Subject: [rddp] Privileged Resource Manager comments

From: "Jim Pinkerton" <[email-masked]>
Date: Thu, 20 Nov 2003 11:05:16 -0800

In the minutes for the last IETF meeting, it states:

Q: Draft introduces Privileged Resource Manager as a mandatory

      functional component.  How does this affect performance?

A: The intent is that it not be involved in high-frequency

      operations, but more work is needed to define the precise

      functionality of the Privileged Resource Manager and check

      if there are problems.

In the latest draft, per feedback from the reflector, the following text
was added:

For example, the Privileged Resource Manager may be partially or
completely encapsulated in the Privileged Application. Regardless, it is
expected that the security analysis of the potential threats and
countermeasures still apply.

Thus I don't believe the draft requires a distinct entity called the
Privileged Resource Manager. It can be encapsulated in an application
that has been trusted to access privileged resources directly. For
example, a particular implementation may run exactly one application,
which has physical access to all resources. In that case the security
issues described for the non-privileged application are unnecessary to
implement (because there is not one), and there is no need to separate
the Privileged Resource Manager from the privileged application.

Jim

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 20 Nov 2003 15:54:49 -0600

On Nov 20, 2003, at 1:05 PM, Jim Pinkerton wrote:

> In the latest draft, per feedback from the reflector, the following 
> text was added:
>
>  
>
> completely encapsulated in the Privileged Application. Regardless, it 
> is expected that the security analysis of the potential threats and 
> Thus I don’t believe the draft requires a distinct entity called the 

Agreed, the "Privileged Resource Manager" is merely a label that 
reflects the
fact that DDP Layer must be given permission to access user memory, and
that in most environments this fact must/should be validated.

But to be even more precise, the DDP Layer does not *have* to be given
access to "physical memory". The "RNIC" could be implemented *within*
a process, in which case the memory being accessed could be just
plain "normal" memory. The DDP Layer could also be operating over
a system bus with its own addressing (such as VME-64 or CPCI).