116
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
7.0 APPENDIX C – INTEGRITY MEASUREMENT
AUTHORITY (IMA)
Understanding
The MCR supports the integrity measurement and attestation architecture as described by Trusted
Network Connect (TNC) specifications, jointly developed and published by Trusted Computing Group
(TCG) and IETF NEA working group.
The MCR establishes secure IPsec VPN connection with the VPN gateway via mutual authentication
based on certificates or pre-shared secrets. The TNC architecture adds the ability to measure, report
and verify the security state of the MCR (e.g. integrity of critical system configuration file) as a part of
IPsec VPN authentication and authorization process.
MCR supports TNCCS 2.0 protocol and subset of TCG’s Platform trust Service (PTS). The MCR supports
only file measurement capability of the PTS protocol. Also, only measurements for following files are
supported:
1.
/tmp/system.config
- This file includes all current system configuration.
2.
/etc/tnc_config
Once the unit has been configured, the hash (sha256 or sha385) of system configuration file can be
obtained via CLI (locally or remotely) and loaded into the Integrity Measurement Authority (IMA)
database.
Typically, integrity measurement and attestation happens automatically as part of IPsec VPN “data”
connection establishment using EAP-TTLS method (and EAP-TNC authentication within it) as
instructed by the VPN-gateway. However, MCR also supports an out-of-band IMA connection, where
the unit connects to a separate IMA server not to pass data but just to perform integrity measurement
and attestation. The IMA server, in such a setup, can then publish the unit’s “health” information to the
VPN server that is terminating the actual data connections. This allows VPN server to enforce
permit/deny policy for incoming VPN data connections from the unit.
Configuring
The out of band IMA configuration is exactly similar to VPN configuration described in VPN section
except that the IPsec connection is designated specifically as out-of-band IMA connection and local
and remote ip subnet are all set 0.0.0.0/0 as shown below:
admin@(none) 21:51:32> admin@(none) 19:33:29% set services vpn ipsec connections connection
IMA-CONN-1 is-out-of-band-ima true
admin@(none) 21:51:32> admin@(none) 19:33:29% set services vpn ipsec connections connection
IMA-CONN-1 local-ip-subnet 0.0.0.0/0
admin@(none) 21:51:32> admin@(none) 19:33:29% set services vpn ipsec connections connection
IMA-CONN-1 remote-ip-subnet 0.0.0.0/0
