Paul, Thank you very much for the update. The schedule looks very good.
Linda From: Mr. Jaehoon Paul Jeong <[email protected]> Sent: Wednesday, December 9, 2020 8:40 PM To: [email protected] Cc: Roman Danyliw <[email protected]>; Linda Dunbar <[email protected]>; Yoav Nir <[email protected]>; skku-iotlab-members <[email protected]>; Mr. Jaehoon Paul Jeong <[email protected]> Subject: Re: Requests for Comments on I2NSF WG Re-chartering Text Hi I2NSF WG, I have the schedule to submit our I2NSF YANG Data Model Drafts to the IESG as follows. o I2NSF Capability YANG Data Model Draft (https://datatracker.ietf.org/doc/draft-ietf-i2nsf-capability-data-model/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-i2nsf-capability-data-model%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485649986%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=13kcCM1D%2BSemu0RoKd6futT0Ea2Aw%2F1RglIwuiFg2bA%3D&reserved=0>) - The revised draft for the IESG's and Tsvart's reviews will be submitted on December 18, 2020. o I2NSF NSF-Facing Interface YANG Data Model Draft (https://datatracker.ietf.org/doc/draft-ietf-i2nsf-nsf-facing-interface-dm/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-i2nsf-nsf-facing-interface-dm%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485659981%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=8n4%2BzctXApn7dfyjJDG%2B6CR0j74qUAFnLCqLWxoG54A%3D&reserved=0>) - The revised draft for our AD Roman's review will be submitted on January 18, 2021. o I2NSF Consumer-Facing Interface YANG Data Model Draft (https://datatracker.ietf.org/doc/draft-ietf-i2nsf-consumer-facing-interface-dm/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-i2nsf-consumer-facing-interface-dm%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485659981%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=qB%2BB69yyZlBKx9coL%2FtaYAl2ilw44NIdACLwtY%2BxmFA%3D&reserved=0>) - The draft will be submitted to the IESG for our AD's review on January 25, 2021. o I2NSF NSF Monitoring Interface YANG Data Model Draft (https://datatracker.ietf.org/doc/draft-ietf-i2nsf-nsf-monitoring-data-model/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-i2nsf-nsf-monitoring-data-model%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485669974%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=VlYZzRzS14btI3a4L98k3JaIpoGbUJ%2Ft1XVlngBRn8k%3D&reserved=0>) - The revised draft for the 1st YANG Doctor review will be submitted to the YANG Doctor on January 31, 2021. o I2NSF Registration Interface YANG Data Model Draft (https://datatracker.ietf.org/doc/draft-ietf-i2nsf-registration-interface-dm/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-i2nsf-registration-interface-dm%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485669974%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=uPWWXnXVUbKUIMwSxgK8IXBxMX0auCbTRQN%2FRCSb6vk%3D&reserved=0>) - The draft will be submitted to the IESG for our AD's review on February 15, 2021. Thanks. Best Regards, Paul On Thu, Dec 10, 2020 at 11:16 AM Mr. Jaehoon Paul Jeong <[email protected]<mailto:[email protected]>> wrote: Hi I2NSF WG, I2NSF WG chairs (Linda and Yoav) and members including Susan, Diego, and me had an online meeting for I2NSF WG Re-chartering Text on December 3, 2020. Could you read the following text and give us your comments on it? ------------------------------------------------------------------------------------------------------------------------------- <I2NSF WG Re-chartering Text> Interface to Network Security Functions (I2NSF) provides security function vendors, users, and operators with a standard framework and interfaces for cloud-based security services. I2NSF enables the enforcement of a high-level security policy, which is expressed according to a user's perspective of the target network. This security policy enforcement in I2NSF is a data-driven approach using NETCONF/YANG or RESTCONF/YANG, where a security policy is constructed based on a YANG data model. The I2NSF framework consists of four components such as I2NSF User, Security Controller, Network Security Function (NSF), and Developer's Management System (DMS). The I2NSF User specifies a high-level security policy for a target network. The Security Controller is aware of the capabilities of the attached NSFs, using them to build the security service(s) satisfying the policy expressed by the I2NSF User. An NSF provides a set of specific security capabilities (e.g., firewalling, web filtering, packet inspection, and DDoS-attack mitigation), applying security policy rules. The DMS registers the capabilities of an NSF with the Security Controller. The I2NSF framework has four interfaces such as Consumer-Facing Interface, NSF-Facing Interface, Registration Interface, and Monitoring Interface. Consumer-Facing Interface is used to deliver high-level security policies from the I2NSF User to the Security Controller. NSF-Facing Interface is used to deliver low-level security policies from the Security Controller to an NSF. The Registration Interface is used to register the capabilities of an NSF with the Security Controller. The Monitoring Interface is used to collect monitoring data from an NSF. The goal of I2NSF is to define a set of software interfaces and data models of such interfaces for configuring, maintaining, and monitoring NSFs in cloud environments, including NFV and edge deployments. For security management automation in an autonomous security system, I2NSF needs to have a feedback control loop consisting of security policy configuration in an NSF, monitoring for an NSF, data analysis for NSF monitoring data, feedback delivery, and security policy augmentation/generation. For this security management automation, the I2NSF framework requires a new component to collect NSF monitoring data and analyze them, which is called I2NSF Analyzer. Also, the I2NSF framework needs a new interface to deliver feedback messages for security policy adjustment from I2NSF Analyzer to Security Controller. A proper translation of the planned actions onto NSF capabilities requires a well-defined model for representing these actions. I2NSF is vulnerable to inside and supply chain attacks since it trusts NSF capability declarations as provided by DMS, assuming that NSFs work appropriately in all circumstances, as well as I2NSF User’s policy declarations and the actions of the Security Controller. The registration of NSF capabilities, the declaration of a security policy from either the I2NSF User or its enforcement by the Security Controller, and the monitoring data from an NSF are assumed to be genuine and non-malicious. If one of such activities is malicious, the security system based on I2NSF may collapse. To prevent this malicious activity from happening in the I2NSF framework or detect the root of a security attack, all the activities in the I2NSF framework should be logged in either a centralized or decentralized (e.g., blockchain) way. Also, the provenance and status of the I2NSF components (i.e., I2NSF User, Security Controller, NSF, DMS, and I2NSF Analyzer) need to be verified by remote attestation, leveraging the current results mostly focused on IT environments. Finally, the current YANG data models for the I2NSF interfaces are designed on the basis of NSFs implemented as virtual machines, and therefore they need to be redesigned for the case where I2NSF components are instantiated by containers. The I2NSF working group's deliverables include: o A single document for an extension of I2NSF framework for security management automation. This document will initially be produced for reference as a living list to track and record discussions: the working group may decide to not publish this document as an RFC. o A YANG data model document for I2NSF Application Interface to deliver feedback from I2NSF Analyzer to Security Controller. o A single document for applicability and use cases in I2NSF-based security management automation. o A single document for a framework for security policy translation to support the mapping between a high-level YANG module and a low-level YANG module: the working group may decide to not publish this document as an RFC. This document will apply the recommendations under discussion in NETMOD and OPSAWG on event modeling. o A single document for remote attestation for I2NSF components, based on the work of the RATS WG. o A single document for I2NSF on container deployments in a cloud native NFV architecture. -------------- Milestones o July 2022: Adopt applicability and use cases in I2NSF-based security management automation as WG document o March 2022: Adopt I2NSF on container deployments in a cloud native NFV architecture as WG document o November 2021: Adopt a framework for security policy translation as WG document o July 2021: Adopt remote attestation for I2NSF components as WG document o July 2021: Adopt a YANG data model for I2NSF Application Interface as WG document o March 2021: Adopt an extension of I2NSF framework for security management automation as WG document ------------------------------------------------------------------------------------------------------------------------------- After submitting all the I2NSF YANG data model drafts, we will be able to work on the I2NSF WG re-chartering in earnest. Thanks. Best Regards, Paul -- =========================== Mr. Jaehoon (Paul) Jeong, Ph.D. Associate Professor Department of Computer Science and Engineering Sungkyunkwan University Office: +82-31-299-4957 Email: [email protected]<mailto:[email protected]>, [email protected]<mailto:[email protected]> Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcpslab.skku.edu%2Fpeople-jaehoon-jeong.php&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485679970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zxbZd6jk0HT9OLox4UFfBznjoUPD9%2F9usnczW6JnubI%3D&reserved=0> -- =========================== Mr. Jaehoon (Paul) Jeong, Ph.D. Associate Professor Department of Computer Science and Engineering Sungkyunkwan University Office: +82-31-299-4957 Email: [email protected]<mailto:[email protected]>, [email protected]<mailto:[email protected]> Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcpslab.skku.edu%2Fpeople-jaehoon-jeong.php&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4469ffc114244fef5dba08d89cb4fef3%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637431648485679970%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zxbZd6jk0HT9OLox4UFfBznjoUPD9%2F9usnczW6JnubI%3D&reserved=0>
_______________________________________________ I2nsf mailing list [email protected] https://www.ietf.org/mailman/listinfo/i2nsf
