I want to introduce the IETF OPSAWG to some MUD related work that I started in the spring. After some discussion about an appropriate place for this work, I realized that this is primarily aimed at Operators, and I primarily want feedback from those who want to do this. I also realized in March that was I was building a playbook, and that the IETF CACAO (BOF) work might want to use some of this as requirements, but that BOF didn't continue.
So the plan is to do this mostly in the RIPE IoT-WG, with the document
providing recommendations (BCP), and also gap analysis feedback to many
places, including the IETF.
The talk I was going to do at RIPE78 did not happen due to a short agenda.
I had done a screencast; it got cut off 94% through due to a full /var/tmp,
but I decided that was good enough. The slides and video are below.
My thanks to Kathleen Moriarty who walked me through some of the
ROLIE/STIIX/MISP stuff that I know very little about.
The first step of the Secure Home Gateway/MUD-Controller to ISP/operator link
is when an IoT device violates it's MUD profile. My document contemplates
two stages of pergatory on the assumption that MUD ACLs will initially be
not that reliable, and what we do not want to do is to train end users to
click through warnings.
This requires some kind of "three strikes" and you are out kind of system,
and to make that work, well, to continue the Baseball analogy, we need an
umpire. The ISP/network-operator will need to do that, and that means that
they need to get data on what is going wrong. Which devices are doing what,
and how often, and this needs to be in enough detail to corelate across
customers. And the data needs to be pseudo-nonymized and expunged against
the eventual database breach or LEA action.
IPFIX seems to be the right protocol for this. Tiru says they already use it.
It will need some significant extra security/management layer to provide for
automatic enrollment.
Also needed is some kind of feedback to the MUD controller as to how
significant this event currently is, and whether futher quarantine is
waranted or whether to expect an updated MUD file. It has been suggested
that this part of the first step is a place for DOTS.
The document is in your nearest Internet Draft archive as:
draft-richardson-shg-un-quarantine-00
and the github is at:
https://github.com/CIRALabs/shg-un-quarantine
including the slides in fodp and pdf format (with the animations expanded) in
the "presentations" folder.
The screencast/video is at:
http://junk.sandelman.ca/junk/unquarantine-RIPE-talk.ogv
https://youtu.be/GOmHx8jpaCM
--
Michael Richardson <[email protected]>, Sandelman Software Works
-= IPv6 IoT consulting =-
signature.asc
Description: PGP signature
_______________________________________________ OPSAWG mailing list [email protected] https://www.ietf.org/mailman/listinfo/opsawg
