Re: [pcp] Proxy security (was Re: CONSENSUS CALL on PCP security)

[Dan Wing <[e-mail]>]

On Jul 16, 2013, at 11:53 PM, Alper Yegin <[e-mail]> wrote:

> Hi Prashanth,
> 
> 
>>> I'm not sure if enough thought went into the PCP Proxy security. As much as I'd love to be DONE! with this discussion, I also want to make sure people feel comfortable having thought all aspects around the proxy use. For (very important) example, what kind of security associations are needed for securing the proxy use: An SA btw client and server, an SA btw client and proxy, an SA btw proxy and server -- which combinations of these are needed?
>> 
>> We've included this in the updated version of auth req:
>> 
>> REQ-9: A PCP proxy that modifies PCP messages SHOULD have the
>> ability to independently authenticate with the PCP client and PCP
>> server. The presence of a PCP proxy hence requires two separately
>> authenticates SAs. As a consequence, the PCP proxy:
>> 
>> A. MUST be able to validate message integrity of PCP messages
>> from the PCP server and client respectively.
>> 
>> B. MUST be able to ensure message integrity after updating the
>> PCP message for cases described in sections 6 of ietf-pcp-proxy.
>> 
>> The PCP proxy MUST also permit authentication on only one side of
>> the proxy. For example, a customer premises host may not
>> authenticate with the PCP proxy but the PCP proxy may authenticate
>> with the PCP server.
>> 
> 
> 
> So:
> 
> - We have two types of SAs. One between the client and the proxy, another between the proxy and the server.
> - None of them are mandatory to use.
> 
> For each one that needs to be used, we need to perform authentication between the end-points. 
> (e.g., between client and proxy).
> 
> So, in a way, we are dealing with security in two independent parts; client to proxy, and proxy to server. 
> They are totally segregated from security perspective. 
> 
> 
> Right?

That is how I have modeled it in my head, yes.  Imagining a home network, there are "N" people and "MM" devices in the home.  Each person and each device might have its own credentials and its own permissions to do various things (e.g., I don't want to allow my Sony television to run a server).  My ISP does not care about my NNN people and MMMM devices; it only knows of one user, and only wants to know of one user (anything else is too hard for the ISP).  So, the PCP proxy enforces policies for the NNN people and MMMM devices, and the PCP proxy uses different credentials (and thus a different security association) to talk with the ISP's PCP server.  The per-user and per-device policy is "aggregated" by the PCP proxy.  The same would occur within an enterprise network, where there are NNN people and MMMM devices.

> 
> Hmm, one thing: The server may need to know the authenticated ID of the client. Since it's not part of the client authentication, it won't know that value readily. So, we may need to define an option to carry that piece of information from the proxy to the server.

That's a different model, where the per-user / per-device policy is not aggregated by the PCP proxy; instead, the client's identity is propagated through the network.  I don't know if we need that model yet.

-d


> Alper
> 
> 
> 
> 
>> -Prashanth
>> 
>>> Then we need to talk about how we dynamically create those using any one of these solutions.
>>> 
>>> Alper
>>> 
>>> 
>>> 
>>> 
>>> 
>>> On Jul 16, 2013, at 7:50 PM, Dave Thaler wrote:
>>> 
>>>>> -----Original Message-----
>>>>> From: Tirumaleswar Reddy (tireddy) [mailto:[e-mail]]
>>>>> Sent: Monday, July 15, 2013 10:51 PM
>>>>> To: Dave Thaler; [e-mail]
>>>>> Subject: RE: [pcp] CONSENSUS CALL on PCP security
>>>>> Hi Dave,
>>>>> In the poll when you refer to PANA, please clarify the draft you are referring
>>>>> to http://tools.ietf.org/html/draft-ohba-pcp-pana-04 or
>>>>> http://tools.ietf.org/html/draft-ohba-pcp-pana-encap-01 ?
>>>>> --Tiru.
>>>> The question is intentionally agnostic as this is about a general approach,
>>>> not which specific implementation.  If it helps, you can interpret the
>>>> answer as "which of the two you think is better".
>>>> If the consensus is PANA rather than direct EAP-in-PCP, then we could
>>>> ask as a follow-up question which of the two we should go with. If
>>>> you'd like to include your answer to that now though, feel free to
>>>> include that in your response to the call.
>>>> -Dave
>>>> _______________________________________________
>>>> pcp mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/pcp
>>> 
>>> _______________________________________________
>>> pcp mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/pcp
>>> 
> 
> _______________________________________________
> pcp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pcp