[I2nsf] Questions & suggstions to draft-pastor-i2nsf-vnsf-attestation-00

[Linda Dunbar <[e-mail]>]

Antonio and Diego,

The draft-pastor-i2nsf-vnsf-attestation-00 has brought out very interesting security aspects of deploying I2NSF. Thank you very much.

Section 1 provides a very good threat analysis for I2NSF environment.  However, the solution (Section 5) only covers how "user" attest the "Controller". Do you plan to expand the draft to cover all the security threats documented in the Section 1?
I understand some of the issues described in the Section 1 is very difficult to solves. For example:
An authorized user may misuse assigned privileges to alter the network traffic processing of other users in the virtualization platform...


It is great to have those security threats documented. It would also be good to add a note when those issues are out of the scope of I2NSF.

Another example:
A user with physical access to the virtualization platform can modify the behavior of hardware components.
(my note: This issue is true to all virtualized functions. There is also data leakage across different VNFs instantiated on the same physical servers.  We should put a note that this is not something that IETF can address)


Architecturally, there are two ways that users  can use I2NSF:

1.     Users can specify the "Service Layer Policies/rules"  to the Security Controller. The Controller select the appropriate NSFs (virtual or physical) to enforce the "Service Policies" by passing down the "Capability Layer rules/policies".

2.     vNSFs are allocated to the Users. So the Users can send direct policies to its designated vNSFs via the Security Controller.


Your draft covers the Case 2 above very well. Can you add some description to the Case 1 ?

Some questions:

Section 4.1.3: Secure Boot is applicable to any Hypervisors that host multiple VMs. Should it be out of scope for I2NSF?

Section 5.2: Does the controller measure the User's hardware & software  components or measure its own HW&SW?

Section 5.3: Instantiation of vNSF to Container should be done by the lifecycle management of vNSF. The controller's job is only to pass policies. Is this your understanding too?


Thank you.

Linda