Subject: RE: [Rserpool] Data transmission

From: "Sengodan Senthil (NRC/Boston)" <[email-masked]>
Date: Thu, 26 Jul 2001 12:29:10 -0500

Qiaobing,

I think that Ram and I agree with you that data security to the
application itself is out of scope, and should not be considered. But
there is a difference between being authorized to access an application
and being authorized to access a specific transport address via which
the application is accessed. The latter should be part of Rserpool, and
this is what we've addressed.

- Senthil

> -----Original Message-----
> From: ext Qiaobing Xie [mailto:[email-masked]]
> Sent: Thursday, July 26, 2001 1:05 PM
> To: Gopal Ram (NRC/Boston)
> Cc: 'ext Randall Stewart'; Sengodan Senthil (NRC/Boston); Miguel Angel
> Nieto Jimenez ECE/TL/NA TU-146 Tlf.91.339.4670; [email-masked]
> Subject: Re: [Rserpool] Data transmission
> 
> 
> "Gopal Ram (NRC/Boston)" wrote:
> ....
> > 
> > Requirement states the end name being encrypted . Secured 
> channel has to
> > be established between
> > ENRP - PE to perform message exchange and also applies to 
> ENRP - PU and
> > also between PE to autenticate
> > PU,  otherwise whole purpose of end name encryption becomes 
> meaningless.
> > 
> 
> Ram,
> 
> The goal of RSERPOOL security is to **protect the integrity 
> of RSERPOOL
> itself**, it is NOT meant to provide data security to the application
> above (i.e., anything between PU and PE is the responsibility of the
> application, including server access permission, user authentication,
> data encryption, etc). It is very important to see this 
> difference here.
> 
> -Qiaobing
> 

_______________________________________________
rserpool mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rserpool

---

From: Randall Stewart <[email-masked]>
Date: Fri, 27 Jul 2001 10:57:25 -0500

Sengodan:

Please look carefully at Qiaobing's reply again... the key
here is that all security between PE and PU for both
encryption and authorization is NOT performed by rserpool but
by the applications themselves. The security we have put
into the RSERPOOL requrirments are not for PE-PU but for
access to the name space. 

This is a KEY fundamental issue that I think you have missed.

R

-- 
Randall R. Stewart
[email-masked] 815-342-5222 (cell phone)

---

From: Qiaobing Xie <[email-masked]>
Date: Fri, 27 Jul 2001 12:33:46 -0500

> this is what we've addressed.

Senthil,

Then please tell me what it means if a PU has been authorized to access
the application but not been authorized to access the specific transport
address on which the application is running? And who is going to make
the decision of granting or rejecting the access to a specific transport
address?

I just don't see any practical significance or usefulness of making such
a distinction.

-Qiaobing