Re: [Mud] Simplified Quarantine model

tirumal reddy <kondtir@gmail.com> Tue, 21 May 2019 07:03 UTC

MIME-Version: 1.0
References: <CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ@mail.gmail.com>
In-Reply-To: <CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ@mail.gmail.com>
From: tirumal reddy <kondtir@gmail.com>
Date: Tue, 21 May 2019 12:33:12 +0530
Message-ID: <CAFpG3gd=4vd5oY72pS4o2f3VrjuxCUr6OL==tNR8hXVHJmRJcw@mail.gmail.com>
To: "M. Ranganathan" <mranga@gmail.com>
Cc: mud@ietf.org
Content-Type: multipart/alternative; boundary="000000000000fe465d0589607107"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mud/PhK8B7INHVzB5tiLvyYsBjXtbww>
Subject: Re: [Mud] Simplified Quarantine model
Precedence: list

How do you identify an attacker is using the victim device's MAC and IP
address to send attack traffic (e.g. SYN flood) ?

The problem I am facing is victim device can possibly get quarantined based
on the attack traffic from the attacker spoofing MAC and IP addresses.
Normal traffic from victim's device will end-up getting blocked, and the
compromised device in the home can quarantine other normal devices.

-Tiru


On Tue, 30 Apr 2019 at 21:23, M. Ranganathan <mranga@gmail.com> wrote:

>
> Hello,
>
> I have been reading
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00
>
> and
>
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00#ref-I-D.richardson-shg-mud-quarantined-access
>
> I am wondering if these different states defined in the model need to be
> defined.
>
> I would like to collapse these to only two states :
>
> 1. Normal operation --  a device is operating normally and has not
> violated any access rules.
> 2. Quarantined  - A device that misbehaves (packets originating from the
> device cause an access violation) is sent to the quarantined state. A
> device is allowed to access those ACEs tagged for quarantined access while
> in the quarantined state.
>
> The system should inform the device administrator under these conditions.
> While under quarantine, only the tagged ACE's are allowed i.e. as defined
> in :
>
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00#ref-I-D.richardson-shg-mud-quarantined-access
>
> If the device violates its normal ACEs it gets put into the "Quarantine"
> state and it remains in that state until the administrator takes whatever
> administrative action needs to be taken and changes the state to "Normal".
> The manner in which the administrator does this is implementation dependent
> (not part of the standard). This can include downloading the firmware
> update and flashing it or somehow signaling the device to update itself.
>
> Any comments on the above?
>
> Thanks,
>
> Ranga
>
>
> --
> M. Ranganathan
>
> --
> You received this message because you are subscribed to the Google Groups
> "mud-discuss" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to mud-discuss+unsubscribe@googlegroups.com.
> To post to this group, send email to mud-discuss@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/mud-discuss/CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ%40mail.gmail.com
> <https://groups.google.com/d/msgid/mud-discuss/CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
> For more options, visit https://groups.google.com/d/optout.
>

Re: [Mud] Simplified Quarantine model tirumal reddy
Re: [Mud] Simplified Quarantine model Michael Richardson
Re: [Mud] Simplified Quarantine model tirumal reddy