Subject: I-D ACTION:draft-hardaker-snmp-session-sm-00.txt

From: [email-masked]
Date: Mon, 06 Oct 2003 13:13:42 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: A Security Based Session Model (SBSM) for the Simple
			  Network Management Protocol (SNMP).
	Author(s)	: W. Hardaker
	Filename	: draft-hardaker-snmp-session-sm-00.txt
	Pages		: 39
	Date		: 2003-10-6
	
This document describes a Session Based Security Model (SBSM) for use
within the Simple Network Management Protocol (SNMP).  The security
model is designed to establish a 'session' between two interacting
hosts, over which SNMP operations can be sent.  It provides a number
of security properties not previously available in defined SNMP
security models, such as public key based authentication, limited
life-time keying, and the ability to make use of previously
implemented and deployed security infrastructures for purposes of
identification and authentication.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-hardaker-snmp-session-sm-00.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-hardaker-snmp-session-sm-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-hardaker-snmp-session-sm-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 15 Oct 2003 15:35:27 -0700

>>>>> On Tue, 14 Oct 2003 08:01:51 -0500, "Golovinsky, Eugene" <[email-masked]> said:

Eugene> My understanding is that when sessions die from natural causes
Eugene> it'll clean up key(s) associated with it. That is done without
Eugene> MIB involved. On the other hand I would like to be able to
Eugene> manage and administer the entity while session is active (per
Eugene> session statistics, retries, failed sessions, whatever else)
Eugene> and to be able to cancel the key if there is a need. If not
Eugene> through the MIB, then we'll have to come up with other way
Eugene> (protocol ??) to do that. I'd rather stick to SNMP here.

My expectation is that the following three methods will be available
for tearing down connections:

1) An in-protocol CONNECTION-DELETED to inform the other side that it
   should release and clean resources (MUST actually, especially
   keys).  Functionally, it's a FIN.

2) A MIB method for control by SNMP, either within the same session or
   by someone with administrative rights.

3) If either side simply deletes its side of the session, then the
   other side will be unable to communicate over it (this must always
   be supported since things like reboots will normally clean the
   session information within a device).

-- 
Wes Hardaker
Sparta