Labeled IPsec Traffic Selector support for IKEv2
draft-ietf-ipsecme-labeled-ipsec-00

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00

Network                                                       P. Wouters
Internet-Draft                                                   Red Hat
Intended status: Standards Track                               S. Prasad
Expires: September 11, 2019               Technical University of Munich
                                                          March 10, 2019

            Labeled IPsec Traffic Selector support for IKEv2
                  draft-ietf-ipsecme-labeled-ipsec-00

Abstract

   This document defines two new Traffic Selector (TS) Types for
   Internet Key Exchange version 2 to add support for Mandatory Access
   Control (MAC) security labels, also known as "Labeled IPsec".  The
   two new TS Types are TS_IPV4_ADDR_RANGE_SECLABEL and
   TS_IPV6_ADDR_RANGE_SECLABEL, which are identical to their non-
   seclabel namesakes except for the addition of a variable length
   opaque field specifying the security label.  These new Traffic
   Selector Types facilitate negotiating security labels as an
   additional selector of the Security Policy Database to further
   restrict the type of traffic allowed to be send and received over the
   IPsec SA.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 11, 2019.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents

Wouters & Prasad       Expires September 11, 2019               [Page 1]
Internet-Draft                Labeled IPsec                   March 2019

   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   3
   2.  Traffic Selector negotiation  . . . . . . . . . . . . . . . .   3
   3.  SECLABEL Traffic Selector . . . . . . . . . . . . . . . . . .   3
   4.  Traffic Selector matching . . . . . . . . . . . . . . . . . .   5
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   6
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     8.2.  Informative References  . . . . . . . . . . . . . . . . .   7
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   7

1.  Introduction

   In computer security, Mandatory Access Control usually refers to
   systems in which all subjects and objects are assigned a security
   label.  A security label is comprised of a set of security
   attributes.  The security labels along with a system authorization
   policy determine access.  Rules within the system authorization
   policy determine whether the access will be granted based on the
   security attributes of the subject and object.

   Traditionally, security labels used by Multilevel Systems (MLS) are
   comprised of a sensitivity level (or classification) field and a
   compartment (or category) field, as defined in [FIPS188] and
   [RFC5570].  As MAC systems evolved, other MAC models gained in
   popularity.  For example, SELinux, a Flux Advanced Security Kernel
   (FLASK) implementation, has security labels represented as colon-
   separated ASCII strings composed of values for identity, role, and
   type.  The security labels are often referred to as security
   contexts.

   This document specifies two new Traffic Selector Types for IKEv2 that
   can be used to negotiate security labels as additional selectors for
   the Security Policy Database (SPD) to further restrict the type of
   traffic allowed to be send and received over the IPsec SA.