Re: NEA requirements (was Re: Fwd: [Nea] Re: use of a design team to develop requirements)

[Alan DeKok <aland at deployingradius.com>]

Douglas Otis wrote:
>
> It seems the entire exchange could be an exchanging certificates.  The
> provider offers certificates in sets,

  Why sets?  Why not just one certificate?

  We can presume that NEA client policy updates are much rarer than
network connection requests (i.e. posture assessments).  In that case,
the client can be issued a certificate for a particular network once it
has downloaded the latest set of updates.  That certificate may then be
used for repeated posture assessments.

  i.e. the NEA server issues the client a certificate that validates a
particular posture (or set of provider certificates).  Once that's done,
the client only has to present one certificate to the NEA server, rather
than a set.

  When the NEA server decided that it has new updates available, it can
compare the date of "last known update" to the "client certificate issue
date".  If the clients certificate was issued before the last update,
then the client needs remediation.  Otherwise, the client doesn't need
remediation.  The process then repeats.

  Similarly, if the client notices that updates are available, it can
invalidate it's own certificate (i.e. by not using it), at which point
the NEA server will ask it to perform remediation, and then issue a new
certificate.

> perhaps by reference based upon a
> service URI, OS, and service name, where clients then request and verify
> a producer of the certificate which may be some third-party.  Within the
> certificates held by the provider, there should be a time-stamp, their
> identity (perhaps hostmaster@), the type of service providing the
> certificate, suitable OS, and resources needed to obtain the service
> that in the end generates a certificate for the client based upon the
> client's identity.

  Yes, although it's not clear what provider posture information (if
any) needs to be available to the NEA server.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog

_______________________________________________
Nea mailing list
Nea at ietf.org
https://www1.ietf.org/mailman/listinfo/nea