Subject: [sacm] Information Model of Guidance: a Sketch

From: "Kahn, Clifford" <[email-masked]>
Date: Mon, 3 Nov 2014 19:43:46 +0000

In draft-ietf-sacm-information-model-00 is this comment:

[jmf- the guidance sections need more detail. . .]

Thanks, JMF. This co-editor agrees!

Here is a sketch. If we like it, we can color it in and include it in the next draft of the Information Model.

Best,
                Cliff

OVERVIEW

An instance of Guidance may *match* Endpoint Attribute Assertions. We add a "matches" relation to Figure 2.
                  |0..1
                  |
                  |*
                 +---+        +---------+______>______+-------+
                 |AVP|________|Endpoint |*           1|Report |
                 +---+1..*   1|Attribute|_______      +-------+
                ______________|Assertion|0..1   |        *|
               | <matches    *+---------+       |         |
               |                 |*   |*        |         |
               |                 |^   |____>____|        ^|
               |      asserted-by|     <based-on          |reported-by
               |*                |1                       |
             ------------     +---------+                 |
             |          |__>__|SACM     |_________________|
             |Guidance  |1   *|Component|1
             ------------     +---------+

A matching criterion is part of the Guidance instance.

-   An instance of Collection Guidance contains a matching criterion that tells attribute providers what Endpoint Attribute Assertions are wanted as output.

-   An instance of Evaluation Guidance contains *two* matching criteria:

o   One tells evaluators what Endpoint Attribute Assertions to consider as input.

o   The other tells Evaluators what Endpoint Attribute Assertions are wanted as output.

-   An instance of Report Guidance tells Report Generators what Endpoint Attribute Assertions to use as input. It also helps consumers to interpret the report.
TODO: Create normative text about how SACM components must heed guidance.

MATCHING CRITERIA, IN MORE DETAIL

This Information Model does not embrace every possible matching criterion. Rather, a criterion is a Boolean expression. Each Boolean variable is a predicate on a single attribute type. Predicates include:

     Attribute-is-present
     Attribute-value-equals
     Attribute-value-is-in-range
     Attribute-value-matches-regular-expression
     (More to be added over time)

Predicates can be about provenance. For example, they may specify methods of deriving Endpoint Attribute Assertions. Predicates may specify attributes of the SACM component that makes the assertion, such as the component's vendor.

The precise notation for a matching criterion will be defined by the data model(s).

GUIDANCE, IN MORE DETAIL

Guidance instances have other parts. For example:

-   Collection Guidance may specify the desired collection interval.

-   Report Guidance will specify the format of the report. There should be a few standard, machine-readable formats and a lot of extensibility.

ASSIGNMENT of GUIDANCE to SACM COMPONENTS

There is a plumbing issue. Suppose:

-   A consumer of Endpoint Attribute Assertions publishes Collection Guidance.

-   Two virtually identical Endpoint Attribute Collectors notice the guidance. Each determines that it can provide the desired assertions.

-   Both collectors do it, creating redundant Endpoint Attribute Assertions.
This creates undesirable overhead.

Perhaps the SACM architecture needs a function that *assigns* a piece of guidance to a provider.

IF-MAP has a possibly instructive approach to this assignment problem. Request-for-investigation metadata is a kind of collection guidance. This metadata can include hints that help other IF-MAP clients decide whether to respond to the request.

Clifford Kahn
Principal Engineer/Technical Lead
[Pulse-Secure-Logo-xSmall]