TNC IF-M: TLV Binding TCG Copyright 2005-2014
Specification Version 1.0
Revision 41 Published Page 9 of 49
TCG Published
2 Background
2.1 Purpose of IF-M
This document describes and specifies IF-M, an application level protocol capable of carrying Integrity
Check Handshake messages between the Integrity Measurement Collectors (IMCs) on the TNC Client and
the Integrity Measurement Verifiers (IMVs) on the TNC Server. IF-M is a multiple roundtrip messaging
protocol that enables IMC(s) to send measurement information about local components on the endpoint to
IMV(s) for evaluation against network security policy. The IMV(s) can respond using IF-M messages with
additional requests for measurement data or optionally with its IMV Action Recommendation. The decision
might also include a set of remediation instructions that the IMC could perform to bring its associated
component into compliance with the IMV’s policy.
The IF-M protocol is carried over the network by the IF-TNCCS protocol [IF-TNCCS][IF-TNCCS-SOH]. The
TNC Client and Server pass the received IF-M messages to the appropriate set of IMCs and IMVs using the
respective IF-IMC[IF-IMC] and IF-IMV[IF-IMV] APIs.
This specification defines the standard IF-M messages that can be used to enable interoperability between
an IMC from one vendor and an IMV from another vendor. However, these messages are only a subset of
the broader IF-M protocol. For years prior to the IF-M specification, IMC and IMV vendors have been
employing vendor-defined IF-M messages to communicate between their IMCs and IMVs. It is expected
that in the future a mixture of vendor-defined IF-M messages and standard IF-M messages may be
employed to provide the best of both worlds: interoperability between IMCs and IMVs from different vendors
and the tight integration that vendor-specific IF-M messages provide.
IF-M is a robust, extensible protocol capable of exchanging sets of attributes between zero or more
subscribed IMCs and IMVs. This specification includes the definition of the message protocol and a partial
set of standard attributes that are expected to have general applicability to different types of components
(e.g. version information). IF-M attribute name space is extensible allowing for vendor-defined attributes to
be established that convey product specific information and to allow for additional standard attributes to be
defined in future specifications as more deployment experience becomes available.
2.2 Supported Use Cases
This section describes the IF-M use cases that must be supported. In order to focus on the protocol
interactions, these use cases do not describe what triggered the assessment to occur. Thus it’s expected
that each use case is able to work regardless of what triggers the TNCC or TNCS to start the assessment.
For example, such triggers include: an endpoint initially joining the network, a change to an endpoint or a
significant event on the endpoint, the TNCS’s policy change or the TNCS receiving notice of a significant
event. Each type of trigger must be able to cause an assessment to occur even if a prior assessment of the
endpoint has already occurred. In each case, the following use case message exchanges must be
supported.
2.2.1 TNCC Initiated Assessment Use Case
1) TNCC determines that an assessment of the endpoint is required. This might occur if the TNCC becomes
aware that the endpoint is trying to access an 802.1X protected network.
2) TNCC invokes one or more IMCs to send measurement information to their corresponding IMVs on the
TNCS. Each IMC consults its policy and could choose to:
a) Send nothing, if unwilling or unable to participate
b) Send a hello message indicating its availability to respond to requests
c) Send a subset of the measurements it’s able to collect
d) Send all of its collected measurements
e) Send previously received and cached assertion attributes
剩余48页未读，继续阅读
书香度年华
- 粉丝: 1w+
- 资源: 383
我的内容管理
展开
最新资源
- Hadoop生态系统与MapReduce详解
- MDS系列三相整流桥模块技术规格与特性
- MFC编程：指针与句柄获取全面解析
- LM06：多模4G高速数据模块，支持GSM至TD-LTE
- 使用Gradle与Nexus构建私有仓库
- JAVA编程规范指南：命名规则与文件样式
- EMC VNX5500 存储系统日常维护指南
- 大数据驱动的互联网用户体验深度管理策略
- 改进型Booth算法：32位浮点阵列乘法器的高速设计与算法比较
- H3CNE网络认证重点知识整理
- Linux环境下MongoDB的详细安装教程
- 压缩文法的等价变换与多余规则删除
- BRMS入门指南：JBOSS安装与基础操作详解
- Win7环境下Android开发环境配置全攻略
- SHT10 C语言程序与LCD1602显示实例及精度校准
- 反垃圾邮件技术：现状与前景
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
