SORT BY:

LIST ORDER
THREAD
AUTHOR
SUBJECT


SEARCH

IPS HOME


    [Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

    RE: ISCSI: User authentication vs. Machine Authentication for iSCSI



    
    Bill,
    I think I understand your question, so here's a remark.
    
    I think a problem that creeps in to the iSCSI space (that doesn't exist in
    essentially every other existing SCSI stack) is that a user can write an
    application that acts like an iSCSI initiator and never ever go through the
    OS stack.  (I've written an iSCSI initiator in Java that doesn't ever use
    the host stack at all, just the standard network interfaces).   So, I could
    easily have multiple iSCSI Initiators running (even in user space) on the
    same machine.  At that point, I may want user level security.
    
    If I didn't understand your question, I'll shut up (on this topic :-{))
    
    Jim Hafner
    
    
    "Bill Strahm" <bill@sanera.net>@ece.cmu.edu on 08/29/2001 02:23:20 pm
    
    Sent by:  owner-ips@ece.cmu.edu
    
    
    To:   <mbakke@cisco.com>
    cc:   "Ips@Ece. Cmu. Edu" <ips@ece.cmu.edu>
    Subject:  RE: ISCSI: User authentication vs. Machine Authentication for
          iSCSI
    
    
    
    I am not sure that helped.  Again, the model of a Tape drive...
    
    The user does not own the tape drive, the operating system owns the tape
    drive, when I (as a user) wants to use the tape drive, I ask the operating
    system, it grants me access, and I go on.
    
    In fact from a purely SCSI level, I do not believe there is any concept of
    a
    user at all, the Operating system on the device provides the concept of a
    user through the OS abstraction layer.
    
    The problem that I am having is that I do not see how I can make user
    security work through the OS abstraction.  And if the OS HAS to know about
    the multiple users, I now have to trust the OS as well, which means that
    effectively I have one user on the machine anyway...
    
    Bill
    
    -----Original Message-----
    From: mbakke@cisco.com [mailto:mbakke@cisco.com]
    Sent: Wednesday, August 29, 2001 2:06 PM
    To: Bill Strahm
    Cc: Ips@Ece. Cmu. Edu
    Subject: Re: ISCSI: User authentication vs. Machine Authentication for
    iSCSI
    
    
    Bill Strahm wrote:
    >
    > I have been fighting with this problem since I left LA.
    >
    > I am not aware of any usage scenarios today where block devices are owned
    by
    > the user rather than the machine.  I will conceed that in many instances
    the
    > first thing the system does is assign the resource to a use (tape,
    scanner,
    > etc.) but the machine still owns the resource and can in fact remove it
    out
    > from under the user...
    >
    > I am not to certain how I could build a trusted iSCSI environment where
    one
    > user would have no knowledge about what was happening with other users in
    a
    > malicious environment (especially where a system was participating in the
    > exposure of resourses).  Examples of this include things like co-located
    Web
    > hosting where a single user scans process memory looking for 1Kbit of
    random
    > data, and when finding it attempts to determine if that is the private
    key
    > of a user sharing the resource.
    >
    > The reason I am bringing this up, is I am not sure trying to define
    security
    > above the machine level makes any sense for iSCSI.  Aren't most SCSI
    devices
    > owned by the Operating System not the User and partitioned out by the
    > Operating System to the users ?  If this is the case many of our
    > authentication methods simplify to simple IKE identities.
    >
    > Bill
    
    Bill-
    
    As you pointed out, there is a case where just using IKE with
    an iSCSI AuthMethod of "none" is valid.  That case is where:
    
    - There a one-to-one correspondence between an initiator and an
      operating system
    - IPsec is being used for all iSCSI traffic
    - The customer is willing to deploy public key certificates on the
      client side (for each initiator) as well as on the devices
    
    If all of the above are true, iSCSI can certainly use an AuthMethod
    of none, and be done with it.
    
    However,
    
    - There are cases (David Black brought up some tape applications) where
      more than one initiator might exist on an operating system
    
    - IPsec is not likely to be used for a large percentage of iSCSI
      traffic any time soon
    
    - When IPsec is used, many customers will have an easier time with the
      familiar model of authenticating the server "machine" but using a
      dummy certificate for the client.
    
    If any of the above are true, iSCSI-level of authentication is
    required.
    
    Hope this helps,
    
    Mark
    
    
    
    
    


Home

Last updated: Tue Sep 04 01:03:51 2001
6315 messages in chronological order