Subject: Re: RE: [Nea] PT protocol must be capable of transporting messages forassessment during network connection request ?

From: Han Yin <[email-masked]>
Date: Fri, 26 Jan 2007 01:43:30 +0800

Hi Kaushik Narayan,

　　Thanks for your response. Please find my response inline.

======== 2007-01-25 03:34:01 您在来信中写道： ========

Hi Han,

Thanks for your comments. Please find my response inline.

From: Han Yin [mailto:[email-masked]] 
Sent: Tuesday, January 23, 2007 11:29 PM
To: [email-masked]
Subject: [Nea] PT protocol must be capable of transporting messages for assessment during network connection request ?

In new requirement, it is presented in section 5.2.3 Posture Transport Protocol:
"The PT protocol must be capable of transporting Messages for Assessment during network connection request and after network connectivity has been established." But I think this is only necessary for assessment triggered by network connection request. Addtional in Section 7.4 Posturen Transport (PT) Protocol Requirements, there is no such a requirement. why? 

<Kaushik> This requirement is covered under "Common Requirements" in section 7.1, the requirement number is C-2.

<Han Yin>
Yes, such requirement is coverd under C-2.
But, I think such requirement is unnecessary. In abstract, it is stated:
     "NEA provides owners of 
     networks (e.g. an enterprise offering remote access) a mechanism 
     to evaluate the posture of a system.  This may take place during 
     the request for network access and/or subsequently at any time 
     while connected to the network."
     Additionally, in some environment, the assessment only occurs after the host is connected to the network, 
     which is described in section 6.1.3.1.  In such cases, user is concerned about endpoint security status, not the network access.
</Han Yin>

On my view, if PT protocol is not expected to carry assessment messages during network connection request, TLS is a good choice. If PT protocol is expected to carry assessment messages during network connection request, EAP-TLS might be a good
choice. Why should we choose among EAP-TTLS/EAP-FAST/EAP-PEAP or define a new one? 

<Kaushik> This draft is intended to capture the protocol requirements; the choice of protocols would be part of future work which might be addressed by a separate draft.

<Han Yin>
Yes, PT protocol is a part of future work. Howerver, the requirement of PT protocol must be determined now . Please see above.
</Han Yin>

Another question of PT protocol:
In the 16th procedure of section 6.1.2.2, it is described that PT protocol informs the gateway of the compliance status. But, how to apply the result of assessment to network access control is out of NEA WG scope. Is it a unintended mistake? 

<Kaushik>  This is intentional since the mechanisms used to apply access control is out of scope of the NEA charter. There is a line in the NEA charter that clearly states. "Specifying mechanisms for providing restricted access is outside the scope of the NEA WG. "

<Han Yin>
But,in Require Introduction, it is stated: 
"While the NEA Reference Model recognizes there is 
      a link between an Endpoint Assessment and the enforcement of 
      the Assessment decision, the mechanisms and protocols for 
      enforcement are not in scope for this specification."
So, PT protocol is not required to inform the assess result to the gateway. Deployer can complete it by other protocols.
In my sense, expression in the 16th porocedure of section 6.1.2.2 is somewhat confusing. 
I think it can be modified as " the compliance status is informed to gateway by PT protocol or other protocols".
</Han Yin>
regards,
  kaushik 

Thank to the requirement design team!

Best regards

Han Yin 
[email-masked]

= = = = = = = = = = = = = = = = = = = = = = 
　　　　　　　　致
礼！

　　　　　　　　　　　　　　Han Yin
　　　　　　　　　　　　　　[email-masked]
　　　　　　　　　　　　　　　　　2007-01-26
_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Mani, Mahalingam \(Mani\)" <[email-masked]>
Date: Sat, 27 Jan 2007 09:42:39 -0700

Han,

Thanks for the thorough read and feedback. To your specific question on 6.1.2.2

Sorry about the delay in responding.

Regards,

-mani

  _____  

From: Han Yin [mailto:[email-masked]] 
Sent: Thursday, January 25, 2007 9:43 AM
To: Kaushik Narayan (kaushik); nea
Subject: Re: RE: [Nea] PT protocol must be capable of transporting messagesforassessment during network connection request ?

Hi Kaushik Narayan, 

	Hi Han,

	[Mani, Mahalingam (Mani)] [snip]

	<Han Yin>

	</Han Yin>

	<mani>

	[Mani, Mahalingam (Mani)] the first para at the beginning of section 6 states the motivation of the section where it says 

	“It should be emphasized that the provided examples are not intended to indicate the only approach to addressing the use case but rather are included to ease understanding of how the flows might occur and require support from the NEA protocols.”

	This use-case cites PT as a possible carrier to help illustrate the use-case. If it is confusing, it can be worded differently as you suggest or, alternatively

	“The PB server also informs the gateway of the compliance status, so that it can take the appropriate enforcement action if required.” Which is less specific about 

	</mani>

	regards,

	  kaushik 

	Best regards

	Han Yin 

	[email-masked]

　　　　　　　　致
礼！

　　　　　　　　　　　　　　Han Yin

　　　　　　　　　　　　　　[email-masked]

　　　　　　　　　　　　　　　　　2007-01-26

---

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Sun, 28 Jan 2007 17:03:35 -0800

Hi Han,
 
Sorry for the delay in responding. Please find my response inline with the tag <Kaushik-Response>
 
<snipped>

	 

	
	<Han Yin>
	 
	<Kaushik-Response>
	 
	The ability to support endpoint assessment prior to network access and subsequently at any time when endpoint is connected to the network does have a impact on protocol design and choice and it is important to state this as a requirement in Section 7 even though the abstract makes a similar statement.
	 
	</Kaushik-Response>

	 

	<Han Yin>

	<Kaushik-Response>
	 
	I am not sure that stating protocol choices such as TLS and EAP methods is part of requirements, I would consider that part of protocol design.
	 
	</Kaushik-Response>

	<Han Yin>

	<Kaushik-Response>
	 
	I agree with you &  Mani that we should modify the text in section 6.1.2.2.
	 
	regards,
	 kaushik
	 
	</Kaushik-Response>

	 
	 [email-masked]

　　　　　　　　致
礼！

　　　　　　　　　　　　　　Han Yin
　　　　　　　　　　　　　　[email-masked]
　　　　　　　　　　　　　　　　　2007-01-26

---

From: Han Yin <[email-masked]>
Date: Tue, 30 Jan 2007 12:01:30 +0800

Hi Kaushik,
Thanks for your responding.
I do not want to state protocol choices in requirements document.

>From my point of view,  Requiremt C-2 is not flexible and not to cover the use case in 6.1.3.
Since in some environment, inital-assessment and re-assessment  are both performed after the host is connected to the network, it is uncessary to require that  NEA protocols must be capable of carrying assessment message during network access request.
We can define several PT protocols(certainly, not in requirement document) which might carry assessment messary in different cases.

However, in my opinon, the range of available PT protoco is reduced by  Requirement C-2, which claims "NEA protocols MUST allow the NEA Server to initiate requests for Posture information prior ...... AND at any time after the ...... ". Additionally, in section 5.2.3 Posture Transport Protocol, It is claimed "The PT protocol must be capable of transporting Messages for Assessment during .... AND after ...." So, some PT protocols surpporting other requirements could be excluded because of these claims. For examle, in some cases descibed in section 6.1.3, 
some protocols that can only carry assessment message after the host is connected to network might act as PT protocol, but not meet the claims above.

Therefore, I think that these claims might be modified from "AND" to "AND/OR", which could increase the flexibility of PT protocol selection.

Regards,

Han Yin
[email-masked]

  ----- Original Message ----- 
  From: Kaushik Narayan (kaushik) 
  To: Han Yin ; Mani, Mahalingam (Mani) ; nea 
  Sent: Monday, January 29, 2007 9:03 AM
  Subject: RE: RE: [Nea] PT protocol must be capable of transporting messages forassessment during network connection request ?

  Hi Han,

  <snipped>

          <Han Yin>

          <Kaushik-Response>

          </Kaushik-Response>

          <Han Yin>

          <Kaushik-Response>

          </Kaushik-Response>

          <Han Yin>

          <Kaushik-Response>

          regards,
           kaushik

          </Kaushik-Response>

           [email-masked] 

  　　　　　　　　致
  礼！

  　　　　　　　　　　　　　　Han Yin
  　　　　　　　　　　　　　　[email-masked]
  　　　　　　　　　　　　　　　　　2007-01-26

---

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Tue, 30 Jan 2007 13:08:49 -0800

Hi Han,
 
I think that is a fair suggestion and we will update the document.
 
regards,
  kaushik

________________________________

From: Han Yin [mailto:[email-masked]] 
Sent: Monday, January 29, 2007 8:02 PM
To: Kaushik Narayan (kaushik); Mani, Mahalingam (Mani); nea
Subject: Re: RE: [Nea] PT protocol must be capable of transporting messages forassessment during network connection request ?

Hi Kaushik,

 
 
Regards,
 
Han Yin
[email-masked]

	----- Original Message ----- 
	From: Kaushik Narayan (kaushik) <mailto:[email-masked]>  
	To: Han Yin <mailto:[email-masked]>  ; Mani, Mahalingam (Mani) <mailto:[email-masked]>  ; nea <mailto:[email-masked]>  
	Sent: Monday, January 29, 2007 9:03 AM
	Subject: RE: RE: [Nea] PT protocol must be capable of transporting messages forassessment during network connection request ?

	Hi Han,

	<snipped>

	 

	
	<Han Yin>
	 
	<Kaushik-Response>

	</Kaushik-Response>

	 

	<Han Yin>

	<Kaushik-Response>

	</Kaushik-Response>

	<Han Yin>

	<Kaushik-Response>

	regards,
	 kaushik
	 
	</Kaushik-Response>

	 
	 [email-masked]

	　　　　　　　　致
	礼！

	　　　　　　　　　　　　　　Han Yin
	　　　　　　　　　　　　　　[email-masked]
	　　　　　　　　　　　　　　　　　2007-01-26