[sacm] SWIMA and Source Identification

["Schmidt, Charles M." <[e-mail]>]

Hello all,

In last week's virtual interim meeting we had a long discussion about the new draft's handling of source identification. No final resolution was achieved on the call so let's see if the list offers some clarity. References to the current draft are to draft-ietf-sacm-nea-swid-patnc-00 (https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swid-patnc/). References to issue numbers are from the Software Identification GitHub tracker (https://github.com/sacmwg/software-identification).

On the call we talked about two ways to handle software identification: the procedures described in section 3.4.5 of the new draft, and a variation proposed by Dave Waltermire:

Procedure in the current draft:
Each record and record identifier is accompanied by a 1-bit Source First Use flag and a 7-bit Source Identification Number field. Whenever a Collector gets information from a new source, it assigns that source a 7-bit Source Identification Number. The first time records from that source are sent to a given Validator, the Collector sets the Source First Use flag in all records from that source in the given attribute. In all cases, records/identifiers are always sent with the Source Identification Number the Collector assigned to the source from which each record/identifier came.

Dave Waltermire variation:
There is no Source First Use flag and the Source Identification Number field is 8-bits. Collectors assign Source Identification Numbers to each source as defined above. No special flag is used to indicate first use of a source to a Validator and Validators can note a new source simply by observing the use of a Source Identification Number it has not seen before. (Personally, I agree with Dave's observation that the Source First Use flag adds complexity without really adding much value.)
In addition, there is a new attribute exchange by which the Collector can send a text string describing each source. Basically, this would provide the collector a way to assign some descriptive information to each Source Identification Number. The contents of this string are not currently standardized.

In addition, there was a question regarding the "lifetime" of Source Identification Numbers. Two valid options were noted, in order of likely duration:
- Session (as defined by the valid lifetime of a Connection ID value in a PB-TNC session) - This is the same lifetime of a subscription established by a Validator to a Collector by which the Collector pushes new information based on detected changes. The possible disadvantage is that there are many reasons to terminate a session (including a desire to free up resources and the fact that the PB-TNC state machine does not allow certain actors to do things in certain states, and if the Validator needs to take one of those actions, their only choice is to close the session and start a new one - see RFC 5793 PB-TNC, section 3.2). This could mean that the Validator might be unable to correlate sources across messages separated by only a few hours (current procedure) or need to re-collect descriptive information about sources fairly regularly (Waltermire variation).
- Event ID Epoch - The Event ID Epoch is conveyed in every attribute that sends records or record identifiers. It is used to indicate continuity in the total ordering of Event Identifiers. An Epoch can remain constant across multiple reboots of a Collector. This provides better long-term consistency in Software Identifier Values than Session lifespans. A possible disadvantage is that Epochs are intended to be very long lived and it is possible that the 256 available Source Identifier Numbers could be exhausted before an Epoch changes, although this would only happen if the Collector had a very large number of sources (~3 is probably more normal) and the Collector loses track of sources regularly so needs to re-assign new values to old sources repeatedly (probably an unlikely situation).

So the question to the group (phrases as a yes/no question so that "+1" can be a valid response):

1) Do people like the Waltermire variation for Source Identification capabilities described above?

2) Do people like using Event ID Epochs for the lifetime of Source Identification Number assignments?

Thanks,
Charles