Internet DRAFT - draft-bouaram-ethernet-over-https
draft-bouaram-ethernet-over-https
INTAREA (Internet Area Working Group) S. B. ARAM
Internet-Draft SKELDUS
Intended status: Informational 27 December 2023
Expires: 29 June 2024
Ethernet over HTTPS Protocol
draft-bouaram-ethernet-over-https-01
Abstract
This document defines a protocol for encapsulating Ethernet frames
over HTTPS, allowing secure communication between a client and
internal web servers. The protocol includes authentication using
strong API keys encrypted with the server's public key. The
communication is secured using TLS for privacy and integrity.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 29 June 2024.
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
ARAM Expires 29 June 2024 [Page 1]
Internet-Draft EOH December 2023
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. TLS Considerations . . . . . . . . . . . . . . . . . . . 2
1.2. Flow and Scenarios . . . . . . . . . . . . . . . . . . . 2
1.2.1. Client Authentication . . . . . . . . . . . . . . . . 2
1.2.2. Internal Webpage Request . . . . . . . . . . . . . . 3
1.2.3. Server-Side Processing . . . . . . . . . . . . . . . 3
1.2.4. Response to the Client . . . . . . . . . . . . . . . 3
2. FLow summary . . . . . . . . . . . . . . . . . . . . . . . . 3
3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4
1. Introduction
Ethernet over HTTPS (EOH) extends traditional networking by allowing
communication between a web client and internal resources over the
HTTPS protocol. This document outlines the procedures for
authentication, encapsulation of Ethernet frames, and communication
between the client and internal web servers. TLS is employed to
secure the communication channel and ensure privacy and integrity.
1.1. TLS Considerations
To ensure the security of the Ethernet-over-HTTPS communication, TLS
must be used to encrypt and authenticate the data exchanged between
the client and server. Implementations MUST follow best practices
for TLS configuration, including the use of strong cipher suites,
secure protocols, and proper certificate validation.
1.2. Flow and Scenarios
1.2.1. Client Authentication
If the client specifies an internal URL (e.g., internal.url), the
browser recognizes that Ethernet over HTTPS should be used for the
communication. The client browser, pre-configured with the IP
address and port of the HTTP Server acting as the gateway to the LAN,
automatically recognizes the internal URL (e.g., internal.url). It
then initiates the Ethernet-over-HTTPS protocol and sends an
authentication request.
* The client initiates the connection by sending an authentication
request to the server.
ARAM Expires 29 June 2024 [Page 2]
Internet-Draft EOH December 2023
plaintext
POST /authenticate HTTP/1.1
Host: server.example.com
Content-Type: application/json
{
"api_key": "encrypted_api_key"
}
### Server Authentication and LAN Information The server decrypts the
API key, authenticates the client, and responds with the MAC address
or IP address of the target server (or both) based on the LAN layer
architecture.
HTTP/1.1 200 OK
Content-Type: application/json
{
"target_server_mac_address": "xx:xx:xx:xx:xx:xx",
"target_server_ip_address": "192.168.1.2"
"dhcp_ip_address": "192.168.1.10"
}
1.2.2. Internal Webpage Request
The client, now authenticated, sends an Ethernet frame encapsulated
within an HTTPS request for an internal webpage
1.2.3. Server-Side Processing
The server decapsulates the Ethernet frame, extracts the original
HTTP request, and routes it to the internal web server.
1.2.4. Response to the Client
The server encapsulates the response from the internal web server
POST /ethernet-over-https HTTP/1.1
Host: server.example.com
Content-Type: application/octet-stream
Content-Length: length_of_payload_in_bytes
{
"http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\n<html>Internal Webpage</html>"
}
2. FLow summary
ARAM Expires 29 June 2024 [Page 3]
Internet-Draft EOH December 2023
+----------------------+ +----------------------+
| | | |
| Web Client | | EOH Server |
| | | |
+----------------------+ +----------------------+
| |
| 1. Browser Recognizes |
| Internal URL |
| --------------------------> |
| |
| 2. Authentication Request |
| --------------------------> |
| |
| |
| 3. Browser Initiates |
| Ethernet over HTTPS |
| |
| |
| 4. Server Authenticates |
| and Responds |
| <-------------------------- |
| |
| 5. Internal Webpage Request |
| as Encapsulated Frame |
| --------------------------> |
| |
| 6. Server Decapsulation |
| and Routing |
| <-------------------------- |
| |
| 7. Response to Client |
| as Encapsulated Frame |
| --------------------------> |
| |
# Security Considerations The security of the Ethernet-over-HTTPS
protocol relies on the implementation of TLS. It ensures the
confidentiality, integrity, and authenticity of the communication
between the client and server. Implementers should adhere to best
practices for TLS configuration, including the use of strong cipher
suites, secure protocols, and proper certificate validation.
3. IANA Considerations
This document has no IANA actions.
Author's Address
ARAM Expires 29 June 2024 [Page 4]
Internet-Draft EOH December 2023
Salim-Amine BOU ARAM
SKELDUS
Email: salim@mycio.io
ARAM Expires 29 June 2024 [Page 5]
