Re: [Atoca] Requirement for Originator Authentication?

Authorization to initiate alerts  should be provided by the entity that is initiating the alerts and not ATOCA. ATOCA should authenticate the receipt of the alerts is from a trusted source.
Brian K. Daly
   Sent to you by AT&T... 
   America's Fastest Mobile Broadband
       Network.  Rethink Possible.
   +1.425.580.6873
-------
Sent from my Blackberry

----- Original Message -----
From: earlywarning-bounces@ietf.org <earlywarning-bounces@ietf.org>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>; earlywarning@ietf.org <earlywarning@ietf.org>; Igor Faynberg <igor.faynberg@alcatel-lucent.com>
Sent: Sun Jan 16 15:32:09 2011
Subject: Re: [Atoca] Requirement for Originator Authentication?

On 2011-01-16 at 06:30:33, Hannes Tschofenig wrote:
> Igor raised an interesting question during the meeting in context of
> the security threats, namely:
> 
> " Do we have the requirement to authenticate the originator? "

The question that I heard was not so much related to authentication as it was to authorization.  There was also a question about whether authentication was identity-based or on some other property, like some asserted trait.

What statements can we make about how recipients (and relays) authorize the receipt (and sending) of alert messages?

> I couldn't provide him an answer during the meeting because I was not
> quite sure whether he was asking the question in the style of
> 
> "Do we need end-to-end security or is a hop-by-hop security solution
> good enough?"

In the context of this interpretation, I think that there's a real need to delegate alert distribution.  The scale of distribution makes intermediaries a valuable addition.  Relying on the integrity of relays makes the authorization question more difficult to resolve.

For something concrete, the relay case is probably the simplest.  I might trust my signalling peer to a certain extent.  I certainly don't trust them enough to generate the massive packet storm requested by an alert message.  They might say the alert comes from the government, but I might require better proof than their say-so alone.  Distributing an alert will cost me money and I want proof.

That's one argument.  The other argument says that peering relationships require a degree of trust that would not be broken without serious ramifications - enough to discourage its abuse.

The recipient case might have some interesting quirks.  Particularly in wholesale/reseller arrangements.  A recipient that relies on hop-by-hop might receive an alert from the network operator: an entity with whom they have no direct relationship.  For instance, no fewer than two different operators are involved in getting packets to my house, neither of which I have a business relationship with.  How would someone - ignorant of the convoluted business arrangements that underpin their Internet service - decide to authorize an alert that is relayed by either party?

--Martin
_______________________________________________
earlywarning mailing list
earlywarning@ietf.org
https://www.ietf.org/mailman/listinfo/earlywarning