Subject: ISCSI: User authentication vs. Machine Authentication for iSCSI

From: "Bill Strahm" <[email-masked]>
Date: Wed, 29 Aug 2001 08:40:54 -0700

I have been fighting with this problem since I left LA.

I am not aware of any usage scenarios today where block devices are owned by
the user rather than the machine.  I will conceed that in many instances the
first thing the system does is assign the resource to a use (tape, scanner,
etc.) but the machine still owns the resource and can in fact remove it out
from under the user...

I am not to certain how I could build a trusted iSCSI environment where one
user would have no knowledge about what was happening with other users in a
malicious environment (especially where a system was participating in the
exposure of resourses).  Examples of this include things like co-located Web
hosting where a single user scans process memory looking for 1Kbit of random
data, and when finding it attempts to determine if that is the private key
of a user sharing the resource.

The reason I am bringing this up, is I am not sure trying to define security
above the machine level makes any sense for iSCSI.  Aren't most SCSI devices
owned by the Operating System not the User and partitioned out by the
Operating System to the users ?  If this is the case many of our
authentication methods simplify to simple IKE identities.

Bill

---

From: Mark Bakke <[email-masked]>
Date: Wed, 29 Aug 2001 16:05:54 -0500

> authentication methods simplify to simple IKE identities.

Bill-

As you pointed out, there is a case where just using IKE with
an iSCSI AuthMethod of "none" is valid.  That case is where:

- There a one-to-one correspondence between an initiator and an
  operating system
- IPsec is being used for all iSCSI traffic
- The customer is willing to deploy public key certificates on the
  client side (for each initiator) as well as on the devices

If all of the above are true, iSCSI can certainly use an AuthMethod
of none, and be done with it.

However,

- There are cases (David Black brought up some tape applications) where
  more than one initiator might exist on an operating system

- IPsec is not likely to be used for a large percentage of iSCSI
  traffic any time soon

- When IPsec is used, many customers will have an easier time with the
  familiar model of authenticating the server "machine" but using a
  dummy certificate for the client.

If any of the above are true, iSCSI-level of authentication is
required.

Hope this helps,

Mark

---

From: "Bill Strahm" <[email-masked]>
Date: Wed, 29 Aug 2001 14:23:20 -0700

I am not sure that helped.  Again, the model of a Tape drive...

The user does not own the tape drive, the operating system owns the tape
drive, when I (as a user) wants to use the tape drive, I ask the operating
system, it grants me access, and I go on.

In fact from a purely SCSI level, I do not believe there is any concept of a
user at all, the Operating system on the device provides the concept of a
user through the OS abstraction layer.

The problem that I am having is that I do not see how I can make user
security work through the OS abstraction.  And if the OS HAS to know about
the multiple users, I now have to trust the OS as well, which means that
effectively I have one user on the machine anyway...

Bill

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, August 29, 2001 2:06 PM
To: Bill Strahm
Cc: Ips@Ece. Cmu. Edu
Subject: Re: ISCSI: User authentication vs. Machine Authentication for
iSCSI

Bill-

However,

Hope this helps,

Mark