[I2nsf] Security event reporting management - the firstMILE

[Robert Moskowitz <[e-mail]>]

One of the functions described within the I2NSF environment is 
monitoring security events.  I have not found any IETF work covering 
general security alerts from security defense devices aside from the 
specific DDoS reporting in DOTS.  So I have developed firstMILE:

https://www.ietf.org/internet-drafts/draft-moskowitz-firstmile-00.txt

Which proposes a sub/pub model including initial registration for 
security alerts reporting.

At this point the draft is more a skeleton for hanging how the three 
components work:

Registration of security device to monitor(s).
Subscription of monitors for specific reporting.
Publication of security reports to subscribed monitors.

I have covered some of the requirements for these components.  I bring 
this to the I2NSF workgroup for:

Is this something the I2NSF wg should talk on?
And am I correct that currently security alert reporting is not covered 
within the IETF.

For the pub portion, I hold that the requirements align with the DOTS 
requirements, other than the bi-directional communications needs.  Do 
others agree?  If so, I have a DOTS draft:

https://www.ietf.org/internet-drafts/draft-moskowitz-dots-ssls-02.txt

DOTS Secure Session Layer Services

This introduces a real session layer, something really not present in 
the IETF stack, that provides a set of services.  SSLS and its services 
are laid out in:

https://www.ietf.org/internet-drafts/draft-hares-i2nsf-ssls-00.txt

Sue and I developed the design for SSLS, as it is broadly applicable in 
a number of areas under i2nsf.

Two other drafts that fit into this architecture are:

https://www.ietf.org/internet-drafts/draft-moskowitz-sse-03.txt
and
https://www.ietf.org/internet-drafts/draft-moskowitz-gpcomp-00.txt

SO.....

I open the floor to discussion.

I would be interested in how others see this part of the security 
defense environment.

I am interested in how others see SLS and particularly SSLS and its use 
for firstMILE pub.  I have requested a slot in the meeting to cover my work.