Re: [Anima-bootstrap] Can the proxy add information during bootstrap?

[Toerless Eckert <[e-mail]>]

MichaelR:

So, lets talk use-case:

Consider that you have edge ports going to secure and less secure locations.
(secure: links ending up on your own premises vs. those ending up on customer
 premises).  Consider you have *yuck* devices with only UDI. You only want to
give them a cert when they connect to a secure location(port). Only S-UDI into
customer-prem locations.

Consider you do have any reason to make sure devices are only deployed in ghe
right location. If device shows up in wrong location, you need an exception
re-shipment to the right location. Imagine you care about NSA interception or
the like. Handing out the certificate later is more secure.

Consider the operator in the NOC sits on a console with a GUI saying
"Device XXX (destined for location X) has connected in location Y". Enroll ?
Yes, he could always enrol, but then there is more work afterwards in for
example quarantining or changing target configs for the device.

Consider we do want to tie devices to location and put that into some extension
data of the certificate.

Cheers
    Toerless

P.S.: I am a bit preoccupied on this whole thing because i had around year 2000 a
perfect ATM-PVC based home IP connection into Cisco, and when those became too
expensive and we got IPsec VPN, our IT security introduced all type of additional
checks (like having to authenticate myself as a user on every device), and when i 
inquired with our InfoSec team they told me that for their security evaluation,
a key difference is that the prior ATM-PVC solution gave them location security,
aka: network access only went to a well known location (my home). I could refute
that argument, so i filed what became US8886934. Arguably, location info in
the cert would be one possible element to implement that patent ;-))


On Wed, Apr 13, 2016 at 09:00:57AM -0400, Michael Richardson wrote:
> 
> Toerless Eckert <[e-mail]> wrote:
>     > On Wed, Apr 13, 2016 at 12:46:54PM +1200, Brian E Carpenter wrote:
>     >> If there's a need to discover topology, which I understood Michael B
>     >> was after, couldn't that be done after enrolment, with no security
>     >> risk?
> 
>     > I am sure operators would love to have the option to reject enrollment
>     > if the device is in a wrong location.
> 
> <putting my operator hat on, [AS26227, AS26413]>
> 
> That's silly.  Either it's your device, or it's not.
> Even if it is in the wrong location, enrolling the device makes sense.
> Unless it's completely the wrong *model* and hasn't got any interfaces of the
> right type, getting the new service online usually takes priority.
> Installing a $300 8-port firewall instead of the $200 2-port firewall isn't a
> disaster. If the model was close enough, you'd want to consider the cost of
> shipping vs the cost difference of the devices.
> 
> You might ship the *correct* model out once you figure this out and have
> remote hands swap cables later on, but that's essentially a capital
> allocation question.
> 
> If you know enough in advance to know which device (down to the SN) was
> supposed to be in each location, then I don't think you need/have a zero-touch
> situation.
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 



> _______________________________________________
> Anima-bootstrap mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap


-- 
---
Toerless Eckert, [e-mail]