1. SNIA/SSIF KMIP Interoperability Proposal

2. What is the proposal? Host a KMIP interoperability program which includes: – Publishing a set of interoperability tests – Maintaining a site with KMIP server implementation (s) to test against – Maintaining a web site with a list of members and results from the KMIP interoperability testing – Making a portion of the web site available to each member to publish more documentation on their KMIP implementation with pointers back to their own web sites

3. What does it mean to be included? Documented results of at a minimum a vendor’s KMIP client interaction with a KMIP server implementation Document test results Document how to configure diagnostics to trouble shoot a configuration Document release levels tested Focus is on providing material for vendor support organizations

4. What we are not focusing on: Formal certification Validation of KMIP implementation internal operations Claims of security or function outside of the KMIP specification

5. Levels of Interoperability Testing New specification items - pre-finalization of the specification proposals / updates We are suggesting that this is handled through the KMIP interop process we have been using currently With agreed to KMIP specifications and profiles We are suggesting hosting server implementations and clients in a neutral hosting facility Interoperability lab testing has multiple phases: Private testing – used during development or validation - confidential Public testing – once interoperability and meeting conformance is achieved then a documented public test to demonstrate Formal compliance testing – branding and versioning

6. New protocol elements and versions Current team for interop has successfully gotten to a agreed to specification Rough consensus and working code Validate that new proposals do not have implementation challenges Challenges with this approach for other purposes: Bilateral configurations for testing Each company has to host servers outside the corporate network Not public – can not point customers to a site that shows interoperability results As companies ship products they want demonstrated interoperability against know versions of products

7. Private testing in a hosted interoperability lab Clients or servers schedule testing Estimate of a month for a client Hosting environment needs to : set up ids for firewall traversal Ids to get read only access to server logs Scheduling of testing windows Opportunity for clients to validate their implementations in private Clients get access to server logs and diagnostic and error reporting for trouble shooting Testing is private and confidential

8. Public testing in a hosted interoperability lab Hosted environment for: KMIP servers KMIP client test harness Clients declare readiness to run public test Moderated test Captures logs Reviews conformance to stated specification and profile Success is declared

9. Public web site Lists products that have completed interoperability testing Product identification with versions KMIP specification level and profile(s) supported Description of the usage model Configuration example Logs documenting the results Diagnostics and documentation links to the vendor site

10. How to fund the interoperability lab Web site Describes tests Describes program and how to join Publishes implementations that have passed interoperability testing Server implementations Cost for hosting of physical or virtual server Client implementations Cost for 2 months per year of testing Web site for documenting results Contractor resources Manage hosted resources Schedule testing Committee Defines test cases Reviews and approves test results

11. SSIF Tutorials White Papers Articles Solutions Guides Best Current Practices Creating, Publishing and Presenting S torage S ecurity I ndustry F orum Join the SSIF and help lead the way to a better understanding of storage security.

12. What are the costs? SNIA/SSIF membership – $5000 for > $50 million company – $1000 for < $50 million company – Non-storage centric restriction SNIA/SSIF will maintain – Interop test site – Web site for interop results – Meet regularly to review interop results – Meet infrequently to update interop tests – Provide marketing presence for member companies to point to 3 rd party KMIP validation