Real-time Inter-network Defense (RID)
RFC 6545

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 11

Internet Engineering Task Force (IETF)                       K. Moriarty
Request for Comments: 6545                                           EMC
Obsoletes: 6045                                               April 2012
Category: Standards Track
ISSN: 2070-1721

                 Real-time Inter-network Defense (RID)

Abstract

   Security incidents, such as system compromises, worms, viruses,
   phishing incidents, and denial of service, typically result in the
   loss of service, data, and resources both human and system.  Service
   providers and Computer Security Incident Response Teams need to be
   equipped and ready to assist in communicating and tracing security
   incidents with tools and procedures in place before the occurrence of
   an attack.  Real-time Inter-network Defense (RID) outlines a
   proactive inter-network communication method to facilitate sharing
   incident-handling data while integrating existing detection, tracing,
   source identification, and mitigation mechanisms for a complete
   incident-handling solution.  Combining these capabilities in a
   communication system provides a way to achieve higher security levels
   on networks.  Policy guidelines for handling incidents are
   recommended and can be agreed upon by a consortium using the security
   recommendations and considerations.  This document obsoletes RFC
   6045.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6545.

Moriarty                     Standards Track                    [Page 1]
RFC 6545                           RID                        April 2012

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................3
      1.1. Changes from RFC 6045 ......................................5
      1.2. Normative and Informative ..................................6
      1.3. Terminology ................................................7
   2. Characteristics of Incidents ....................................7
   3. Communication between CSIRTs and Service Providers ..............8
      3.1. Inter-Service-Provider RID Messaging ......................10
      3.2. RID Communication Topology ................................12
   4. Message Formats ................................................13
      4.1. RID Data Types ............................................13
           4.1.1. Boolean ............................................13
      4.2. RID Message Types .........................................14
   5. IODEF-RID Schema ...............................................15
      5.1. RIDPolicy Class ...........................................17
           5.1.1. ReportSchema .......................................23
      5.2. RequestStatus .............................................26
      5.3. IncidentSource ............................................28
      5.4. RID Name Spaces ...........................................29
      5.5. Encoding ..................................................29
      5.6. Including IODEF or Other XML Documents ....................29
           5.6.1. Including XML Documents in RID .....................30
   6. RID Messages ...................................................31
      6.1. Request ...................................................31
      6.2. Acknowledgement ...........................................33
      6.3. Result ....................................................34
      6.4. Report ....................................................36
      6.5. Query .....................................................38
   7. RID Communication Exchanges ....................................39
      7.1. Upstream Trace Communication Flow .........................40
           7.1.1. RID TraceRequest Example ...........................43