SNMPV 3

SNMPv3
 OVERVIEW:
 DESIGN DECISIONS
 ARCHITECTURE
 SNMP MESSAGE STRUCTURE
 SECURE COMMUNICATION
 USER SECURITY MODEL (USM)
 IMPLEMENTATIONS
DESIGN DECISIONS
 Address the need for secury set support

 Define an architecture that allows for longevity of snmp
 Allow that different portions of the architecture
 Move at different speeds towards standard status
 Allow for future extensions
 Keep snmp as simple as possible
 Allow for minimal implementations
 Support also the more complex features,
 Which are required in large networks
 Re-use existing specifications, whenever possible
SNMPv3 ARCHITECTURE
SNMP ENTITY
SNMP APPLICATIONS
COMMAND COMMAND NOTIFICATION NOTIFICATION PROXY

GENERATOR RESPONDER ORIGINATOR RECEIVER FORWARDER
OTHER
OTHER
SNMP ENGINE
MESSAGE PROCESSING SECURITY ACCESS CONTROL

DISPATCHER
SUBSYSTEM SUBSYSTEM SUBSYSTEM
SNMPv3 ARCHITECTURE: MANAGER
COMMAND NOTIFICATION
GENERATOR RECEIVER
PDU MESSAGE PROCESSING SECURITY SUBSYSTEM

DISPATCHER SUBSYSTEM
SNMPv1 COMMUNITY BASED

SECURITY MODEL
MESSAGE
DISPATCHER SNMPv2C
USER BASED
SECURITY MODEL
SNMPv3
OTHER
TRANSPORT SECURITY MODEL
OTHER
MAPPINGS
SNMPv3 ARCHITECTURE: AGENT
MANAGEMENT INFORMATION BASE
ACCESS CONTROL SUBSYSTEM

COMMAND VIEW BASED
NOTIFICATION
RESPONDER ACCESS CONTROL
ORIGINATOR
PDU MESSAGE PROCESSING SECURITY SUBSYSTEM

DISPATCHER SUBSYSTEM
SNMPv1 COMMUNITY BASED

SECURITY MODEL
MESSAGE
DISPATCHER SNMPv2C
USER BASED
SECURITY MODEL
SNMPv3
OTHER
TRANSPORT SECURITY MODEL
MAPPINGS OTHER
CONCEPTS: snmpEngineID
SNMP ENTITY
OT HE R
SNMP ENGINE
snmpEngineID=1
SNMP ENTITY
O TH ER
SNMP ENGINE
snmpEngineID=2
SNMP ENTITY
SNMP ENTITY
O TH ER
O TH ER
SNMP ENGINE
SNMP ENGINE snmpEngineID=4
snmpEngineID=3
CONCEPTS: Context
contextName=card1 contextName=card2
SNMP ENTITY MIB MIB

COMMAND RESPONDER APPLICATION
OTHER
SNMP ENGINE
snmpEngineID=1
The context can be reached from this engine, thus:

contextEngineID=1
PRIMITIVES BETWEEN MODULES
Parameters
contextEngineID
contextName
destTransportAddress
APPLICATIONS APPLICATIONS destTransportDomain
expectResponse
globalData
maxMessageSize
maxSizeResponseScopedPDU
messageProcessingModel
ACCESS ACCESS outgoingMessage
CONTROL CONTROL outgoingMessageLength
SUBSYSTEM SUBSYSTEM PDU
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
DISPATCHER DISPATCHER statusInformation
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
MESSAGE MESSAGE securityParameters
PROCESSING PROCESSING securityStateReference
SUBSYSTEM SUBSYSTEM sendPduHandle
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
sendPdu
Parameters
contextEngineID
contextName
expectResponse
globalData
sendPdu maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
prepareOutgoingMessage
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
prepareOutgoingMessage viewType
wholeMsg
wholeMsgLength
generateRequestMsg
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
generateRequestMsg viewType
wholeMsg
wholeMsgLength
send / receive
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
send and receive wholeMsg
wholeMsgLength
prepareDataElements
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
prepareDataElements viewType
wholeMsg
wholeMsgLength
processIncomingMsg
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
processIncomingMsg viewType
wholeMsg
wholeMsgLength
processPd
Parameters
contextEngineID
contextName
expectResponse
globalData
processPdu maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
isAccessAllowed
Parameters
contextEngineID
contextName
expectResponse
globalData
isAccessAllowed maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
returnResponsePdu
Parameters
contextEngineID
contextName
expectResponse
globalData
returnResponsePdu maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
prepareResponseMessage
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
prepareResponseMessage viewType
wholeMsg
wholeMsgLength
generateResponseMsg
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
generateResponseMsg viewType
wholeMsg
wholeMsgLength
send / receive
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
send and receive wholeMsg
wholeMsgLength
prepareDataElements
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
prepareDataElements viewType
wholeMsg
wholeMsgLength
processIncomingMsg
Parameters
contextEngineID
contextName
expectResponse
globalData
maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
processIncomingMsg viewType
wholeMsg
wholeMsgLength
processResponsePdu
Parameters
contextEngineID
contextName
expectResponse
globalData
processResponsePdu maxMessageSize
pduType
pduVersion
scopedPDU
stateReference
SECURITY SECURITY
SUBSYSTEM SUBSYSTEM
securityEngineID
securityLevel
securityModel
securityName
transportAddress
transportDomain
variableName
viewType
wholeMsg
wholeMsgLength
MODULES OF THE SNMPv3 ARCHITECTURE
 DISPATCHER AND MESSAGE PROCESSING MODULE
 • SNMPv3 MESSAGE STRUCTURE
 • snmpMPDMIB
 • RFC 2572
 APPLICATIONS
 • snmpTargetMIB
 • snmpNotificationMIB
 • snmpProxyMIB
 • RFC 2573
 SECURITY SUBSYSTEM
 • USER BASED SECURITY MODEL
 • snmpUsmMIB
 • RFC 2574
 ACCESS CONTROL SUBSYSTEM

 • VIEW BASED ACCESS CONTROL MODEL
 • snmpVacmMIB
 • RFC 2575
SNMPv3 MESSAGE STRUCTURE
msgVersion USED BY MESSAGE PROCESSING SUBSYSTEM
msgID
msgMaxSize
msgFlags USED BY SNMPv3 PROCESSING MODULE
msgSecurityModel
msgSecurityParameters USED BY SECURITY SUBSYSTEM
contextEngineID
contextName
USED BY ACCESS CONTROL SUBSYSTEM

AND APPLICATIONS
PDU
SNMPv3 PROCESSING MODULE PARAMETERS
msgVersion
0..2147483647
msgID
msgMaxSize 484..2147483647
msgFlags
msgSecurityModel authFlag
privFlag
reportableFlag
msgSecurityParameters SNMPv1
SNMPv2c
USM
contextEngineID
contextName
PDU
SECURE COMMUNICATION VERSUS ACCESS CONTROL
MANAGER AGENT
MIB
ACCESS CONTROL
MANAGER
APPLICATION PROCESSES
SECURE COMMUNICATION
GET / GET-NEXT / GETBULK

SET / TRAP / INFORM
TRANSPORT SERVICE
USM: SECURITY THREATS
THREAT ADDRESSED? MECHANISM
REPLAY YES TIME STAMP
MASQUERADE YES MD5 / SHA-1
INTEGRITY YES (MD5 / SHA-1)
DISCLOSURE YES DES
DENIAL OF SERVICE YES
TRAFFIC ANALYSIS YES

USM MESSAGE STRUCTURE
msgVersion
msgID
msgMaxSize
msgFlags
msgSecurityModel
REPLAY
msgAuthoritativeEngineID
msgAuthoritativeEngineBoots
msgAuthoritativeEngineTime
MASQUERADE/INTEGRITY/DISCLOSURE
msgUserName
msgAuthenticationParameters MASQUERADE/INTEGRITY
msgPrivacyParameters
contextEngineID DISCLOSURE
contextName
PDU
IDEA BEHIND REPLAY PROTECTION
Nonauthoritative Engine Authoritative Engine
LOCAL NOTION OF ALLOWED LOCAL

REMOTE CLOCK LIFETIME CLOCK
+ >?
ID BOOTS TIME DATA ID BOOTS TIME DATA

IDEA BEHIND DATA INTEGRITY AND AUTHENTICATION
KEY DATA
HASH FUNCTION
MAC
ADD THE MESSAGE AUTHENTICATION CODE (MAC) TO THE DATA

AND SEND THE RESULT
IDEA BEHIND AUTHENTICATION
KEY DATA KEY DATA
HASH FUNCTION HASH FUNCTION
MAC
MAC
=?
USER MAC DATA USER MAC DATA

IDEA BEHIND THE DATA CONFIDENTIALITY (DES)
DES-KEY DATA
DES ALGORITHM
ENCRYPTED DATA
IDEA BEHIND ENCRYPTION
DES-KEY DATA DES-KEY DATA
DES ALGORITHM DES ALGORITHM
ENCRYPTED DATA ENCRYPTED DATA
USER ENCRYPTED DATA USER ENCRYPTED DATA

Thank You !!!

SNMPV 3

Uploaded by

Copyright:

Available Formats

SNMPV 3

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SNMPV 3

Uploaded by

Copyright:

Available Formats

SNMPv3

 SNMP MESSAGE STRUCTURE

 Address the need for secury set support

COMMAND COMMAND NOTIFICATION NOTIFICATION PROXY

MESSAGE PROCESSING SECURITY ACCESS CONTROL

PDU MESSAGE PROCESSING SECURITY SUBSYSTEM

SNMPv1 COMMUNITY BASED

MANAGEMENT INFORMATION BASE

ACCESS CONTROL SUBSYSTEM

PDU MESSAGE PROCESSING SECURITY SUBSYSTEM

SNMPv1 COMMUNITY BASED

SNMP ENTITY MIB MIB

The context can be reached from this engine, thus:

 ACCESS CONTROL SUBSYSTEM

msgSecurityParameters USED BY SECURITY SUBSYSTEM

USED BY ACCESS CONTROL SUBSYSTEM

GET / GET-NEXT / GETBULK

THREAT ADDRESSED? MECHANISM

REPLAY YES TIME STAMP

MASQUERADE YES MD5 / SHA-1

INTEGRITY YES (MD5 / SHA-1)

DISCLOSURE YES DES

DENIAL OF SERVICE YES

TRAFFIC ANALYSIS YES

Nonauthoritative Engine Authoritative Engine

LOCAL NOTION OF ALLOWED LOCAL

ID BOOTS TIME DATA ID BOOTS TIME DATA

ADD THE MESSAGE AUTHENTICATION CODE (MAC) TO THE DATA

KEY DATA KEY DATA

HASH FUNCTION HASH FUNCTION

USER MAC DATA USER MAC DATA

DES-KEY DATA DES-KEY DATA

DES ALGORITHM DES ALGORITHM

ENCRYPTED DATA ENCRYPTED DATA

USER ENCRYPTED DATA USER ENCRYPTED DATA

You might also like