RFC 6045

Real-time Inter-network Defense (RID) 🦋

Okay bestie, this is Part 1 of 16 so buckle up 🎀

• Who wrote it: K. Moriarty from EMC, published under the Internet Engineering Task Force (IETF) 💖
• Category: Informational, so this is a "here's how it works" doc and not a mandatory standard 📚
• Date: November 2010 🍓
• Number: RFC 6045, with ISSN 2070-1721 ✨
• Obsoletes / Updates: The title block doesn't list any RFCs that this one obsoletes or updates, so there's nothing extra to chase there 💅

Abstract

okay so network security incidents are the absolute worst 😭 we're talking system compromises, worms, viruses, phishing, and denial of service attacks, and they usually leave behind lost service, lost data, and lost resources, both for the humans and the systems involved 💀

that's why network providers and Computer Security Incident Response Teams (CSIRTs) need to be ready to help communicate and trace incidents. the tools and procedures need to be set up before an attack happens, not during the chaos 🫶

so Real-time Inter-network Defense (RID) is a proactive way for networks to talk to each other and share incident handling data. it doesn't replace existing detection, tracing, source identification, and mitigation mechanisms. instead it plugs into them so you get a complete incident handling solution 🔥

putting all of these capabilities into one communication system gets you higher security levels on networks, which is giving main character energy ✨ policy guidelines for handling incidents are recommended, and a consortium can agree on them using the security recommendations and considerations in the document 🌈

RID has been used by international research communities but hasn't really been adopted anywhere else yet 🧚 this publication gives the specification to the communities that already use it, and to communities that are looking into real-time inter-network defense solutions. it may also speed up solutions that need different transports or message formats, since they can reuse the data elements and structures specified here 💜

Status of This Memo

this document is not an Internet Standards Track specification. it's published for informational purposes 📖

it is a product of the IETF and represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). not every document the IESG approves is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you want the details 🙈

for info on the current status of this document, any errata, and how to give feedback, head to http://www.rfc-editor.org/info/rfc6045 🦋

Copyright Notice

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. 💅

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can read at http://trustee.ietf.org/license-info. those are the versions in effect on the publication date. please read them carefully, because they explain your rights and restrictions for this document 🎀

if you pull Code Components out of this document, they must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. they come without warranty, as described in the Simplified BSD License 🫶

Table of Contents

   1. Introduction ....................................................4
      1.1. Normative and Informative ..................................6
      1.2. Terminology ................................................6
      1.3. Attack Types and RID Messaging .............................6
   2. RID Integration with Network Provider Technologies ..............8
   3. Characteristics of Attacks ......................................9
      3.1. Integrating Trace Approaches ..............................11
      3.2. Superset of Packet Information for Traces .................11
   4. Communication between Network Providers ........................12
      4.1. Inter-Network Provider RID Messaging ......................14
      4.2. RID Network Topology ......................................16
      4.3. Message Formats ...........................................17
           4.3.1. RID Data Types .....................................17
                  4.3.1.1. Boolean ...................................17
           4.3.2. RID Messages and Transport .........................18
           4.3.3. IODEF-RID Schema ...................................19
                  4.3.3.1. RequestStatus Class .......................21
                  4.3.3.2. IncidentSource Class ......................23
                  4.3.3.3. RIDPolicy Class ...........................24
           4.3.4. RID Namespace ......................................29
      4.4. RID Messages ..............................................29
           4.4.1. TraceRequest .......................................29
           4.4.2. RequestAuthorization ...............................30
           4.4.3. Result .............................................31
           4.4.4. Investigation Request ..............................33
           4.4.5. Report .............................................35
           4.4.6. IncidentQuery ......................................36
      4.5. RID Communication Exchanges ...............................37
           4.5.1. Upstream Trace Communication Flow ..................39
                  4.5.1.1. RID TraceRequest Example ..................40
                  4.5.1.2. RequestAuthorization Message Example ......44
                  4.5.1.3. Result Message Example ....................44
           4.5.2. Investigation Request Communication Flow ...........47
                  4.5.2.1. Investigation Request Example .............48
                  4.5.2.2. RequestAuthorization Message Example ......50
           4.5.3. Report Communication ...............................51
                  4.5.3.1. Report Example ............................51
           4.5.4. IncidentQuery Communication Flow ...................54
                  4.5.4.1. IncidentQuery Example .....................54
   5. RID Schema Definition ..........................................55
   6. Security Considerations ........................................60
      6.1. Message Transport .........................................62
      6.2. Message Delivery Protocol - Integrity and Authentication ..63
      6.3. Transport Communication ...................................63
      6.4. Authentication of RID Protocol ............................64
           6.4.1. Multi-Hop TraceRequest Authentication ..............65
      6.5. Consortiums and Public Key Infrastructures ................66
      6.6. Privacy Concerns and System Use Guidelines ................67
   7. IANA Considerations ............................................72
   8. Summary ........................................................72
   9. References .....................................................73
      9.1. Normative References ......................................73
      9.2. Informative References ....................................74
   Acknowledgements ..................................................75
   Sponsor Information ...............................................75

bestie, the table of contents is the map for the next 15 parts 🗺️✨ Part 2 is next, and it starts with Section 1, Introduction 💖

1. Introduction ✨

okay so bestie, incident handling is basically the whole detective squad 🕵️‍♀️💅. It covers detecting, reporting, identifying, and mitigating an attack, whether that's a system compromise, a socially engineered phishing attack, or a denial-of-service (DoS) attack 😭. When something gets detected, the response could be as simple as filing a report, notifying the source of the attack, requesting mitigation, or requesting that someone locate the source 🔍. The hardest case is when nobody knows where the attack is coming from. Then you have to trace the attack traffic iteratively upstream through the network, so that any further actions can happen 🌊. If there are accurate records of an active session between the victim system and the attacker or source system, the source is easy to spot 🎀. It gets way messier when the source is obscured or spoofed, logs get deleted, or there are overwhelmingly many sources 🙈. And if the source of an attack is known or identified, it may be desirable to request actions that stop or mitigate the effects of the attack 💖.

Current approaches to mitigating security incidents are all about identifying and filtering or rate-limiting packets from attackers who try to hide where their attack is coming from by spoofing source addresses from multiple locations 🦋. Measures can be taken at network provider (NP) edge routers that handle ingress, egress, and broadcast filtering, which is a recommended best practice in [RFC2827] 🧚.

Network providers have come up with solutions, both in-house and commercial, to trace attacks across their backbone infrastructure. The goal is to identify the source either on their own network or on the next upstream network in the path to the source 🌈. Some techniques collect packets as traffic traverses the network, so attack traffic can be traced after an incident has already happened 📦. Other methods use packet-marking techniques or flow-based traffic analysis to trace traffic across the network in real time ⚡. Single-network trace mechanisms use similar information across the individual networks to do their tracing 🧩. The tricky part is when a trace needs to keep going through the next upstream network, because the trace mechanism and management can vary from network to network 😤.

When traffic crosses multiple networks, there is currently no established communication mechanism for continuing the trace 💀. If the next upstream network has been identified, someone might have to place a phone call to contact the network administrators and try to get them to continue the trace 📞. So what's needed is a communication mechanism that transfers information to continue traces accurately and efficiently to upstream networks 👑. The mechanism described in this document, Real-time Inter-network Defense (RID), takes into account the information that various single-network trace implementations need, as well as the requirement for network providers to decide whether a TraceRequest should be permitted to continue 🫶. RID messages represent their data in an Extensible Markup Language (XML) [XML1.0] document using the Incident Object Description Exchange Format (IODEF) and RID. By following this model, integrating with other aspects of the network for incident handling becomes simpler ✨. Finally, the communication system includes methods to indicate what actions need to be taken closest to the source in order to halt or mitigate the effects of the attack at hand 🎯. RID is meant to communicate the relevant information between Computer Security Incident Response Teams (CSIRTs), while staying compatible with a variety of existing and possible future detection, tracing, and response approaches 🌸.

At this point, RID has found use within the international research communities, but it hasn't been widely adopted in other sectors yet 🔬. This document provides the specification for the communities that have adopted it, and for communities currently considering solutions for real-time inter-network defense 📜. The specification may also speed up development of solutions where different transports or message formats are needed, by reusing the data elements and structures specified here 🚀.

Security and privacy are a HUGE deal here 🚨 since potentially sensitive information can be passed through RID messages. RID messaging takes advantage of the XML security and privacy policy information set in the RID schema 🔐. The RID schema acts as an XML envelope that supports the communication of IODEF documents, which are used for exchanging or tracing information about security incidents 💌. RID messages are encapsulated for transport, and that transport is defined in a separate document [RFC6046] 📮. The authentication, integrity, and authorization features that each layer offers are used together to reach the necessary level of security 🛡️.

1.1. Normative and Informative

The XML schema [XMLschema] and the transport requirements in this document are normative. Everything else is informative 📚. More specifically, these sections are informative: Sections 1, 2, and 3, plus the subsections of 4, including the introduction to 4, 4.1, and 4.2 🌷. These sections are normative: the subsections of 4 including 4.3, 4.4, and 4.5, plus Section 5 and Section 6 💜.

1.2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀.

1.3. Attack Types and RID Messaging

RID messaging is meant for coordinating incident handling, so you can locate the source of an attack and stop or mitigate its effects 🦸‍♀️. The attack types include system or network compromises, denial-of-service attacks, and other malicious network traffic 🥀. RID is basically a messaging system that coordinates attack detection, tracing mechanisms, and incident handling responses to locate the source of traffic 🧠. If a source address is spoofed, you need a more detailed trace of a packet (an RID TraceRequest) to find the true source 🕵️. If the source address is valid, incident handling may only need routing information to figure out which network provider is closest to the source (an RID Investigation request), and that can help with remediation 🍓. So the type of RID message you use to locate a source depends on whether the source address is valid 💅. RID message types are discussed in Section 4.3 📖.

Okay, now DDoS, which is so intense 😭. DoS [DoS] attacks are characterized by large amounts of traffic aimed at particular Internet locations, and they can come from a single source or from multiple sources 🌊. An attack from multiple sources is known as a distributed denial-of-service (DDoS) attack 💥. Since DDoS attacks can come from multiple sources, tracing one can be extremely difficult or nearly impossible 😵. Many TraceRequests may be needed to get the job done, and they may require dedicated network resources to communicate incident handling information, so that a DoS attack can't be launched against the RID system and the network used for tracing and remediation 🛠️. Provisions are suggested to reduce the load and to prevent the same trace from happening twice on a single-network backbone, as discussed in Section 4 on communication between NPs 🔁. The attacks can be launched from systems across the Internet that are unified in their efforts, or by compromised systems enlisted as "zombies" that are controlled by servers, which gives the controlling server anonymity 🧟. This scenario may require multiple RID traces: one to locate the zombies, and another to locate the controlling server 🎯. DDoS attacks don't necessarily spoof the source address, since there are so many source addresses that tracing them is hard anyway 🌀. DDoS attacks can also come from a single system or a subset of systems that spoof the source address in packet headers to mask the identity of the attack source 🎭. In that case, an iterative trace through the upstream networks in the path of the attack traffic may be required 🔗.

RID traces may also be used to locate a system that was used in an attack to compromise another system 🕸️. A system can be compromised through many attack vectors, using various techniques from a remote host or through local privilege escalation attempts 🔓. The attack may exploit a system or application-level vulnerability, which may be the result of a design flaw or a configuration issue 🧩. A compromised system, as described above, can later be used to attack other systems 😬. In this case a single RID Investigation request may be used, since the source address is probably valid 💁‍♀️. Identifying the sources of system compromises can be difficult, because an attacker may access the compromised system from various sources 🌫️. The attacker may also try to cover their tracks by deleting log files, or by accessing the system through a series of compromised hosts 🫥. Iterative RID traces may be required for each of the compromised systems used to obscure the source of the attack 🔍. If the source address is valid, an Investigation request may be used in lieu of a full RID TraceRequest 💖.

Once an attack has been reported, CSIRTs may want to query other CSIRTs to see whether they have detected an attack, or they may simply report that one has taken place 📣. The Report message can be used to file a report without any action taken, and an IncidentQuery can be used to ask whether another CSIRT has seen an attack 🙋‍♀️.

System compromises can also result from other security incident types, such as worms, Trojans, or viruses 🐛. It's often the case that an incident goes unreported, even when valid source address information is available, because it's hard to take any action to mitigate or stop the attack 😩. Incident handling is a tough job for an NP, and even at some client locations, due to network size and resource limitations 🥺.

2. RID Integration with Network Provider Technologies ✨

okay so for this doc, a network provider (NP) is the backbone infrastructure manager of a network 🌐 The NP's Computer Security Incident Response Team is called the CSIRT (the acronym tax is real, bestie 💀). The backbone could belong to an org giving network access, Internet or private, to commercial, personal, government, or educational institutions, or it could be the backbone provider of the connected network. The connected network provider is meant to cover Intranet and Extranet providers too, plus stuff like a business's or school's private network 🏫

NPs usually manage and watch their networks through a centralized network management system (NMS) 🖥️ "NMS" is used generically for any management system on a network that's used to manage network resources. An incident handling system (IHS) is what communicates RID messages, and it may be integrated with an NMS and other components of the network too. The parts of the network that can be integrated through the RID messaging system include attack or event detection, network tracing, and network devices that stop the effects of an attack 🛑

Detecting security incidents may rely on manual reporting, automated intrusion detection tools, and variations in traffic types or levels on a network 👀 Intrusion detection systems (IDSs) may be integrated into the IHS to create IODEF documents or RID messages and make incident handling easier 🫶 Detection of a security incident is outside the scope of this paper, however, it should be possible to integrate detection methods with RID messaging.

RID messaging in an IHS is meant to be flexible so it can accommodate the traceback systems in use right now, plus the ones that evolve with tech later 🦋 RID is supposed to communicate the info a trace mechanism needs to the next upstream NP in the path of a trace. So a RID message must carry the superset of data required for all tracing systems (that's the whole vibe, no cap 💅). If possible, the trace may need to inspect packets to determine a pattern, which could help reverse path identification. This can be done by inspecting packet header info like source and destination IP addresses, ports, and protocol flags, to see if there's a way to tell the traced packets apart from other packets 🔍 A description of the incident along with any available automated trace data should trigger an alert to the NP's CSIRT for further investigation. The various technologies used to trace traffic across a network are described in Section 3.1 ✨

Another area of integration is being able to mitigate or stop attack traffic once a source has been located 🚫 Any automated solution should consider the possible side effects to the network (so nothing breaks, obviously 😭). A change control process or a central point for configuration management might be used to make sure the security of the network and necessary functionality are maintained, and that equipment configuration changes are documented 📝 Automated solutions may depend on the capabilities and current configuration management solutions on a particular network. The solutions may be based on HTTP/TLS (Transport Layer Security) or an appropriate protocol defined in the transport specification 🎀

---

3. Characteristics of Attacks 🕵️‍♀️

the goal of tracing a security incident may be to identify the source, or to find a point on the network as close to the origin of the incident as possible 🎯 A security incident may be defined as a system compromise, a worm or Trojan infection, or a single- or multiple-source denial-of-service attack. Incident tracing can be used to identify the source(s) of an attack so the undesired behavior can be halted or mitigated. The communication system, RID, described in this paper can be used to trace any type of security incident, and it allows for actions to be taken once the source of the attack, or a point closer to the source, is known or has been identified 💖 The purpose of tracing an attack is to halt or mitigate its effects through methods like filtering or rate-limiting the traffic close to the source, or by taking the host or network offline 📴 Care must also be taken to make sure the system isn't abused, and to use proper analysis to determine if attack traffic is, in fact, attack traffic at each NP along the path of a trace 🧐

Tracing security incidents can be a difficult task since attackers go to great lengths to hide their identity 🥷 In the case of a security incident, the true source might be identified through an existing established connection to the attacker's point of origin. However, the attacker may not connect to the compromised system for a long period of time after the initial compromise, or may access the system through a series of compromised hosts spread across the network. Other ways of obscuring the source may include targeting the host with the same attack from multiple sources using both valid and spoofed source addresses. This tactic can be used to compromise a machine and leave the difficult task of locating the true origin to the administrators 😤 Security incidents, including DDoS attacks, can be difficult or nearly impossible to trace because of the nature of the attack. Some of the difficulties in tracing attacks include the following:

• the attack originates from multiple sources;
• the attack may include various types of traffic meant to consume server resources, such as a SYN flood attack without a significant increase in bandwidth utilization;
• the type of traffic could include valid destination services, which cannot be blocked since they are essential services to business, such as DNS servers at an NP or HTTP requests sent to an organization connected to the Internet;
• the attack may utilize varying types of packets including TCP, UDP, ICMP, or other IP protocols;
• the attack may be from "zombies", which then require additional searches to locate a controlling server as the true origin of the attack;
• the attack may use a very small number of packets from any particular source, thus making a trace after the fact nearly impossible 🥲

If the source(s) of the attack cannot be determined from IP address information or by tracing the increased bandwidth utilization, it may be possible to trace the traffic based on the type of packets seen by the client 🔎 In the case of packets with spoofed source addresses, it is no longer a trivial task to identify the source of an attack. In the case of an attack using valid source addresses, methods such as the traceroute utility can be used to fairly accurately identify the path of the traffic between the source and destination of an attack 🗺️ If the true source has been identified, actions should be taken to halt or mitigate the effects of the attack by reporting the incident to the NP or the upstream NP closest to the source. In the case of a spoofed source address, other methods can be used to trace back to the source of an attack. These methods include packet filtering, packet hash comparisons, IP marking techniques, ICMP traceback, and packet flow analysis. As in the case of attack detection, tracing traffic across a single network is a function that can be used with RID to give the network the ability to trace spoofed traffic to the source, while RID provides all the necessary information to accommodate the approach used on any single network to accomplish this task 🧩 RID can also be used to report attack traffic close to the source where the IP address used was determined to be valid, or simply to report that an incident occurred 📣

3.1. Integrating Trace Approaches 🧩

there have been many separate research initiatives to solve the problem of tracing upstream packets to detect the true source of attack traffic 🔬 Upstream packet tracing is currently confined to the borders of a network or an NP's network. Traces require access to network equipment and resources, which can potentially limit a trace to a specific network 🚧 Once a trace reaches the boundaries of a network, the network manager or NP adjacent in the upstream trace must be contacted in order to continue the trace 📞 NPs have been working on individual solutions to accomplish upstream tracing within their own network environments. The tracing mechanisms implemented thus far have included proprietary or custom solutions requiring specific information such as IP packet header data, hash values of the attack packets, or marked packets. Hash values are used to compare a packet against a database of packets that have passed through the network, as described in "Hash-Based IP Traceback" [HASH-IPtrace]. Other research solutions involve marking packets, as explained in "ICMP Traceback Messages" [ICMPtrace], "Practical network support for IP traceback" [NTWK-IPtrace], the IP Flow Information eXport (IPFIX) protocol [RFC3917], and IP marking [IPtrace]. The single-network traceback solutions were considered in developing RID to determine the information needed to accomplish an inter-network trace where different solutions may be in place 🌈

3.2. Superset of Packet Information for Traces ✨

Okay so, to trace traffic across a network, an example packet from the attack has to be sent along with the TraceRequest or Investigation request 📦. The hash-based IP traceback research says all of the non-changing fields of an IP header, along with 8 bytes of payload, are needed to give enough info to uniquely trace a packet's path 🔍. Those non-changing header fields plus the 8 bytes of payload are the superset of data that most single-network tracing systems use. Limiting the shared data to that superset means nobody has to share potentially sensitive stuff that might be hiding in the data portion of a packet 🔒. No oversharing, periodt 💅.

The RecordItem class in IODEF stores a hexadecimal formatted packet with all the packet header info plus 8 bytes of payload, or the entire packet contents 🎀. The trace systems above don't need a full packet, but it can be useful sometimes, so the data model gives you the option to include one 🧚.

If you only use a subset of a packet, the research in "Hash-Based IP Traceback" [HASH-IPtrace] gives guidelines for a minimum requirement for telling packets apart 🧠. The full packet and content SHOULD be provided, but the minimum requirement MUST be provided. The [HASH-IPtrace] research found that the first 28 invariant bytes of a packet (masked IP header plus the first 8 bytes of the payload) are enough to differentiate almost all non-identical IPv4 packets 🤯. RID requires the first 28 invariant bytes of an IPv4 packet in order to perform a trace. For an IPv6 packet, RID requires the first 48 invariant bytes to distinguish the packet in a trace. Reference [HASH-IPtrace] for additional details 📚.

The input mechanism for packets to be traced should be flexible, so that intrusion detection systems or packet sniffers can provide the information 🦋. The system creating the RID message should also use the packet information to populate the Incident class information, which avoids human error and still lets a system administrator override the auto-populated info 💖.

---

4. Communication between Network Providers 🌍

Note: The Introduction, and Sub-sections 4.1 and 4.2, are informative, with the exception of references to IODEF/RID Transport [RFC6046]. Sub-sections 4.3, 4.4, and 4.5 are normative.

Okay, bestie, speeding up communication between CSIRTs is essential when you're responding to a security-related incident 🚨. The incident might cross network access points (Internet backbones) between providers. Because this inter-NP incident communication is so urgent, there must be an effective system in place to make the interaction happen 🏃‍♀️. That communication policy or system should involve multiple means of communication so there isn't a single point of failure 🫶. Email is one way to send info about the incident, packet traces, and so on. Ngl though, email may not get received quickly, or acted on with the same urgency as a phone call or another communication mechanism 📞.

Each NP should dedicate a phone number to reach a member of their CSIRT 📱. That phone number could be dedicated to inter-NP incident communications, and it must be a hotline that provides a 24x7 live response 🌙. The phone line should reach someone with the authority, expertise, and means to expedite the action needed to investigate the incident 👑. Honestly this can be a tough policy for smaller NPs because of resource limitations, so another solution may be needed 😭. An outside group may be able to fill this role if it's given the necessary access to the NP's network 🧑‍💻. That outside resource should be able to ease the financial limitations and any lack of experienced personnel 💜.

A technical solution to trace traffic across a single NP may include homegrown or commercial systems, and RID messaging must accommodate their input requirements 🛠️. The IHS used on the NP's backbone by the CSIRT to coordinate the trace across the single network needs a way to accept and process RID messages, relay TraceRequests to the system, and wait for responses from the system so the RID request process can continue as appropriate 🔄. In this setup, each NP would maintain its own RID/IHS and integrate it with a management station used for network monitoring and analysis 🖥️. An alternative for NPs that lack sufficient resources may be a neutral third party with access to the NP's network resources, who could perform the incident handling functions 🦸‍♀️. This could be a function of a central organization operating as a CSIRT for the Internet as a whole, or within a consortium that can provide centralized resources 🌈.

Consortiums would consist of a group of NPs and/or CSIRTs that agree to take part in the RID communication protocol, with an agreed-upon policy and communication protocol that facilitates the secure transport of IODEF/RID XML documents 🤝. Transport for RID messages is specified in the IODEF/RID Transport [RFC6046] document 📄.

One goal of RID is to avoid needing to permit access to other networks' equipment. It does this with a standard messaging mechanism that lets IHSs communicate incident handling information to other networks in a consortium or in neighboring networks 🍓. The third party mentioned above may be used in this technical solution to help with incident handling and possibly traceback through smaller NPs 🧚. The RID messaging mechanism may be a logical or physical out-of-band network, so the communication stays secure and unaffected by the state of the network under attack 🛡️. The two management methods accommodate the needs of larger NPs, which want full management of their own network, and the third-party option, which can be available to smaller NPs that lack the human resources to handle incidents 💅. The first method lets individual NPs involve their network operations staff to authorize the continuation of a trace, or another necessary response to a RID communication request through their network, via a notification and alerting system 🔔. The out-of-band logical solution for messaging may be permanent virtual circuits configured with a small amount of bandwidth dedicated to RID communications between NPs 💫.

The network used for the communication should consist of out-of-band or protected channels (direct communication links), or encrypted channels dedicated to transporting RID messages 🔐. The communication links would be direct connections between network peers who have agreed-upon use and abuse policies through a consortium 🫂. Consortiums might be linked through policy comparisons and additional agreements to form a larger web, or iterative network, of peers that correlates to the traffic paths available across the larger web of networks 🕸️. The maintenance of each individual link is the responsibility of the two network peers hosting it 🔧. Contact information, IP addresses of RID systems, and other info must be coordinated between bilateral peers by a consortium, and may use existing databases such as the Routing Arbiter 🗂️. The security, configuration, and Confidence rating schemes of the RID messaging peers must be negotiated by the peers and must meet certain overall requirements of the fully connected network (Internet, government, education, etc.) through the peering and/or a consortium-based agreement 👀.

RID messaging established with clients of an NP may be negotiated in a contract as part of a value-added service, or through a service level agreement (SLA). Further discussion is beyond the scope of this document, and may be more appropriately handled in network peering or service level agreements 📝.

Procedures for incident handling need to be established and well known by anyone who may be involved in incident response 📣. The procedures should also contain contact information for internal escalation procedures, as well as for external assistance groups such as a CSIRT, CERT Coordination Center (CERT/CC), Global Information Assurance Certification (GIAC), and the FBI or other assisting government organization in the country of the investigation 🚓.

4.1. Inter-Network Provider RID Messaging ✨

okay so bestie, if RID systems (or IHSs) are gonna talk to each other across different vendors, they need a standard protocol and format 🎀. Otherwise nothing lines up. These messages also have to hold up as they travel across several networks, which is a lot to ask 💅. RID gives the framework for the networks involved in incident handling, possible traceback, and mitigation of a security incident 🦋.

Section 4.3 lists the message types that make this work: Report, IncidentQuery, TraceRequest, RequestAuthorization, Result, and the Investigation request message. Here's the vibe for each one:

• Report is for filing an incident on a RID system or its associated database when no further action is needed 📝.
• IncidentQuery asks for information about a particular incident 🔍.
• TraceRequest is for when the traffic's source may have been spoofed. Every upstream network provider that gets one issues a trace across its network to find the upstream source of the traffic 🕵️‍♀️.
• RequestAuthorization and Result are how the status and outcome of a TraceRequest or an Investigation request get communicated 💌.
• Investigation request only involves the RID communication systems along the path to the source of the traffic. It doesn't use network trace systems at all. Instead it leans on bilateral relationships or a consortium's interconnections to stop problematic traffic close to the source 🌸.

Routes could figure out the fastest path to a known source IP address for an Investigation request, which is giving efficiency 🚀.

A message sent between RID systems for a TraceRequest or an Investigation request, to stop traffic at the source through a bordering network, would require the information listed below:

1. Enough information for the network administrators to decide whether it's worth continuing the trace 🤔.
2. The incident or IP packet information needed to carry out the trace or investigation 🧩.
3. Contact information for the origin of the RID communication. This could come through the Autonomous System Number (ASN) [RFC1930] or Network Information Center (NIC) handle information listed in the Registry for Internet Numbers or other Internet databases 📇.
4. Network path information, so routing loops can't keep a trace going forever 🔁. If a RID system gets a TraceRequest that already has its own information in the path, the trace must cease, and the RID system should generate an alert to tell the network operations staff that a tracing loop exists 🚨.
5. A unique identifier for a single attack. This identifier should be used to correlate traces to multiple sources in a DDoS attack 🌈.

Now the rules. Use of the communication network and the RID protocol must be for pre-approved, authorized purposes only 🙅‍♀️. Every participating party is responsible for following the guidelines in both a global use policy for the system and whatever is set in the peering agreements for each bilateral peer, or the agreed-upon consortium guidelines 📜. The whole point of these policies is to avoid abuse of the system, and the policies shall be developed by a consortium of participating entities 🤝. The global policy may depend on the domain it operates under. A government network and a commercial network like the Internet would follow different guidelines to address their individual concerns 🏛️. Privacy issues must be considered in public networks such as the Internet 🔒. They're discussed in the Security Considerations section, along with other requirements that participating entities must agree upon 🛡️.

RID requests must be legitimate security-related incidents, and they must not be used for things like sabotage or censorship 🚫. Some examples of abuse would be asking to rate-limit legitimate traffic so information can't be shared between users on the Internet (like restricting access to online versions of papers), or blocking a competitor's product just to sabotage their business 😤.

The RID system should be configurable so it either requires user input or automatically continues traces. That way a network manager can check the available resources before a trace continues 🎛️. A trace started from a TraceRequest may cause adverse effects on a network. If the Confidence rating is low, it may not be in the NP's best interest to continue the trace 📉. The Confidence ratings must adhere to the specifications for choosing the percentage used to avoid abuse of the system 💯. And TraceRequests must be issued by authorized individuals from the initiating network, as set out in the policy guidelines established through peering or an SLA 🎀.

---

4.2. RID Network Topology

The simplest setup for RID systems that talk to each other is a direct connection, or a bilateral relationship, as shown below 🧸.

      ___________                                  __________
      |         |                                  |        |
      |  RID    |__________-------------___________|  RID   |
      |_________|          | NP Border |           |________|
                           -------------

                   Figure 1.  Direct Peer Topology

Inside a consortium model, a few different topologies might be agreed upon and used 🌐. One option leans on the bilateral network peering relationships of the consortium members. The RID peers would match the routing peers, and the logical network borders would be used. This approach may be necessary for an iterative trace where the source is unknown 🔎. The model would look like the diagram above, but there may be an extensive number of bilateral interconnections formed 🕸️. Also inside a consortium, it may be useful to set up an integrated mesh of networks to pass RID messages 🧶. This can be really helpful when the source address is known, because an interconnection may give a faster route to the closest upstream peer to the source of the attack traffic ⚡. Here's an example:

  _______                     _______                     _______
  |     |                     |     |                     |     |
__| RID |____-------------____| RID |____-------------____| RID |__
  |_____|    | NP Border |    |_____|    | NP Border |    |_____|
     |       -------------               -------------       |
     |_______________________________________________________|

 Direct connection to network that is not an immediate network peer

                    Figure 2.  Mesh Peer Topology

Now, broadcasting RID requests in a fully meshed consortium would be possible, but it's not advisable 🙅‍♀️. If you broadcast a request, RID peers that may not have carried the attack traffic on their network get asked to run a trace, in the hope of cutting down the time it takes to find the true source. But that means lots of networks could end up spending resources on a TraceRequest that may have been unnecessary too 😩.

---

4.3. Message Formats

Section 4.3.2 describes the six RID message types, which are based on the IODEF model [RFC5070]. These messages get generated and received on RID communication systems on the NP's network 📨. They may come from IODEF messages sent by intrusion detection servers, CSIRTs, analysts, and so on 🕵️. A RID message uses the IODEF framework with the RID extension, and it's encapsulated for transport [RFC6046] 🎁. Each RID message type is described along with an example in the sections that follow. The IODEF-RID schema is introduced in Section 4.3.3 to support the RID message types in Section 4.3.2 🧁.

4.3.1. RID Data Types

RID is derived from the IODEF data model, so it inherits all of the data types defined in the IODEF model 👯‍♀️. RID adds exactly one data type of its own: BOOLEAN ✅.

4.3.1.1. Boolean

A boolean value is represented by the BOOLEAN data type 💖.

The BOOLEAN data type is implemented as xs:boolean [XMLschema] in the schema 🧾.

4.3.2. RID Messages and Transport

There are six RID message types 💫:

1. TraceRequest. This message is sent to the RID system next in the upstream trace. It starts a TraceRequest, or continues one, out to an upstream network closer to the source address of the security incident's origin. The TraceRequest would trigger a traceback on the network to locate the source of the attack traffic 🔙.
2. RequestAuthorization. This message is sent back to the initiating RID system from each upstream NP's RID system, to report on the request status in the current network 📋.
3. Result. This message is sent to the initiating RID system through the network of RID systems in the path of the trace, as a heads-up that the source of the attack was located. The Result message is also used to notify about actions taken for an Investigation request 🎉.
4. Investigation. This message type is used when the source of the traffic is believed not to be spoofed. The point of the Investigation request message is to use the existing peer relationships to tell the network provider closest to the source of the valid traffic about a security-related incident, so any necessary actions can be taken 🎯.
5. Report. This message is used to report a security incident that doesn't need any action. It can be used for correlating attack information by CSIRTs, for statistics and trending information, and so on 📊.
6. IncidentQuery. This message is used to request information about an incident or incident type from a trusted RID system. The response comes back through the Report message 🔁.

When a system receives a RID message, it must be able to determine the type of message and parse it accordingly 🧠. The message type is specified in the RIDPolicy class. The RIDPolicy class may also be used by the transport protocol to help communicate security incident data, for tracing, investigating, querying, or reporting information about security incidents 💜.

4.3.3. IODEF-RID Schema 🎀

okay so there are three classes in the RID extension that make RID communications actually work 💅 the RequestStatus class tells you whether a TraceRequest or Investigation request got approved, the IncidentSource class says whether a source was found and names the source host(s) or network(s), and the RIDPolicy class holds the agreed-upon policies and says what type of communication message is being used 🦋

the RID schema acts as an envelope for the IODEF schema 📩 and the whole point is flexibility, so RID hosts can send messages back and forth easily. instead of stuffing everything into the AdditionalData extension of IODEF, RID gets its own schema that wraps IODEF. that means the RIDPolicy class can be pulled out super easily and handed to the transport protocol ✨

here's the lowkey genius part 🧠 sending incident info across the network requires encryption, but the RIDPolicy info doesn't have to be encrypted 🙈 so separating it out means nobody has to decrypt and parse the entire IODEF and RID document just to figure out how to handle it at each RID host. no extra drama, no cap 💖

the RIDPolicy class exists to specify the message type for the receiving host, facilitate the policy needs of RID, and provide routing information in the form of an IP address of the destination RID system 🧚

the policy information and guidelines are discussed in Section 6.6 📜 the policy is defined between RID peers and within or between consortiums. the RIDPolicy is meant to be a tool that helps carry out those defined policies. this MUST be used in accordance with policy set between clients, peers, consortiums, and/or regions. security, privacy, and confidentiality MUST be considered as specified in this document. bestie, don't skip this part 🫶

the RID schema is defined as follows:

        +------------------+
        |        RID       |
        +------------------+
        | ANY              |
        |                  |<>---{0..1}----[ RIDPolicy      ]
        | ENUM restriction |
        | ENUM type        |<>---{0..1}----[ RequestStatus  ]
        | STRING meaning   |
        |                  |<>---{0..1}----[ IncidentSource ]
        +------------------+

Figure 3. The RID Schema

these are the aggregate classes that make up the RID schema in the iodef-rid namespace 👑

RIDPolicy

Zero or One. The RIDPolicy class is used by all message types to facilitate policy agreements between peers, consortiums, or federations, as well as to properly route messages. 🗺️

RequestStatus

Zero or One. The RequestStatus class is used only in RequestAuthorization messages to report back to the originating RID system if the trace will be continued by each RID system that received a TraceRequest in the path to the source of the traffic. 🔁

IncidentSource

Zero or One. The IncidentSource class is used in the Result message only. The IncidentSource provides the information on the identified source host or network of an attack trace or investigation. 🔍

each of the three listed classes may be the only class included in the RID class, hence the option for zero or one. in some cases, RIDPolicy MAY be the only class in the RID definition when used by the transport protocol [RFC6046], as that information should be as small as possible and may not be encrypted. 🌸 and the RequestStatus message MUST be able to stand alone without the need for an IODEF document to facilitate the communication, limiting the data transported to the required elements per [RFC6046]. main character energy, but make it minimal ✨

4.3.3.1. RequestStatus Class 💌

the RequestStatus class is an aggregate class in the RID class.

                    +--------------------------------+
                    | RequestStatus                  |
                    +--------------------------------+
                    |                                |
                    | ENUM restriction               |
                    | ENUM AuthorizationStatus       |
                    | ENUM Justification             |
                    | STRING ext-AuthorizationStatus |
                    | STRING ext-Justification       |
                    |                                |
                    +--------------------------------+

Figure 4. The RequestStatus Class

the RequestStatus class has five attributes 🎀

restriction

OPTIONAL. ENUM. this attribute indicates the disclosure guidelines the sender expects the recipient to adhere to. this guideline provides no real security since it's up to the recipient to honor it 🙈 this attribute follows the same guidelines as "restriction" used in IODEF.

AuthorizationStatus

REQUIRED. ENUM. the listed values give the requesting CSIRT a response about the status of a TraceRequest in the current network 📬

1. Approved. The trace was approved and will begin in the current NP. ✅
2. Denied. The trace was denied in the current NP. The next closest NP can use this message to filter traffic from the upstream NP using the example packet to help mitigate the effects of the attack as close to the source as possible. The RequestAuthorization message must be passed back to the originator, and a Result message used from the closest NP to the source to indicate actions taken in the IODEF History class. 🚫
3. Pending. Awaiting approval; a timeout period has been reached, which resulted in this Pending status and RequestAuthorization message being generated. ⏳
4. ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1. 🧩

Justification

OPTIONAL. ENUM. provides a reason for a Denied or Pending message 🤔

1. SystemResource. A resource issue exists on the systems that would be involved in the request. 🖥️
2. Authentication. The enveloped digital signature [RFC3275] failed to validate. ✍️
3. AuthenticationOrigin. The detached digital signature for the original requestor on the IP packet failed to validate. 🔏
4. Encryption. Unable to decrypt the request. 🔐
5. Other. There were other reasons this request could not be processed. 🤷
6. ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1. 🧩

AuthorizationStatus-ext

OPTIONAL. STRING. a means by which to extend the AuthorizationStatus attribute. See IODEF [RFC5070], Section 5.1. 🌈

Justification-ext

OPTIONAL. STRING. a means by which to extend the Justification attribute. See IODEF [RFC5070], Section 5.1. 🌈

4.3.3.2. IncidentSource Class 🕵️‍♀️

the IncidentSource class is an aggregate class in the RID class.

       +-------------------+
       | IncidentSource    |
       +-------------------+
       |                   |
       | ENUM restriction  |
       |                   |<>-------------[ SourceFound    ]
       |                   |
       |                   |<>---{0..*}----[ Node           ]
       |                   |
       +-------------------+

Figure 5. The IncidentSource Class

here are the elements that make up the IncidentSource class 💖

SourceFound

One. BOOLEAN. the Source class indicates if a source was identified. If the source was identified, it is listed in the Node element of this class.

• True. Source of incident was identified. ✨
• False. Source of incident was not identified. 🙃

Node

One. The Node class is used to identify a host or network device, in this case to identify the system communicating RID messages. 📡

the base definition of this class is reused from the IODEF specification [RFC5070], Section 3.16. 🔁

the IncidentSource class has one attribute 🎀

restriction

OPTIONAL. ENUM. this attribute indicates the disclosure guidelines the sender expects the recipient to adhere to. this guideline provides no real security since it's up to the recipient to honor it 🙈 this attribute follows the same guidelines as "restriction" used in IODEF.

4.3.3.3. RIDPolicy Class ✨

okay so the RIDPolicy class is the one that handles delivering RID messages 🚚, and the transport doc [RFC6046] pulls it in too. main character energy, fr fr 💅

    +------------------------+
    | RIDPolicy              |
    +------------------------+
    |                        |
    | ENUM restriction       |<>-------------[ Node         ]
    | ENUM MsgType           |
    | ENUM MsgDestination    |<>---{0..1}----[ IncidentID   ]
    | ENUM ext-MsgType       |
    | ENUM ext-MsgDestination|<>---{1..*}----[ PolicyRegion ]
    |                        |
    |                        |<>---{1..*}----[ TrafficType  ]
    |                        |
    +------------------------+

                   Figure 6.  The RIDPolicy Class

Here's the breakdown of the aggregate elements that make up RIDPolicy 🎀

Node

One. The Node class identifies a host or network device, and in this case it identifies the system communicating RID messages 🖥️

The base definition of this class is reused from the IODEF specification [RFC5070], Section 3.16.

IncidentID

Zero or one. This is a global reference pointing back to the IncidentID defined in the IODEF data model 🔗. The IncidentID includes the name of the CSIRT, an incident number, and an instance of that incident. The instance number is appended with a dash separating the values, and it's used in cases where it may be desirable to group incidents. Examples of incidents that may be grouped would be botnets, DDoS attacks, multiple hops of compromised systems found during an investigation, etc. 🤖

PolicyRegion

One or many. REQUIRED. The values for the attribute region are used to determine what policy area may require consideration before a trace can be approved 🌍. The PolicyRegion may include multiple selections from the attribute list so it can fit all possible policy considerations when crossing regions, consortiums, or networks.

region

One. ENUM. ✨

1. ClientToNP. An enterprise network initiated the request.
2. NPToClient. An NP passed a RID request to a client, or to an enterprise attached network to the NP, based on the service level agreements.
3. IntraConsortium. A trace that should have no restrictions within the boundaries of a consortium, with the agreed-upon use and abuse guidelines.
4. PeerToPeer. A trace that should have no restrictions between two peers, but it may require further evaluation before continuing beyond that point, with the agreed-upon use and abuse guidelines.
5. BetweenConsortiums. A trace that should have no restrictions between consortiums that have established agreed-upon use and abuse guidelines.
6. AcrossNationalBoundaries. This selection must be set if the trace type is anything but a trace of attack traffic with malicious intent. It must also be set if the traffic request is based upon regulations of a specific nation that would not apply to all nations. This is different from the BetweenConsortiums setting, since it may be possible to have multiple nations as members of the same consortium. This option must be selected if the traffic is of a type that may have different restrictions in other nations 🗺️
7. ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1.

TrafficType

One or many. REQUIRED. The values for the attribute type are meant to help determine whether a trace is appropriate for the NP receiving the request to continue the trace 🔍. Multiple values may be selected for this element; however, where possible, it should be restricted to one value that most accurately describes the traffic type.

type

One. ENUM. 🚦

1. Attack. This option should only be selected if the traffic is related to a network-based attack. The type of attack MUST also be listed in more detail in the IODEF Method and Impact classes for further clarification, so it can help determine whether the trace can be continued ([RFC5070], Sections 3.9 and 3.10.1) ⚔️
2. Network. This option MUST only be selected when the trace is related to NP network traffic or routing issues 🛰️
3. Content. This category MUST be used only when the request is related to content and regional restrictions on accessing that type of content exist. This is not malicious traffic, but it may include determining what sources or destinations accessed certain materials available on the Internet, including, but not limited to, news, technology, or inappropriate content 📰
4. OfficialBusiness. This option MUST be used if the traffic being traced is requested by, or is affiliated with, any government or other official business request. This would be used during an investigation by government authorities, or other government traces to track suspected criminal or other activities 🏛️
5. Other. If this option is selected, a description of the traffic type MUST be provided so that policy decisions can be made to continue or stop the trace. The information should be provided in the IODEF message in the Expectation class, or in the History class using a HistoryItem log 📝
6. ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1.

The RIDPolicy class has five attributes 🎀

restriction

OPTIONAL. ENUM. This attribute indicates the disclosure guidelines the sender expects the recipient to adhere to. This guideline provides no real security, since it is the choice of the recipient of the document whether to honor it 🤷‍♀️ This attribute follows the same guidelines as "restriction" used in IODEF.

MsgType

REQUIRED. ENUM. The type of RID message sent. The six types of messages are described in Section 4.3.2, and each can be noted as one of the six selections below 📬

1. TraceRequest. This message may be used to initiate a TraceRequest, or to continue a TraceRequest to an upstream network closer to the source address of the origin of the security incident 🕵️‍♀️
2. RequestAuthorization. This message is sent to the initiating RID system from each of the upstream RID systems to provide information on the request status in the current network.
3. Result. This message indicates that the source of the attack was located, and it is sent to the initiating RID system through the RID systems in the path of the trace 🎯
4. Investigation. This message type is used when the source of the traffic is believed to be valid. The purpose of the Investigation request is to leverage the existing peer or consortium relationships in order to notify the NP closest to the source of the valid traffic that some event occurred, which may be a security-related incident 👀
5. Report. This message is used to report a security incident, for which no action is requested in the IODEF Expectation class. It may be used to correlate attack information by CSIRTs, for statistics and trending information, etc. 📊
6. IncidentQuery. This message is used to request information from a trusted RID system about an incident or incident type 🔎

There's also an extension attribute to add new enumerated values, and it's:

• ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1.

MsgDestination

REQUIRED. ENUM. The destination required at this level may either be the RID messaging system intended to receive the request, or, in the case of an Investigation request, the source of the incident 🎯. In the case of an Investigation request, the RID system that can help stop or mitigate the traffic may not be known, so the message may have to traverse RID messaging systems by following the routing path to the RID system closest to the source of the attack traffic 🛤️. The Node element lists either the RID system or the IP address of the source, and the meaning of the value in the Node element is determined by the MsgDestination element.

1. RIDSystem. The address listed in the Node element of the RIDPolicy class is the next upstream RID system that will receive the RID message.
2. SourceOfIncident. The address listed in the Node element of the RIDPolicy class is the incident source. The IP address is used to determine the path of RID systems that will be used to find the closest RID system to the source of an attack, in which the IP address used by the source is believed to be valid and an Investigation request message is used. This is not to be confused with the IncidentSource class, since the value defined here comes from an initial trace or Investigation request, not from the source used in a Result message 🙅‍♀️
3. ext-value. An escape value used to extend this attribute. See IODEF [RFC5070], Section 5.1.

MsgType-ext

OPTIONAL. STRING. A means of extending the MsgType attribute. See IODEF [RFC5070], Section 5.1. 🧩

MsgDestination-ext

OPTIONAL. STRING. A means of extending the MsgDestination attribute. See IODEF [RFC5070], Section 5.1. 🧩

---

4.3.4. RID Namespace 🌸

The RID schema declares a namespace of "iodef-rid-1.0" and registers it per [XMLnames]. Each IODEF-RID document MUST use the "iodef-rid-1.0" namespace in the top-level element RID-Document. It can be referenced as follows:

<RID-Document
   version="1.00" lang="en-US"
   xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
   xsi:schemaLocation=http://www.iana.org/assignments/xml-registry/
      schema/iodef-rid-1.0.xsd">

4.4. RID Messages 💌

The IODEF model is followed as specified in [RFC5070] for each of the RID message types 📦. The RID schema is used in combination with IODEF documents to facilitate RID communications. Each message type varies slightly in format and purpose, so the requirements vary and are specified for each one 📋. All classes, elements, attributes, etc., that are defined in the IODEF-Document are valid in the context of a RID message. However, some listed as optional in IODEF are mandatory for RID, as listed for each message type. The IODEF model MUST be fully implemented to ensure proper parsing of all RID messages 🫶

Note: The implementation of the RID system may obtain some of the information needed to fill in the content required for each message type automatically from packet input to the system, or default information such as that used in the EventData class. 💡

4.4.1. TraceRequest

okay bestie, this one is the trace request 🕵️‍♀️✨ it gets sent to the next network management station upstream once the upstream source of the traffic has been identified 💖

The following information is required for TraceRequest messages. It comes in through these pieces:

• RID Information:
  • RIDPolicy: RID message type, IncidentID, and destination policy information 🎀
• IODEF Information:
  • Time Stamps: DetectTime, StartTime, EndTime, ReportTime ⏰
  • Incident Identifier: the Incident class and IncidentID 🪪
    • Trace number: this is used for multiple traces of a single incident, and it must be noted 📝
  • Confidence rating of the security incident, which comes from the Impact and Confidence class 📊
  • System class: this lists both the Source and Destination info used in the attack, and it must note whether the traffic is spoofed, because spoofed traffic needs an upstream TraceRequest in RID 🕸️
  • Expectation class: use this to request any specific actions to be taken close to the source 🎯
  • Path information of nested RID systems, starting with the request originator, used in the trace. This goes in IODEF EventData with category set to "infrastructure" 🛤️
  • Event, Record, and RecordItem classes: these include example packets and other info related to the incident 📦
    • Note: Event info here needs a second instance of EventData, on top of the one used for NP path contact info 👀
• Standards for encryption and digital signatures [RFC3275], [XMLsig]:
  • Digital signature from the initiating RID system, passed to all systems in the upstream trace using XML digital signature 🔐

Okay, real talk, a DDoS attack can have a LOT of sources 😭 which means multiple traces to find them all. Continuing multiple traces for a single attack can totally be valid 💅 The path info helps admins figure out if an exact trace has already gone through a single network, so nobody's doing the same work twice. The Incident Identifier also has to be used to tell apart multiple TraceRequests from one incident. If a single TraceRequest splits into divergent paths of TraceRequests, a separate instance number MUST be used under the same IncidentID. The IncidentID instance number in IODEF can be used to link related incident data that's part of a bigger incident, so it's giving organization 🗂️✨

4.4.2. RequestAuthorization

This message gets sent back to the initiating RID system from the next upstream NP's RID system. It tells the initiator what the request status is in the current network 🌸

The following information is required for RequestAuthorization messages. It comes in through these pieces:

• RID Information:
  • RIDPolicy: RID message type, IncidentID, and destination policy information 🎀
  • Status of TraceRequest: the RequestStatus class in the RID schema 🚦
• Standards for encryption and digital signatures [RFC3275], [XMLsig]:
  • Digital signature of the responding NP, for the authenticity of the Trace Status Message. It's created by the NP making this message, using XML digital signature 🔏

Basically this is the status notification that goes back to the initiator of the trace 💌 It confirms the next RID system in the path actually got the message from the previous system. It also confirms whether the trace is continuing, has stopped, or is pending in the next upstream RID system. The Pending status gets generated automatically after a 2-minute timeout, if nobody (no predefined system rule, no admin) takes action to approve or disapprove the trace continuing 😤⏳ If a Request is denied, the originator and the sending peer (if they're not the same) MUST both receive the message. This gives the sending peer the option to stop or mitigate the traffic as close to the source as possible 🛑🫶

4.4.3. Result

This message says the trace or investigation is finished and hands over the result 🏁 It tells you whether a source was found, plus the source info through the IncidentSource class 🔍 The Result information MUST go back to the originating RID system that started the investigation or trace. An NP can use any number of incident handling data sources to figure out the true source of an attack 🧠 Not all of those info sources are necessarily hooked up to the RID communications system, though, so it's not always a one-stop shop 🙈

The following information is required for Result messages. It will be provided through:

• RID Information:
  • RIDPolicy: RID message type, IncidentID, and destination policy information 🎀
  • Incident Source: the IncidentSource class of the RID schema is used to note whether a source was identified and to provide the source address(es) 📍
• IODEF Information:
  • Time Stamps: DetectTime, StartTime, EndTime, ReportTime ⏰
  • Incident Identifier: the Incident class and IncidentID 🪪
    • Trace number: this is used for multiple traces of a single incident, and it must be noted 📝
  • Confidence rating of the security incident, which comes from the Impact and Confidence class 📊
  • System class: this lists both the Source and Destination info used in the attack, and it must note whether the traffic is spoofed, because spoofed traffic needs an upstream TraceRequest in RID 🕸️
  • History class: the atype attribute is used to note any actions taken 🛠️
  • History class also notes any other background info, including notes about the confidence level or rating of the result info 💭
  • Path information of nested RID systems, starting with the request originator, used in the trace. This goes in IODEF EventData with category set to "infrastructure". The last NP listed is the NP that located the source of the traffic, which is the NP sending the Result message 🏆
  • Event, Record, and RecordItem classes: these can include example packets and other info related to the incident (optional) 📦
    • Note: Event info here needs a second instance of EventData, on top of the one used for NP path contact info 👀
• Standards for encryption and digital signatures [RFC3275]:
  • Digital signature of the source NP, for the authenticity of the Result Message. It's created by the NP making this message, using XML digital signature 🔐

This message goes back to the initiating RID system to tell the associated CSIRT that the source has been located 🎉 Whether the actual source info gets included depends on the policy of the network where the client or host is attached, so it's not always spilled ☕ Any action the NP took to act on finding the source of a trace should be included. The NP might be able to automate adjusting filters on its border router to block outbound access for the machine(s) found as part of the attack 🧱 Those filters might be strong enough to block all Internet access until the host deals with its security issues, or they might just rate-limit the ingress traffic as close to the source as possible 🚫📉

Security and privacy considerations discussed in Section 6 MUST be taken into account. Tea, this part is serious 🚨🔒

Note: The History class has been expanded in IODEF so it can cover all the possible actions taken as a result of a RID TraceRequest or Investigation request, using the "iodef:atype", or action type, attribute 🧾 The History class should be used to note all actions taken close to the source of a trace or incident. Use the most appropriate option for the type of action, along with a description 💅 The atype attribute in the Expectation class can also be used to request an appropriate action when a TraceRequest or Investigation request is made 🎯

4.4.4. Investigation Request

This message type is used when the source of the traffic is believed not to be spoofed 🙌 The whole point of the Investigation request is to use the existing bilateral peer relationships to notify the network provider closest to the source of the valid traffic that some event happened, which might be a security-related incident 👀🚨

The following information is required for Investigation request messages. It will be provided through:

• RID Information:
  • RID Policy: RID message type, IncidentID, and destination policy information 🎀
• IODEF Information:
  • Time Stamps: DetectTime, StartTime, EndTime, ReportTime ⏰
  • Incident Identifier: the Incident class and IncidentID 🪪
    • Trace number: this is used for multiple traces of a single incident, and it must be noted 📝
  • Confidence rating of the security incident, which comes from the Impact and Confidence class 📊
  • System class: this lists both the Source and Destination info used in the attack, and it must note whether the traffic is spoofed, because spoofed traffic needs an upstream TraceRequest in RID 🕸️
  • Expectation class: use this to request any specific actions to be taken close to the source 🎯
  • Path information of nested RID systems, starting with the request originator, used in the trace. This goes in IODEF EventData with category set to "infrastructure" 🛤️
  • Event, Record, and RecordItem classes: these include example packets and other info related to the incident 📦
    • Note: Event info here needs a second instance of EventData, on top of the one used for NP path contact info 👀
• Standards for encryption and digital signatures [RFC3275]:
  • Digital signature from the initiating RID system, passed to all systems in the upstream trace using XML digital signature 🔐

Security considerations include the ability to encrypt [XMLencrypt] the contents of the Investigation request message, using the public key of the destination RID system 🔑 The incident number increases as if it were a TraceRequest message, so it stays unique within the system 🔢 The relaying peers also append their Autonomous System (AS) or RID system info as the request gets relayed along the web of network providers. That way the Result message can use the same path as the set of trust relationships for the return trip, and it shows any actions taken 🕸️💞 The request also gets recorded in the state tables of both the initiating and destination NP RID systems 📒 The destination NP is responsible for any actions taken because of the request, following any service level agreements or internal policies 🧑‍⚖️ The NP should confirm that the traffic actually came from the suspected system before taking any action, and it should confirm the reason for the request 🧐 The request may be sent directly to a known RID system, or routed by the source address of the attack using the message destination of RIDPolicy, SourceOfIncident 🗺️

Note: All intermediate parties must be able to view RIDPolicy information in order to properly direct RID messages 👑

4.4.5. Report 📝

Okay so the Report message is how you send a RID system a write-up of a security incident 💖. It doesn't ask anyone to do anything. It's basically "hey, just file this, thx" 💅. The receiving RID system (or its associated database) just stores it.

The following information is required for Report messages and will be provided through:

• RID Information:
  • RID Policy RID message type, IncidentID, and destination policy information

The following data is recommended if available and can be provided through:

• IODEF Information:
  • Time Stamps (DetectTime, StartTime, EndTime, ReportTime).
  • Incident Identifier (Incident class, IncidentID). Trace number - used for multiple traces of a single incident; must be noted.
  • Confidence rating of security incident (Impact and Confidence class).
  • System class is used to list both the Source and Destination Information used in the attack.
  • Event, Record, and RecordItem classes to include example packets and other information related to the incident (optional).
• Standards for encryption and digital signatures [RFC3275]:
  • Digital signature from initiating RID system, passed to all systems receiving the report using XML digital signature.

Now for the security stuff, and yes, it's serious 🙈. The Report can be encrypted [XMLencrypt] using the public key of the destination RID system, which is giving locked-down energy 🔐. Senders need to keep in mind that the info may be used to correlate incident data for trending, pattern detection, and stuff like that 📊. It may also get shared with other parties, unless you and the receiving RID system agree otherwise 🤝. So sending parties may obfuscate or remove destination addresses or other sensitive info before the Report goes out. A Report can be sent either to file an incident report or as a reply to an IncidentQuery, and data sensitivity must be considered in both situations 🚨. Also, the NP path info isn't necessary for this message, since it gets communicated directly between two trusted RID systems 💜.

4.4.6. IncidentQuery 🔍

The IncidentQuery message is how you ask a trusted RID system for incident info 👀. Your request can include the incident number (if you know it) or detailed info about the incident. If you know the incident number, the Report with the incident info can be sent back to the trusted requestor using automated methods, which is so efficient 🤖. If an example packet or other unique info is included in the IncidentQuery, the return report may be automated too. Otherwise, an analyst may need to step in 🧑‍💻.

The following information must be used for an IncidentQuery message and is provided through:

• RID Information:
  • RID Policy RID message type, IncidentID, and destination policy information
• IODEF Information (optional):
  • Time Stamps (DetectTime, StartTime, EndTime, ReportTime).
  • Incident Identifier (Incident class, IncidentID). Trace number - used for multiple traces of a single incident; must be noted.
  • Confidence rating of security incident (Impact and Confidence class).
  • System class is used to list both the Source and Destination Information used in the attack.
  • Event, Record, and RecordItem classes to include example packets and other information related to the incident (optional).
• Standards for encryption and digital signatures [RFC3275]:
  • Digital signature from initiating RID system, passed to all systems receiving the IncidentQuery using XML digital signature. If a packet is not included, the signature may be based on the RIDPolicy class.

The proper response to an IncidentQuery is a Report message 📩. You can get multiple incidents back from one query if you ask for an incident type. In that case, the receiving system sends back an IODEF document with multiple incidents or all instances of an incident 🗂️. The system sending the reply can set a limit on how many documents it returns in one report. The recommended limit is 5, so the documents don't get too chunky 🍰. For big transfers, other transfer methods may be a better fit than RID 🚚.

You can also use the Confidence rating in an IncidentQuery to select only incidents with an equal or higher Confidence rating than what you specify. This is handy when you have info about a type of incident but not the specifics of one incident 🎯. And if the IncidentQuery is meant to gather data about a specific type of incident, Source and Destination Information may not be needed 🌸.

---

4.5. RID Communication Exchanges 🦋

This section lays out the communication flows for RID and gives examples of messages, so get comfy 🛋️. The proper response to a TraceRequest is a RequestAuthorization message. The RequestAuthorization message tells the requestor whether the trace will continue through the next upstream network 🛤️. If there's a problem with the request, like a failure to validate the digital signature or decrypt the request, a RequestAuthorization message MUST be sent to the requestor and the downstream peer (if they're not one and the same) explaining why the message couldn't be processed 🙅‍♀️. If the trace continued, more TraceRequests, each answered with a RequestAuthorization message, pass the request upstream along the path toward the source of the traffic related to the incident ⬆️. Once a source is found, a Result message is sent to the originator of the trace. The originator is found through the NP path information in the document instance of EventData, where contact is set to "infrastructure" 🕵️. The NP path information is also used when sending the RequestAuthorization messages to the first entry (the trace originator) and the last nested entry (the downstream peer) 🧭. The Result message is encrypted [XMLencrypt] for the originator, and it tells them about the incident source and any actions taken 🔐. If the originator fails to decrypt or authenticate the Result message, a RequestAuthorization message is sent back in response. Otherwise, no return message is sent ✅. If a RequestAuthorization message goes out with the RequestStatus set to Denied, a downstream peer that receives it may choose to stop or mitigate the traffic at that point in the network, as close to the source as possible 🛑. If the downstream peer picks that option, it sends a Result message to the trace originator 📬.

Note: For each example listed below, [RFC5735] addresses were used. Assume that each IP address listed is actually a separate network range held by different NPs. Addresses were used from /27 network ranges. 🎀

4.5.1. Upstream Trace Communication Flow 🌈

This diagram shows the RID TraceRequest communication flow between RID systems on different networks tracing an attack 🧩.

   Attack Dest      NP-1            NP-2        NP-3        Attack Src

   1. Attack    |  Attack
      reported  |  detected

   2.              Initiate trace

   3.              Locate origin
                   through
                   upstream NP

   4.              o---TraceRequest----->

   5.                              Trace
                                   Initiated

   6.              <-RequestAuthorization-o

   7.                              Locate origin
                                   through
                                   upstream NP

   8.                              o---TraceRequest--->

   9.                                             Trace Initiated

   10.             <----------RequestAuthorization----o
                                    <---RequestAuth---o

   11.                                            Locate attack
                                                  source on network   X

   12.             <------------Result----------------o

Figure 7. TraceRequest Communication Flow

Before a trace starts, the RID system should verify that an instance of the trace or a similar request isn't already active 👀. Traces can be resource intensive, so providers need to be able to detect potential abuse of the system or unintentional resource drains 🚨. Info like the Source and Destination Information, associated packets, and the incident may be worth keeping for a period of time that administrators decide on 🗓️.

The flow shows that a RequestAuthorization message goes to both the downstream peer and the original requestor 💌. If a TraceRequest is denied, the downstream peer can take action and reply with a Result message 🛡️. The originator of the request can follow up with the downstream peer of the NP involved, using an Investigation request, to make sure action is taken if no response comes back 📞. Nothing stops the originator from starting a new TraceRequest that bypasses the NP that denied the request, if a trace is needed beyond that point 🚀. Another option is for the initiator to send an Investigation request to an NP upstream of the NP that denied the request, if they gathered enough information from the incident handling info to figure out the true source of the attack traffic 🎯.

4.5.1.1. RID TraceRequest Example 💻

This example is a TraceRequest based on the incident report example from the IODEF document 📄. The RID extension classes were included as appropriate for a TraceRequest message, using the RIDPolicy class 🧁. In this scenario, a CSIRT is reporting a DoS attack in progress to the upstream NP. The request asks the next NP to continue the trace and have the traffic mitigated closer to the source of the traffic 🌟.

In the following example, [XMLsig] is used to generate digital signatures. It doesn't currently provide digest algorithm agility, because [XMLsig] only supports SHA-1 🙃. A future version of [XMLsig] may support additional digest algorithms, which would give digest algorithm agility 🔮.

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="TraceRequest"
                       MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="IntraConsortium"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.3</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#207-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
</iodef-rid:RID>
<!-- IODEF-Document accompanied by the above RID -->

The bestie-approved signed IODEF bundle comes first, then the envelope that wraps it up 🔐✨

<iodef:IODEF-Document version="1.00"
                      xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef:Incident restriction="need-to-know" purpose="traceback">
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#207-1
    </iodef:IncidentID>
    <iodef:DetectTime>2004-02-02T22:49:24+00:00</iodef:DetectTime>
    <iodef:StartTime>2004-02-02T22:19:24+00:00</iodef:StartTime>
    <iodef:ReportTime>2004-02-02T23:20:24+00:00</iodef:ReportTime>
    <iodef:Description>Host involved in DoS attack</iodef:Description>
    <iodef:Assessment>
      <iodef:Impact severity="low" completion="failed" type="dos"/>
    </iodef:Assessment>
    <iodef:Contact role="creator" type="organization">
      <iodef:ContactName>Constituency-contact for 192.0.2.35
      </iodef:ContactName>
      <iodef:Email>Constituency-contact@192.0.2.35</iodef:Email>
    </iodef:Contact>
    <iodef:EventData>
      <iodef:Flow>
        <iodef:System category="source">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.35
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>38765</iodef:port>
          </iodef:Service>
        </iodef:System>
        <iodef:System category="target">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.67
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>80</iodef:port>
          </iodef:Service>
        </iodef:System>
      </iodef:Flow>
      <iodef:Expectation severity="high" action="rate-limit-host">
        <iodef:Description>
          Rate-limit traffic close to source
        </iodef:Description>
      </iodef:Expectation>
      <iodef:Record>
        <iodef:RecordData>
          <iodef:Description>
            The IPv4 packet included was used in the described attack
          </iodef:Description>
          <iodef:RecordItem dtype="ipv4-packet">450000522ad9
             0000ff06c41fc0a801020a010102976d0050103e020810d9
             4a1350021000ad6700005468616e6b20796f7520666f7220
             6361726566756c6c792072656164696e6720746869732052
             46432e0a
          </iodef:RecordItem>
        </iodef:RecordData>
      </iodef:Record>
    </iodef:EventData>
    <iodef:History>
      <iodef:HistoryItem>
        <iodef:DateTime>2001-09-14T08:19:01+00:00</iodef:DateTime>
        <iodef:IncidentID name="CSIRT-FOR-OUR-DOMAIN">
          CSIRT-FOR-OUR-DOMAIN#207-1
        </iodef:IncidentID>
        <iodef:Description>
          Notification sent to next upstream NP closer to 192.0.2.35
        </iodef:Description>
      </iodef:HistoryItem>
    </iodef:History>
  </iodef:Incident>
</iodef:IODEF-Document>
<!-- Digital signature accompanied by above RID and IODEF -->

<Envelope xmlns="urn:envelope"
          xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0"
          xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0">
  <iodef:IODEF-Document>
    <iodef:Incident>
      <iodef:EventData>
        <iodef:Record>
          <iodef:RecordData>
            <iodef:RecordItem type="ipv4-packet">450000522ad9
             0000ff06c41fc0a801020a010102976d0050103e020810d9
             4a1350021000ad6700005468616e6b20796f7520666f7220
             6361726566756c6c792072656164696e6720746869732052
             46432e0a
            </iodef:RecordItem>
          </iodef:RecordData>
        </iodef:Record>
      </iodef:EventData>
    </iodef:Incident>
  </iodef:IODEF-Document>
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod
         Algorithm="http://www.w3.org/TR/2001/
          REC-xml-c14n-20010315#WithComments"/>
      <SignatureMethod
         Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
      <Reference URI="">
        <Transforms>
          <Transform Algorithm=
           "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
        </Transforms>
        <DigestMethod
           Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <DigestValue>KiI5+6SnFAs429VNwsoJjHPplmo=</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>
      VvyXqCzjoW0m2NdxNeToXQcqcSM80W+JMW+Kn01cS3z3KQwCPeswzg==
    </SignatureValue>
    <KeyInfo>
      <KeyValue>
        <DSAKeyValue>
          <P>/KaCzo4Syrom78z3EQ5SbbB4sF7ey80etKII864WF64B81uRpH5t9j
             QTxeEu0ImbzRMqzVDZkVG9xD7nN1kuFw==</P>
          <Q>li7dzDacuo67Jg7mtqEm2TRuOMU=</Q>
          <G>Z4Rxsnqc9E7pGknFFH2xqaryRPBaQ01khpMdLRQnG541Awtx/XPaF5
             Bpsy4pNWMOHCBiNU0NogpsQW5QvnlMpA==</G>
          <Y>VFWTD4I/aKni4YhDyYxAJozmj1iAzPLw9Wwd5B+Z9J5E7lHjcAJ+bs
             HifTyYdnj+roGzy4o09YntYD8zneQ7lw==</Y>
        </DSAKeyValue>
      </KeyValue>
    </KeyInfo>
  </Signature>
</Envelope>

4.5.1.2. RequestAuthorization Message Example 💌

Okay so this RequestAuthorization message is the reply to the TraceRequest we just looked at, and it's giving approval ✨ The NP that got the request is saying yes, the trace can keep going inside their network 💅

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="RequestAuthorization"
                       MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="IntraConsortium"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.67</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#207-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
  <iodef-rid:RequestStatus AuthorizationStatus="Approved"/>
</iodef-rid:RID>

4.5.1.3. Result Message Example 🏁

Now the Result message, which is the reply to the TraceRequest from above, and it's the main character moment of the whole flow 🎀 Ngl, this one only shows up after a RequestAuthorization in the TraceRequest flow, so the order matters bestie 🫶 It may also be a direct response to an Investigation request. The big payoff is that it tells you where the attack came from and what got done to mitigate the traffic 😭🔥

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="Result"
                       MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="IntraConsortium"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.67</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#207-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
  <iodef-rid:IncidentSource>
    <iodef-rid:SourceFound>true</iodef-rid:SourceFound>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.37</iodef:Address>
    </iodef:Node>
  </iodef-rid:IncidentSource>
</iodef-rid:RID>

<!-- IODEF-Document accompanied by the above RID -->

<iodef:IODEF-Document version="1.00"
                      xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef:Incident restriction="need-to-know" purpose="traceback">
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#207-1
    </iodef:IncidentID>
    <iodef:DetectTime>2004-02-02T22:49:24+00:00</iodef:DetectTime>
    <iodef:StartTime>2004-02-02T22:19:24+00:00</iodef:StartTime>
    <iodef:ReportTime>2004-02-02T23:20:24+00:00</iodef:ReportTime>
    <iodef:Description>Host involved in DoS attack</iodef:Description>
    <iodef:Assessment>
      <iodef:Impact severity="low" completion="failed" type="dos"/>
    </iodef:Assessment>
    <iodef:Contact role="creator" type="organization">
      <iodef:ContactName>Constituency-contact for 192.0.2.35
      </iodef:ContactName>
      <iodef:Email>Constituency-contact@192.0.2.35</iodef:Email>
    </iodef:Contact>
    <iodef:EventData>
      <iodef:Contact role="admin" type="organization">
        <iodef:ContactName>Admin-contact for 192.0.2.35
        </iodef:ContactName>
        <iodef:Email>Admin-contact@10.1.1.2</iodef:Email>
      </iodef:Contact>
      <iodef:Flow>
        <iodef:System category="intermediate">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.35
            </iodef:Address>
          </iodef:Node>
        </iodef:System>
      </iodef:Flow>
      <iodef:EventData>
        <iodef:Contact role="admin" type="organization">
          <iodef:ContactName>Admin-contact for 192.0.2.3
          </iodef:ContactName>
          <iodef:Email>Admin-contact@192.0.2.3</iodef:Email>
        </iodef:Contact>
        <iodef:Flow>
          <iodef:System category="intermediate">
            <iodef:Node>
              <iodef:Address category="ipv4-addr">192.0.2.3
              </iodef:Address>
            </iodef:Node>
          </iodef:System>
        </iodef:Flow>
      </iodef:EventData>
    </iodef:EventData>
    <iodef:EventData>
      <iodef:Flow>
        <iodef:System category="source">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.35
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>38765</iodef:port>
          </iodef:Service>
        </iodef:System>
        <iodef:System category="target">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.67
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>80</iodef:port>
          </iodef:Service>
        </iodef:System>
      </iodef:Flow>
      <iodef:Expectation severity="high" action="rate-limit-host">
        <iodef:Description>
          Rate-limit traffic close to source
        </iodef:Description>
      </iodef:Expectation>
      <iodef:Record>
        <iodef:RecordData>
          <iodef:Description>
            The IPv4 packet included was used in the described attack
          </iodef:Description>
          <iodef:RecordItem dtype="ipv4-packet">450000522ad9
          0000ff06c41fc0a801020a010102976d0050103e020810d9
          4a1350021000ad6700005468616e6b20796f7520666f7220
          6361726566756c6c792072656164696e6720746869732052
          46432e0a
          </iodef:RecordItem>
        </iodef:RecordData>
      </iodef:Record>
    </iodef:EventData>
    <iodef:History>
      <iodef:HistoryItem>
        <iodef:DateTime>2004-02-02T22:53:01+00:00</iodef:DateTime>
        <iodef:IncidentID name="CSIRT-FOR-OUR-DOMAIN">
          CSIRT-FOR-OUR-DOMAIN#207-1
        </iodef:IncidentID>
        <iodef:Description>
          Notification sent to next upstream NP closer to 192.0.2.35
        </iodef:Description>
      </iodef:HistoryItem>
      <iodef:HistoryItem action="rate-limit-host">
        <iodef:DateTime>2004-02-02T23:07:21+00:00</iodef:DateTime>
        <iodef:IncidentID name="CSIRT-FOR-NP3">
          CSIRT-FOR-NP3#3291-1
        </iodef:IncidentID>
        <iodef:Description>
          Host rate-limited for 24 hours
        </iodef:Description>
      </iodef:HistoryItem>
    </iodef:History>
  </iodef:Incident>
</iodef:IODEF-Document>

4.5.2. Investigation Request Communication Flow

okay so this diagram shows the RID Investigation request flow between RID systems on different networks, for a security incident where we already know the source address 👀✨ the proper response to an Investigation request is a Result message 💅 but if something goes wrong, like the digital signature won't validate or the request won't decrypt, a RequestAuthorization message gets sent back to the requestor 🫶 and that one should tell them why the message couldn't be processed, because nobody likes being left on read 😭

     Attack Dest      NP-1              NP-2        Attack Src

     1. Attack    |  Attack
        reported  |  detected

     2.              Determine source
                     of security incident

     3.              o---Investigation---->

     4.                              Research
                                     incident and
                                     determine appropriate
                                     actions to take

     5.              <-------Result-------o

                Figure 8.  Investigation Communication Flow

4.5.2.1. Investigation Request Example

the example only shows the RID-specific bits, bestie 🎀 the IODEF and security measures are basically the same as the TraceRequest info, except here the source is already known and the receiving RID system is known to be close to the source 🦋 the known source gets written into the IODEF document, and that's also where incident sources can be marked as spoofed if that's appropriate 🙈

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="Investigation"
                       MsgDestination="SourceOfIncident">
    <iodef-rid:PolicyRegion region="PeerToPeer"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.98</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#208-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
</iodef-rid:RID>
<!-- IODEF-Document accompanied by the above RID -->

<iodef:IODEF-Document version="1.00"
                      xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef:Incident restriction="need-to-know" purpose="other">
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#208-1
    </iodef:IncidentID>
    <iodef:DetectTime>2004-02-05T08:13:33+00:00</iodef:DetectTime>
    <iodef:StartTime>2004-02-05T08:13:31+00:00</iodef:StartTime>
    <iodef:EndTime>2004-02-05T08:13:33+00:00</iodef:EndTime>
    <iodef:ReportTime>2004-02-05T08:13:35+00:00</iodef:ReportTime>
    <iodef:Description>Host involved in DoS attack</iodef:Description>
    <iodef:Assessment>
      <iodef:Impact severity="low" completion="failed" type="recon"/>
    </iodef:Assessment>
    <iodef:Contact role="creator" type="organization">
      <iodef:ContactName>Constituency-contact for 192.0.2.35
      </iodef:ContactName>
      <iodef:Email>Constituency-contact@10.1.1.2</iodef:Email>
    </iodef:Contact>
    <iodef:EventData>
      <iodef:Flow>
        <iodef:System category="source">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.35
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>41421</iodef:port>
          </iodef:Service>
        </iodef:System>
        <iodef:System category="target">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.67
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>80</iodef:port>
          </iodef:Service>
        </iodef:System>
      </iodef:Flow>
      <iodef:Expectation severity="high" action="investigate">
        <iodef:Description>
          Investigate whether source has been compromised
        </iodef:Description>
      </iodef:Expectation>
    </iodef:EventData>
    <iodef:History>
      <iodef:HistoryItem>
        <iodef:DateTime>2004-02-05T08:19:01+00:00</iodef:DateTime>
        <iodef:IncidentID name="CSIRT-FOR-OUR-DOMAIN">
          CSIRT-FOR-OUR-DOMAIN#208-1
        </iodef:IncidentID>
        <iodef:Description>
          Investigation request sent to NP for 192.0.2.35
        </iodef:Description>
      </iodef:HistoryItem>
    </iodef:History>
  </iodef:Incident>
</iodef:IODEF-Document>

4.5.2.2. RequestAuthorization Message Example

this RequestAuthorization message is the reply to the Investigation request we just looked at ✨ the NP that got the request couldn't validate the digital signature that was used to authenticate the sending RID system, so it sent this back 🙅‍♀️

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="RequestAuthorization"
                       MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="IntraConsortium"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.67</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#208-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
  <iodef-rid:RequestStatus AuthorizationStatus="Denied"
                           Justification="Authentication"/>
</iodef-rid:RID>

4.5.3. Report Communication

the diagram below shows the RID Report flow between RID systems on different networks 📨🌸

        NP-1                           NP-2

     1. Generate incident information
        and prepare Report message

     2.              o-------Report------->

     3.                              File report in database

                   Figure 9.  Report Communication Flow

okay so the Report flow is used to share info about specific incidents detected on the network 🕵️‍♀️ incident info can be passed between CSIRTs or participating RID hosts using this format 💖 when a report comes in, the RID system must verify that the report hasn't already been filed 🧐 the incident number and incident data, like the hexadecimal packet and incident class info, can be compared against what's already in the database 🍓 the Report message typically doesn't get a response 🙈 and if there's a problem, like the digital signature [RFC3275] won't validate or the request won't decrypt, a RequestAuthorization message goes back to the requestor, and it should explain why the message couldn't be processed 💀

4.5.3.1. Report Example

the example only includes the RID-specific details, and it's giving unsolicited Report message that carries an IPv4 packet 🦋 the IODEF document and digital signature would look similar to the TraceRequest info ✨

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="Report" MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="PeerToPeer"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.130</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#209-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
</iodef-rid:RID>

<!-- IODEF-Document accompanied by the above RID -->

<iodef:IODEF-Document version="1.00"
                      xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef:Incident restriction="need-to-know" purpose="reporting">
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#209-1
    </iodef:IncidentID>
    <iodef:DetectTime>2004-02-05T10:21:08+00:00</iodef:DetectTime>
    <iodef:StartTime>2004-02-05T10:21:05+00:00</iodef:StartTime>
    <iodef:EndTime>2004-02-05T10:35:00+00:00</iodef:EndTime>
    <iodef:ReportTime>2004-02-05T10:27:38+00:00</iodef:ReportTime>
    <iodef:Description>Host illicitly accessed admin account
    </iodef:Description>
    <iodef:Assessment>
      <iodef:Impact severity="high" completion="succeeded"
                    type="admin"/>
      <iodef:Confidence rating="high"/>
    </iodef:Assessment>
    <iodef:Contact role="creator" type="organization">
      <iodef:ContactName>Constituency-contact for 192.0.2.35
      </iodef:ContactName>
      <iodef:Email>Constituency-contact@10.1.1.2</iodef:Email>
    </iodef:Contact>
    <iodef:EventData>
      <iodef:Flow>
        <iodef:System category="source">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.35
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>32821</iodef:port>
          </iodef:Service>
        </iodef:System>
        <iodef:System category="target">
          <iodef:Node>
            <iodef:Address category="ipv4-addr">192.0.2.67
            </iodef:Address>
          </iodef:Node>
          <iodef:Service>
            <iodef:port>22</iodef:port>
          </iodef:Service>
        </iodef:System>
      </iodef:Flow>
    </iodef:EventData>
    <iodef:History>
      <iodef:HistoryItem>
        <iodef:DateTime>2004-02-05T10:28:00+00:00</iodef:DateTime>
        <iodef:IncidentID name="CSIRT-FOR-OUR-DOMAIN">
          CSIRT-FOR-OUR-DOMAIN#209-1
        </iodef:IncidentID>
        <iodef:Description>
          Incident report sent to NP for 192.0.2.35
        </iodef:Description>
      </iodef:HistoryItem>
    </iodef:History>
  </iodef:Incident>
</iodef:IODEF-Document>

4.5.4. IncidentQuery Communication Flow

this diagram is for the RID IncidentQuery flow between RID systems on different networks 🔍💜

        NP-1                           NP-2

     1. Generate a request for
        information on a specific
        incident number or incident type

     2.              o---IncidentQuery--->

     3.                              Verify policy information
                                     and determine if matches exist
                                     for requested information

     4.              <-------Report------o

     5.  Associate report to request
         by incident number or type
         and file report(s).

               Figure 10.  IncidentQuery Communication Flow

the IncidentQuery message gets a Report message back as its response 🎁 if that Report is empty, it means the responding host didn't have any info to share with the requestor 🫧 the incident number and the responding RID system, plus the transport, help link the request and response together, since a report can be filed and isn't always solicited 🧩 and if there's a problem with the IncidentQuery message, like the digital signature won't validate or the request won't decrypt, a RequestAuthorization message goes back to the requestor, and it should say why the message couldn't be processed 🥺

4.5.4.1. IncidentQuery Example

the IncidentQuery request can show up in a few different formats depending on the kind of query 🌈 if the incident number is the only info given, the IODEF document and IP packet data might not be needed to finish the request 💅 but if a type of incident is requested, the incident number stays NULL, and the IP packet data won't be included in the IODEF RecordItem class, so the other incident info is the main thing to compare against ✨ and when the incident number might not match between CSIRTs, the incident number and/or IP packet info can be provided and used for comparison on the receiving RID system, which then generates (a) Report message(s) 🦋

<iodef-rid:RID xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
               xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0">
  <iodef-rid:RIDPolicy MsgType="IncidentQuery"
                       MsgDestination="RIDSystem">
    <iodef-rid:PolicyRegion region="PeerToPeer"/>
    <iodef:Node>
      <iodef:Address category="ipv4-addr">192.0.2.3</iodef:Address>
    </iodef:Node>
    <iodef-rid:TrafficType type="Attack"/>
    <iodef:IncidentID name="CERT-FOR-OUR-DOMAIN">
      CERT-FOR-OUR-DOMAIN#210-1
    </iodef:IncidentID>
  </iodef-rid:RIDPolicy>
</iodef-rid:RID>

5. RID Schema Definition ✨

Okay bestie, this is the schema, the official blueprint 📐 Every RID message has to fit inside it, so here's the full thing, no edits 💜

<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:iodef-rid="urn:ietf:params:xml:ns:iodef-rid-1.0"
 xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0"
 xmlns:xs="http://www.w3.org/2001/XMLSchema"
 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 targetNamespace="urn:ietf:params:xml:ns:iodef-rid-1.0"
 elementFormDefault="qualified" attributeFormDefault="unqualified">
<xs:import namespace="urn:ietf:params:xml:ns:iodef-1.0"
 schemaLocation="http://www.iana.org/assignments/xml-registry/
 schema/iodef-rid-1.0.xsd"/>

<xs:import namespace="http://www.w3.org/2000/09/xmldsig#"
 schemaLocation=
 "http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>

<!-- ****************************************************************
*********************************************************************
***  Real-time Inter-network Defense - RID XML Schema             ***
***    Namespace - iodef-rid, August 2006                         ***
***    The namespace is defined to support transport of IODEF     ***
***     documents for exchanging incident information.            ***
*********************************************************************
-->
<!--RID acts as an envelope for IODEF documents to support the exchange
    of messages-->
<!--
====== Real-Time Inter-network Defense - RID ======
====  Suggested definition for RID messaging ======
 -->

<xs:annotation>
  <xs:documentation>XML Schema wrapper for IODEF</xs:documentation>
</xs:annotation>
<xs:element name="RID" type="iodef-rid:RIDType"/>
  <xs:complexType name="RIDType">
    <xs:sequence>
      <xs:element ref="iodef-rid:RIDPolicy" minOccurs="0"/>
      <xs:element ref="iodef-rid:RequestStatus" minOccurs="0"/>
      <xs:element ref="iodef-rid:IncidentSource" minOccurs="0"/>
    </xs:sequence>
  </xs:complexType>

<!--Used in RequestAuthorization Message for RID-->

<xs:element name="RequestStatus" type="iodef-rid:RequestStatusType"/>
  <xs:complexType name="RequestStatusType">
     <xs:attribute name="AuthorizationStatus" use="required">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
          <xs:whiteSpace value="collapse"/>
            <xs:enumeration value="Approved"/>
            <xs:enumeration value="Denied"/>
            <xs:enumeration value="Pending"/>
            <xs:enumeration value="ext-value"/>
          </xs:restriction>
        </xs:simpleType>
     </xs:attribute>
     <xs:attribute name="ext-AuthorizationStatus"
                   type="xs:string" use="optional"/>

     <xs:attribute name="Justification">
        <xs:simpleType>
          <xs:restriction base="xs:NMTOKEN">
          <xs:whiteSpace value="collapse"/>
            <xs:enumeration value="SystemResource"/>
            <xs:enumeration value="Authentication"/>
            <xs:enumeration value="AuthenticationOrigin"/>
            <xs:enumeration value="Encryption"/>
            <xs:enumeration value="Other"/>
            <xs:enumeration value="ext-value"/>
          </xs:restriction>
        </xs:simpleType>
     </xs:attribute>
     <xs:attribute name="ext-Justification"
                   type="xs:string" use="optional"/>
    <xs:attribute name="restriction" type="iodef:restriction-type"/>
  </xs:complexType>

<!--Incident Source Information for Result Message-->

<xs:element name="IncidentSource" type="iodef-rid:IncidentSourceType"/>
  <xs:complexType name="IncidentSourceType">
    <xs:sequence>
      <xs:element ref="iodef-rid:SourceFound"/>
      <xs:element ref="iodef:Node" minOccurs="0"
          maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="restriction" type="iodef:restriction-type"/>
  </xs:complexType>
  <xs:element name="SourceFound" type="xs:boolean"/>

<!--
====== Real-Time Inter-network Defense Policy - RIDPolicy ======
======  Definition for RIDPolicy for messaging
 -->

<xs:annotation>
 <xs:documentation>RID Policy used for transport of
     messages</xs:documentation>
</xs:annotation>
<!-- RIDPolicy information with setting information listed in RID
     documentation -->

<xs:element name="RIDPolicy" type="iodef-rid:RIDPolicyType"/>
  <xs:complexType name="RIDPolicyType">
    <xs:sequence>
      <xs:element ref="iodef-rid:PolicyRegion" maxOccurs="unbounded"/>
      <xs:element ref="iodef:Node"/>
      <xs:element ref="iodef-rid:TrafficType" maxOccurs="unbounded"/>
      <xs:element ref="iodef:IncidentID" minOccurs="0"/>
    </xs:sequence>
   <xs:attribute name="MsgType" use="required">
    <xs:simpleType>
      <xs:restriction base="xs:NMTOKEN">
      <xs:whiteSpace value="collapse"/>
        <xs:enumeration value="TraceRequest"/>
        <xs:enumeration value="RequestAuthorization"/>
        <xs:enumeration value="Result"/>
        <xs:enumeration value="Investigation"/>
        <xs:enumeration value="Report"/>
        <xs:enumeration value="IncidentQuery"/>
        <xs:enumeration value="ext-value"/>
      </xs:restriction>
    </xs:simpleType>
   </xs:attribute>
  <xs:attribute name="ext-MsgType" type="xs:string" use="optional"/>
  <xs:attribute name="MsgDestination" use="required">
    <xs:simpleType>
      <xs:restriction base="xs:NMTOKEN">
      <xs:whiteSpace value="collapse"/>
        <xs:enumeration value="RIDSystem"/>
        <xs:enumeration value="SourceOfIncident"/>
        <xs:enumeration value="ext-value"/>
      </xs:restriction>
    </xs:simpleType>
   </xs:attribute>
  <xs:attribute name="ext-MsgDestination" type="xs:string"
                use="optional"/>
   </xs:complexType>

  <xs:element name="PolicyRegion">
    <xs:complexType>
     <xs:attribute name="region" use="required">
      <xs:simpleType>
       <xs:restriction base="xs:NMTOKEN">
       <xs:whiteSpace value="collapse"/>
         <xs:enumeration value="ClientToNP"/>
         <xs:enumeration value="NPToClient"/>
         <xs:enumeration value="IntraConsortium"/>
         <xs:enumeration value="PeerToPeer"/>
         <xs:enumeration value="BetweenConsortiums"/>
         <xs:enumeration value="AcrossNationalBoundaries"/>
         <xs:enumeration value="ext-value"/>
       </xs:restriction>
      </xs:simpleType>
     </xs:attribute>
     <xs:attribute name="ext-region"
                   type="xs:string" use="optional"/>
    </xs:complexType>
  </xs:element>
  <xs:element name="TrafficType" default="Attack">
    <xs:complexType>
     <xs:attribute name="type" use="required">
      <xs:simpleType>
       <xs:restriction base="xs:NMTOKEN">
       <xs:whiteSpace value="collapse"/>
         <xs:enumeration value="Attack"/>
         <xs:enumeration value="Network"/>
         <xs:enumeration value="Content"/>
         <xs:enumeration value="OfficialBusiness"/>
         <xs:enumeration value="Other"/>
         <xs:enumeration value="ext-value"/>
       </xs:restriction>
      </xs:simpleType>
     </xs:attribute>
     <xs:attribute name="ext-type"
                   type="xs:string" use="optional"/>
    </xs:complexType>
  </xs:element>
</xs:schema>

6. Security Considerations ✨

Okay bestie, this part is serious but we're gonna get through it together 🫶. Communication between NPs' RID systems must be protected 🔒. RID has a lot of security stuff built right into its design, and several of those pieces are covered in the sub-sections below 💅. To see the full picture, you have to think about availability, confidentiality, and integrity for how info is transported, stored, and exchanged 🧠.

When it comes to transport, an out-of-band network (logical or physical) would protect RID communication from outside attacks, which is giving fortress 🏰. An out-of-band connection would be ideal, but it isn't always practical, ngl 🥺. Authenticated encrypted tunnels between RID systems MUST be used to provide confidentiality, integrity, authenticity, and privacy for the data 🔐. Trust relationships are built on consortiums and on established public key infrastructure (PKI) cross-certifications between consortiums 🤝. RID uses RIDPolicy info, TLS, and the XML security features of encryption [XMLencrypt] and digital signatures [RFC3275], [XMLsig], so it's standing on existing security standards 👑. Those standards give clear ways to make sure messages are secure, authenticated, and authorized, and that they meet policy and privacy guidelines and keep their integrity ✨.

As specified in the relevant sections of this document, the XML digital signature [RFC3275] and XML encryption [XMLencrypt] are used in the following cases:

XML Digital Signature

• The originator of the TraceRequest or Investigation request MUST use a detached signature to sign at least one of the original IP packets included in the RecordItem class data, so every upstream participant in the trace can authenticate the origin 🕵️. All IP packets provided by the originator may be signed, and additional packets added by upstream peers may be signed by the peer adding the data, while the IP packet and detached signature from the original requestor stay intact 🧵. This signature MUST be passed to all recipients of the TraceRequest 📨.
• For all message types, the full IODEF/RID document MUST be signed using an enveloped signature by the sending peer, which gives authentication and integrity to the receiving RID system 💅.

XML Encryption

• The IODEF/RID document may be encrypted for an extra layer of security between peers, so the message is protected not just for transport but also while stored 🗄️. Peers or a consortium can agree on this, or it can be decided per message, depending on security requirements. It should be noted that there are transport cases where the RIDPolicy class needs to be presented in clear text, as detailed in the transport document [RFC6046] 👀.
• An Investigation request, or any other message type that may be relayed through RID systems other than the intended destination because of trust relationships, may be encrypted for the intended recipient 🎀. This may be necessary if the RID network is being used for message transfer, the intermediate parties don't need to know the request contents, and a direct communication path doesn't exist. In that case, the RIDPolicy class is used by intermediate parties and is maintained in clear text 🫣.
• The action taken in the Result message may be encrypted using the key of the request originator 🔑. In that case, intermediate parties can still view the RIDPolicy information and know the trace has been completed, without needing to see the action 🙈. If encryption is limited to sections of the message, the History class information would be encrypted. Otherwise, it is RECOMMENDED to encrypt the entire IODEF/RID document, using an enveloped signature, for the originator of the request 💜. The existence of the Result message for an incident would tell any intermediate parties used in the path of the incident investigation that the incident handling has been completed ✅.

The formation of policies is a very important part of using a messaging system like RID to exchange potentially sensitive information 🚨. Lots of things should be considered by peering parties, and some guidelines for protecting the data, systems, and transport are covered in this section. Policies that get established should provide guidelines for communication methods, security, and fall-back procedures 📋.

The security considerations for storing and exchanging information in RID messaging may include following local, regional, or national regulations, in addition to the obligations to protect client information during an investigation ⚖️. RID Policy is a necessary tool for listing the requirements of messages, giving a way to categorize data elements for proper handling 🏷️. Controls are also provided for the sending entity to protect messages from third parties through XML encryption 🛡️.

RID provides a method to exchange incident handling requests and Report messages with peer networks 🌐. Network administrators, who can make decisions based on the resources available and other factors in their network, keep control of incident investigations within their own network 👑. So RID gives participating networks the ability to manage their own security controls, leveraging the information listed in RIDPolicy 💖.

---

6.1. Message Transport

The transport specifications are fully defined in a separate document [RFC6046] 📖. The specified transport protocols MUST use encryption to provide an additional level of security and integrity, while supporting mutual authentication through bi-directional certificate usage 🔐. Any subsequent transport method defined should take advantage of existing standards, which makes implementation and integration of RID systems easier 🧩. Session encryption for the transport of RID messages is enforced in the transport specification 💅. The privacy and security considerations are addressed fully in RID to protect sensitive portions of documents and provide a method to authenticate the messages. Therefore, RID messages don't rely on the security provided by the transport layer alone 🙌. The encryption requirements and considerations for RID are discussed at the beginning of Section 6 of this document 📍.

XML security functions such as the digital signature [RFC3275] and encryption [XMLencrypt] give a standards-based way to encrypt and digitally sign RID messages 🎀. RID messages specify system use and privacy guidelines through the RIDPolicy class. A public key infrastructure (PKI) provides the base for authentication and authorization, encryption, and digital signatures, which set up trust relationships between members of a RID consortium or a peering consortium 🌈.

XML security functions such as the digital signature [RFC3275] and encryption [XMLencrypt] can also be used within the contents of the message for privacy and security, in cases where certain elements must stay encrypted or signed as they travel along the path of a trace 🕵️‍♀️. For example, the digital signature on a TraceRequest can be used to verify the identity of the trace originator ✅. The use of the XML security features in RID messaging follows the specifications for the IODEF model. However, the use requirements may differ, since RID also carries security incident information 🚨.

---

6.2. Message Delivery Protocol - Integrity and Authentication

The RID protocol must be able to guarantee delivery and meet the necessary security requirements of a state-of-the-art protocol 🚀. To guarantee delivery, TCP should be considered as the underlying protocol, following current network standard practices 🧱.

Security considerations must include the integrity, authentication, privacy, and authorization of the messages sent between RID communication systems or IHSs 🔐. Communication between RID systems must be authenticated and encrypted to ensure the integrity of the messages and of the RID systems involved in the trace 💜. Another concern is authentication for a request that traverses multiple networks 🛤️. In this scenario, systems in the path of the multi-hop TraceRequest need to authorize a trace not only from their neighbor network, but also from the initiating RID system, as discussed in Section 6.4 👀. Several methods can be used to ensure integrity and privacy of the communication 🎀.

The transport mechanism selected MUST follow the defined transport protocol [RFC6046] when using RID messaging, so peers stay consistent 📏. Consortiums may vary their selected transport mechanisms, so they must decide on a mutual protocol to use for transport when communicating with peers in a neighboring consortium using RID 🤝. RID systems MUST implement and deploy HTTPS as defined in the transport document [RFC6046], and optionally support other protocols such as the Blocks Extensible Exchange Protocol (BEEP) 🌸. RID, the XML security functions, and transport protocols must properly integrate with a public key infrastructure (PKI) managed by the consortium or one managed by a trusted entity 🏛️. For the Internet, an example of an existing effort that could be leveraged to provide the supporting PKI is the American Registry for Internet Numbers (ARIN) and the Regional Internet Registry's (RIR's) PKI hierarchy 🌍. Security and privacy considerations related to consortiums are discussed in Sections 6.5 and 6.6 📚.

---

6.3. Transport Communication

Out-of-band communications dedicated to NP interaction for RID messaging would provide additional security, as well as guaranteed bandwidth during a denial-of-service attack 🛡️. For example, an out-of-band channel may consist of logical paths defined over the existing network. Out-of-band communications may not be possible between all network providers, but they should be considered to protect the network management systems used for RID messaging 🧠. Methods to protect the data transport may also be provided through session encryption 🔐.

To address the integrity and authenticity of messages, transport encryption MUST be used to secure the traffic sent between RID systems 💖. Systems with predefined relationships for RID would include those who peer within a consortium with agreed-upon appropriate use regulations, and peering consortiums 🤝. Trust relationships may also be defined through a bridged or hierarchical PKI that both peers belong to 🌈.

Systems used to send authenticated RID messages between networks MUST use a secured system and interface to connect to a border network's RID systems 🚪. Each connection to a RID system MUST meet the security requirements agreed upon through consortium regulations, peering, or SLAs 📜. The RID system MUST only listen for and send RID messages on the designated port, which also MUST be over an encrypted tunnel meeting the minimum requirement of algorithms and key lengths established by the consortium, peering, or SLA 🔒. The selected cryptographic algorithms for symmetric encryption, digital signatures, and hash functions MUST meet minimum security levels of the times ⏳. The encryption strength MUST adhere to import and export regulations of the countries involved in the data exchange 🌍✨.

6.4. Authentication of RID Protocol ✨

okay so bestie, RID messages have to be authentic 🔐 and that's why the protocol uses a message authentication scheme to secure itself. The XML security functions in RID need a trust center, like a PKI, to hand out credentials, and layered transport protocols also use encryption and rely on a trust center 🫶. Public key certificate pairs issued by a trusted Certification Authority (CA) MAY be used to give RID the authentication and encryption it needs 💖. The CA used for RID messaging must be trusted by all involved parties, and it can take advantage of similar efforts, like the Internet2 federated PKI or the ARIN/RIR effort to provide a PKI to network providers 🌸. The PKI used for authentication would also provide the certificates needed for the encryption used by the RID transport protocol [RFC6046] 🦋.

Pre-shared keys may be considered for authentication too 🗝️. If you go that route, the specifications in "Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)" [RFC4279] MUST be followed 🙈.

Now the big one 👑: hosts receiving a RID message MUST be able to verify that the sender of the request is valid and trusted. Digital signatures on a hash of the RID message, using an X.509 version 3 certificate issued by a trusted party, MUST be used to authenticate the request 💅. The X.509 version 3 specifications, plus the digital signature and path validation standards in [RFC5280], MUST be followed so you can interoperate with a PKI designed for similar purposes 🎀. The IODEF specification MUST be followed for digital signatures, giving you the authentication and integrity that secure messaging between network providers needs ✨. When digital signatures are used in RID XML messages, the World Wide Web Consortium (W3C) recommendations for signature syntax and processing MUST be followed, whether XML encryption [XMLencrypt] or digital signature [XMLsig], [RFC3275] is used within a document 🧚. Transport specifications are detailed in a separate document [RFC6046] 📄.

It might be helpful to define an extension to the authentication scheme that uses attribute certificates [RFC5755], so an application could automatically work out whether human intervention is needed to authorize a request 🤔. Just a heads up though, specifying that extension is out of scope for this document 🙈.

6.4.1. Multi-Hop TraceRequest Authentication 🦋

okay this is the part where trust gets passed down the line 🔗. Bilateral trust relations between network providers keep requests for TraceRequests authentic when they come from immediate peers in the web of networks built to provide the traceback capability 🕸️. A network provider several hops into the path of the RID trace has to trust the information from its own trust relationships, as well as the previous trust relationships in the downstream path 💜. For practical reasons, the NPs may want to prioritize incident handling events based on the immediate peer for a TraceRequest, the originator, and the listed Confidence rating for the incident 📊.

To get a higher assurance level for the authenticity of the TraceRequest, the originating RID system is included in the TraceRequest, along with contact information and the information of all RID systems in the path the trace has taken 🌈. This info comes through the IODEF EventData class, which nests the list of systems and contacts involved in a trace and sets the category attribute to "infrastructure" 🍓.

A second measure MUST be taken to make sure the identity of the originating RID system is verified 🔍. The originating RID system MUST include a digital signature in the TraceRequest sent to all systems in the upstream path 🖋️. That signature is made on the RecordItem class of the IODEF, following the XML digital signature specifications from W3C [XMLsig], using a detached signature 💖. The signature MUST be passed to all parties that receive a TraceRequest, and each party MUST be able to perform full path validation on it 🙌. Full path validation checks the chaining relationship back to a trusted root, and it also does a certificate revocation check 🔎. To make that work, the IP packet in the RecordItem data MUST remain unchanged as the request passes between providers, and it's the only element the signature is applied to 🎯. If additional packets are included in the document at upstream peers, the initial packet MUST still remain with the detached signature 🫶. The subsequent packets may be signed by the peer adding the incident information for the investigation ✍️. A second benefit is that the integrity of the filter is ensured as it's passed to subsequent NPs in the upstream trace of the packet 🛡️. The trusted PKI also provides the keys used to digitally sign the RecordItem class for TraceRequests, which meets the requirement of authenticating the original request 🔑. Any host in the path of the trace should be able to verify the digital signature using the trusted PKI 🧐.

Now, if an enterprise network using RID sends a TraceRequest to its provider, the signature from the enterprise network MUST be included in the initial request 🏢. The NP may generate a new request to send upstream to members of the NP consortium to continue the trace 🚀. If the original request is sent, the originating NP, acting on behalf of the enterprise network under attack, MUST also digitally sign the full IODEF document with an enveloped signature, so the authenticity of the TraceRequest is assured 💅. An NP that offers RID as a service may be using its own PKI to secure RID communications between its RID system and the attached enterprise networks 🎁. NPs participating in the trace MUST be able to determine the authenticity of RID requests 👑.

6.5. Consortiums and Public Key Infrastructures 🌈

okay consortiums are basically the ideal way to build a communication web of trust for RID messaging 🕸️💖. A consortium could provide centralized resources, like a PKI, plus established guidelines for using the RID protocol 📚. It would also help set up trust relationships between the participating NPs, so they get the cooperation and experience-sharing they need among consortium entities 🤝. This may be established through PKI certificate policy [RFC3647] reviews, which help figure out the right trust levels between organizations or entities 🔍. A consortium may also be used for other purposes that make communication among NPs easier in a common area (Internet, region, government, education, private networks, etc.) 🌍.

Using a PKI to distribute certificates for RID systems is an already established way to link trust relationships between NPs in consortiums that peer with NPs from a separate consortium 🧩. In other words, consortiums can peer with other consortiums so RID messages can flow between the participating NPs 🦋. The PKI, together with Memorandums of Agreement, could be used to link border directories and share public key information through a bridge, a hierarchy, or a single cross-certification relationship 🌉.

Consortiums also need to set up guidelines that each participating NP has to adhere to 📋. The RECOMMENDED guidelines include:

• Physical and logical practices to protect RID systems;
• Network and application layer protection for RID systems and communications;
• Proper use guidelines for RID systems, messages, and requests; and
• A PKI to provide authentication, integrity, and privacy.

The functions a consortium plays would parallel those of a PKI federation 🧁. The PKI federations that exist today are responsible for setting security guidelines and PKI trust models 🛡️. Those trust models support applications that share information using trusted methods and protocols 💅.

A PKI can also give the same level of security for communication between an end entity (enterprise, educational, or government customer network) and the NP 🎀. The PKI may be a subordinate CA, or sit in the CA hierarchy from the NP's consortium, to establish the trust relationships needed as the request is made to other connected networks 🌸.

6.6. Privacy Concerns and System Use Guidelines 🔥

okay privacy is a HUGE deal 😭. Sharing information is sometimes needed to stop or mitigate a security incident, but it raises a lot of concerns 💭. The RIDPolicy class automates the enforcement of the privacy concerns listed in this document 🤖. The privacy and system use concerns that MUST be addressed in the RID system and other integrated components include the following:

Network Provider Concerns:

• Privacy of data monitored and/or stored on IDSs for attack detection.
• Privacy of data monitored and stored on systems used to trace traffic across a single network.

Customer Attached Networks Participating in RID with NP:

• Customer networks may include an enterprise, educational, government, or other attached networks to an NP participating in RID, and they MUST be made fully aware of the security and privacy considerations for using RID 📣.
• Customers MUST know the security and privacy considerations in place by their NP and the consortium of which the NP is a member 🧠.
• Customers MUST understand that their data can and will be sent to other NPs in order to complete a trace, unless an agreement stating otherwise is made in the service level agreements between the customer and NP 💌.

Parties Involved in the Attack:

• Privacy of the identity of a host involved in an attack.
• Privacy of information such as the source and destination used for communication purposes over the monitored or RID connected network(s).
• Protection of data from being viewed by intermediate parties in the path of an Investigation request MUST be considered 🕵️.

Consortium Considerations:

• System use restricted to security incident handling within the local region's definitions of appropriate traffic for the network monitored and linked via RID in a single consortium, also abiding by the consortium's use guidelines 🌷.
• System use prohibiting the consortium's participating NPs from inappropriately tracing non-attack traffic to locate sources or mitigate traffic unlawfully within the jurisdiction or region 🚫.

Inter-Consortium Considerations:

• System use between peering consortiums MUST also adhere to any government communication regulations that apply between those two regions, such as encryption export and import restrictions. This may include consortiums that are categorized as "BetweenConsortiums" or "AcrossNationalBoundaries" 🌐.
• System use between consortiums MUST NOT request traffic traces and actions beyond the scope intended and permitted by law or inter-consortium agreements 🙅.
• System use between consortiums classified as "AcrossNationalBoundaries" MUST respect national boundary issues and limit requests to appropriate system use, and not to achieve their own agenda to limit or restrict traffic that is otherwise permitted within the country in which the peering consortium resides 🫡.

The security and privacy considerations listed above are for the consortiums, NPs, and enterprises to agree upon 🤝 The agreed-upon policies may be facilitated through use of the RIDPolicy class ✨ Some privacy considerations are addressed through the RID guidelines for encryption and digital signatures as described at the beginning of Section 6 🔐

RID is useful for figuring out the true source of a packet that traverses multiple networks, or for communicating security incidents and automating the response 🕵️‍♀️ The information obtained from the trace may determine the identity of the source host or the network provider used by the source of the traffic 👀 It should be noted that the trace mechanism used across a single-network provider may also raise privacy concerns for the clients of the network 🙈 Methods that may raise concern include those that involve storing packets for some length of time in order to trace packets after the fact 📦 Monitoring networks for intrusions and for tracing capabilities also raises concerns for potentially sensitive valid traffic that may be traversing the monitored network 💭 IDSs and single-network tracing are outside of the scope of this document, but the concern should be noted and addressed within the use guidelines of the network 📋 Some IDSs and single-network trace mechanisms attempt to properly address these issues 💅 RID is designed to provide the information needed by any single-network trace mechanism ✨ The provider's choice of a single trace mechanism depends on resources, existing solutions, and local legislation 🌸 Privacy concerns in regard to the single-network trace must be dealt with at the client-to-NP level and are out of scope for RID messaging 🫶

The identity of the true source of an attack packet being traced through RID could be sensitive 😭 The true identity listed in a Result message can be protected through the use of encryption [XMLencrypt] enveloping the IODEF document and RID Result information, using the public encryption key of the originating NP 🔑 Alternatively, the action taken may be listed without the identity being revealed to the originating NP 🦋 The ultimate goal of the RID communication system is to stop or mitigate attack traffic, not to ensure that the identity of the attack traffic is known to involved parties 🎯 The NP that identifies the source should deal directly with the involved parties and proper authorities in order to determine the guidelines for the release of such information, if it is regarded as sensitive 🧚 In some situations, systems used in attacks are compromised by an unknown source and, in turn, are used to attack other systems 😬 In that situation, the reputation of a business or organization may be at stake, and the action taken may be the only additional information reported in the Result message to the originating system 💼 If the security incident is a minor incident, such as a zombie system used in part of a large-scale DDoS attack, ensuring the system is taken off the network until it has been fixed may be sufficient 🧟‍♀️ The decision is left to the system users and consortiums to determine appropriate data to be shared, given that the goal of the specification is to provide the appropriate technical options to remain compliant 📝 The textual descriptions should include details of the incident in order to protect the reputation of the unknowing attacker and prevent the need for additional investigation 🌈 Local, state, or national laws may dictate the appropriate reporting action for specific security incidents ⚖️

Privacy becomes an issue whenever sensitive data traverses a network 🚨 For example, if an attack occurred between a specific source and destination, then every network provider in the path of the trace would become aware that the cyber attack occurred 👑 In a targeted attack, it may not be desirable that information about two nation states that are battling a cyber war would become general knowledge to all intermediate parties 🌍 However, it is important to allow the traces to take place in order to halt the activity, since the health of the networks in the path could also be at stake during the attack 💜 This provides a second argument for allowing the Result message to only include an action taken and not the identity of the offending host 🎀 In the case of an Investigation request, where the originating NP is aware of the NP that will receive the request for processing, the free-form text areas of the document could be encrypted [XMLencrypt] using the public key of the destination NP to ensure that no other NP in the path can read the contents 🔒 The encryption would be accomplished through the W3C [XMLencrypt] specification for encrypting an element 🛠️

In some situations, all network traffic of a nation may be granted through a single network provider 🇺🇳 In that situation, options must support sending Result messages from a downstream peer of that network provider 🪞 That option provides an additional level of abstraction to hide the identity and the NP of the identified source of the traffic 🫥 Legal action may override this technical decision after the trace has taken place, but that is out of the technical scope of this document ⚖️

Privacy concerns when using an Investigation request to request action close to the source of valid attack traffic need to be considered 🔍 Although the intermediate NPs may relay the request if there is no direct trust relationship to the closest NP to the source, the intermediate NPs do not require the ability to see the contents of the packet or the text description field(s) in the request 🙌 This message type does not require any action by the intermediate RID systems, except to relay the packet to the next NP in the path 🏃‍♀️ Therefore, the contents of the request may be encrypted for the destination system 🔐 The intermediate NPs would only need to know how to direct the request to the manager of the ASN in which the source IP address belongs 🗺️

Traces must be legitimate security-related incidents and not used for purposes such as sabotage or censorship 🚫 An example of such abuse of the system would include a request to block or rate-limit legitimate traffic to prevent information from being shared between users on the Internet (restricting access to online versions of papers), or restricting access from a competitor's product in order to sabotage a business 💀

Intra-consortium RID communications raise additional issues, especially when the peering consortiums reside in different regions or nations 🌏 TraceRequests and requested actions to mitigate traffic must adhere to the appropriate use guidelines and yet prevent abuse of the system 🧐 First, the peering consortiums MUST identify the types of traffic that can be traced between the borders of the participating NPs of each consortium 🧾 The traffic traced should be limited to security-incident-related traffic ✅ Second, the traces permitted within one consortium, if passed to a peering consortium, may infringe upon the peering consortium's freedom of information laws 📚 An example would be a consortium in one country permitting a trace of traffic containing objectionable material that is outlawed within that country 🚧 The RID trace may be a valid use of the system within the confines of that country's network border; however, it may not be permitted to continue across network boundaries where such content is permitted under law 🌐 By continuing the trace in another country's network, the trace and response could have the effect of improperly restricting access to data 😤 A continued trace into a second country may break the laws and regulations of that nation 📜 Any such traces MUST cease at the country's border 🛑

The privacy concerns listed in this section address issues among the trusted parties involved in a trace within an NP, a RID consortium, and peering RID consortiums 🤍 Data used for RID communications must also be protected from parties that are not trusted 🛡️ This protection is provided through the authentication and encryption of documents as they traverse the path of trusted servers 🔗 Each RID system MUST perform a bi-directional authentication when sending a RID message and use the public encryption key of the upstream or downstream peer to send a message or document over the network 🤝 This means that the document is decrypted and re-encrypted at each RID system via TLS over the transport protocol [RFC6046] 🧩 The RID messages may be decrypted at each RID system in order to properly process the request or relay the information 📨 Today's processing power is more than sufficient to handle the minimal burden of encrypting and decrypting relatively small typical RID messages 💪✨

7. IANA Considerations 🗂️

This document uses URNs to describe XML namespaces and XML schemas [XMLschema] conforming to a registry mechanism described in [RFC3688] 📇

Registration request for the iodef-rid namespace:

URI: urn:ietf:params:xml:ns:iodef-rid-1.0

Registrant Contact: See the "Author's Address" section of this
document.

XML: None.  Namespace URIs do not represent an XML specification.

Registration request for the iodef-rid XML schema:

URI: urn:ietf:params:xml:schema:iodef-rid-1.0

Registrant Contact: See the "Author's Address" section of this
document.

XML: See Section 5, "RID Schema Definition", of this document.

8. Summary 🎀

Security incidents have always been difficult to trace because of spoofed sources, resource limitations, and bandwidth utilization problems 😩 Incident response is often slow even when the IP address is known to be valid, because of the resources required to notify the responsible party of the attack and then to stop or mitigate the attack traffic 🐢 Methods to identify and trace attacks in near real time are essential to thwarting attack attempts ⏱️ Network providers need policies and automated methods to combat the hacker's efforts 🥊 NPs need automated monitoring and response capabilities to identify and trace attacks quickly without resource-intensive side effects 🏎️ Integration with a centralized communication system to coordinate the detection, tracing, and identification of attack sources on a single network is essential 🧠 RID provides a way to integrate NP resources for each aspect of attack detection, tracing, and source identification, and it extends the communication capabilities among network providers 🌟 The communication is accomplished through the use of flexible IODEF XML-based documents passed between IHSs or RID systems 📄 A TraceRequest or Investigation request is communicated to an upstream NP and may result in an upstream trace or in an action to stop or mitigate the attack traffic 🔥 The messages are communicated among peers, with security inherent to the RID messaging scheme provided through existing standards such as XML encryption and digital signatures 🔐 Policy information is carried in the RID message itself through the use of the RIDPolicy 📜 RID provides the timely communication among NPs, which is essential for incident handling 💖

9. References 📚

9.1. Normative References

okay so these are the must-read-first docs 📚💅 everything below is stuff the spec leans on, so you need the exact details:

[RFC2119]      Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3275]      Eastlake 3rd, D., Reagle, J., and D. Solo,
               "(Extensible Markup Language) XML-Signature Syntax and
               Processing", RFC 3275, March 2002.

[RFC3688]      Mealling, M., "The IETF XML Registry", BCP 81, RFC
               3688, January 2004.

[RFC4279]      Eronen, P., Ed., and H. Tschofenig, Ed., "Pre-Shared
               Key Ciphersuites for Transport Layer Security (TLS)",
               RFC 4279, December 2005.

[RFC5070]      Danyliw, R., Meijer, J., and Y. Demchenko, "The
               Incident Object Description Exchange Format", RFC
               5070, December 2007.

[RFC5280]      Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
               Housley, R., and W. Polk, "Internet X.509 Public Key
               Infrastructure Certificate and Certificate Revocation
               List (CRL) Profile", RFC 5280, May 2008.

[RFC5755]      Farrell, S., Housley, R., and S. Turner, "An Internet
               Attribute Certificate Profile for Authorization",
               RFC 5755, January 2010.

[RFC6046]      Moriarty, K. and B. Trammell, "Transport of Real-Time
               Inter-Network Defense (RID) Messages," RFC 6046,
               November 2010.

[XML1.0]       "Extensible Markup Language (XML) 1.0 (Second
               Edition)".  W3C Recommendation.  T. Bray, E. Maler, J.
               Paoli, and C.M. Sperberg-McQueen.  October 2000.
               http://www.w3.org/TR/2000/REC-xml-20001006.

[XMLnames]     "Namespaces in XML 1.0 (Third Edition)".  W3C
               Recommendation.  T. Bray, D. Hollander, A. Layman, R.
               Tobin, H. Thompson.  December 2009.
               http://www.w3.org/TR/REC-xml-names/.

[XMLencrypt]   "XML Encryption Syntax and Processing".  W3C
               Recommendation.  T. Imamura, B. Dillaway, and E.
               Simon.  December 2002.
               http://www.w3.org/TR/xmlenc-core/.

[XMLschema]    "XML Schema".  E. Van der Vlist.  O'Reilly.  2002.

[XMLsig]       "XML-Signature Syntax and Processing (Second
               Edition)".  W3C Recommendation.  M. Bartel, J. Boyer,
               B. Fox, B. LaMacchia, and E. Simon.  June 2008.
               http://www.w3.org/TR/xmldsig-core/#sec-Design.

---

9.2. Informative References

these ones are the background reading 🧚 handy for going deeper, but they aren't the core rules:

[RFC1930]      Hawkinson, J. and T. Bates, "Guidelines for creation,
               selection, and registration of an Autonomous System
               (AS)", BCP 6, RFC 1930, March 1996.

[RFC2827]      Ferguson, P. and D. Senie, "Network Ingress Filtering:
               Defeating Denial of Service Attacks which employ IP
               Source Address Spoofing", BCP 38, RFC 2827, May 2000.

[RFC3647]      Chokhani, S., Ford, W., Sabett, R., Merrill, C., and
               S. Wu, "Internet X.509 Public Key Infrastructure
               Certificate Policy and Certification Practices
               Framework", RFC 3647, November 2003.

[RFC3917]      Quittek, J., Zseby, T., Claise, B., and S. Zander,
               "Requirements for IP Flow Information Export (IPFIX)",
               RFC 3917, October 2004.

[RFC5735]      Cotton, M. and L. Vegoda, "Special Use IPv4
               Addresses", BCP 153, RFC 5735, January 2010.

[IPtrace]      "Advanced and Authenticated Marking Schemes for IP
               Traceback".  D. Song and A. Perrig.  IEEE INFOCOM
               2001.

[HASH-IPtrace] "Hash-Based IP Traceback".  A. Snoeren, C. Partridge,
               L. Sanchez, C. Jones, F. Tchakountio, S. Kent, and W.
               Strayer.  SIGCOMM'01.  August 2001.

[ICMPtrace]    Bellovin, S., Leech, M., and T. Taylor, "ICMP
               Traceback Messages", Work in Progress, February 2003.

[NTWK-IPtrace] "Practical network support for IP traceback".  S.
               Savage, D. Wetherall, A. Karlin, and T. Anderson.
               SIGCOMM'00.  August 2000.

[DoS]          "Trends in Denial of Service Attack Technology".  K.
               Houle, G. Weaver, N. Long, and R. Thomas.  CERT
               Coordination Center.  October 2001.

Acknowledgements 🫶

huge thank yous to the coworkers and the wider Internet community who reviewed and commented on this doc and gave recommendations to simplify and secure the protocol 🙌 the whole crew: Robert K. Cunningham, Ph.D, Cynthia D. McLain, Dr. William Streilein, Iljitsch van Beijnum, Steve Bellovin, Yuri Demchenko, Jean-Francois Morfin, Stephen Northcutt, Jeffrey Schiller, Brian Trammell, Roman Danyliw, Tony Tauber, and Sandra G. Dykes, Ph.D. legends, all of them 👑

Sponsor Information ✨

this work was sponsored by the Air Force under Air Force Contract FA8721-05-C-0002, while the author was working at MIT Lincoln Laboratory 🎀 and there's a disclaimer too:

"Opinions, interpretations, conclusions, and recommendations are those of the author and are not necessarily endorsed by the United States Government".

Author's Address 💜

Kathleen M. Moriarty
RSA, The Security Division of EMC
174 Middlesex Turnpike
Bedford, MA  01730
US

EMail: Moriarty_Kathleen@EMC.com