Dive into RFC 2574 Userbased Security Model USM

Dive into RFC 2574 User-based Security Model (USM) for the SNMP-v 3 1

Threats Limited protection provided for: l l 2 Modification of Information Masquerade - False pretend of unauthorized users Disclosure - Eavesdropping on the exchange between managed agents and managed station. Message Stream Modification – Danger of the message being re-ordered, delayed, or replayed by unauthorized management stations

Threats Cont. No protection against: l l 3 Denial of Service Traffic Analysis

Goals 4 l Verify that each received SNMP message has not been modified during its transmission through the network. l Verify the identity of the user on whose behalf a received SNMP message claims to have been generated. l Detect the received SNMP messages, which request or contain management information, whose time of generation was not recent. l Provide, when necessary, that the contents of each received SNMP message are protected from disclosure.

Constraints l l l 5 When the requirements of effective management in times of network stress are inconsistent with those of security, the design should prefer the former Neither the security protocol nor its underlying security mechanisms should depend upon the ready availability of other network services (e. g. , Network Time Protocol (NTP) or key management protocols) A security mechanism should entail no changes to the basic SNMP network management philosophy

Security Services 6 l Data Integrity l Data Origin Authentication l Data Confidentiality l Message timeliness and limited replay protection

Why Use SNMP-v 3 • Authentication • • • Privacy • • • 7 Packet data may now be DES encrypted (additional encryptions) CBC-DES Symmetric Encryption Protocol Allows for unique Privacy password Inform Traps • • HMAC-MD 5 -96, or SHA authentication Password must be greater than 8 characters including spaces Old style trap was "throw-n-pray" over UDP v 2 Inform trap is over TCP and requires a response Traps may also have Authentication and Privacy passwords Security Structures • User / Scope / ACL all may have independent Auth. Priv structures

Authoritative and Non-authoritative Engines l l 8 In any message one of the transmitter/receiver SNMP entities is designated as the Authoritative SNMP engine When a message expects a response, the receiver of such messages is authoritative When no response is expected the sender is authoritative This serves two purposes • Timeliness of message determined with clock of authoritative engine • Key localization process

Protocol context of SNMP 9

SNMPv 3 Architecture l l l SNMPv 3 architecture (RFC 2571) consists of a distributed collection of SNMP entities communicating together Each SNMP entity may act as manager, agent, or combination SNMP Engine - Implements functions for: • • • 10 sending and receiving messages Authenticating and encrypting/decrypting messages Controlling access to managed objects

SNMP Engine Modules l l Modular nature means that upgrades to individual modules can be made without redoing the architecture Modules: • • 11 Dispatcher Message Processing Subsystem Security Subsystem Access Control Subsystem

SNMP Manager 12

SNMP Agent 13

SNMP Engine Modules: Dispatcher l l Dispatcher is a simple traffic manager On incoming messages l l 14 It accepts incoming messages from the transport layer Routes each message to the appropriate message processing module When the message processing completes the Dispatcher sends the PDU to the appropriate application On outgoing messages • It accepts PDUs from Application layer • Sends to Message processing subsystem • Sends to Transport layer

SNMP Engine Modules: Dispatcher l 15 Dispatcher Submodules • PDU Dispatcher – sends/accepts Protocol Data Units (PDUs) to/from SNMP applications • Message Dispatcher – transmits to/from message processing subsystem • Transport Mapping – sends/receives transport layer packets

Message Processing Module l Accepts outgoing PDUs from dispatcher l l 16 Passes message to the security subsytem Wraps the result with the appropriate header Sends back to the dispatcher On incoming PDUs • Accepts messages from the dispatcher • Processes the headers • Possibly sending to Security Subsystem for authenitication and decryption and • Returns the enclosed PDU to the dispatcher

Security and Access Control Modules 17 l Security modules – User-based Security Model (USM) – Other security models allowed for but not yet. l Access Control Modules – View-based access control model (VACM) – Others allowed

SNMPv 3 Terminology l l l l 18 l snmp. Engine. Id – unique ID to engine (Octet string) context. Engine. Id – unique ID to SNMP entity context. Name – identifies particular context within SNMP Engine scoped. PDU – block including: context. Engine. Id, context. Name and an SNMP PDU snmp. Message. Processing. Model – unique identifier snmp. Security. Model – integer indicating whether authentication and/or encryption are required principal – the entity for “Whom the Bell Tolls” security. Name – string representation of the principal

SNMPv 3 Applications l l l Command generator applications • Makes use of send. Pdu primitive • Dispatcher Message Processing Security subsytem • Finally UDP • and later the process. Response dispatcher primitive handles the response Notification originator/receiver applications • Operates similarly sending a notification Command Responder applications use primitives l l 19 l Register. Context. Engine. ID – here is my ID (unregister also) process. PDU return. Respnse. PDU is. Access. Allowed (Access Control Subsystem primitive) Proxy forwarder application

Message Processing Model l l RFC 2572 defines the message processing model The model on outgoing messages • Accepts PDUs from the dispatcher • Encapsulates them in messages • Invokes the user Security Model (USM) to insert security related parameters in the headers • On incoming • Invokes the user Security Model (USM) process the security related parameters in the header • Delivers encapsulated PDU back to dispatcher • SNMP message first five fields 20

SNMP 3 Message Format with USM 21

USM Timeliness Mechanisms l Non authoritative engine maintains copies of l l l 22 snmp. Engine. Boots = number of times rebooted since originally configured 0 to 231 snmp. Engine. Time latest. Received Engine. Time USM update conditions USM update rule Message judged to be outside window …

Key Localization Process 23

SNMPv 3 RFCs 24

SNMP-v 3 Strength l Widespread Support – l Flexible and Extensible – – – 25 SNMP agents available for many network deviced (hosts, routers, switches, bridges, modems, printers, etc. ) SNMP agents can be extended to cover devicespecific data Clear mechanism for upgrading Additional interoperability via proxies

SNMP-v 3 Weaknesses l SNMP is not really “simple” – – l SNMP is not an efficient protocol – – l l 26 Complicated protocol to implement Complex encoding rules Bandwidth wasted with useless information Inefficiencies of ASN. 1 with respect to compactness SNMP lacking in security Lack of privacy or strong authentication Offered in SNMP-v 3, but SNMP-v 1 still widely used Limits utility for monitoring remote networks

SNMP Weaknesses Cont. l Latency can be high in SNMP – – 27 Request-response protocol, leading to a delay between time of request and time of response Typically small in a LAN, but potentially a problem in a WAN

THANK YOU 28