Overview What are the provisioning methods used in the Australian registry system? How are these provisioning systems secured?

What are the provisioning methods used in the Australian registry systems?

The Key points: Object model Web based interface Socket based interface (EPP)

The Object Model Registrars – Registrar name, address, telephone Contacts – contact name, organisation, address, telephone, fax, Hosts – host name, IP address Domains – domain name, name servers, subordinate hosts, associated contacts

Object State - Status Objects maintain status Available statuses include: client/server – approved, cancelled, deleteProhibited, hold, rejected, renewProhibited, transferProhibited, updateProhibited inactive, linked, ok, pending pending – delete, transfer, verification

Web Based Interface Encrypted and secured using HTTPS(SSL) Good for small volumes Contains most features Limited technical knowledge Standard Web based forms – like objects

Socket Interface IETF EPP Protocol Extensible and Customisable SSL Encryption Full Automation Good for high volumes

EPP in detail An XML based protocol Full W3C compliant XML schema definition Makes use of XML namespaces Extensibility UTF - Internationalisation Manipulate all properties of objects Transport independent

Typical EPP command XML Header EPP Namespace EPP Command Object Specific Namespace Object Specific Information EPP Transaction ID

Typical EPP response XML Header EPP Namespace EPP Response Object Specific Namespace Object Specific Information EPP Transaction IDs EPP Response Code EPP Response Message

EPP Commands Hello and Greeting Login and Logout Check and Info Create, Modify and Delete Transfer (request, cancel and approve) Poll Status

Hello and Greeting Used to establish presence and server capabilities Client says “Hello” Server replies with its capabilities, current time and policies in effect. Sent as soon as transport session established

Login and Logout Used to start and stop session based communications Username and password Objects to be managed in that session Client can request policies to be used during that session Credentials used in the login are assumed for all following transactions in the established session

Check and Info Used to view information on objects in the registry database Check availability of objects e.g. Domains Names Retrieve the properties of objects you sponsor Retrieve information on other objects using the “authinfo”

Create, Modify and Delete Used to manipulate objects in the registry database Create new objects (Domains, Contacts and Hosts) Creating registrar becomes “sponsor” of object Modify details of existing objects that logged in registrar currently “sponsors” Delete objects, objects may fall into a pending delete status depending on policies in effect

Transfer (request, cancel and approve) Transfer of objects (Domains and Contacts) Gaining Registrar requests transfer from another Registrar Losing Registrar can approve or reject the transfer depending on policy Transfers will be server approved after a timeout period

Poll Used to check the server message queue Low balance messages Transfer request messages Expiry messages Used to acknowledge receipt of messages Also used to keep sessions active

Status Commands are atomic i.e. succeed or fail Can look up a command by transaction ID and find out if it succeeded or failed Can get details of previous command

Advantages of using EPP Industry standard - IETF Extensible - will support modifications or fit policy Vast array of toolkits available Well-defined atomic operation Full Automation

Example of Extensibility NAPTR records in domain create command

How are these provisioning systems secured?

Security viewed on three Levels Security of systems Authentication of Registrars (Tier 2) Authentication of Registrants

Security of systems Physical Security Firewalls – Authorised IPs only Security Policies Data

Registrar Authentication 3 Layers Secure Certificate Signed by AusRegistry Access given only to Registrar IP address range EPP Credentials (Username and Password)

Registrar Authentication Certificate Common name must match Username Username must match IP addresses being used Certificate must match IP address range Can’t use someone else’s certificate from your addresses

Registrant Authentication All domains contain “authinfo” field (domain password) “authinfo” is required to perform operations on domain, especially transfers Exactly how this is implemented is based on policy

Questions?

Thank you