Re: [I2nsf] Side Meeting for I2NSF WG

"Diego R. Lopez" <diego.r.lopez@telefonica.com> Thu, 21 November 2019 03:50 UTC

Return-Path: <diego.r.lopez@telefonica.com>
X-Original-To: i2nsf@ietfa.amsl.com
Delivered-To: i2nsf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72AD112022E for <i2nsf@ietfa.amsl.com>; Wed, 20 Nov 2019 19:50:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8UV4-ydKRbYV for <i2nsf@ietfa.amsl.com>; Wed, 20 Nov 2019 19:50:08 -0800 (PST)
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on072d.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe02::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0DD8120941 for <i2nsf@ietf.org>; Wed, 20 Nov 2019 19:50:07 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Ll8popoBPVU7aryNyarlk5I7ZreRHmZyJw93OC/oXUzZkd+OMOtTHiUuzlDefzYVpm2NL5iRpYTR7vViiShn7JDRBadSLZVtlgo2Z0Lrorj1+gVAszZTrWp4Q48VQKfAA0lxi6xjeZHnfIXraIEiuvrGPi1A6ZcQo8/8pEh9+hGCuINOqiZ9co9yqAIi8zlBBEQeD0MTcPFpn+p1bfUo16NNOM1YwCRB06h+rzJqtUiOYrIkBJcpZEm23chbeKDMb+joOMzcwv0WQcSbmZGo4FbwhewseYJ0yw98Kr2XMMLjn69v8SqzzcqFbbBGFoqrf2Qj6aldlUKukfrNSEJd/g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lSxSlmAsIer2lxpR9zFgNh0M+6fQrOX649sNb+4VZHE=; b=MY3YSxr2rOkoxENlZZpbNeBZRzTahkOB4TcHLD5mDBL4hnOcFou32HpqneSyOylH2RNwY8+BBJPOHSROYt+LOU0JPfxEaJZubbdvEcVYbDFuvNjpirIbjjTbLcZ3gmxLyncac/nSl9werzFYDRojPs7fIjcJevBX4ceu6s8bwZQbsJHUJU95/snnpMd7UPuZmUUqy6wnJMZ5GIQvErq4GI07EmO9PPAkmpIUl/nrZcoWcXboHDnjc+hh881kqbPxVYmy3PSw4kXcfuZdKopRIw4roF3jbGSeceNRbTRKVWZ1GOR7j85oVpkweTxYXCTL0olS0jgryc2IFTBMlU+ITA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=telefonica.com; dmarc=pass action=none header.from=telefonica.com; dkim=pass header.d=telefonica.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lSxSlmAsIer2lxpR9zFgNh0M+6fQrOX649sNb+4VZHE=; b=cRa63YSpUv0z/irZ3E5W2PeaBKTJ4FPen2rTnnwBujliHmmxpqnEAgD2NZV4Cpnv9Zm/mh9CN70IUU1lioMAjzlJWsz5j6z5e9F+/bjc3tVZrzmwaT/jCS6+w7FGbO1BiHUXt0gDpGrZfrAQmBlbjIcXvTSAy75RjVWnt22VbNA=
Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3673.eurprd06.prod.outlook.com (52.134.71.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.30; Thu, 21 Nov 2019 03:50:05 +0000
Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::110f:5653:9dc2:14ee]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::110f:5653:9dc2:14ee%7]) with mapi id 15.20.2474.018; Thu, 21 Nov 2019 03:50:05 +0000
From: "Diego R. Lopez" <diego.r.lopez@telefonica.com>
To: "Mr. Jaehoon Paul Jeong" <jaehoon.paul@gmail.com>, "i2nsf@ietf.org" <i2nsf@ietf.org>
CC: Roman Danyliw <rdd@cert.org>, "Ciavaglia, Laurent (Nokia - FR/Paris-Saclay)" <laurent.ciavaglia@nokia.com>, skku-iotlab-members <skku-iotlab-members@googlegroups.com>, Qin Wu <bill.wu@huawei.com>, =?utf-8?B?SsOpcsO0bWUgRnJhbsOnb2lz?= <jerome.francois@inria.fr>
Thread-Topic: [I2nsf] Side Meeting for I2NSF WG
Thread-Index: AQHVoBgO9h/20pR3TUCuh8xhB+h+uqeVg20A
Date: Thu, 21 Nov 2019 03:50:05 +0000
Message-ID: <03F50305-C65C-4622-8953-F4740E2D39A3@telefonica.com>
References: <CAPK2Dey7WQvvVC_=1Rk7toWBY2JUSeka_fSWCmpLd0b=Tv3JLA@mail.gmail.com>
In-Reply-To: <CAPK2Dey7WQvvVC_=1Rk7toWBY2JUSeka_fSWCmpLd0b=Tv3JLA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.10.10.191111
authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com;
x-originating-ip: [2001:67c:370:128:65db:a072:4b0:4a72]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 1765cc7a-a795-4e55-2b6a-08d76e35e51a
x-ms-traffictypediagnostic: DB3PR0602MB3673:
x-ms-exchange-purlcount: 4
x-microsoft-antispam-prvs: <DB3PR0602MB3673252281622E332AEE8C21DF4E0@DB3PR0602MB3673.eurprd06.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0228DDDDD7
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(366004)(376002)(136003)(346002)(396003)(39860400002)(199004)(189003)(15404003)(40134004)(66574012)(66556008)(6436002)(25786009)(6486002)(229853002)(316002)(786003)(6246003)(102836004)(2616005)(99286004)(11346002)(8676002)(76176011)(33656002)(4326008)(54896002)(46003)(476003)(446003)(2501003)(6306002)(110136005)(8936002)(54906003)(58126008)(236005)(81156014)(81166006)(6512007)(186003)(66476007)(64756008)(14444005)(5660300002)(66446008)(66946007)(6116002)(6506007)(486006)(7736002)(71200400001)(256004)(71190400001)(86362001)(606006)(36756003)(966005)(2906002)(91956017)(76116006)(478600001)(14454004)(45080400002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3673; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 2BaEK1TzYLiuo+bkpGfPU9VbWA3QjJN/M8q3l7vEfISOWELRZmGIkqjcGs514eDP7HEBtq1jlm7WfDTe7HOPLu11TvRZFFEmXnxOYJP/LPn/DzAgYf1elhGRud8A3q/X0Kd2OtZ7HlaEGS9d8eKtWjGY/wXGxXbXb/OuisJPBiQYu1Cx/PlLkS6Vm6JKl9tH9ouHyXvrT8MDtxoMEZjEDfuYf3K3sCKEdYEuGUDPOlQR2SFzRmanhMnziSTfd6GKciWfxc4uKW1HqR4wHo2wKizDE/b31WrTprYVpImhuoHml6ayY2fPOob2dj/C0SmXe2k0Ob3oo1q2mIMy52A2krq3/x5pcItjRodKAR9KjE2G8LKuiTN9wLrv7YbJ1VVMUn2svrGRcgxP7WPlh6iu4IHB7CiyNroOcwXJLtSeLOTLE5xO/jLw8n6/SR/bZjI3g2+RnDT4t6nCN2/tZ6FqmkvItS3iqTIPVxteLnv3rDU=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_03F50305C65C46228953F4740E2D39A3telefonicacom_"
MIME-Version: 1.0
X-OriginatorOrg: telefonica.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1765cc7a-a795-4e55-2b6a-08d76e35e51a
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Nov 2019 03:50:05.1334 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: s+Hx0TbNlbHTiil8DQi61aNCxDpnOvvTlQhxZ343aMe8KkFs3haq+kherO17M4tftTkcMBSvRhwB8UO9tyzOu4rdUd+puQhiS1+X2KN5BPg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3673
Archived-At: <https://mailarchive.ietf.org/arch/msg/i2nsf/rtsxprqEAPkMKRLYW5vPZn_PUCI>
Subject: Re: [I2nsf] Side Meeting for I2NSF WG
X-BeenThere: i2nsf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "*I2NSF: Interface to Network Security Functions mailing list*" <i2nsf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/i2nsf>, <mailto:i2nsf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/i2nsf/>
List-Post: <mailto:i2nsf@ietf.org>
List-Help: <mailto:i2nsf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/i2nsf>, <mailto:i2nsf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Nov 2019 03:50:13 -0000

Hi Paul,

Just to frame today’s discussion, let me remark I find especially interesting points (3) and (4), that I believe can only happen within I2NSF. We can connect (3) with the ECA discussions happening in OPSAWG and NMRG, and I see (4) as an interesting opportunity for consolidating and achieving the full potential of the capability model.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: diego.r.lopez@telefonica.com<mailto:diego.r.lopez@telefonica.com>
Tel:         +34 913 129 041
Mobile:  +34 682 051 091
----------------------------------

On 21/11/2019, 11:02, "I2nsf on behalf of Mr. Jaehoon Paul Jeong" <i2nsf-bounces@ietf.org<mailto:i2nsf-bounces@ietf.org> on behalf of jaehoon.paul@gmail.com<mailto:jaehoon.paul@gmail.com>> wrote:

Hi I2NSF WG,
There will be a side meeting for I2NSF WG's next steps from 6PM to 7PM today at Bras Basah.
https://datatracker.ietf.org/meeting/106/floor-plan?room=bras-basah#raffles-city-convention-center

* Agenda for I2NSF Side Meeting
- I2NSF Hackathon Project Report (Jaehoon Paul Jeong, 5 min)
- I2NSF Data Model Drafts Update (Jaehoon Paul Jeong, 10 min)
  . I2NSF Capability YANG Data Model
  . I2NSF Consumer-Facing Interface YANG Data Model
  . I2NSF Network Security Function-Facing Interface YANG Data Model
  . I2NSF Registration Interface YANG Data Model
  . I2NSF NSF Monitoring YANG Data Model
- Security Policy Translator Draft Update (Chaehong Chung, 5 min)
- Open Discussion: Possible Work Items for I2NSF Rechartering (30 min)

I will report the progress of data model drafts.
I would like to discuss the rechartering of I2NSF WG with you.

I suggest four work items as the 2nd phase I2NSF.
1. YANG data model of the interface between I2NSF Security Controller and SDN Switch Controller
2. YANG data model of the interface between I2NSF Security Controller and SFC Classifier
3. Configuration of Advanced Security Functions with I2NSF Security Controller
4.  Policy Object for Interface to Network Security Functions (I2NSF)

Let me explain why each of them is important for I2NSF.

1.  YANG data model of the interface between I2NSF Security Controller and SDN Switch Controller
According to the I2NSF Applicability Draft and I2NSF Hackathon Project,
the SDN switches can perform simple packet filtering and the firewall NSF can perform complicated packet filtering.
For this two separated packet filtering, the security policy about a traffic flow should be delivered to an SDN Switch Controller.
For the delivery of a security policy to the SDN network, the interface between the I2NSF Security Controller and
the SDN Switch Controller is needed.

2.  YANG data model of the interface between I2NSF Security Controller and SFC Classifier
According to the I2NSF Applicability Draft and I2NSF Hackathon Project,
a security policy (e.g., time-based web filtering) requires a Service Function Chaining (SFC) such as
firewall and web filter.
For this SFC path specification of a security policy, a security about a traffic flow should be delivered to an SFC Classifier.
For the delivery of a security policy to specify the service function path in the SFC Classifier, the interface between
the I2NSF Security Controller and the SFC Classifier is needed.

3. Configuration of Advanced Security Functions with I2NSF Security Controller
    (https://tools.ietf.org/html/draft-dong-i2nsf-asf-config-01)
With the current NSF-Facing Interface, we can configure basic security functions, such as firewall, deep packet inspection, and
DDoS attack mitigator. For rich network security functions,  the YANG data model of advanced security services needs to be
developed.

4. Policy Object for Interface to Network Security Functions (I2NSF)
    (https://tools.ietf.org/html/draft-xia-i2nsf-security-policy-object-01)
Policy objects for I2NSF security policy rules can provide the I2NSF system with reusability for security policy construction
by defining essential attributes for each policy object. This will be useful for security policy rule generation in the I2NSF system.

Welcome your feedback.

Thanks.

Best Regards,
Paul


________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição