COPS Common Open Policy Services Protocol IETF RFC 2748, 2749, 2753, 3084 Diana Rawlins WorldCom

16 May 2001Diana Rawlins WorldCom 2 COPS–PR Features Straightforward and reliable Enforces an authoritative source of provisioning management Operational integrity Rich set of atomic transaction capabilities Usage feedback Efficient, flexible and extensible

16 May 2001Diana Rawlins WorldCom 3 IETF Policy Framework DIR PDP PEP PDP PEP COPS PEP LDAP

16 May 2001Diana Rawlins WorldCom 4 Straightforward Compact & flexible object oriented operation set Reliable - persistent, TCP based connection PEPPDP Request Decision Report PEPPDP Open Client Type Connection Client Connection Accept

16 May 2001Diana Rawlins WorldCom 5 Authoritative provisioning source PEP restricted to one connection per client type A single point of provisioning enforces access control to device policies  Know who is doing what

16 May 2001Diana Rawlins WorldCom 6 Integrity COPS Integrity object Digest based authentication Sequencing prevents replay attack COPS usage with TLS work underway

16 May 2001Diana Rawlins WorldCom 7 Rich transaction set Multiple, interdependent, policies described efficiently in a single Decision operation Decision operation contains 1 to n policy instances Policy instances are constructed using –Single row (series of columnar attributes) –Inter-table row relationships Atomic transaction  All succeed or all fail Rollback to previous state Efficient use of resources

16 May 2001Diana Rawlins WorldCom 8 Policy Usage feedback Deterministic feedback of policy usage –Periodic or solicited Installed policies define monitoring characteristics and define reporting intervals Feedback supplied in Report operation –Type Success / failure –Accounting Type – provides policy usage feedback

16 May 2001Diana Rawlins WorldCom 9 Flexible and extensible Multiple capabilities with Decision operation –Policy installation –Remove policy – single instance, wildcard per class or entire policy state associated with request –Context switching – switch potentially large policy sets with compact and concise instruction Client Specific Interface object – clientSI –Define objects for new client types Supports Policy Information Base (PIB) extensions and deprecations –Subject categories distinguish the types of policy

16 May 2001Diana Rawlins WorldCom 10 Failover PEP uses cached policies for adjudication –Based on configured time period Upon re-establishment of connection, the PDP may issue Synchronize State Request message –solicit from PEP its cached policy and synchronize with the cached policy

16 May 2001Diana Rawlins WorldCom 11 Wrap COPS supports a rich set of both static and dynamic policies Is efficient with network, computing and engineering development resources Permits the focus to be on constructing and maintaining network policy