[dtn] DTN addressing, routing, and ownership

[Brian Sipos <[e-mail]>]

All,
I've been trying to figure out some details related to DTN addressing which are not covered in detail in the DTN architecture document [1]. My exposure to DTN has been from the protocol definition perspective and not from the historical-use perspective, so any undocumented current practices are probably unknown to me.

My questions are similar to the following:

  1.  Are EIDs with identical dtn-scheme "node name" or ipn-scheme "node number" guaranteed to be routed to the same BP agent? How is this guaranteed? What document requires or disallows it?
  2.  Are bundle routers allocated a well-known dtn-scheme "demux" text or ipn-scheme "service number"? i.e., is a bundle always routed through "dtn://NodeA/router" before it reaches endpoint "dtn://NodeA/svc1"?
  3.  Must each node run its own router service? Can a router on NodeA deliver bundles to an endpoint service on NodeB? Through what mechanism would this occur?
  4.  Can a single BP agent use convergence layers (CLs) which expose different Node IDs to neighbors? Can my BP agent use TCPCL sessions with local Node ID as "dtn://NodeA/svc1" and "dtn://NodeA/svc2"? Must it only expose the router service to CLs? Or does the CL itself constitute a service (e.g. as "dtn://NodeA/tcpcl")?

BPbis for Node ID schemes "dtn" [2] and "ipn" [3] has syntax explained but not full semantics. CBHE [4] gives some non-normative explanation of node number vs. service number semantics, but again doesn't dig into much detail about relationship requirements.

The reason for all of these questions are two answer security topics such as:

  1.  If I get a PKI certificate [5] for my node, do I need to authenticate (i.e. have a subjectAltName for) all possible Node IDs which could be used on my node? Or do I only need to authenticate for one "router" service, which is the only Node ID used by CLAs?
  2.  If I validate that I "own" a single Endpoint ID using a method such as [6], what else can be derived from that EID validation? Can I be said to own the entire dtn "node name" or ipn "node number"? Or can separate BP agents own EIDs with identical node-name/node-number?
  3.  When using BPsec [6] as a security acceptor, when I look up implicit keys associated with a security source Node ID must I relate keys to the full URI or can I relate keys to any URI with the same node-name/node-number? Will a security source always be a router service, or some other well-known service on a node?
  4.  When using a neighbor discovery (ND) protocol such as [8], which Node ID is supposed to be used as the "canonical EID" for each node? Just the router Node ID? Just the CL-based Node IDs? What about endpoint IDs directly delivered by the router on this node?

My own intuition makes me think that there is such a "router" service which is implicitly present on each node, which is used as the CL "Node ID" or ND "canonical EID", but that doesn't seem to actually be documented anywhere. It looks like there was a similar attempt to clarify DTN services in [9] but I don't see any movement on that after 2012.

Thanks in advance for clarification on any of these points.

[1] https://tools.ietf.org/html/rfc4838
[2] https://tools.ietf.org/html/draft-ietf-dtn-bpbis-24#section-10.7
[3] https://tools.ietf.org/html/draft-ietf-dtn-bpbis-24#section-10.8
[4] https://tools.ietf.org/html/rfc6260#section-2.1
[5] https://datatracker.ietf.org/doc/html/draft-ietf-dtn-tcpclv4-21
[6] https://datatracker.ietf.org/doc/html/draft-sipos-acme-dtnnodeid-01
[7] https://datatracker.ietf.org/doc/html/draft-ietf-dtn-bpsec-22
[8] https://datatracker.ietf.org/doc/html/draft-irtf-dtnrg-ipnd-03
[9] https://datatracker.ietf.org/doc/html/draft-blanchet-dtnrg-bp-application-framework-01