Re: [Detnet] I-D Action: draft-ietf-detnet-security-06.txt

["Grossman, Ethan A." <[e-mail]>]

Hi All,
The main purpose of this update is to add new (albeit "placeholder") text for security issues specific to DetNet over MPLS, kindly contributed by Stewart. The IP-specific text was already in place, although it doesn't say much more than "nothing to see here, keep moving". The new MPLS text says pretty much the same thing but in many more words ;- ) 
A few other minor changes crept in along the way, which I characterize in total as: 

v06 2019-11-02 EAG   
	Add placeholder text from Stewart for MPLS dataplane-specific considerations.
              Removed Kevin Stanton as author. 
              Added "dummy traffic insertion" based on Norm's comment.
              Clarified that authentication (not encryption) is used for traffic origin verification, per Henrik.
              Added "Packet Sequence Number Integrity Considerations" section, per Norm comment.
              Occasional auto-reformat changes.

There is still work identified to do on this draft. Below is my current ToDo list, in no particular order: 

ToDo list:
              Update Appendix A security text for various drafts including Architecture and new dataplane drafts.
              Validate use of words "attack" and "threat" is correct - prefer use of "attack" unless necessary.
              Add a new attack type for internal knowledge of drivers/firmware (as noted in the existing Multiple Hops section) per Pascal - Is this in scope?
              Fill in ToDo sections.
              ?? Should control plane references be moved to an appendix since currently out of scope for DetNet?
              ?? Is the Security draft going to hold up publication of the DP drafts? It is referenced as 
               Informational in DP drafts.
              ?? What to do with use case text from appendix? "We believe it would be helpful to establish 
                solid requirements before we can expect external reviewers 
                to review this draft, so our intent is to take the various use case statements in the appendix and 
                turn them into more formal statement of requirements that a reviewer could measure our draft against."
              ?? Pascal pointed out that we could discuss attacks on the UNI, e.g. buffering
	Flesh out MPLS-specific considerations, e.g. "dynamic aspects". 

If anyone has any interest in contributing to any of these items, or any of your own observations on the subject, or any corrections to the above work, that would be much appreciated, please send me raw text or xml or just random notes and I can flesh them out into sentences. 

Thanks,
Ethan (as DetNet Security draft editor) 


-----Original Message-----
From: detnet <[e-mail]> On Behalf Of [e-mail]
Sent: Saturday, November 2, 2019 9:00 PM
To: [e-mail]
Cc: [e-mail]
Subject: [Detnet] I-D Action: draft-ietf-detnet-security-06.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Deterministic Networking WG of the IETF.

        Title           : Deterministic Networking (DetNet) Security Considerations
        Authors         : Tal Mizrahi
                          Ethan Grossman
                          Andrew J. Hacker
                          Subir Das
                          John Dowdell
                          Henrik Austad
                          Norman Finn
	Filename        : draft-ietf-detnet-security-06.txt
	Pages           : 46
	Date            : 2019-11-02

Abstract:
   A deterministic network is one that can carry data flows for real-
   time applications with extremely low data loss rates and bounded
   latency.  Deterministic networks have been successfully deployed in
   real-time operational technology (OT) applications for some years.
   However, such networks are typically isolated from external access,
   and thus the security threat from external attackers is low.  IETF
   Deterministic Networking (DetNet) specifies a set of technologies
   that enable creation of deterministic networks on IP-based networks
   of potentially wide area (on the scale of a corporate network)
   potentially bringing the OT network into contact with Information
   Technology (IT) traffic and security threats that lie outside of a
   tightly controlled and bounded area (such as the internals of an
   aircraft).  These DetNet technologies have not previously been
   deployed together on a wide area IP-based network, and thus can
   present security considerations that may be new to IP-based wide area
   network designers.  This draft, intended for use by DetNet network
   designers, provides insight into these security considerations.  In
   addition, this draft collects all security-related statements from
   the various DetNet drafts (Architecture, Use Cases, etc) into a
   single location Section 8.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-detnet-security/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-detnet-security-06
https://datatracker.ietf.org/doc/html/draft-ietf-detnet-security-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-detnet-security-06


Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
detnet mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/detnet