[I2nsf] Requests for Comments on I2NSF WG Re-chartering Text

["Mr. Jaehoon Paul Jeong" <[e-mail]>]

Hi I2NSF WG,
I2NSF WG chairs (Linda and Yoav) and members including Susan, Diego, and me
had an online meeting for I2NSF WG Re-chartering Text on December 3, 2020.

Could you read the following text and give us your comments on it?

-------------------------------------------------------------------------------------------------------------------------------
<I2NSF WG Re-chartering Text>

Interface to Network Security Functions (I2NSF) provides security function
vendors, users, and
operators with a standard framework and interfaces for cloud-based security
services. I2NSF
enables the enforcement of a high-level security policy, which is expressed
according to a user's
perspective of the target network. This security policy enforcement in
I2NSF is a data-driven
approach using NETCONF/YANG or RESTCONF/YANG, where a security policy is
constructed
based on a YANG data model.

The I2NSF framework consists of four components such as I2NSF User,
Security Controller,
Network Security Function (NSF), and Developer's Management System (DMS).
The I2NSF
User specifies a high-level security policy for a target network. The
Security Controller is aware
of the capabilities of the attached NSFs, using them to build the security
service(s) satisfying
the policy expressed by the I2NSF User. An NSF provides a set of specific
security capabilities
(e.g., firewalling, web filtering, packet inspection, and DDoS-attack
mitigation), applying security
policy rules. The DMS registers the capabilities of an NSF with the
Security Controller.

The I2NSF framework has four interfaces such as Consumer-Facing Interface,
NSF-Facing
Interface, Registration Interface, and Monitoring Interface.
Consumer-Facing Interface is used
to deliver high-level security policies from the I2NSF User to the Security
Controller. NSF-Facing
Interface is used to deliver low-level security policies from the Security
Controller to an NSF.
The Registration Interface is used to register the capabilities of an NSF
with the Security
Controller. The Monitoring Interface is used to collect monitoring data
from an NSF.

The goal of I2NSF is to define a set of software interfaces and data models
of such interfaces
for configuring, maintaining, and monitoring NSFs in cloud environments,
including NFV and
edge deployments. For security management automation in an autonomous
security system,
I2NSF needs to have a feedback control loop consisting of security policy
configuration in an
NSF, monitoring for an NSF, data analysis for NSF monitoring data, feedback
delivery, and
security policy augmentation/generation. For this security management
automation, the I2NSF
framework requires a new component to collect NSF monitoring data and
analyze them, which
is called I2NSF Analyzer. Also, the I2NSF framework needs a new interface
to deliver feedback
messages for security policy adjustment from I2NSF Analyzer to Security
Controller. A proper
translation of the planned actions onto NSF capabilities requires a
well-defined model for
representing these actions.

I2NSF is vulnerable to inside and supply chain attacks since it trusts NSF
capability declarations
as provided by DMS, assuming that NSFs work appropriately in all
circumstances, as well as
I2NSF User’s policy declarations and the actions of the Security
Controller. The registration of
NSF capabilities, the declaration of a security policy from either the
I2NSF User or its
enforcement by the Security Controller, and the monitoring data from an NSF
are assumed to be
genuine and non-malicious. If one of such activities is malicious, the
security system based on
I2NSF may collapse. To prevent this malicious activity from happening in
the I2NSF framework
or detect the root of a security attack, all the activities in the I2NSF
framework should be logged
in either a centralized or decentralized (e.g., blockchain) way. Also, the
provenance and status
of the I2NSF components (i.e., I2NSF User, Security Controller, NSF, DMS,
and I2NSF Analyzer)
need to be verified by remote attestation, leveraging the current results
mostly focused on IT
environments.

Finally, the current YANG data models for the I2NSF interfaces are designed
on the basis of NSFs
implemented as virtual machines, and therefore they need to be redesigned
for the case where
I2NSF components are instantiated by containers.

The I2NSF working group's deliverables include:

o A single document for an extension of I2NSF framework for security
management automation.
This document will initially be produced for reference as a living list to
track and record discussions:
the working group may decide to not publish this document as an RFC.
o A YANG data model document for I2NSF Application Interface to deliver
feedback from I2NSF
Analyzer to Security Controller.
o A single document for applicability and use cases in I2NSF-based security
management
automation.
o A single document for a framework for security policy translation to
support the mapping
between a high-level YANG module and a low-level YANG module: the working
group may decide
to not publish this document as an RFC. This document will apply the
recommendations under
discussion in NETMOD and OPSAWG on event modeling.
o A single document for remote attestation for I2NSF components, based on
the work of the
RATS WG.
o A single document for I2NSF on container deployments in a cloud native
NFV architecture.

--------------
Milestones

o July 2022: Adopt applicability and use cases in I2NSF-based security
management automation
as WG document
o March 2022: Adopt I2NSF on container deployments in a cloud native NFV
architecture as WG
document
o November 2021: Adopt a framework for security policy translation as WG
document
o July 2021: Adopt remote attestation for I2NSF components as WG document
o July 2021: Adopt a YANG data model for I2NSF Application Interface as WG
document
o March 2021: Adopt an extension of I2NSF framework for security management
automation as
WG document
-------------------------------------------------------------------------------------------------------------------------------

After submitting all the I2NSF YANG data model drafts, we will be able to
work on
the I2NSF WG re-chartering in earnest.

Thanks.

Best Regards,
Paul
-- 
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Associate Professor
Department of Computer Science and Engineering
Sungkyunkwan University
Office: [phone]
Email: [e-mail], [e-mail]
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
<http://cpslab.skku.edu/people-jaehoon-jeong.php>