TPM支持的可信网络通信技术规范(TNC_CESP_v1.0r14)

需积分: 1 60 浏览量更新于2024-06-22 收藏 574KB PDF 举报

本资源为《TNC_CESP_v1.0r14.pdf》，即Trusted Network Communications (TNC) 客户端无需支持 profile 的版本1.0修订版14，发布日期为2009年5月18日。该文档由 Trusted Computing Group (TCG) 出品，旨在提供基于TPM（Trusted Platform Module）的可信网络连接技术规范。TPM 是一种高度安全的硬件组件，用于确保计算机平台的可信度，通过加密、身份验证和数据保护功能来增强系统的安全性。该规格书中涉及的主要知识点包括： 1. **TCG Trusted Network**：这是一个概念，强调了利用TPM技术来构建安全、可信的网络环境，其中所有通信和数据交换都是在保证隐私和完整性的情况下进行。 2. **Clientless Endpoint Support Profile**：这是一个针对无客户端终端设备的安全模型，意味着系统可以在没有预装特定软件或应用程序的情况下实现信任关系。这在移动设备或者轻量级设备中特别有用，它们可能无法承载完整的安全软件栈。 3. **Specification Version 1.0 Revision 14**：这是技术规范的最新版本，可能包含了对先前版本的改进、新功能添加以及对TPM在网络安全中的最佳实践更新。 4. **Copyright and Disclaimer**：文档声明版权属于TCG，且提供“原样”无保证，即不保证适合任何特定目的，包括但不限于非侵权性、适销性、无错误或符合用户预期。同时，TCG对使用规范中信息导致的任何损失或损害不负责任，包括间接或附带损害。 5. **Liability Disclaimers**：TCG明确排除了所有法律责任，包括但不限于侵犯知识产权的责任，以及因遵循规范或实施规范而产生的费用或损失，不论责任基础为何。这份文档是关于如何在基于TPM的环境下设计和实现无客户端终端支持的可信网络通信的技术指南，适用于那些追求高安全性的网络服务提供商、设备制造商以及系统集成商，他们需要理解和遵守这些标准以确保网络连接的安全性和可靠性。

Clientless Endpoint Support Profile TCG Copyright

Specification Version 1.0

Revision 14 Published Page 6 of 31

TCG PUBLISHED

1 Introduction

1.1 Scope and Audience

The Trusted Network Communications Work Group (TNC) defines an open solution architecture

that enables network operators to enforce policies regarding endpoint integrity when granting

access to a network infrastructure. Today's networks contain many "clientless endpoints", legacy

devices that do not have a functional TNC client and therefore do not support integrity checking. In

the absence of standards addressing clientless endpoints, every vendor may handle them in a

different manner, negating the interoperability provided by TNC and causing situations where one

vendor's Policy Enforcement Point (PEP) only works with that vendor's Policy Decision Point (PDP)

because of different ways in which clientless endpoints are handled.

In addition to these compatibility problems, clientless endpoints represent a security risk in many

environments because of the lack of identity and integrity information provided by the client.

Mechanisms such as RADIUS-based MAC authentication and Link Layer Discovery Protocol

(LLDP) can help classify clientless endpoints by function for authorization purposes; IF-MAP

enables a standard way to achieve much greater security than previously available for clientless

endpoints by incorporating information such as behavior, provisioning, etc. to infer an endpoint's

integrity. The Clientless Endpoint Support Profile (CESP) specifies how PEPs, PDPs, and other

TNC entities should handle clientless endpoints to ensure interoperability and enforce compliance

in environments where endpoints lack a TNC client.

This specification is integral to the TCG Trusted Network Communications Work Group’s (TNC)

reference architecture. Specifically, this specification defines a Clientless Endpoint Support Profile,

which is used to perform assessment and make access control decisions in the absence of a TNC

client on the endpoint.

Architects, designers, developers, and technologists interested in the development, deployment,

and interoperation of trusted systems will find this document necessary in providing a specific

mechanism for assessing endpoints without a TNC client. Before reading this document any further,

the reader should review and understand the TNC architecture as described in [1]. To understand

this specification, the reader should review and understand the TNC IF-MAP Binding for SOAP [4].

1.2 Keywords

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”,

“SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be

interpreted as described in RFC 2119 [2]. This specification does not distinguish blocks of

informative comments and normative requirements. Therefore, for the sake of clarity, note that

lower case instances of must, should, etc. do not indicate normative requirements.

Clientless Endpoint Support Profile TCG Copyright

Specification Version 1.0

Revision 14 Published Page 7 of 31

TCG PUBLISHED

2 Background

2.1 Role of the CESP

Many environments contain IP-enabled endpoints that either cannot run a TNCC (e.g. printers,

cameras, badge readers, etc.) or may not have a TNCC installed on them (e.g. guest laptops). This

document defines a method for enforcing network security policies on clientless endpoints.

The Clientless Endpoint Support Profile offers a reasonable way to handle clientless endpoints.

Network devices are designed to be flexible, providing many different types of policy and methods

for applying policy; however, this flexibility may also lead to complexity and inability to interoperate.

The CESP defines standard methods for handling clientless endpoints, which allows network

devices from many vendors to interoperate and provide a predictable set of functionality. A vendor

may offer functionality beyond what the CESP addresses; what the CESP provides is a standard

set of functionality that users can rely upon across all devices, without limiting vendor creativity.

This solution addresses a variety of environments, including - but not limited to - a standalone

switch or access point (AP) applying policy directly; a switch or AP that consults a policy server to

determine what policy to apply (and what happens if that policy server is unavailable); a policy

server that consults a Metadata Access Point (MAP) for available metadata to determine what

policy to apply; and modification of an initial policy decision based on information that becomes

available after the endpoint has connected to the network. In environments where a MAP is present,

the MAP Server is used to aggregate information about clientless endpoints, and PDPs may use

MAP data or static access control configuration to determine and apply permissible levels of access

control.

2.1.1 Role of the CESP in the TNC Architecture

The Clientless Endpoint Support Profile utilizes a subset of the standard TNC components to

provide a range of security measures for endpoints that, lacking a TNC client, would not otherwise

be addressed by the TNC architecture. The PDP may consist of NAA, TNCS, and IMV(s), but only

the NAA is utilized in this environment; likewise, the client may lack a TNCS and IMC(s) entirely, or

they may be present but unavailable for interrogation. Also, the PDP and PEP may be separate,

individual devices in the network (.e.g. a switch configured to consult a RADIUS server for MAC-

based authentication) or may be combined in a single network device (e.g. a switch automatically

assigning an unresponsive endpoint to a default guest VLAN).

PEP

Verifiers

Collector

Integrity

Measurement

Collectors

Integrity

Measurement

Verifiers

TNC

Client

Network

Access

Requestor

Network Access

Enforcer

Network Access

Authority

TNC

Server

PDP

Integrity

Measurement

Layer

Integrity

Evaluation

Layer

Network

Access

Layer

MAPC

MAP

Server

IF-MAP

MAP

Others

Sensors

Flow

Controllers

IF-MAP

Supplicant/

VPN Client, etc.

Edge Switch/

Access Firewall/

VPN Gateway

AAA Server

Metadata

Access Point

IDS, Interior

Firewalls, etc

IF-T

IF-PEP

IF-MAP

Figure 1 - Clientless Endpoint Support in the TNC Architecture

剩余30页未读，继续阅读

书香度年华

粉丝: 1w+
资源: 385

TPM支持的可信网络通信技术规范(TNC_CESP_v1.0r14)

"TPM技术规范TNC_IF-PEP-v1.1-rev-0.8.pdf解读

"基于TPM的可信网络连接技术规范：TNC IF-T绑定到TLS规范V2.0

"TPM基于的TNC IF-M技术规范v1.0r41-a详解

TNC_Federated_TNC_v1.0-r27.pdf

CoreIntegrity_Schema_Specification_v2.0.r5.pdf

Reference_Manifest_Schema_Specification_v2.0.r5.pdf

IWG_Integrity_Report_Schema_v2.0.r5.pdf

TNC_IFMAP_v2_2r10.pdf

TNC_IFMAP_Metadata_For_Network_Security_v1_1r9.pdf

TNC_SCAP_Integration-Whitepaper_09272010.pdf

最新资源