Application and Sub Application Identity Policy Element for Use with RSVP
Extracted elements (14)
The policy locator uses a four-level hierarchy (vendor GUID, application name, version, sub-application) so that network administrators can write policies that range from coarse application-class control down to fine-grained sub-operation control without requiring a central registry of specific values.
X.500 DN format (ASCII_DN / UNICODE_DN) was chosen for the POLICY_LOCATOR because it provides a well-known, globally-scoped naming structure that naturally represents the vendor–application–version–sub-application hierarchy.
The AUTH_APP policy element is built on the general application identity policy element framework defined in RFC 2752; implementations must conform to RFC 2752 for the enclosing policy element and attribute encoding.
The APP, VER, and SAPP attributes SHOULD describe the application to a human reader in as unique and unambiguous a way as possible.
The recommended keywords (GUID, APP, VER, SAPP) are recommended but others MAY be used in the POLICY_LOCATOR attribute.
When the GUID attribute is used to achieve absolute uniqueness of application identification, its contents MUST be an identifier from a globally-unique source (e.g., domain names assigned by corresponding registration authorities).
The Application Identity Policy Element (AUTH_APP) is an RSVP policy element carrying application information. It has P-type AUTH_APP and contains a list of authentication attributes, as defined in RFC 2752.
The first authentication attribute in the AUTH_APP element is of A-type POLICY_LOCATOR with sub-type ASCII_DN or UNICODE_DN. Its data is an X.500 Distinguished Name encoding the application vendor, name, version, and sub-application in a hierarchical structure.
The POLICY_LOCATOR DN uses a hierarchical set of keywords: GUID (optional, globally unique identifier), APP (application name), VER (version number), and SAPP (sub-application, optional). Example: 'APP=SAP, VER=1.1, SAPP=Print'.
The second authentication attribute is of A-type CREDENTIAL with sub-type ASCII_ID or UNICODE_ID, carrying the application name as a plain ASCII or Unicode string (e.g., 'SAP.EXE').
A practical level of security is achieved by trusting the application policy element only when it is co-presented with a trusted (encrypted and authenticated) user policy element in the same RSVP message.
All RSVP integrity considerations (from RFC 2205) apply in full to any RSVP message that contains the application policy element.
The AUTH_APP policy element does not cryptographically guarantee that it is associated with the application it claims to represent; signed application policy elements were deferred to future work.
The AUTH_APP policy element begins with a 2-octet PE Length field (value 8) and a 2-octet P-type field set to AUTH_APP, followed by authentication attributes each prefixed by a 2-octet Attribute Length, 1-octet A-type, and 1-octet Sub-type.