CCing the WG because I was wrong about the aliases. ---------- Forwarded message --------- From: Eric Rescorla <[email protected]> Date: Fri, Dec 21, 2018 at 6:32 AM Subject: AD Review of draft-ietf-i2nsf-applicability-07 To: <[email protected]>
Rich version of this review at: https://mozphab-ietf.devsvcdev.mozaws.net/D3181 I found a number of typographical and grammar errors. Please give this document a thorough read. IMPORTANT S 1. > > Interface to Network Security Functions (I2NSF) defines a framework > and interfaces for interacting with Network Security Functions > (NSFs). The I2NSF framework allows heterogeneous NSFs developed by > different security solution vendors to be used in the Network > Functions Virtualization (NFV) environment [ETSI-NFV] by utilizing Much of this document cannot be understood without reading ETSI-NFV, so it has to be a normative reference. It also would be helpful to provide a link. S 2. > This document uses the terminology described in [RFC7149], > [ITU-T.Y.3300], [ONF-OpenFlow], [ONF-SDN-Architecture], > [ITU-T.X.1252], [ITU-T.X.800], [RFC8329], [i2nsf-terminology], > [consumer-facing-inf-im], [consumer-facing-inf-dm], > [i2nsf-nsf-cap-im], [nsf-facing-inf-dm], [registration-inf-dm], and > [nsf-triggered-steering]. In addition, the following terms are Every term in this document needs to be understandable without reference to closed specifications or internally defined. Please ensure that this is so, S 3. > used for the I2NSF NSF-Facing Interface. > > The Registration Interface between the Security Controller and the > Developer's Management System can be implemented by RESTCONF > [RFC8040]. The data model defined in [registration-inf-dm] can be > used for the I2NSF Registration Interface. What role does the Developer's Management System play in this? I think this refers to the text above starting with "The developers (or vendors)...". Is that correct? Assuming I am correct, this seems like a potentially serious security vulnerability in this design in that it potentially allows an inside attacker at the developer to seriously weaken a system's security. What protections exist to prevent this? S 4. > administrator wants to control the staff members' access to a > particular Interner service (e.g., Example.com) during business > hours. The following is an example high-level security policy rule > that the administrator requests: Block the staff members' access to > Example.com from 9 AM to 6 PM. The administrator sends this high- > level security policy to the Security Controller, then the Security The text above suggests that high-level policies are via RESTCONF/YANG, but this is clearly freeform text. COMMENTS S 1. > > 1. Introduction > > Interface to Network Security Functions (I2NSF) defines a framework > and interfaces for interacting with Network Security Functions > (NSFs). The I2NSF framework allows heterogeneous NSFs developed by Please define "Network Security Functions" here. S 1. > functions in the NFV platform. In the I2NSF framework, each NSF > initially registers the profile of its own capabilities into the > system in order for themselves to be available in the system. In > addition, the Security Controller is validated by the I2NSF Client > (also called I2NSF User) that the user is employing, so that the user > can request security services through the Security Controller. In this case the user is the system administrator. S 1. > [RFC7149] to provide different security functionality such as > firewalls [opsawg-firewalls], Deep Packet Inspection (DPI), and > Distributed Denial of Service (DDoS) attack mitigation; (iv) the use > of NFV as supporting technology. The implementation of I2NSF in > these scenarios has allowed us to verify the applicability and > effectiveness of the I2NSF framework for a variety of use cases. This would be easier to read with a standard bulleted list. S 2. > network resources, which facilitates the design, delivery and > operation of network services in a dynamic and scalable manner > [ITU-T.Y.3300]. > > o Firewall: A service function at the junction of two network > segments that inspects every packet that attempts to cross the Nit: It might not inspect *every* packet. S 4. > > 4. Time-dependent Web Access Control Service > > This service scenario assumes that an enterprise network > administrator wants to control the staff members' access to a > particular Interner service (e.g., Example.com) during business Nit: "Internet" S 4. > inspection capability is required to check whether the target URL of > a received packet is in the Example.com domain or not. > > The Security Controller maintains the security capabilities of each > NSF running in the I2NSF system, which have been reported by the > Developer's Management System via the Registation interface. Based Nit: "Registration" S 4. > currently using the network. Based on the retrieved information, the > Security Controller generates low-level security rules to check > whether the source IP address of a received packet matches any one > being used by a staff member. In addition, the low-level security > rules should be able to determine that a received packet is of HTTP > protocol. The low-level security rules for web filter checks that Nit: "rules"... "checks" disagree. S 6. > translated into their packet forwarding rules, whereas NSFs enforce > NSF-related security rules requiring the security capabilities of the > NSFs. For this purpose, the Security Controller instructs the SDN > Controller via NSF-Facing Interface so that SDN forwarding elements > can perform the required security services with flow tables under the > supervision of the SDN Controller. I'm having some trouble understanding the difference here between NSFs and SDN elements. They both seem to be software controlled network elements. Is this just some continuum about CPU power? S 6. > can perform the required security services with flow tables under the > supervision of the SDN Controller. > > As an example, let us consider two different types of security rules: > > Rule A is a simple packet fltering rule that checks only the IP Nit: "filtering" S 6.2. > packets that have the same call-id. > > 6. The SDN Controller installs new rules (e.g., drop packets) into > underlying switches. > > 7. The illegal packets are dropped by these switches. "Illegal" is probably the wrong wrod here. S 6.3. > is helpful to determine security policies for such a network. > > 6.3. Attack Mitigation: Centralized DDoS-attack Mitigation System > > A centralized DDoS-attack mitigation can manage each network resource > and manipulate rules to each switch through a common server for DDoS- "manipulate rules to" is not grammatical. S 6.3. > > Servers are categorized into stateless servers (e.g., DNS servers) > and stateful servers (e.g., web servers). For DDoS-attack > mitigation, traffic flows in switches are dynamically configured by > traffic flow forwarding path management according to the category of > servers [AVANT-GUARD]. Such a managenent should consider the load 1. This seems hard to understand without this reference, which is not public. 2. "management" S 6.3. > mitigation, traffic flows in switches are dynamically configured by > traffic flow forwarding path management according to the category of > servers [AVANT-GUARD]. Such a managenent should consider the load > balance among the switches for the defense against DDoS attacks. > > The procedure of DDoS-attack mitigation operations in this system is "procedure of... operations" is ungrammatical
_______________________________________________ I2nsf mailing list [email protected] https://www.ietf.org/mailman/listinfo/i2nsf
