IP Security Policy (IPSP) Requirements
Extracted elements (18)
Compliance checking is architecturally separated from SA resolution so that even a computationally complex SA resolution scheme that produces an incorrect result cannot lead to violation of either host's specified security policy.
IPSP addresses the gap in IPsec key management: while ISAKMP/IKE handles negotiation of cryptographic parameters for SAs, it provides no scheme for managing, negotiating, or enforcing the security policies under which SAs operate.
IPSP is designed as a decentralized framework because two hosts can establish an SA even without a common security policy or mutual trust. SA parameters acceptable to a pair of hosts will often not be specified in advance and must be negotiated on-the-fly.
IPSP must be secure, sound, and comprehensible: the difficulty of understanding a policy should be proportional to the problem complexity. The security-critical parts should be small and well-specified enough to allow verification, ideally compatible with formal methods.
Some hosts' IPsec policies may be derived from a more comprehensive higher-layer security policy managed by another system, or from proprietary vendor tools. IPSP therefore only requires deriving a policy specification for aspects involving interoperability with other IPSP hosts.
The gateway discovery mechanism may piggyback information needed by other IPSP components (e.g., policy discovery), allowing multiple functions to be served by a single protocol exchange and reducing overhead.
IPSP mechanisms must be independent of the SA-negotiation protocol but may assume certain functionality from it, ensuring that future SA-negotiation protocols are not made incompatible with IPSP.
IPSP must scale to support complex policy administration across heterogeneous networks where different parts of a policy may be owned by different entities in a complex hierarchy, requiring delegation of specific kinds of authority to specific entities.
An IPSP solution MUST include a policy model with well-defined semantics, a gateway discovery mechanism, a policy specification language, distributed policy management, a policy discovery mechanism, an SA resolution mechanism, and a compliance checking mechanism.
The mechanisms used in IPSP must not require any protocol modifications in any of the IPsec standards (ESP, AH, IKE). The mechanisms must be independent of the SA-negotiation protocol, but may assume certain functionality from such a protocol.
A Policy Specification Language provides a common language for expressing host security policies, enabling policy discovery, compliance checking, and resolution across heterogeneous hosts. Vendor-specific policies would be translated to this common language for IPSP management.
Compliance Checking verifies that proposed SA parameters conform to the local security policy of each host. The security of IPSP-managed SAs should depend only on the correctness of compliance checking, even if SA resolution produces an incorrect result.
Distributed policy management requires that all or part of a host's policy can be managed remotely, possibly by more than one entity, supporting delegation of specific kinds of authority to specific entities.
IPSP defines a Policy Model that captures the semantics of IPsec policy, governing the relationship between IPsec Security Associations and higher-level security policies. Policy specification, checking, and resolution must implement these semantics.
Security Association Resolution requires that once two hosts have learned each other's policies, it must be possible and computationally feasible to find an acceptable set of SA parameters meeting both hosts' requirements.
The Policy Discovery mechanism provides essential information that two IPsec endpoints can use to determine what kinds of SAs are possible between them. A host need not reveal its entire security policy, only enough to support SA resolution.
The Security Gateway Discovery mechanism allows any host or gateway to determine what IPsec gateways exist between the initiator and the intended communication peer. It may be invoked at any time to detect topology changes.
The document discusses high-level requirements for a policy framework and architecture for IPsec, justifying the various components. Security and soundness of IPSP-managed SAs must depend only on the correctness of the compliance checking stage.