idnits 2.17.1 draft-richardson-opsawg-securehomegateway-mud-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The abstract seems to contain references ([I-D.ietf-opsawg-mud]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 11, 2019) is 1866 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-02) exists of draft-richardson-shg-mud-quarantined-access-00 Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 6tisch Working Group M. Richardson 3 Internet-Draft Sandelman Software Works 4 Intended status: Informational J. Latour 5 Expires: September 12, 2019 CIRA Labs 6 F. Khan 7 Twelve Dot Systems 8 March 11, 2019 10 MUD processing and extensions for Secure Home Gateway Project 11 draft-richardson-opsawg-securehomegateway-mud-01 13 Abstract 15 This document details the mechanism used by the CIRA Secure Home 16 Gateway and CIRA MUD integration server to return MUD artifacts to 17 participating gateway systems. 19 The work in [I-D.ietf-opsawg-mud] creates a relationship between a 20 device's manufacturer and a border gateway that may need to enforce 21 policy. This document ads an additional relationship to a service 22 provider, trusted by the border gateway to enhance or modify the 23 stated security policy. 25 Status of This Memo 27 This Internet-Draft is submitted in full conformance with the 28 provisions of BCP 78 and BCP 79. 30 Internet-Drafts are working documents of the Internet Engineering 31 Task Force (IETF). Note that other groups may also distribute 32 working documents as Internet-Drafts. The list of current Internet- 33 Drafts is at https://datatracker.ietf.org/drafts/current/. 35 Internet-Drafts are draft documents valid for a maximum of six months 36 and may be updated, replaced, or obsoleted by other documents at any 37 time. It is inappropriate to use Internet-Drafts as reference 38 material or to cite them other than as "work in progress." 40 This Internet-Draft will expire on September 12, 2019. 42 Copyright Notice 44 Copyright (c) 2019 IETF Trust and the persons identified as the 45 document authors. All rights reserved. 47 This document is subject to BCP 78 and the IETF Trust's Legal 48 Provisions Relating to IETF Documents 49 (https://trustee.ietf.org/license-info) in effect on the date of 50 publication of this document. Please review these documents 51 carefully, as they describe your rights and restrictions with respect 52 to this document. Code Components extracted from this document must 53 include Simplified BSD License text as described in Section 4.e of 54 the Trust Legal Provisions and are provided without warranty as 55 described in the Simplified BSD License. 57 Table of Contents 59 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 60 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2 61 3. Requirements Language . . . . . . . . . . . . . . . . . . . . 3 62 4. Security Considerations . . . . . . . . . . . . . . . . . . . 3 63 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 64 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 3 65 7. Normative References . . . . . . . . . . . . . . . . . . . . 3 66 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 3 68 1. Introduction 70 This document details how the CIRALabs Secure Home Gateway uses MUD 71 files. 73 [I-D.richardson-shg-mud-quarantined-access] details an extension to 74 mark certain ACLs as providing firmware update access. 76 The second issue addressed by the document is the question of whether 77 and when the MUD file should be specific to a specific version of the 78 device firmware. 80 The third issue is that an intermediary (ISP, or third-party security 81 service) may want to extend or amend a MUD file received from a 82 manufacturer. In order to maintain an audit trail of changes, a way 83 to encode the previous MUD URL and signature file (and status) is 84 provided. 86 2. Terminology 88 The major new term, compared to the MUD document is the term 90 quaranteed: a device which has shown behaviour forbidden by a MUD 91 file ACL, and has subsequently been denied further access to the 92 network. 94 3. Requirements Language 96 In this document, the key words "MUST", "MUST NOT", "REQUIRED", 97 "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", 98 and "OPTIONAL" are to be interpreted as described in BCP 14, RFC 2119 99 [RFC2119] and indicate requirement levels for compliant STuPiD 100 implementations. 102 4. Security Considerations 104 TBD. 106 5. IANA Considerations 108 TBD. 110 6. Acknowledgements 112 This work was supported by the Canadian Internet Registration 113 Authority (cira.ca). 115 7. Normative References 117 [I-D.ietf-opsawg-mud] 118 Lear, E., Droms, R., and D. Romascanu, "Manufacturer Usage 119 Description Specification", draft-ietf-opsawg-mud-25 (work 120 in progress), June 2018. 122 [I-D.richardson-shg-mud-quarantined-access] 123 Richardson, M., "Manufacturer Usuage Description for 124 quarantined access to firmware", draft-richardson-shg-mud- 125 quarantined-access-00 (work in progress), January 2019. 127 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 128 Requirement Levels", BCP 14, RFC 2119, 129 DOI 10.17487/RFC2119, March 1997, 130 . 132 Authors' Addresses 134 Michael Richardson 135 Sandelman Software Works 137 Email: mcr+ietf@sandelman.ca 138 Jacques Latour 139 CIRA Labs 141 Email: Jacques.Latour@cira.ca 143 Faud Khan 144 Twelve Dot Systems 146 Email: faud.khan@twelvedot.com