GE MDS ORBIT ECR, Technical Manual

Page: 408 / 463

408 MDS Orbit MCR/ECR Technical Manual MDS 05-6632A01, Rev. F
7.0 APPENDIX B
– Integrity Measurement Authority
(IMA)
7.1 Understanding
The MCR supports the integrity measurement and attestation architecture as described by Trusted
Network Connect (TNC) specifications, jointly developed and published by Trusted Computing Group
(TCG) and IETF NEA working group.
The MCR establishes secure IPsec VPN connection with the VPN gateway via mutual authentication
based on certificates or pre-shared secrets. The TNC architecture adds the ability to measure, report and
verify the security state of the MCR (e.g. integrity of critical system configuration file) as a part of IPsec
VPN authentication and authorization process.
MCR supports TNCCS 2.0 protocol and subset of TCG’s Platform trust Service (PTS). The MCR
supports only file measurement capability of the PTS protocol. Also, only measurements for following
files are supported:

/tmp/system.config - This file includes all current system configuration.

/etc/tnc_config
Once the unit has been configured, the hash (sha256 or sha385) of system configuration file can be
obtained via CLI (locally or remotely) and loaded into the Integrity Measurement Authority (IMA)
database.
Typically, integrity measurement and attestation happens automatically as part of IPsec VPN “data”
connection establishment using EAP-TTLS method (and EAP-TNC authentication within it) as instructed
by the VPN-gateway. However, MCR also supports an out-of-band IMA connection, where the unit
connects to a separate IMA server not to pass data but just to perform integrity measurement and
attestation. The IMA server, in such a setup, can then publish the unit’s “health” information to the VPN
server that is terminating the actual data connections. This allows VPN server to enforce permit/deny
policy for incoming VPN data connections from the unit.
7.2 Configuring
The out of band IMA configuration is exactly similar to VPN configuration described in VPN section
except that the IPsec connection is designated specifically as out-of-band IMA connection and local and
remote ip subnet are all set 0.0.0.0/0 as shown below:
% set services vpn ipsec connection IMA-CONN-1 is-out-of-band-ima true
% set services vpn ipsec connection IMA-CONN-1 local-ip-subnet 0.0.0.0/0
% set services vpn ipsec connection IMA-CONN-1 remote-ip-subnet 0.0.0.0/0
% set services vpn ipsec connection IMA-CONN-1 periodic-retry-interval 60
The “periodic-retry-interval” applies only to the IPsec connection designated as an “out-of-band” IMA
connection. The MCR attempts attestation every “periodic-retry-interval” if the previous attempt to
connect with IMA server was unsuccessful.
In case of an out of band IMA server setup, the MCR needs to be configured with an IMA IPsec
connection and a VPN-GWY IPsec connection. An example follows:
connection IMA-CONN-1 {
ike-peer IMA-SERVER;
ipsec-policy IPSEC-POLICY-IMA;
local-ip-subnet 0.0.0.0/0;
remote-ip-subnet 0.0.0.0/0;
is-out-of-band-ima true;