Internet Info 1994 March

home *** CD-ROM | disk | FTP | other *** search

/ Internet Info 1994 March / Internet Info CD-ROM (Walnut Creek) (March 1994).iso / inet / internet-drafts / draft-labarre-iimc-party-01.txt < prev next >

Wrap

Text File | 1993-04-05 | 127KB | 2,914 lines

INTERNET DRAFT Expires August 27, 1993 ISO/CCITT and Internet Management Coexistence (IIMC): ISO/CCITT to Internet Management Security (IIMCSEC) March 26, 1993 Lee LaBarre (Editor) The MITRE Corporation Burlington Road Bedford, MA 01730 cel@mbunix.mitre.org Status of this Memo This document provides information to the network and systems management community. This document is intended as a contribution to ongoing work in the area of multi-protocol management coexistence and interworking. This document is part of a package; see also [IIMCIMIBTRANS] [IIMCMIB-II] [IIMCPROXY] and [IIMCOMIBTRANS]. Distribution of this document is unlimited. Comments should be sent to the Network Management Forum IIMC working group (iimc@thumper.bellcore.com). This document is an Internet Draft. Internet Drafts are working documents of the Internet Engineering Task Force (IETF), its Areas, and its Working Groups. Note that other groups may also distribute working documents as Internet Drafts. Internet Drafts are draft documents valid for a maximum of six months. Internet Drafts may be updated, replaced, or obsoleted by other documents at any time. It is not appropriate to use Internet Drafts as reference material or to cite them other than as a ``working draft'' or ``work in progress.'' Please check the 1id-abstracts.txt listing contained in the internet-drafts Shadow Directories on nic.ddn.mil, nnsc.nsf.net, nic.nordu.net, ftp.nisc.sri.com, munnari.oz.au to learn the current status of any Internet Draft. Editor's Note: Readers are warned that this draft is incomplete as to the security architecture, but fairly complete as to the Party MIB translation. LaBarre Expires August 27, 1993 Page i Draft ISO/CCITT to Internet Management Security 3/26/93 Abstract This document is intended to facilitate the multi-protocol management coexistence and interworking for networks that are managed using the ISO/CCITT Common Management Information Protocol (CMIP) and networks that are managed using the Internet Simple Network Management Protocol (SNMP). This document defines the end-to-end security architecture, services, and mechanisms for use with ISO/CCITT-Internet proxies. This document also contains the ISO/CCITT GDMO definition and registration of the SNMP Parties MIB, derived from the Internet SNMP Parties MIB [SNMPv2PARTY] according to the procedures defined in "Translation of Internet MIBs to ISO/CCITT GDMO MIBs" [IIMCIMIBTRANS]. Table of Contents Status of this Memo ......................................i Abstract .................................................ii Table of Contents ........................................ii Revision History .........................................iii 1.Introduction ...........................................1 1.1 Background ...........................................1 1.2 Overview .............................................2 1.3 Scope ................................................4 1.4 Terms and Conventions ................................5 2. Security and Management Requirements ..................5 2.1 Security of Management ...............................5 2.2 Management of Security ...............................5 2.3 Threat Characterization ..............................6 2.3.1 Communications Path Security .......................6 2.3.2 Managed System Security ............................7 3. Security Model, Requirements, and Constraints .........8 3.1 Security Model .......................................8 3.2 Requirements .........................................9 3.3 Constraints on Mapping Security Services .............10 3.4 Consequences of Requirements and Constraints .........11 4. Manager to Internet Proxy Security ....................11 5. Internet Proxy to Internet Agent Security .............12 6. Party MIB .............................................12 6.1 Attribute Types ......................................12 6.2 Object Class Definitions .............................15 6.3 Attribute Definitions ................................21 6.4 The Containment Hierarchy ............................36 6.5 ASN.1 Definitions ....................................38 7.MOCS ...................................................40 8. Acknowledgments .......................................40 References ...............................................41 LaBarre Expires August 27, 1993 Page ii Draft ISO/CCITT to Internet Management Security 3/26/93 Revision History Draft 0 - October 9, 1992 Initial draft of this document (previously entitled "IIMC: Translation of Internet Party MIB (RFC1353) to ISO/CCITT GDMO MIB" [IIMCPARTY]). Draft 1 - March 26, 1993 Current draft of this document (replaces Draft 0). Major Changes Since Last Revision 1. Changed title to reflect new scope of document. 2. Added security architecture text. 3. Aligned MIB translation with latest SNMPv2 document [SNMPv2PARTY]. 4. Aligned templates with changes as per [IIMCIMIBTRANS]. - Revised OID translation procedure. - Revised generic notification replaces previous notifications. - Updated to reflect SNMPv2 changes. - Added parsing capability to entry type templates. - Revised registration of documents and modules. Action Item Proposals Contained In This Document #22 Revamp Party MIB (proposed) Outstanding Issues 1. Lack of standards and implementation agreements for ISO/CCITT security. 2. Create and delete modifiers in name bindings. Editor's Note: [All object identifier assignments in this document will be resolved before final publication of this document.] Editor's Note: [This document will change to reflect the new scope. It is preliminary, and incomplete as to the security architecture, but fairly complete as to the Party MIB translation.] LaBarre Expires August 27, 1993 Page iii Draft ISO/CCITT to Internet Management Security 3/26/93 1.Introduction The past decade has witnessed the development of enterprise wide networks composed of a multi-vendor environment containing heterogeneous protocol and hardware suites. Organizations have become increasingly dependent on these enterprise networks for their daily operations. This dependence has focused attention on the need for operation, administration, maintenance, and provisioning (OAM&P) of the multi-vendor enterprise network on an end-to-end basis. 1.1 Background This document is part of a package of ISO/CCITT and Internet Management Coexistence (IIMC) drafts. Other documents included in this package are: [IIMCIMIBTRANS] Translation of Internet MIBs to ISO/CCITT GDMO MIBs [IIMCOMIBTRANS] Translation of ISO/CCITT GDMO MIBs to Internet MIBs [IIMCMIB-II] Translation of Internet MIB-II to ISO/CCITT GDMO MIB [IIMCPROXY] ISO/CCITT to Internet Management Proxy These documents together comprise a package aimed at integrating ISO/CCITT-based and Internet-based management systems. These documents represent coexistence and interworking efforts underway within the IIMC working group, chartered under the auspices of the Network Management Forum Architecture Integration ISO/Internet technical team. This work was initiated, in part, by NM Forum efforts to translate RFC 1214 for use with OMNIPoint 1 implementations. Through this effort, it became obvious that end-to-end management requires an integrated, unified view of the managed network, despite differences in management protocol and information structure. Integrated management can be facilitated by the development of "proxy" mechanisms which translate between functionally equivalent service, protocol, and SMI differences to create this unified view. MIB translation procedures can be used to support proxy management, as well as to take advantage of existing MIB definition and avoid duplication of effort. In this way, commercial investment in both ISO/CCITT and Internet-based management technologies can be preserved through deployment of common methods and tools which support integration. This overall strategy was outlined in a joint publication developed by the NM Forum and X/Open entitled "ISO/CCITT and LaBarre Expires August 27, 1993 Page 1 Draft ISO/CCITT to Internet Management Security 3/26/93 Internet Management: Coexistence and Interworking Strategy" [NMFMC92]. The documents included in the IIMC package are the next level of detailed specifications which implement several of the methodologies identified in the strategy. 1.2 Overview The response to the need for OAM&P of enterprise networks has been the development of network management standards within various networking communities - most notably the ISO/CCITT and Internet communities. However, coordination of standards activities between these two communities has not occurred. As a result, although they share a nearly common management model, differences in their management protocols and structures of management information (SMIs) have developed due to differing management philosophies. The ISO/CCITT community has developed the Common Management Information Protocol (CMIP) [ISO9596-1], and related SMI documents [ISO10165-1,2,4]. The Internet community has developed the Simple Network Management Protocol (SNMP) [RFC1157], and its successor, SNMPv2 [SNMPv2PROT]. The Internet SMI is defined in [RFC1155] and [SNMPv2SMI]. Although functionally similar, the Internet and ISO/CCITT protocols and SMIs differ in terms of their complexity and specific operations. The focus on the need for end-to-end enterprise management has indicated the need to integrate the management of components accessed by ISO/CCITT management, Internet management and proprietary management mechanisms in a manner which presents a unified view of the network, despite protocol and SMI differences. One way to integrate management is by the development of "proxy" mechanisms which translate between functionally equivalent services, protocol and SMI differences to create this unified view. A body of telecommunications and computer vendors, represented by organizations such as the Network Management Forum (NMF), and the U.S. government, as specified in the Government Network Management Profile (GNMP) have based their integrated management model on the ISO/CCITT management model using CMIP and the ISO/CCITT SMI. These organizations are particularly interested in the development of proxies for devices that use the Internet management protocols and SMI. Their interest is primarily due to the widespread commercial implementation and use of such devices within their enterprises, especially devices that use the Internet TCP/IP protocol suite. LaBarre Expires August 27, 1993 Page 2 Draft ISO/CCITT to Internet Management Security 3/26/93 The basic model for ISO/CCITT-Internet proxy management is illustrated in the following diagram. Manager Proxy Agent +-----------------------+ +---------------------+ +------ ----------------+ |+---------------------+| |+------+ +----------+| |+----- --------------+ | || Management || || GDMO | | Internet || || Managed | | || Applications || || MIB | | MIB || || Resources | | |+---------------------+| |+------+ +----------+| |+----- --------------+ | | | | |+-------------------+| | | | | | | || Service || | | | | | | || Emulation || | | | | | | ||(scoping) || | | | | | | || (filtering) || | | | | | || (operations)|| | | | |+-----------+---------+| |+-------------------+| |+----- -----+---------+| || ISO/CCITT | GDMO || || Protocols Mapping || || Internet | Internet|| || Manager | MIB || || CMIS |...| SNMP || || Agent | MIB || |+-----------+---------+| |+-------------------+| |+----- -----+---------+| | | | | |CMIS | | | | | | | CMIS Services | | |Services | | | | SNMP "Services" | | | | | | | | | | | | | | | | SNMP| | | | | | | | | | "Services"| | | | | +-----------------------+ +---------------------+ +------ ----------------+ | CMIP | | CMIP | SNMP | | SNMP | +-----------------------+ +---------------------+ +------ ----------------+ ^ ^ ^ ^ LaBarre Expires August 27, 1993 Page 3 Draft ISO/CCITT to Internet Management Security 3/26/93 | | | | +---------------------+ +--------------- ----+ CMIP Messages SNMP Messages The proxy architecture provides emulation of CMIS services by mapping to the corresponding SNMP message(s) necessary to carry out the service request. The service emulation allows management of Internet objects by an ISO/CCITT manager. The left hand side of the proxy behaves like an ISO/CCITT agent, communicating with the ISO/CCITT manager using CMIP protocols. The right hand side of the proxy behaves like an Internet manager, communicating with the Internet agent using SNMP protocols. The proxy relies on the existence of a pair of directly- related MIB definitions, where the Internet MIB has been translated into ISO/CCITT GDMO using the procedures specified in [IIMCIMIBTRANS]. The proxy defined in [IIMCPROXY] uses these MIB definitions and rules to provide run-time translation of management information carried in service requests and responses. The proxy architecture is designed with a specified interface between the proxy and the underlying protocol stacks, and so deals primarily in terms of CMIS services and SNMP "services". The proxy emulates services such as CMIS scoping and filtering, processing of CMIS operations, and forwarding/logging of CMIS notifications by performing a mapping process which must be tailored for each protocol (for example, SNMP and SNMPv2 are variants of the same protocol mapping process). In addition, [IIMCOMIBTRANS] specifies translation procedures for converting ISO/CCITT GDMO MIBs into Internet MIBs. MIBs generated by this translation process cannot be utilized by the Proxy defined in [IIMCPROXY], although another kind of Proxy could be defined for this purpose in the future. Finally, note that MIBs translated by procedures such as those defined by [IIMCIMIBTRANS] and [IIMCOMIBTRANS] may also be used without a proxy. For example, a translated MIB may be used to take advantage of existing MIB definitions when business needs require deployment in a different management environment. Translated MIBs may also be used to provide uniformity when multiple management environments are supported by a single system (e.g., dual stack managers). 1.3 Scope One of the IIMC objectives is to provide for the secure end- LaBarre Expires August 27, 1993 Page 4 Draft ISO/CCITT to Internet Management Security 3/26/93 to-end management of resources managed using ISO/CCITT and Internet management services, protocols and SMI. Security and management by their very nature are entwined such that each needs the services of the other. Security services are required to protect management services. Management services are required to monitor and control security services. This document defines the security architecture for end-to- end security between an ISO/CCITT manager and an Internet agent via proxies such as that defined in [IIMCPROXY]. The architecture requires that information required to support Internet security mechanisms from an end-to-end perspective, and to manage it, be translated into the ISO/CCITT SMI. This document applies the procedures described in [IIMCMIBTRANS] to the translation and registration of the Internet SNMP Parties MIB defined in [SNMPv2PARTY]. This document assumes that the reader is familiar with the ISO/CCITT and Internet management security services, protocols and mechanisms. This document assumes that the reader is familiar with the Internet and ISO/CCITT SMIs and terminology as well as the Internet to SMI translation defined in [IIMCIMIBTRANS]. This document is allocated the following registration identifier for purposes of referencing material contained herein. iimcSEC OBJECT IDENTIFIER ::={iimcManagementDocMan 3} Editor's Note: [The iimcManagementDocMan will be resolved before the final publication of this document.] 1.4 Terms and Conventions Editor's Note: [To Be Provided.] 2. Security and Management Requirements Security and management are entwined by their very nature such that each needs the services of the other. Security services are required to protect management services. Management services are required to monitor and control security services. These requirements are briefly presented in this section. 2.1 Security of Management Management is most vulnerable to security attacks at the manager user interface, the communications path over which management messages are transmitted, and at the managed system that contains the resources being managed. Accordingly, management's security requirements are to LaBarre Expires August 27, 1993 Page 5 Draft ISO/CCITT to Internet Management Security 3/26/93 overcome these threats by: - Preventing unauthorized operator access to manager applications and associated management information contained in a manager workstation, - Protecting management information in transit between managers and agents, and - Enforcing management policy regarding access to information within the managed system. Preventing unauthorized access to manager applications is beyond the scope of this document, and therefore will not be discussed. The characterization of the security threats in relation to the other two vulnerable areas are discussed more fully in the following sections. 2.2 Management of Security Security requires management support for three basic activities: - monitoring and control of security mechanisms, - detection of security related events through security alarm generation, reporting and audit trail analysis, - damage assessment and recovery from a security attack. Security mechanisms and algorithm resources are modeled as managed objects and the management information is stored in a secure portion of the management information base. The same management and security mechanisms used to manage non- security managed objects may be applied to the management of security objects. 2.3 Threat Characterization Security threats for management are the same as for any distributed application. Security threats can be characterized as being active or passive. Active threats to a management system may effect changes to the state or operation of the managed resource. Examples of active threats are malicious changes to the routing tables of a system, or to the objects used to control decisions related to policies, such as security policies relating to resource access. Active threats include: - masquerade, - modification and fabrication of messages and stored data, - replay and reordering of messages, and LaBarre Expires August 27, 1993 Page 6 Draft ISO/CCITT to Internet Management Security 3/26/93 - denial of management services. Passive threats are those which, if realized, would not result in any modifications to information contained in the system, e.g., management information, and where neither the operation nor the state of the system is changed. Passive threats include: - disclosure of message contents and stored data, - traffic analysis, and - repudiation. 2.3.1 Communications Path Security The threats to the communications path used for manager to agent communications, and applicable security services include: - modification and fabrication of management messages * integrity - disclosure of management message data * confidentiality, selective field confidentiality - replay and reordering of messages * integrity - denial of management services * continuity of operations - traffic analysis * confidentiality Note that the communications path from the manager to an agent may be direct, or indirect via the management applications of an intermediate manager or proxy. In the indirect case, the portion of the message that must be exposed in the intermediate manager for the purpose of application layer relaying is subject to unauthorized disclosure and modification. Such entities must be trusted not to perform such modifications or to disclose the contents of the management messages. Selective field confidentially services may be required if intermediate managers or proxies are acting as application layer relays in the path. Such selective field services allow only the information in management messages required for application layer routing to be unprotected while preventing other fields in the message from disclosure or modification. 2.3.2 Managed System Security The threats to the managed system include: LaBarre Expires August 27, 1993 Page 7 Draft ISO/CCITT to Internet Management Security 3/26/93 - masquerade of a manager application or operator * peer authentication, data origin authentication - modification and fabrication of data residing in the management information base * access control, data integrity - disclosure of management data in the managed system * access control, confidentiality - repudiation of management requests at the destination * non-repudiation at destination. Non-repudiation services may be provided in circumstances where such accountability is required. While the non- repudiation service does nothing to protect the network, it does provide the capability to trace the entities that are to be blamed for mis-management. 3. Security Model, Requirements, and Constraints 3.1 Security Model The model for IIMC end-to-end security is illustrated in Figure 2. The objective is to provide continuity of security services from the ISO/CCITT Manager through to the Internet Agent. The end-to-end solution is constrained by the security services available at the Internet agent and those available at the ISO/CCITT Manager. The mapping of security services is provided by the ISO/CCITT-Internet proxy. The mapping of those services at the proxy will depend upon the availability of the services and the compatibility of the mechanisms used to provide the services. Figure 2 illustrates the proxy in a separate device from the manager or the agent. If the proxy function is performed in the manager, then how the manager's internal security mechanisms map to Internet security services is beyond the scope of this document. If ISO management services and protocol are provided in the managed device, and the proxy function is still applied, then ISO security services apply at the managed system. The mapping of ISO security services that still apply at the internal proxy to Internet agent interface into equivalent Internet services, e.g., authentication and access control, is beyond the scope of this document. ISO/CCITT Manager ISO/CCITT-Internet Proxy Internet Agent +-----------------------+ +----------------------+ +---- ---------+ | | |+--------------------+| | LaBarre Expires August 27, 1993 Page 8 Draft ISO/CCITT to Internet Management Security 3/26/93 | | | || security service || | | | | || mapping || | | | | |+--------------------+| | | |+---------------------+| |+-------+ +----------+| |+--- --------+| || ISO/CCITT || || ISO | | Internet || || Internet || || Manager || || agent | | manager || || agent || || role || || role | | role || || || |+---------------------+| |+-------+ +----------+| |+--- --------+| | CMIP | | CMIP | | SNMP || | SNMP | +-----------------------+ +---------------------+ +---- ---------+ ^ ^ ^ ^ | | | | +---------------------+ +--------------- ----+ CMIP Messages SNMP Messages - ISO peer authentication - ISO data origin authentication* - Internet data origin authentication# - ISO integrity, confidentiality* - Internet integrity, confidentiality - Internet access control - Internet access control# - ISO access control+ * OSI application layer standards are in progress. These services maybe provided by lower layers in some environments, e.g., transport and network # SNMPv1 and SNMPv2 have different mechanisms + ISO access control may be applied by the proxy to GDMO objects, if enforcement is at the proxy. Figure 2: IIMC End-to-end Security Model LaBarre Expires August 27, 1993 Page 9 Draft ISO/CCITT to Internet Management Security 3/26/93 The security services are not required to be provided at the same layers in the protocol suites on the two external proxy interfaces. For example, integrity and confidentiality services may be applied at the transport or network layer at the interface to the ISO/CCITT manager, and at the application layer at the interface to the Internet agent. Depending on the environment, some security services may not be required proxy's interface to the ISO/CCITT manager. For example, data origin authentication and confidentiality services may not be required if the two devices are close together and physical security is adequate to satisfy the security policy. 3.2 Requirements The basic requirements to be met by the architecture for providing end-to-end security services are support for: - enforcement of SNMPv1 security services at the agent (community string). - enforcement of SNMPv2 security services at the agent (party based). - optional enforcement of access control at the proxy on either SNMPv1 or SNMPv2 agents. Since SNMPv1 does not support access control, this implies that SNMPv2 party based access control shall be enforced at the proxy for both SNMPv1 and SNMPv2 agents. - optional enforcement of access control at the proxy using OSI access control mechanisms (ISO 10164-9) to the ISO/CCITT managed objects derived from Internet objects for all proxied agents. - enforcement of access control at the proxy for MIB objects and attributes defined specifically for the proxy operation. - OSI security services between the ISO/CCITT manager and the proxy. - mapping of OSI security services into Internet security services, where possible, and forwarding form the ISO/CCITT manager of information required Internet security mechanisms. LaBarre Expires August 27, 1993 Page 10 Draft ISO/CCITT to Internet Management Security 3/26/93 3.3 Constraints on Mapping Security Services The major constraint on mapping security services is that there is no way that all information required for Internet security services can be derived from parameters provided with OSI security services. The security mechanisms are dissimilar enough that mappings do not exist. The result is that the ISO/CCITT manager must be aware of Internet security services used by the proxy, and transfer the information required for those services to operate. The Internet management SNMPv2 security architecture relies on the identification of distinct entities, called "parties", for peers that exchange SNMP messages [SNMPv2ADMIN]. Multiple parties may exist at the manager and at the agent. Each distinct SNMPv2 peer is identified by a "party identifier", an OID. Associated with the party identifier are it's agent address, and parameters for authentication, integrity and confidentiality services to be used when communicating with other parties. Since parties form a peer relationship, these security service parameters for peer parties must be compatible. The peer relationship between SNMPv2 parties is established via an associated "context", identified by an OID, which provides a means to identify constraints on valid management operations and associated resources (MIB objects). The context also specifies whether the constraints apply to local resources or to remote resources via a proxy relationship. Therefore, SNMPv2 security requires that the peer parties and their context be identified before an SNMPv2 message will even be accepted by an agent - even if no security services are to be invoked. Only then may data authentication, integrity, confidentiality, and access control services be invoked. The problem, from a decoupling perspective, is that there is no way that party and context information required for Internet security services can be derived from parameters provided with OSI security services. The same concepts simply do not exist. The result is that the ISO/CCITT manager must be aware of Internet security services used by the proxy, and transfer the party and context information required for those services to operate. Note, however, that the Internet has registered a set of default parties and contexts that cover a few basic security policies when communicating directly with SNMPv2 agents. These include: no authentication and confidentiality with restricted monitoring privileges; authentication (using MD5) LaBarre Expires August 27, 1993 Page 11 Draft ISO/CCITT to Internet Management Security 3/26/93 without confidentiality but with full management privileges, and authentication(using MD5) with confidentiality using DES and with full management privileges. If the ISO/CCITT manager specifies to the Internet agent (or proxy) which of these default sets of parties and contexts to use, then the specific parties and contexts need not be known to the manager. Editor's Note: [We could provide the capability of specifying the default community string, parties and contexts to use when the proxy communicates to agents. This capability could relieve the ISO/CCITT manager from being aware of specific community string or party based security service requirements. The sets could be specified in attributes of the cmipsnmpProxyagent object. In the absence of security parameters being provided by the ISO/CCITT manager, the default parties and context would be in effect. Of course, agents must be configured to support these sets, and the manager would be constrained to work within the limits of these sets.] 3.4 Consequences of Requirements and Constraints The consequences of the constraint described in 3.3 are: - the ISO/CCITT-Internet proxy shall use community string and party/context information provided by the ISO/CCITT manager to determine security services to be invoked relative to an Internet agent. - if access control mechanisms are used by the proxy on behalf of Internet agents, then the security parameters that would be required by the agent to enforce access control shall be maintained by the proxy. This applies whether Internet or OSI access control mechanisms are used. 4. Manager to Internet Proxy Security OSI peer authentication services shall be supported in accordance with OMNIPoint 1 security specifications. [NMFSEC] OSI data origin authentication services shall optionally be supported in accordance with (TBD) Editor's Note: [To Be Provided.] Integrity services shall optionally be supported using (TBD). Editor's Note: [To Be Provided.] Confidentiality services shall optionally be supported using LaBarre Expires August 27, 1993 Page 12 Draft ISO/CCITT to Internet Management Security 3/26/93 (TBD). Editor's Note: [The use of security services for transport (TLSP), network (NLSP), or the generic upper layer security(GULS) [ISO11586-1,2,3,4] to provide these services might be appropriate.] OSI access control services shall optionally be supported in accordance with [ISO10164-9]. Internet security services shall optionally be supported as follows: - the following privileged attribute certificate (PAC) shall be used to convey Internet security parameters: Editor's Note: [Format is TBD. Contents shall include party and context, or community string information.] 5. Internet Proxy to Internet Agent Security All SNMPv1 and SNMPv2 security services shall be supported. Editor's Note: [Should we have conformance classes?] 6. Party MIB The IIMC Party MIB is derived from the Internet Party MIB defined in[SNMPv2PARTY]. Adjustments have been made to the behavior of some elements in the MIB to accommodate SNMPv1 community string based security. 6.1 Attribute Types party ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:ObjectIdentifier; MATCHES FOR EQUALITY ORDERING; BEHAVIOUR partyBehaviour BEHAVIOUR DEFINED AS !Denotes a SNMPv2 party identifier. Note that agents may impose implementation limitations on the length of OIDs used to identify Parties. As such, management stations creating new parties should be aware that using an excessively long OID may result in the agent refusing to perform the set operation and instead returning the appropriate error response, e.g., noCreation.! tAddress ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString; LaBarre Expires August 27, 1993 Page 13 Draft ISO/CCITT to Internet Management Security 3/26/93 MATCHES FOR EQUALITY ORDERING; BEHAVIOUR tAddressBehaviour BEHAVIOUR DEFINED AS !Denotes a transport service address. For snmpUDPDomain, a TAddress is 6 octets long, the initial 4 octets containing the IP-address in network-byte order and the last 2 containing the UDP port in network-byte order. Consult [5] for further information on snmpUDPDomain.! clock ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:UInteger32; BEHAVIOUR clockBehaviour BEHAVIOUR DEFINED AS !A party's authentication clock - a non-negative integer which is incremented as specified/allowed by the party's Authentication Protocol. For noAuth, a party's authentication clock is unused and its value is undefined. For v2md5AuthProtocol, a party's authentication clock is a relative clock with 1-second granularity.! context ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:ObjectIdentifier; MATCHES FOR EQUALITY ORDERING; BEHAVIOUR contextBehaviour BEHAVIOUR DEFINED AS !Denotes a SNMPv2 context identifier. Note that agents may impose implementation limitations on the length of OIDs used to identify Parties. As such, management stations creating new parties should be aware that using an excessively long OID may result in the agent refusing to perform the set operation and instead returning the appropriate error response, e.g., noCreation.! storageType ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:StorageType; MATCHES FOR EQUALITY ORDERING; BEHAVIOUR storageTypeBehaviour BEHAVIOUR DEFINED AS !Describes the memory realization of a conceptual row. A row which is volatile(2) is lost upon LaBarre Expires August 27, 1993 Page 14 Draft ISO/CCITT to Internet Management Security 3/26/93 reboot. A row which is nonVolatile(3) is backed up by stable storage. A row which is permanent(4) cannot be changed nor deleted.! LaBarre Expires August 27, 1993 Page 15 Draft ISO/CCITT to Internet Management Security 3/26/93 6.2 Object Class Definitions The Internet SNMP Parties MIB objects [RFC1353]are recast into OSI GDMO templates as defined in [ISO10165-4], and registered, using the procedures defined in [IIMCIMIBTRANS]. The object identifier {iimcAutoTrans} is defined in [IIMCIMIBTRANS]. The templates for the object classes are listed in alphabetical order. Editor's Note: [The OID fragment "iimcAutoTrans-partyMIB" will be resolved when the iimcAutotrans and partyMIB OID are allocated.] aclEntry MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY aclEntryPkg PACKAGE BEHAVIOUR aclEntryPkgBehaviour BEHAVIOUR DEFINED AS !PARSE REFERENCE !!This managed object class maps to aclEntry object in [SNMPv2PARTY].!!; MULTIPLEINSTANCES INDEX aclSubject, aclTarget, aclResources; CREATEDELETEATT aclStatus; CREATEDELETEVALUE SNMPV2ROWSTATUS; ENDMULTIPLEINSTANCES ENDPARSE The access privileges for a particular requesting SNMP party in accessing a particular target SNMP party.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET, aclTarget GET, aclSubject GET, aclResources GET, aclPrivileges GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-aclPrivileges, aclStorageType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-aclStorageType, aclStatus GET-REPLACE;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 3 11}; aclTable MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY aclTablePkg PACKAGE LaBarre Expires August 27, 1993 Page 16 Draft ISO/CCITT to Internet Management Security 3/26/93 BEHAVIOUR aclTableBehaviour BEHAVIOUR DEFINED AS !The access privileges database.!;; ATTRIBUTES {iimcManagementDocMan 1}:internetClassId GET;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 3 1}; contextEntry MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY contextEntryPkg PACKAGE BEHAVIOUR contextEntryPkgBehaviour BEHAVIOUR DEFINED AS !PARSE REFERENCE !!This managed object class maps to contextEntry object in [SNMPv2PARTY].!!; MULTIPLEINSTANCES INDEX contextIdentity; CREATEDELETEATT contextStatus; CREATEDELETEVALUE SNMPV2ROWSTATUS; ENDMULTIPLEINSTANCES ENDPARSE Locally held information about a particular SNMPv2 context.!;; ATTRIBUTES {iimcManagementDocMan 1}:internetClassId GET, contextIdentity GET, contextIndex GET-REPLACE, contextLocal GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-contextLocal, contextViewIndex GET-REPLACE, contextLocalEntity GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-contextLocalEntity, contextLocalTime GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-contextLocalTime, contextProxyDstParty GET-REPLACE, contextProxySrcParty GET-REPLACE, contextProxyContext GET-REPLACE, contextStorageType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-contextStorageType, contextStatus GET-REPLACE;;; REGISTERED AS { partyMIB 2 2 1 1}; contextTable MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY contextTablePkg PACKAGE BEHAVIOUR LaBarre Expires August 27, 1993 Page 17 Draft ISO/CCITT to Internet Management Security 3/26/93 contextTablePkgBehaviour BEHAVIOUR DEFINED AS !The SNMPv2 Context database.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET;;; REGISTERED AS { partyMIB 2 2 1}; familyEntry MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992":top; CHARACTERIZED BY familtEntryPkg PACKAGE BEHAVIOUR familyEntryPkgBehaviour BEHAVIOUR DEFINED AS !PARSE REFERENCE !!This managed object class maps to familyEntry object in [SNMPv2PARTY].!!; MULTIPLEINSTANCES INDEX familyIndex; CREATEDELETEATT familyStatus; CREATEDELETEVALUE SNMPV2ROWSTATUS; ENDMULTIPLEINSTANCES ENDPARSE Information on a particular family of view subtrees.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET, familyIndex GET, familySubtree GET-REPLACE, familyMask GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-familyMask, familyStorageType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-familyStorageType, familyStatus GET-REPLACE;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 4 21}; familyTable MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY familyTablePkg PACKAGE BEHAVIOUR familyTablePkgBehaviour BEHAVIOUR DEFINED AS !Locally held information about a family of view subtrees.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 4 2 }; LaBarre Expires August 27, 1993 Page 18 Draft ISO/CCITT to Internet Management Security 3/26/93 partyEntry MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992":top; CHARACTERIZED BY partyEntryPkg PACKAGE BEHAVIOUR partyEntryPkgBehaviour BEHAVIOUR DEFINED AS !PARSE REFERENCE !!This managed object class maps to partyEntry object in [SNMPv2PARTY].!!; MULTIPLEINSTANCES INDEX partyIdentity; CREATEDELETEATT partyStatus; CREATEDELETEVALUE SNMPV2ROWSTATUS; ENDMULTIPLEINSTANCES ENDPARSE Locally held information about a particular SNMPv2 party.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET, partyIdentity GET-REPLACE, partyIndex GET, partyTDomain GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyTDomain, partyTAddress GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyTAddress, partyMaxMessageSize GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyMaxMessageSize, partyLocal GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyLocal, partyAuthProtocol GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyAuthProtocol, partyAuthClock GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyAuthClock, partyAuthPrivate GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyAuthPrivate, partyAuthPublic GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyAuthPublic, partyAuthLifetime GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyAuthLifetime, partyPrivProtocol GET-REPLACE DEFAULT VALUE LaBarre Expires August 27, 1993 Page 19 Draft ISO/CCITT to Internet Management Security 3/26/93 IIMCPartyMIB.c-partyPrivProtocol, partyPrivPrivate GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyPrivPrivate, partyPrivPublic GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyPrivPublic, partyCloneFrom GET-REPLACE, partyStorageType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-partyStorageType, partyStatus GET-REPLACE;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 1 11}; partyTable MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY partyTablePkg PACKAGE BEHAVIOUR partyTablePkgBehaviour BEHAVIOUR DEFINED AS !The SNMPv2 Party database.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 1 1 }; viewEntry MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY viewEntryPkg PACKAGE BEHAVIOUR viewEntryPkgBehaviour BEHAVIOUR DEFINED AS !PARSE REFERENCE !!This managed object class maps to viewEntry object in [SNMPv2PARTY].!!; MULTIPLEINSTANCES INDEX viewIndex, viewSubtree; CREATEDELETEATT viewStatus; CREATEDELETEVALUE SNMPV2ROWSTATUS; ENDMULTIPLEINSTANCES ENDPARSE Information on a particular family of view subtrees included in or excluded from a particular SNMPv2 context's MIB view. Implementations must not restrict the number of families of view subtrees for a given MIB view, except as dictated by resource constraints on the overall number of entries in the viewTable.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET, LaBarre Expires August 27, 1993 Page 20 Draft ISO/CCITT to Internet Management Security 3/26/93 viewIndex GET, viewSubtree GET, viewMask GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-viewMask, viewType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-viewType, viewStorageType GET-REPLACE DEFAULT VALUE IIMCPartyMIB.c-viewStorageType, viewStatus GET-REPLACE;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 4 11}; viewTable MANAGED OBJECT CLASS DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" :top; CHARACTERIZED BY viewTablePkg PACKAGE BEHAVIOUR viewTableBehaviour BEHAVIOUR DEFINED AS !Locally held information about the MIB views known to this SNMPv2 entity. Each SNMPv2 context which is locally accessible has a single MIB view which is defined by two collections of view subtrees: the included view subtrees, and the excluded view subtrees. Every such subtree, both included and excluded, is defined in this table. To determine if a particular object instance is in a particular MIB view, compare the object instance's OBJECT IDENTIFIER with each of the MIB view's entries in this table. If none match, then the object instance is not in the MIB view. If one or more match, then the object instance is included in, or excluded from, the MIB view according to the value of viewType in the entry whose value of viewSubtree has the most sub- identifiers. If multiple entries match and have the same number of sub-identifiers, then the lexicographically greatest instance of viewType determines the inclusion or exclusion. An object instance's OBJECT IDENTIFIER X matches an entry in this table when the number of sub- identifiers in X is at least as many as in the value of viewSubtree for the entry, and each sub- identifier in the value of viewSubtree matches its corresponding sub-identifier in X. Two sub- identifiers match either if the corresponding bit of viewMask is zero (the 'wild card' value), or if LaBarre Expires August 27, 1993 Page 21 Draft ISO/CCITT to Internet Management Security 3/26/93 they are equal. Due to this 'wild card' capability, we introduce the term, a 'family' of view subtrees, to refer to the set of subtrees defined by a particular combination of values of viewSubtree and viewMask. In the case where no 'wild card' is defined in viewMask, the family of view subtrees reduces to a single view subtree.!;; ATTRIBUTES {iimcManagementDocMan 1}: internetClassId GET;;; REGISTERED AS { iimcAutoTrans-partyMIB 2 4 1 }; 6.3 Attribute Definitions The templates for the IIMC Proxy SNMP Parties attributes are listed in alphabetical order. The object identifier{cmipsnmpProxyIMIB} is defined in [IIMCIMIBTRANS]. aclPrivileges ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:AclPrivileges; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR aclPrivilegesBehaviour BEHAVIOUR DEFINED AS !The access privileges which govern what management operations a particular target party may perform with respect to a particular SNMPv2 context when requested by a particular subject party. These privileges are specified as a sum of values, where each value specifies a SNMPv2 PDU type by which the subject party may request a permitted operation. The value for a particular PDU type is computed as 2 raised to the value of the ASN.1 context-specific tag for the appropriate SNMPv2 PDU type. The values (for the tags defined in [5]) are defined in [3] as: Get : 1 GetNext : 2 Response : 4 Set : 8 unused : 16 GetBulk : 32 Inform : 64 SNMPv2-Trap : 128 The null set is represented by the value zero.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 4}; aclResources ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; LaBarre Expires August 27, 1993 Page 22 Draft ISO/CCITT to Internet Management Security 3/26/93 MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR aclResourcesBehaviour BEHAVIOUR DEFINED AS !The value of an instance of this object identifies a SNMPv2 context in an access control policy, and has the same value as the instance of the contextIndex object for that SNMPv2 context.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 3}; aclStatus ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:rowStatus; BEHAVIOUR aclStatusBehaviour BEHAVIOUR DEFINED AS !The status of this conceptual row in the aclTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 6}; aclStorageType ATTRIBUTE DERIVED FROM storageType; BEHAVIOUR aclStorageTypeBehaviour BEHAVIOUR DEFINED AS !The storage type for this conceptual row in the aclTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 5}; aclSubject ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR aclSubjectBehaviour BEHAVIOUR DEFINED AS !The value of an instance of this object identifies a SNMPv2 party which is the subject of an access control policy, and has the same value as the instance of the partyIndex object for that SNMPv2 party.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 2}; aclTarget ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR aclTargetBehaviour BEHAVIOUR DEFINED AS !The value of an instance of this object identifies a SNMPv2 party which is the target of an access control policy, and has the same value as the instance of the partyIndex object for that party.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 3 1 1 1}; contextIdentity ATTRIBUTE LaBarre Expires August 27, 1993 Page 23 Draft ISO/CCITT to Internet Management Security 3/26/93 DERIVED FROM context; BEHAVIOUR contextIdentityBehaviour BEHAVIOUR DEFINED AS !A context identifier uniquely identifying a particular SNMPv2 context.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 1}; contextIndex ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR contextIndexBehaviour BEHAVIOUR DEFINED AS !A unique value for each SNMPv2 context. The value for each SNMPv2 context must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 2}; contextLocal ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:truthValue; BEHAVIOUR contextLocalBehaviour BEHAVIOUR DEFINED AS !An indication of whether this context is realized by this SNMPv2 entity.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 3}; contextViewIndex ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR contextViewIndexBehaviour BEHAVIOUR DEFINED AS !If the value of an instance of this object is zero, then this corresponding conceptual row in the contextTable refers to a SNMPv2 context which identifies a proxy relationship; the values of the corresponding instances of the contextProxyDstParty, contextProxySrcParty, and contextProxyContext objects provide further information on the proxy relationship. Otherwise, if the value of an instance of this object is greater than zero, then this corresponding conceptual row in the contextTable refers to a SNMPv2 context which identifies a MIB view of a locally accessible entity; the value of the instance identifies the particular MIB view which has the same value of viewIndex; and the value of the corresponding instances of the contextLocalEntity and contextLocalTime objects LaBarre Expires August 27, 1993 Page 24 Draft ISO/CCITT to Internet Management Security 3/26/93 provide further information on the local entity and its temporal domain.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 4}; contextLocalEntity ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.OctetString; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR contextLocalEntityBehaviour BEHAVIOUR DEFINED AS !If the value of the corresponding instance of the contextViewIndex is greater than zero, then the value of an instance of this object identifies the local entity whose management information is in the SNMPv2 context's MIB view. The empty string indicates that the MIB view contains the SNMPv2 entity's own local management information; otherwise, a non-empty string indicates that the MIB view contains management information of some other local entity, e.g.,'Repeater1'.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 5}; contextLocalTime ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR contextLocalTimeBehaviour BEHAVIOUR DEFINED AS !If the value of the corresponding instance of the contextViewIndex is greater than zero, then the value of an instance of this object identifies the temporal context of the management information in the MIB view.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 6}; contextProxyDstParty ATTRIBUTE DERIVED FROM party; BEHAVIOUR contextProxyDstPartyBehaviour BEHAVIOUR DEFINED AS !If the value of the corresponding instance of the contextViewIndex is equal to zero, then the value of an instance of this object identifies a SNMPv2 party which is the proxy destination of a proxy relationship. If the value of the corresponding instance of the contextViewIndex is greater than zero, then the value of an instance of this object is zero.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 7}; contextProxySrcParty ATTRIBUTE DERIVED FROM party; BEHAVIOUR LaBarre Expires August 27, 1993 Page 25 Draft ISO/CCITT to Internet Management Security 3/26/93 contextProxySrcPartyBehaviour BEHAVIOUR DEFINED AS !If the value of the corresponding instance of the contextViewIndex is equal to zero, then the value of an instance of this object identifies a SNMPv2 party which is the proxy source of a proxy relationship. Interpretation of an instance of this object depends upon the value of the transport domain associated with the SNMPv2 party used as the proxy destination in this proxy relationship. If the value of the corresponding instance of the contextViewIndex is greater than zero, then the value of an instance of this object is zero.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 8}; contextProxyContext ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR contextProxyContextBehaviour BEHAVIOUR DEFINED AS !If the value of the corresponding instance of the contextViewIndex is equal to zero, then the value of an instance of this object identifies the context of a proxy relationship. Interpretation of an instance of this object depends upon the value of the transport domain associated with the SNMPv2 party used as the proxy destination in this proxy relationship. If the value of the corresponding instance of the contextViewIndex is greater than zero, then the value of an instance of this object is { 0 0 }.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 9}; contextStorageType ATTRIBUTE DERIVED FROM storageType; BEHAVIOUR contextStorageTypeBehaviour BEHAVIOUR DEFINED AS !The storage type for this conceptual row in the contextTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 10}; contextStatus ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:rowStatus; BEHAVIOUR contextStatusBehaviour BEHAVIOUR DEFINED AS LaBarre Expires August 27, 1993 Page 26 Draft ISO/CCITT to Internet Management Security 3/26/93 !The status of this conceptual row in the contextTable. A context is not qualified for activation until instances of all corresponding columns have the appropriate value. In particular, if the context's contextViewIndex is greater than zero, then the viewStatus column of the associated conceptual row(s) in the viewTable must have the value `active'. Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the contextStatus column is `notReady'.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1 1 11}; familyIndex ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR familyIndexBehaviour BEHAVIOUR DEFINED AS !A unique value for each family of view subtrees. The value for each family of view subtrees must remain constant at least from one re- initialization of the entity's network management system to the next re-initialization.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 2 1 1}; familySubtree ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR familySubtreeBehaviour BEHAVIOUR DEFINED AS !An object identifier which, in combination with the corresponding instance of familyMask, defines a family of view subtrees.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 2 1 2}; familyMask ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString16; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR familyMaskBehaviour BEHAVIOUR DEFINED AS !The bit mask which, in combination with the corresponding instance of familySubtree, defines a family of view subtrees.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 2 1 3}; familyStorageType ATTRIBUTE DERIVED FROM storageType; LaBarre Expires August 27, 1993 Page 27 Draft ISO/CCITT to Internet Management Security 3/26/93 BEHAVIOUR familyStorageTypeBehaviour BEHAVIOUR DEFINED AS !The storage type for this conceptual row in the familyTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 2 1 4}; familyStatus ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:rowStatus; BEHAVIOUR familyStatusBehaviour BEHAVIOUR DEFINED AS !The status of this conceptual row in the familyTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 2 1 5}; partyAuthClock ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCRFC1353ProxyASN1.Clock; MATCHES FOR EQUALITY; BEHAVIOUR partyAuthClockBehaviour BEHAVIOUR DEFINED AS !The authentication clock which represents the local notion of the current time specific to the party. This value must not be decremented unless the party's secret information is changed simultaneously, at which time the party's nonce and last-timestamp values must also be reset to zero, and the new value of the clock, respectively.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 8}; partyAuthLifetime ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:PartyLifetime; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyAuthLifetimeBehaviour BEHAVIOUR DEFINED AS !The lifetime (in units of seconds) which represents an administrative upper bound on acceptable delivery delay for protocol messages generated by the party.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 11}; partyAuthPrivate ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.OctetString; MATCHES FOR EQUALITY, SUBSTRINGS; BEHAVIOUR partypartyAuthPrivateBehaviour BEHAVIOUR DEFINED AS !If the value of partyAuthProtocol is {snmpv1CommString} then this attribute contains the community string to be used with SNMPv1 security. LaBarre Expires August 27, 1993 Page 28 Draft ISO/CCITT to Internet Management Security 3/26/93 If the value of partyAuthProtocol is not {snmpv1CommString} then this attribute contains an encoding of the party's private authentication key which may be needed to support the authentication protocol. Although the value of this variable may be altered by a management operation (e.g., a SNMPv2 Set-Request), its value can never be retrieved by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private authentication key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private authentication key (prior to the alteration) with the new private authentication key (after the alteration). Thus, when processing a received protocol Set operation, the new private authentication key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private authentication key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in the calculation.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 9}; partyAuthProtocol ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY; BEHAVIOUR partypartyAuthProtocolBehaviour BEHAVIOUR DEFINED AS !The authentication protocol by which all messages generated by the party are authenticated as to origin and integrity. In this context, the value { noAuth } signifies that messages generated by the party are not authenticated. The value {snmpv1CommString} indicates that SNMPv1 community string is to be used. The community string shall be present in partyAuthPrivate!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 7}; partyAuthPublic ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString16; MATCHES FOR EQUALITY; BEHAVIOUR LaBarre Expires August 27, 1993 Page 29 Draft ISO/CCITT to Internet Management Security 3/26/93 partyAuthPublicBehaviour BEHAVIOUR DEFINED AS !A publicly-readable value for the party. Depending on the party's authentication protocol, this value may be needed to support the party's authentication protocol. Alternatively, it may be used by a manager during the procedure for altering secret information about a party. (For example, by altering the value of an instance of this object in the same SNMP Set-Request used to update an instance of partyAuthPrivate, a subsequent Get-Request can determine if the Set- Request was successful in the event that no response to the Set-Request is received, see RFC1352.) The length of the value is dependent on the party's authentication protocol. If not used by the authentication protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyAuthPrivate object.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 10}; partyCloneFrom ATTRIBUTE DERIVED FROM party; BEHAVIOUR partyCloneFromBehaviour BEHAVIOUR DEFINED AS !The identity of a party to clone authentication and privacy parameters from. When read, the value { 0 0 } is returned. This value can only be written when the associated instance of partyStatus either does not exist or has the value `notReady'. When written, the value identifies a party, the cloning party, whose status column has the value `active'. The cloning party is used in two ways. One, if instances of the following objects do not exist for the party being created, then they are created with values identical to those of the corresponding objects for the cloning party: partyAuthProtocol partyAuthPublic partyAuthLifetime partyPrivProtocol partyPrivPublic Two, instances of the following objects are updated using the corresponding values of the cloning party: LaBarre Expires August 27, 1993 Page 30 Draft ISO/CCITT to Internet Management Security 3/26/93 partyAuthPrivate partyPrivPrivate (e.g., the value of the cloning party's instance of the partyAuthPrivate object is XOR'd with the value of the partyAuthPrivate instances of the party being created.)!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 15}; partyIdentity ATTRIBUTE DERIVED FROM party; BEHAVIOUR partyIdentityBehaviour BEHAVIOUR DEFINED AS !A party identifier uniquely identifying a particular SNMP party.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 1}; partyIndex ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyIndexBehaviour BEHAVIOUR DEFINED AS !A unique value for each SNMPv2 party. The value for each SNMPv2 party must remain constant at least from one re-initialization of the entity's network management system to the next re- initialization.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 2}; partyLocal ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:truthValue; BEHAVIOUR partyLocalBehaviour BEHAVIOUR DEFINED AS !An indication of whether this party executes at this SNMPv2 entity. If this object has a value of true(1), then the SNMPv2 entity will listen for SNMPv2 messages on the partyTAddress associated with this party. If this object has the value false(2), then the SNMPv2 entity will not listen for SNMPv2 messages on the partyTAddress associated with this party.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 6}; partyMaxMessageSize ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:PartyMaxMessageSize; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyMaxMessageSizeBehaviour BEHAVIOUR DEFINED AS !The maximum length in octets of a SNMP message LaBarre Expires August 27, 1993 Page 31 Draft ISO/CCITT to Internet Management Security 3/26/93 which this party will accept. For parties which execute at an agent, the agent initializes this object to the maximum length supported by the agent, and does not let the object be set to any larger value. For parties which do not execute at the agent, the agent must allow the manager to set this object to any legal value, even if it is larger than the agent can generate.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 5}; partyPrivProtocol ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyPrivProtocolBehaviour BEHAVIOUR DEFINED AS !The privacy protocol by which all protocol messages received by the party are protected from disclosure. In this context, the value { noPriv } signifies that messages received by the party are not protected.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 12}; partyPrivPrivate ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString16; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyPrivPrivateBehaviour BEHAVIOUR DEFINED AS !An encoding of the party's private encryption key which may be needed to support the privacy protocol. Although the value of this variable may be altered by a management operation (e.g., a SNMPv2 Set-Request), its value can never be retrieved by a management operation: when read, the value of this variable is the zero length OCTET STRING. The private encryption key is NOT directly represented by the value of this variable, but rather it is represented according to an encoding. This encoding is the bitwise exclusive-OR of the old key with the new key, i.e., of the old private encryption key (prior to the alteration) with the new private encryption key (after the alteration). Thus, when processing a received protocol Set operation, the new private encryption key is obtained from the value of this variable as the result of a bitwise exclusive-OR of the variable's value and the old private encryption key. In calculating the exclusive-OR, if the old key is shorter than the new key, zero-valued padding is appended to the old key. If no value for the old key exists, a zero-length OCTET STRING is used in LaBarre Expires August 27, 1993 Page 32 Draft ISO/CCITT to Internet Management Security 3/26/93 the calculation.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 13}; partyPrivPublic ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString16; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR partyPrivPublicBehaviour BEHAVIOUR DEFINED AS !A publicly-readable value for the party. Depending on the party's privacy protocol, this value may be needed to support the party's privacy protocol. Alternatively, it may be used by a manager as a part of its procedure for altering secret information about a party. (For example, by altering the value of an instance of this object in the same SNMP Set-Request used to update an instance of partyPrivPrivate, a subsequent Get-Request can determine if the Set-Request was successful in the event that no response to the Set-Request is received, see RFC 1352.) The length of the value is dependent on the party's privacy protocol. If not used by the privacy protocol, it is recommended that agents support values of any length up to and including the length of the corresponding partyPrivPrivate object.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 14}; partyStatus ATTRIBUTE DERIVED FROM {iimcManagementDocMan 1}:rowStatus; BEHAVIOUR partyStatusBehaviour BEHAVIOUR DEFINED AS !The status of this conceptual row in the partyTable. A party is not qualified for activation until instances of all columns of its partyEntry row have an appropriate value. In particular: A value must be written to the Party's partyCloneFrom object. If the Party's partyAuthProtocol object has the value md5AuthProtocol, then the corresponding instance of partyAuthPrivate must contain a secret of the appropriate length. Further, at least one management protocol set operation updating the value of the party's partyAuthPrivate object must be successfully processed, before the LaBarre Expires August 27, 1993 Page 33 Draft ISO/CCITT to Internet Management Security 3/26/93 partyAuthPrivate column is considered appropriately configured. If the Party's partyPrivProtocol object has the value desPrivProtocol, then the corresponding instance of partyPrivPrivate must contain a secret of the appropriate length. Further, at least one management protocol set operation updating the value of the party's partyPrivPrivate object must be successfully processed, before the partyPrivPrivate column is considered appropriately configured. Until instances of all corresponding columns are appropriately configured, the value of the corresponding instance of the partyStatus column is `notReady'.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 17}; partyStorageType ATTRIBUTE DERIVED FROM storageType; BEHAVIOUR partyStorageTypeBehaviour BEHAVIOUR DEFINED AS !The storage type for this conceptual row in the partyTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 16}; partyTAddress ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.OctetString; MATCHES FOR EQUALITY, SUBSTRINGS; BEHAVIOUR partyTAddressBehaviour BEHAVIOUR DEFINED AS !The transport service address by which the party receives network management traffic, formatted according to the corresponding value of partyTDomain. For rfc1351Domain, partyTAddress is formatted as a 4-octet IP Address concatenated with a 2-octet UDP port number.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 4}; partyTDomain ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.ObjectIdentifier; MATCHES FOR EQUALITY; BEHAVIOUR partyTDomainBehaviour BEHAVIOUR DEFINED AS !Indicates the kind of transport service by which the party receives network management traffic. An example of a transport domain is 'rfc1351Domain' (SNMP over UDP).!;; LaBarre Expires August 27, 1993 Page 34 Draft ISO/CCITT to Internet Management Security 3/26/93 REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1 3}; viewIndex ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB.Integer64k; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR viewIndexBehaviour BEHAVIOUR DEFINED AS !A unique value for each MIB view. The value for each MIB view must remain constant at least from one re-initialization of the entity's network management system to the next re-initialization.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 1}; viewMask ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:OctetString16; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR viewMaskBehaviour BEHAVIOUR DEFINED AS !The bit mask which, in combination with the corresponding instance of viewSubtree, defines a family of view subtrees. Each bit of this bit mask corresponds to a sub- identifier of viewSubtree, with the most significant bit of the i-th octet of this octet string value (extended if necessary, see below) corresponding to the (8*i - 7)-th sub-identifier, and the least significant bit of the i-th octet of this octet string corresponding to the (8*i)-th sub-identifier, where i is in the range 1 through 16. Each bit of this bit mask specifies whether or not the corresponding sub-identifiers must match when determining if an OBJECT IDENTIFIER is in this family of view subtrees; a '1' indicates that an exact match must occur; a '0' indicates 'wild card', i.e., any sub-identifier value matches. Thus, the OBJECT IDENTIFIER X of an object instance is contained in a family of view subtrees if the following criteria are met: for each sub-identifier of the value of viewSubtree, either: the i-th bit of viewMask is 0, or the i-th sub-identifier of X is equal to the i-th sub-identifier of the value of viewSubtree. LaBarre Expires August 27, 1993 Page 35 Draft ISO/CCITT to Internet Management Security 3/26/93 If the value of this bit mask is M bits long and there are more than M sub-identifiers in the corresponding instance of viewSubtree, then the bit mask is extended with 1's to be the required length. Note that when the value of this object is the zero-length string, this extension rule results in a mask of all-1's being used (i.e., no 'wild card'), and the family of view subtrees is the one view subtree uniquely identified by the corresponding instance of viewSubtree.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 3}; viewStatus ATTRIBUTE DERIVED FROM (iimcManagementDocMan 1}:rowStatus; BEHAVIOUR viewStatusBehaviour BEHAVIOUR DEFINED AS !The status of this conceptual row in the viewTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 6}; viewStorageType ATTRIBUTE DERIVED FROM storageType; BEHAVIOUR viewStorageTypeBehaviour BEHAVIOUR DEFINED AS !The storage type for this conceptual row in the viewTable.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 5}; viewSubtree ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:ObjectIdentifier; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR viewSubtreeBehaviour BEHAVIOUR DEFINED AS !A MIB subtree.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 2}; viewType ATTRIBUTE WITH ATTRIBUTE SYNTAX IIMCPartyMIB:ViewType; MATCHES FOR EQUALITY, ORDERING; BEHAVIOUR viewTypeBehaviour BEHAVIOUR DEFINED AS !The status of a particular family of view subtrees within the particular SNMPv2 context's MIB view. The value 'included(1)' indicates that the corresponding instances of viewSubtree and viewMask define a family of view subtrees included in the MIB view. The value 'excluded(2)' LaBarre Expires August 27, 1993 Page 36 Draft ISO/CCITT to Internet Management Security 3/26/93 indicates that the corresponding instances of viewSubtree and viewMask define a family of view subtrees excluded from the MIBview.!;; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1 4}; 6.4 The Containment Hierarchy A Naming Tree diagram for IIMC Party MIB managed object classes is illustrated below. The IIMC Party MIB is subordinate to the ISO/CCITT system managed object that represents the Internet agent or proxy. "Rec. X.721 | ISO/IEC 10165-2 : 1992" : system | | |-- partyTable --- partyEntry | |-- contextTable --- contextEntry | |-- aclTAble --- aclEntry | |-- viewTable --- viewEntry Name Binding templates that define the containment hierarchy for the IIMC Party MIB managed object classes are listed here in alphabetical order. The object identifier {iimcAutotrans} is assigned in [IIMCIMIBTRANS]. Editor's Note: [The OID fragment "iimcAutoTrans-partyMIB" will be resolved when the iimcAutotrans and partyMIB OID are allocated.] aclEntry-aclTableNB NAME BINDING SUBORDINATE OBJECT CLASS aclEntry AND SUBCLASSES ; NAMED BY SUPERIOR OBJECT CLASS aclTable AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE; REGISTERED AS { iimcAutoTrans-partyMIB 2 3 1 1}; aclTable-systemNB NAME BINDING SUBORDINATE OBJECT CLASS aclTable AND SUBCLASSES ; NAMED BY SUPERIOR OBJECT CLASS "Rec. X.721 | ISO/IEC 10165-2 : 1992" : system AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; LaBarre Expires August 27, 1993 Page 37 Draft ISO/CCITT to Internet Management Security 3/26/93 DELETE ONLY-IF-NO-CONTAINED-OBJECTS; REGISTERED AS { iimcAutoTrans-partyMIB 2 3 1}; contextEntry-contextTableNB NAME BINDING SUBORDINATE OBJECT CLASS contextEntry AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS contextTable AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE; REGISTERED AS { iimcAutoTrans-partyMIB 2 2 1 1}; contextTable-systemNB NAME BINDING SUBORDINATE OBJECT CLASS contextTable AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS "Rec. X.721 | ISO/IEC 10165-2 : 1992" :system AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE ONLY-IF-NO-CONTAINED-OBJECTS; REGISTERED AS {iimcAutoTrans-partyMIB 2 2 1}; partyEntry-partyTableNB NAME BINDING SUBORDINATE OBJECT CLASS partyEntry AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS partyTable AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1 1}; partyTable-systemNB NAME BINDING SUBORDINATE OBJECT CLASS partyTable AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS "Rec. X.721 | ISO/IEC 10165-2 : 1992" :system AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE ONLY-IF-NO-CONTAINED-OBJECTS; REGISTERED AS {iimcAutoTrans-partyMIB 2 1 1}; viewEntry-viewTableNB NAME BINDING LaBarre Expires August 27, 1993 Page 38 Draft ISO/CCITT to Internet Management Security 3/26/93 SUBORDINATE OBJECT CLASS viewEntry AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS viewTable AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1 1}; viewTable-systemNB NAME BINDING SUBORDINATE OBJECT CLASS viewTable AND SUBCLASSES; NAMED BY SUPERIOR OBJECT CLASS "Rec. X.721 | ISO/IEC 10165-2 : 1992" :system AND SUBCLASSES; WITH ATTRIBUTE {iimcManagementDocMan 1}: internetClassId; CREATE WITH-AUTOMATIC-INSTANCE-NAMING; DELETE ONLY-IF-NO-CONTAINED-OBJECTS; REGISTERED AS {iimcAutoTrans-partyMIB 2 4 1}; 6.5 ASN.1 Definitions IIMCPartyMIB {iimcManagementModMan 3} DEFINITIONS IMPLICIT TAGS ::= BEGIN IMPORTS Integer, OctetString, ObjectIdentifier FROM IimcCommonDef iimcAutoTrans, iimcManagementDoc FROM IimcAssignedOIDs mib-2, private, internet FROM RFC1155-SMI; iimcSEC OBJECT IDENTIFIER ::= {iimcManagementDocMan 3} partyMIB OBJECT IDENTIFIER ::= { TBD } Clock ::= INTEGER (0..2147483647) -- A party's authentication clock - a non-negative integer -- which is incremented as specified/allowed by the party's -- Authentication Protocol. -- For noAuth, a party's authentication clock is unused and -- its value is undefined. -- For v2md5AuthProtocol, a party's authentication clock is a -- relative clock with 1-second granularity. TAddress ::= OCTET STRING -- A textual convention denoting a transport service address. -- For snmpUDPDomain, a TAddress is 6 octets long, LaBarre Expires August 27, 1993 Page 39 Draft ISO/CCITT to Internet Management Security 3/26/93 -- the initial 4 octets containing the IP-address in -- network-byte order and the last 2 containing the -- UDP port in network-byte order. Integer64k ::= INTEGER (1..65535) OctetString16 ::= OCTET STRING (SIZE (0..16)) PartyAuthLifetime ::= INTEGER (0..2147483647) PartyMaxMessageSize ::= INTEGER (484..65507) StorageType ::= INTEGER { other(1), -- eh? volatile(2), -- e.g., in RAM nonVolatile(3), -- e.g., in NVRAM permanent(4) -- e.g., in ROM } ViewType ::= INTEGER { included(1), excluded(2) } AclPrivileges ::= INTEGER (0..31) -- assigned OIDs snmpv2 OBJECT IDENTIFIER ::= { TBD } snmpUDPDomain OBJECT IDENTIFIER ::= {snmpv2 1 1 1} partyAdmin OBJECT IDENTIFIER ::= { partyMIB 1 } partyProtocols OBJECT IDENTIFIER ::= { partyAdmin 1 } noAuth OBJECT IDENTIFIER ::= { partyProtocols 1 } noPriv OBJECT IDENTIFIER ::= { partyProtocols 2 } desPrivProtocol OBJECT IDENTIFIER ::= { partyProtocols 3 } v2md5AuthProtocol OBJECT IDENTIFIER ::= { partyProtocols 4 } temporalDomains OBJECT IDENTIFIER ::= { partyAdmin 2 } currentTime OBJECT IDENTIFIER ::= { temporalDomains 1 } restartTime OBJECT IDENTIFIER ::= { temporalDomains 2 } cacheTime OBJECT IDENTIFIER ::= { temporalDomains 3 } initialPartyId OBJECT IDENTIFIER ::= { partyAdmin 3 } initialContextId OBJECT IDENTIFIER ::= { partyAdmin 4 } -- Default value constants c-aclPrivileges INTEGER ::= 35 c-aclStorageType INTEGER ::= 3 c-contextLocal BOOLEAN ::= TRUE c-contextLocalEntity OCTET STRING ::= ''h c-contextLocalTime OBJECT IDENTIFIER ::= {currentTime} c-contextStorageType INTEGER ::= 3 c-familyMask OCTET STRING ::= ''h c-familyStorageType INTEGER ::= 3 c-partyTDomain snmpUDPDomain LaBarre Expires August 27, 1993 Page 40 Draft ISO/CCITT to Internet Management Security 3/26/93 c-partyTAddress OCTET STRING ::= '000000000000'h c-partyMaxMessageSize INTEGER ::= 484 c-partyLocal BOOLEAN ::= FALSE c-partyAuthProtocol OBJECT IDENTIFIER ::= {v2md5AuthProtocol} c-partyAuthClock INTEGER ::= 0 c-partyAuthPrivate OCTET STRING ::= ''h c-partyAuthPublic OCTET STRING ::= ''h c-partyAuthLifetime INTEGER ::= 300 c-partyPrivProtocol OBJECT IDENTIFIER ::= {noPriv} c-partyPrivPrivate OCTET STRING ::= ''h c-partyPrivPublic OCTET STRING ::= ''h c-partyStorageType INTEGER ::= 3 c-viewMask OCTET STRING ::= ''h c-viewType INTEGER ::= 1 c-viewStorageType INTEGER ::= 3 END 7.MOCS Editor's Note: [To Be Provided.] 8. Acknowledgments The following individuals have contributed to this effort. Bob Aronoff - NIST Jon Biggar - NetLabs Mary Brady - NIST April Chang - NetLabs Jock Embry - Opening Technologies Paul Golick - IBM Pramod Kalyanas - University of Delaware Lee LaBarre - The MITRE Corporation David Liu - Northern Telecom, Inc Owen Newnan - U S West Advanced Technologies Steve Ng - MPR Teltech Yasuhiro Ohara - NTT George Pavlou - UCL Lisa Phifer - Bellcore Tom Rutt - AT&T Mark Smith - Hewlett-Packard Einar Stefferud - Network Management Associates, Inc. Dean Voiss - NetLabs Yoshi Yamashita - NKK Corporation LaBarre Expires August 27, 1993 Page 41 Draft ISO/CCITT to Internet Management Security 3/26/93 References [ISO8824] ISO/IEC IS 8824: Information Technology - Open System Interconnection - Specification of Abstract Syntax Notation One(ASN.1),1990. [ISO9595] ISO/IEC IS 9595, Information Technology - Open System Interconnection - Common Management Information Service Definition, 1991. [ISO9596-1] ISO/IEC IS 9596-1, Information Technology - Open Systems Interconnection - Common Management Information Protocol - Part 1: Specification, 1991. [ISO10164-9] ISO DIS 10165-9, Information Processing Systems -Open Systems Interconnection - Structure of Management Information - Part 9: Objects and Attributes for Access Control, 1993 [ISO10165-1] ISO/IEC IS 10165-1: Information Technology - Open Systems Interconnection - Structure of Management Information - Part 1: Management Information Model, 1991. [ISO10165-2] ISO/IEC IS 10165-2: Information Technology - Open Systems Interconnection - Structure of Management Information - Part 2: Definition of Management Information, 1992. [ISO10165-4] ISO/IEC IS 10165-4: Information Technology - Open Systems Interconnection - Structure of Management Information - Part 4: Guidelines for the Definition of Managed Objects, 1991. [ISO11586-1] ISO/IEC CD11586-1, Information Technology - Generic Upper Layers Security - Part 1: Overview, Models and Notation, November 1992. [ISO11586-2] ISO/IEC CD11586-2, Information Technology - Generic Upper Layers Security - Part 2: Security Exchange Service Element(SESE) Service Definition, November 1992. [ISO11586-3] ISO/IEC CD11586-3, Information Technology - Generic Upper Layers Security - Part 3: Security Exchange Service Element(SESE) Protocol Specification, November 1992. [ISO11586-4] ISO/IEC CD11586-4, Information Technology - Generic Upper Layers Security - Part 4: Protecting Transfer Syntax Specification, November 1992. [RFC1155] RFC1155, M. Rose and K. McCloghrie, Structure and Identification of Management Information for TCP/IP based internets, May 1990. [RFC1157] RFC 1157, J.D. Case, M.S. Fedor, M.L. LaBarre Expires August 27, 1993 Page 42 Draft ISO/CCITT to Internet Management Security 3/26/93 Schoffstall,C. Davin, Simple Network Management Protocol (SNMP), May 1990. [RFC1213] RFC1213, K. McCloghrie and M. Rose - Editors, Management Information Base for Network Management of TCP/IP-basedinternets: MIB-II, March 1991. [RFC1214] RFC1214, L. LaBarre - editor, OSI Internet Management: Management Information Base, April 1991. [SNMPv2COEX] J.D. Case, K. McCloghrie, M.T. Rose, S.L.Waldbusser, Coexistence between version 1 and version 2 of the Internet Network Management Framework, Internet- draft, December 1992. [SNMPv2PROT] J.D. Case, K. McCloghrie, M.T. Rose, S.L.Waldbusser, Protocol Operations for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-draft, January 1992. [SNMPv2SMI] J.D. Case, K. McCloghrie, M.T. Rose, S.L.Waldbusser, Structure of Management Information for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-draft, December 1992. [SNMPv2MIB] J.D. Case, K. McCloghrie, M.T. Rose, S.L.Waldbusser, Management Information Base for version 2 of the Simple Network Management Protocol (SNMPv2), Internet- draft, December 1992. [SNMPv2TC] J.D. Case, K. McCloghrie, M.T. Rose, S.L.Waldbusser, Textual Conventions for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-draft, December 1992. [SNMPv2ADMIN] J.R. Davin, J.M. Galvin, K.McCloghrie, Administrative Model for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-Draft, January 1993. [SNMPv2SEC] J.M. Galvin, K. McCloghrie, J.R. Davin, Security Protocols for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-Draft, January 1993. [SNMPv2TM] J.D. Case, K. McCloghrie, M.T. Rose, S.L. Waldbusser, Transport Mappings for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-Draft, January 1993. [SNMPv2PARTY] J.D. Case, K. McCloghrie, M.T. Rose, S.L. Waldbusser, Party MIB for version 2 of the Simple Network Management Protocol (SNMPv2), Internet-Draft, January 1993. [IIMCIMIBTRANS] ISO/CCITT and Internet Management Coexistence (IIMC): Translation of Internet MIBs to ISO/CCITT GDMO MIBs, Draft 1 March 26,1993. LaBarre Expires August 27, 1993 Page 43 Draft ISO/CCITT to Internet Management Security 3/26/93 [IIMCMIB-II] ISO/CCITT and Internet Management Coexistence (IIMC): Translation of Internet MIB-II (RFC1213) to ISO/CCITT GDMO MIB, Draft 1, March 26, 1993. [IIMCPROXY] ISO/CCITT and Internet Management Coexistence (IIMC): ISO/CCITT to Internet Management Proxy, Draft 1, March, 1993 [to be distributed]. [IIMCOMIBTRANS] ISO/CCITT and Internet Management Coexistence (IIMC): Translation of ISO/CCITT GDMO MIBs to Internet MIBs, Draft 1, March 26, 1993. [NMFMC92] NM Forum and X/Open, ISO/CCITT and Internet Management: Coexistence and Interworking Strategy, October, 1992. [NMFSEC] Network Management Forum: Forum 016, Application Services: Security of Management, Issue 1.0, August 1992. INTERNET DRAFT - EXPIRES AUGUST 27, 1993 LaBarre Expires August 27, 1993 Page 44