rfc4534.Group Security Policy Token v1

NetworkWorkingGroupA.ColegroveRequestforComments:4534H.HarneyCategory:StandardsTrackSPARTA,Inc.June2006GroupSecurityPolicyTokenv1StatusofThisMemoThisdocumentspecifiesanInternetstandardstrackprotocolfortheInternetcommunity,andrequestsdiscussionandsuggestionsforimprovements.PleaserefertothecurrenteditionoftheInternetOfficialProtocolStandards(STD1)forthestandardizationstateandstatusofthisprotocol.Distributionofthismemoisunlimited.CopyrightNoticeCopyright(C)TheInternetSociety(2006).AbstractTheGroupSecurityPolicyTokenisastructureusedtospecifythesecuritypolicyandconfigurableparametersforacryptographicgroup,suchasasecuremulticastgroup.Becausethesecurityofagroupiscomposedofthetotalityofmultiplesecurityservices,mechanisms,andattributesthroughoutthecommunicationsinfrastructure,anauthenticatablerepresentationofthefeaturesthatmustbesupportedthroughoutthesystemisneededtoensureconsistentsecurity.Thisdocumentspecifiesthestructureofsuchatoken.Colegrove&HarneyStandardsTrack[Page1]RFC4534GroupSecurityPolicyTokenv1June2006TableofContents1.Introduction....................................................32.TokenCreationandReceipt......................................43.ThePolicyToken................................................53.1.TokenIdentifiers..........................................63.2.RegistrationPolicy........................................63.3.RekeyPolicy...............................................73.4.GroupDataPolicy..........................................84.SecurityConsiderations.........................................85.IANAConsiderations.............................................86.References.......................................................96.1.NormativeReferences.......................................96.2.InformativeReferences....................................107.Acknowledgements...............................................10AppendixA.CorePolicyTokenASN.1Module........................11AppendixB.GSAKMPv1BasePolicy..................................13B.1.GSAKMPv1RegistrationPolicy..............................13B.1.1.Authorization.......................................13B.1.2.AccessControl.......................................14B.1.3.JoinMechanisms......................................15B.1.3.1.alaCarte...................................15B.1.3.2.suite......................................17B.1.4.Transport...........................................17B.2.GSAKMPv1RegistrationASN.1Module........................17B.3.GSAKMPv1De-RegistrationPolicy...........................20B.4.GSAKMPv1De-RegistrationASN.1Module.....................21B.5.GSAKMPv1RekeyPolicy.....................................22B.5.1.RekeyAuthorization................................22B.5.2.RekeyMechanisms...................................23B.5.3.RekeyEventDefinition.............................23B.5.4.RekeyMethods......................................24B.5.4.1RekeyMethodNONE..........................24B.5.4.2RekeyMethodGSAKMPLKH....................24B.5.5RekeyInterval......................................25B.5.6RekeyReliability...................................25B.5.6.1RekeyReliabilityMechanismNone............25B.5.6.2RekeyReliabilityMechanismResend..........25B.5.6.3RekeyReliabilityMechanismPost............26B.5.7DistributedOperationPolicy........................26B.5.7.1NoDistributedOperation....................26B.5.7.2AutonomousDistributedMode.................26B.6.GSAKMPv1RekeyPolicyASN.1Module........................27AppendixC.DataSAPolicy........................................30C.1.GenericDataPolicy.......................................30C.2.GenericDataPolicyASN.1Module..........................30Colegrove&HarneyStandardsTrack[Page2]RFC4534GroupSecurityPolicyTokenv1June20061.IntroductionTheMulticastGroupSecurityArchitecture[RFC3740]definesthesecurityinfrastructuretosupportsecuregroupcommunications.Thepolicytokenassumesthisarchitectureinitsdefinition.ItdefinestheenforceablesecurityparametersforaGroupSecureAssociation.ThepolicytokenisaverifiabledataconstructsignedbytheGroupOwner,theentitywiththeauthorizationtocreatesecuritypolicy.Thegroupcontrollersinagroupwillusethepolicytokentoensurethatthemechanismsusedtosecurethegrouparecorrectandtoenforcetheaccesscontrolrulesforjoiningmembers.Thegroupmembers,whomaycontributedatatothegrouporaccessdatafromthegroup,willusethepolicytokentoensurethatthegroupisownedbyatrustedauthority.Also,themembersmaywanttoverifythattheaccesscontrolrulesareadequatetoprotectthedatathatthememberissubmittingtothegroup.ThepolicytokenisspecifiedinASN.1[X.208]andistobeDER[X.660]encoded.Thisspecificationabilityallowsthetokentoeasilyimportgroupdefinitionsthatspandifferentapplicationsandenvironments.ASN.1allowsthetokentospecifybranchesthatcanbeusedbyanymulticastsecurityprotocol.Anygroupcanusethispolicytokenstructuretospecifytheuseofmultipleprotocolsinsecuringthegroup.Carewastakeninthisspecificationtoprovideacoreleveloftokenspecificitythatwouldalloweaseofextensibilityandflexibilityinsupportingmechanisms.Thiswa