Subject: [sacm] Endpoint ID Design Team Notes+Recording: 2015-04-17

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 17 Apr 2015 11:33:30 -0500

Agenda
Continued Test Case Discussion

Acknowledged Test Cases
Network Profiler (Cliff)
SACM Collector on an endpoint (Danny)
Management Component managing collection of endpoints (Cliff)
Evaluator (Danny)
Datastore (Danny)

Materials (including recordings) are available here
https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0 <https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0>

NOTES
Danny covering Evaluator.  Takes an input, produces some output, and so acts as a provider and a consumer.  An Evaluator may acquire input and send output directly or through a Controller.  It requires identity information for:
Target endpoints if it needs to retrieve the input
Provenance information in the output

Cliff is imagining an Evaluator as the point of instruction for Collection rather than strictly a consumer of such information.  There seems to be a terminology confusion.  Dave pointed out that we may be evaluating previously collected information.  

Henk suggests that this strongly depends on the definition of Evaluator.  An Evaluator is any component with an “evaluation capability”.   Let’s talk about “Evaluation Capability” more than “Evaluator”.  We are also mixing Control and Data Planes.   This is getting into an Architectural tangent, however.  

An Evaluation Capability will produce Evaluation Results.  If the Evaluator is pulling information from a datastore, then we need to identify the target endpoints for the particular Evaluation Capability.  

See slides at https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0 <https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0> for details on specific attributes.

Cliff mentioned that we should be clear about which of the identifiers discussed are the minimal set.

Ron mentions that the Operating System might be a primary attribute, and there’s some discussion there.  It seems that we’re settling on Software Identification as a secondary attribute (where it already sits).  For example, Cliff asked whether there would be a case where two endpoints have the same primary attributes, but different operating systems?  Then, OS might be considered primary identifier.  

We ultimately seemed to settle on that primary attributes are identifying and the secondary identifying attributes may be more of an “endpoint characteristic”.  It’s also very clear that there are different contexts at play here.  If the business operation is inventorying your endpoints, then OS may become more important.  However, still in the distinct context of “endpoint identification” OS is grouped with software inventory.  Even though, there may be an important discussion that needs to take place about whether we need to differentiate between classes of software.

We may need to factor out how we identify endpoints, there may also be more along those lines - we may need to become more pedantic in talking about what our components are.   Definition of “collection” and “assertion” capabilities.  There are different views as to what the outcome of a collection and an assertion - sometimes these are the same things to participants, and to other participants these are different things.

Danny’s moving into Datastore.  (Again, slides at https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0 <https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0>).

A data store may act as a provider or a consumer, be accessed directly or through a Controller, and data may be pushed or pulled.  Identifying attributes will serve as “keys” for storing and looking up data.  Henk is mentioning that we’re conflating the data and control planes again (this probably needs to be worked out).

Moving into Cliff’s discussion of “Network Profiler” (see Cliff’s e-mail: https://www.ietf.org/mail-archive/web/sacm/current/msg02585.html <https://www.ietf.org/mail-archive/web/sacm/current/msg02585.html>).  Much of the information presented in Cliff’s e-mail were credited to section 3.1.8 of TNC IF-MAP Metadata for Network Security v1.8 (specifically to the “device-type” enumeration).  Note that the attributes Cliff presents in his e-mail were not intended to be primary identifying attributes.