rfc2571.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 1,528 行 · 第 1/5 页

         related to the support of the feature.

1.4.  Security Requirements of this Architecture

   Several of the classical threats to network protocols are applicable
   to the management problem and therefore would be applicable to any
   Security Model used in an SNMP Management Framework. Other threats
   are not applicable to the management problem.  This section discusses
   principal threats, secondary threats, and threats which are of lesser
   importance.

   The principal threats against which any Security Model used within
   this architecture SHOULD provide protection are:

      Modification of Information
         The modification threat is the danger that some unauthorized
         entity may alter in-transit SNMP messages generated on behalf
         of an authorized principal in such a way as to effect
         unauthorized management operations, including falsifying the
         value of an object.

      Masquerade
         The masquerade threat is the danger that management operations
         not authorized for some principal may be attempted by assuming
         the identity of another principal that has the appropriate
         authorizations.





SNMPv3 Working Group        Standards Track                     [Page 6]

RFC 2571           Architecture for SNMP Frameworks             April 1999


   Secondary threats against which any Security Model used within this
   architecture SHOULD provide protection are:

      Message Stream Modification
         The SNMP protocol is typically based upon a connectionless
         transport service which may operate over any subnetwork
         service.  The re-ordering, delay or replay of messages can and
         does occur through the natural operation of many such
         subnetwork services.  The message stream modification threat is
         the danger that messages may be maliciously re-ordered, delayed
         or replayed to an extent which is greater than can occur
         through the natural operation of a subnetwork service, in order
         to effect unauthorized management operations.

      Disclosure
         The disclosure threat is the danger of eavesdropping on the
         exchanges between SNMP engines.  Protecting against this threat
         may be required as a matter of local policy.

   There are at least two threats against which a Security Model within
   this architecture need not protect, since they are deemed to be of
   lesser importance in this context:

      Denial of Service
         A Security Model need not attempt to address the broad range of
         attacks by which service on behalf of authorized users is
         denied.  Indeed, such denial-of-service attacks are in many
         cases indistinguishable from the type of network failures with
         which any viable management protocol must cope as a matter of
         course.

      Traffic Analysis
         A Security Model need not attempt to address traffic analysis
         attacks.  Many traffic patterns are predictable - entities may
         be managed on a regular basis by a relatively small number of
         management stations - and therefore there is no significant
         advantage afforded by protecting against traffic analysis.

1.5.  Design Decisions

   Various design decisions were made in support of the goals of the
   architecture and the security requirements:

      - Architecture
         An architecture should be defined which identifies the
         conceptual boundaries between the documents. Subsystems should
         be defined which describe the abstract services provided by
         specific portions of an SNMP framework. Abstract service



SNMPv3 Working Group        Standards Track                     [Page 7]

RFC 2571           Architecture for SNMP Frameworks             April 1999


         interfaces, as described by service primitives, define the
         abstract boundaries between documents, and the abstract
         services that are provided by the conceptual subsystems of an
         SNMP framework.

      - Self-contained Documents
         Elements of procedure plus the MIB objects which are needed for
         processing for a specific portion of an SNMP framework should
         be defined in the same document, and as much as possible,
         should not be referenced in other documents. This allows pieces
         to be designed and documented as independent and self-contained
         parts, which is consistent with the general SNMP MIB module
         approach.  As portions of SNMP change over time, the documents
         describing other portions of SNMP are not directly impacted.
         This modularity allows, for example, Security Models,
         authentication and privacy mechanisms, and message formats to
         be upgraded and supplemented as the need arises. The self-
         contained documents can move along the standards track on
         different time-lines.

      This modularity of specification is not meant to be interpreted as
      imposing any specific requirements on implementation.

      - Threats
         The Security Models in the Security Subsystem SHOULD protect
         against the principal and secondary threats: modification of
         information, masquerade, message stream modification and
         disclosure.  They do not need to protect against denial of
         service and traffic analysis.

      - Remote Configuration
         The Security and Access Control Subsystems add a whole new set
         of SNMP configuration parameters.  The Security Subsystem also
         requires frequent changes of secrets at the various SNMP
         entities. To make this deployable in a large operational
         environment, these SNMP parameters must be remotely
         configurable.

      - Controlled Complexity
         It is recognized that producers of simple managed devices want
         to keep the resources used by SNMP to a minimum.  At the same
         time, there is a need for more complex configurations which can
         spend more resources for SNMP and thus provide more
         functionality.  The design tries to keep the competing
         requirements of these two environments in balance and allows
         the more complex environments to logically extend the simple
         environment.




SNMPv3 Working Group        Standards Track                     [Page 8]

RFC 2571           Architecture for SNMP Frameworks             April 1999


2.  Documentation Overview

   The following figure shows the set of documents that fit within the
   SNMP Architecture.
   +------------------------- Document Set ----------------------------+
   |                                                                   |
   | +----------+              +-----------------+  +----------------+ |
   | | Document |              | Applicability * |  | Coexistence    | |
   | | Roadmap  |              | Statement       |  | & Transition   | |
   | +----------+              +-----------------+  +----------------+ |
   |                                                                   |
   | +---------------------------------------------------------------+ |
   | | Message Handling                                              | |
   | | +----------------+  +-----------------+  +-----------------+  | |
   | | | Transport      |  | Message         |  | Security        |  | |
   | | | Mappings       |  | Processing and  |  |                 |  | |
   | | |                |  | Dispatcher      |  |                 |  | |
   | | +----------------+  +-----------------+  +-----------------+  | |
   | +---------------------------------------------------------------+ |
   |                                                                   |
   | +---------------------------------------------------------------+ |
   | | PDU Handling                                                  | |
   | | +----------------+  +-----------------+  +-----------------+  | |
   | | | Protocol       |  | Applications    |  | Access          |  | |
   | | | Operations     |  |                 |  | Control         |  | |
   | | +----------------+  +-----------------+  +-----------------+  | |
   | +---------------------------------------------------------------+ |
   |                                                                   |
   | +---------------------------------------------------------------+ |
   | | Information Model                                             | |
   | | +--------------+   +--------------+    +---------------+      | |
   | | | Structure of |   | Textual      |    | Conformance   |      | |
   | | | Management   |   | Conventions  |    | Statements    |      | |
   | | | Information  |   |              |    |               |      | |
   | | +--------------+   +--------------+    +---------------+      | |
   | +---------------------------------------------------------------+ |
   |                                                                   |
   | +---------------------------------------------------------------+ |
   | | MIB Modules written in various formats, e.g.:                 | |
   | | +-------------+ +-------------+ +----------+ +----------+     | |
   | | | Standard v1 | | Standard v1 | | Historic | | Draft v2 |     | |
   | | | RFC 1157    | | RFC 1212    | | RFC 14xx | | RFC 19xx |     | |
   | | | format      | | format      | | format   | | format   |     | |
   | | +-------------+ +-------------+ +----------+ +----------+     | |
   | +---------------------------------------------------------------+ |
   |                                                                   |
   +-------------------------------------------------------------------+




SNMPv3 Working Group        Standards Track                     [Page 9]

RFC 2571           Architecture for SNMP Frameworks             April 1999


   Those marked with an asterisk (*) are expected to be written in the
   future. Each of these documents may be replaced or supplemented.
   This Architecture document specifically describes how new documents
   fit into the set of documents in the area of Message and PDU
   handling.


2.1.  Document Roadmap

   One or more documents may be written to describe how sets of
   documents taken together form specific Frameworks. The configuration
   of document sets might change over time, so the "road map" should be
   maintained in a document separate from the standards documents
   themselves.

   An example of such a roadmap is "Introduction to Version 3 of the
   Internet-standard Network Management Framework" [RFC2570].

2.2.  Applicability Statement

   SNMP is used in networks that vary widely in size and complexity, by
   organizations that vary widely in their requirements of management.
   Some models will be designed to address specific problems of
   management, such as message security.

   One or more documents may be written to describe the environments to
   which certain versions of SNMP or models within SNMP would be
   appropriately applied, and those to which a given model might be
   inappropriately applied.

2.3.  Coexistence and Transition

   The purpose of an evolutionary architecture is to permit new models
   to replace or supplement existing models. The interactions between
   models could result in incompatibilities, security "holes", and other
   undesirable effects.

   The purpose of Coexistence documents is to detail recognized
   anomalies and to describe required and recommended behaviors for
   resolving the interactions between models within the architecture.

   Coexistence documents may be prepared separately from model
   definition documents, to describe and resolve interaction anomalies
   between a model definition and one or more other model definitions.

   Additionally, recommendations for transitions between models may also
   be described, either in a coexistence document or in a separate
   document.



SNMPv3 Working Group        Standards Track                    [Page 10]

RFC 2571           Architecture for SNMP Frameworks             April 1999


   One such coexistance document is [SNMP-COEX], "Coexistence between
   Version 1, Version 2, and Version 3 of the Internet-standard Network
   Management Framework".

2.4.  Transport Mappings

   SNMP messages are sent over various transports. It is the purpose of
   Transport Mapping documents to define how the mapping between SNMP
   and the transport is done.

2.5.  Message Processing

   A Message Processing Model document defines a message format, which
   is typically identified by a version field in an SNMP message header.
   The document may also define a MIB module for use in message
   processing and for instrumentation of version-specific interactions.

   An SNMP engine includes one or more Message Processing Models, and
   thus may support sending and receiving multiple versions of SNMP
   messages.

2.6.  Security

   Some environments require secure protocol interactions. Security is
   normally applied at two different stages:

      -  in the transmission/receipt of messages, and

      -  in the processing of the contents of messages.

   For purposes of this document, "security" refers to message-level
   security; "access control" refers to the security applied to protocol
   operations.

   Authentication, encryption, and timeliness checking are common
   functions of message level security.

   A security document describes a Security Model, the threats against
   which the model protects, the goals of the Security Model, the
   protocols which it uses to meet those goals, and it may define a MIB
   module to describe the data used during processing, and to allow the
   remote configuration of message-level security parameters, such as
   keys.

   An SNMP engine may support multiple Security Models concurrently.