80290102 0x80290103 0x80290104 |
| 0x80290105 0x80290106 0x80290107 0x80290108 0x80290109 |
| 0x8029010A 0x8029010B 0x8029010C 0x8029010D 0x8029010E |
| 0x8029010F 0x80290110 0x80290111 0x80290112 0x80290113 |
| 0x80290114 0x80290115 0x80290116 0x80290117 0x80290118 |
| 0x80290119 0x8029011A 0x8029011B 0x8029011C |
+-------------------------------------------------------------------+
+----------+------------+-------+----------------------------+------+
| Name | MID | OID | Description | Type |
+----------+------------+-------+----------------------------+------+
| Source | 0xC22B0101 |[43].1 | Security Info By Source | RPT |
| Report | | | | |
+----------+------------+-------+----------------------------+------+
| Definition |
+-------------------------------------------------------------------+
| 0x1A 0xC029011D 0xC029011E 0xC029011F 0xC0290120 0xC0290121 |
| 0xC0290122 0xC0290123 0xC0290124 0xC0290125 0xC0290126 |
| 0xC0290127 0xC0290128 0xC0290129 0xC029012A 0xC029012B |
| 0xC029012C 0xC029012D 0xC029012E 0xC029012F 0xC0290130 |
| 0xC0290131 0xC0290132 0xC0290133 0xC0290134 0xC0290135 |
| 0xC0290136 |
+-------------------------------------------------------------------+
Controls represent well-known command opcodes that can be run by the Agent in response to direct requests by an AMP Manager, or in response to time- or state-based rules on the Agent itself.
| Name | MID | OID | # Prms | Prms |
|---|---|---|---|---|
| ResetAllCounts | 0x832C0100 | [44].0 | 0 | () |
| ResetSrcCounts | 0xC32C0101 | [44].1 | 1 | (STR Src) |
| DelKey | 0xC32C0102 | [44].2 | 1 | (STR KeyName) |
| AddKey | 0xC32C0103 | [44].3 | 2 | (STR KeyName, BLOB Key) |
| AddBibRule | 0xC32C0104 | [44].4 | 5 | (STR Src, STR Dest, INT Tgt, STR Cs, STR Key) |
| DelBibRule | 0xC32C0105 | [44].5 | 3 | (STR Src, STR Dest, INT Tgt) |
| ListBibRules | 0x832C0106 | [44].6 | 0 | () |
| AddBcbRule | 0xC32C0107 | [44].7 | 5 | (STR Src, STR Dest, INT Tgt, STR Cs, STR Key) |
| DelBcbRule | 0xC32C0108 | [44].8 | 3 | (STR Src, STR Dest, INT Tgt) |
| ListBcbRules | 0x832C0109 | [44].9 | 0 | () |
This section lists the description, parameters, and reports generated for each Control specified in this ADM.
The "DESCRIPTION" section lists the functional requirements of the Control when run on an Agent.
The "PARAMETERS" section illustrates and describes the ordered set of data items provided to the Control, when run on the Agent. A parameterized Control is represented in the AMP by a MID encapsulating a parameterized OID. OID parameters are captured as a Typed Data Collection (TDC).
The TDC capturing these parameters is elided for clarity, as the TDC is only the container used to transmit the parameters between the Agent and Manager and not expected as input to the Control itself.
The "REPORTS GENERATED" section describes the format of any Reports sent from the Agent to a Manager as a result of running the Control. This section ONLY describes Reports that are specific to the Control. Cases where policy requires Agents to send summary Reports when Controls either run or fail to run due to error, are not considered in this section as they are not specific to any one Control. Any Control summary reports should be as described in [AMP].
Reports generated on an Agent by a Control will either be directly sent to the Manager executing the Control or otherwise batched and send with other Reports destined for the receiving Manager. This behavior will be based on the policy associated with the AMP Agent and is not specified in this ADM.
+------------+
| Source EID |
| [STR] |
+------------+
Figure 2: ResetSrcCounts Parameters
+----------+
| Key Name |
| [STR] |
+----------+
Figure 3: DelKey Parameters
+----------+----------+
| Key Name | Key Data |
| [STR] | [BLOB] |
+----------+----------+
Figure 4: AddKey Parameters
+--------+-------+--------+----------------+----------+
| Source | Dest | Target | Ciphersuite ID | Key Name |
| [STR] | [STR] | [INT] | [STR] | [STR] |
+--------+-------+--------+----------------+----------+
Figure 5: AddBibRule Parameters
+--------+-------+--------+
| Source | Dest | Target |
| [STR] | [STR] | [INT] |
+--------+-------+--------+
Figure 6: DelBibRule Parameters
+--------+-------+--------+----------------+----------+
| Source | Dest | Target | Ciphersuite ID | Key Name |
| [STR] | [STR] | [INT] | [STR] | [STR] |
+--------+-------+--------+----------------+----------+
Figure 7: ListBibRule Parameters
+--------+-------+--------+----------------+----------+
| Source | Dest | Target | Ciphersuite ID | Key Name |
| [STR] | [STR] | [INT] | [STR] | [STR] |
+--------+-------+--------+----------------+----------+
Figure 8: AddBcbRule Parameters
+--------+-------+--------+
| Source | Dest | Target |
| [STR] | [STR] | [INT] |
+--------+-------+--------+
Figure 9: DelBcbRule Parameters
+--------+-------+--------+----------------+----------+
| Source | Dest | Target | Ciphersuite ID | Key Name |
| [STR] | [STR] | [INT] | [STR] | [STR] |
+--------+-------+--------+----------------+----------+
Figure 10: ListBcbRule Parameters
The BPSEC ADM does not define any literals.
The BPSEC ADM does not define any macros.
The BPSEC ADM does not define any operators.
At this time, this protocol has no fields registered by IANA.
| [AMA] | Birrane, E., "Asynchronous Management Architecture", Internet-Draft draft-birrane-dtn-ama-00, August 2015. |
| [AMP] | Birrane, E., "Asynchronous Management Protocol", Internet-Draft draft-birrane-dtn-amp-00, August 2015. |
| [BPSEC] | Birrane, E., Mayer, J. and D. Iannicca, "Bundle Protocol Security", Internet-Draft draft-ietf-dtn-bpsec-01, March 2016. |
| [RFC2119] | Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997. |
| [RFC5050] | Scott, K. and S. Burleigh, "Bundle Protocol Specification", RFC 5050, DOI 10.17487/RFC5050, November 2007. |
| [RFC6256] | Eddy, W. and E. Davies, "Using Self-Delimiting Numeric Values in Protocols", RFC 6256, DOI 10.17487/RFC6256, May 2011. |