[Ila] Potential issues, questions, and contentious items concerning ILA

[Tom Herbert <[e-mail]>]

Hello,

In preparation for the BOF, I have compiled an initial list of problems
that might be raised, areas that need clartification, or questions that
could be asked for ILA. Special emphasis is given on security, privacy, and
scalability-- items related to these are marked as such. Also, many of
these items are not specific to ILA and are more related to a general
identifier/locator problem. The distinction is that an item is considered
general if it would still be applicable if the ILA dataplane (address
transformations) were swapped out with a functionally equivalent
encapsulation. Items that don't fall in the general identifier/locator
class are mark "DP-only".

Items that might be raised as major issues or could be contentious are
marked by *** with a note follows.

The goal of this thead is to identify as many potential issues and
questions surrounding ILA as possible. This is not the thread to solve the
issues or answer the questions!

Please review and suggest any additional items that should be in the list.

Thanks,
Tom

----------------------

- Value proposition of ILA (i.e. cost-benefit) *** There are many ways to
implement network overlays. What is the need for yet another method?
   - Value of zero overhead solution (DP-only)
   - Disassociation of identity from location
   - Fine grained object addressing
   - Need for seamless and transparent network layer mobility

- Limitations of ILA
   - Limited amount of information can be fit into 128 bits (DP-only) ***
ILA is not extensible protocol. What use cases would extensibility be
required and ILA not usable?
   - Multicast support not fully scoped out

- Comparison with alternative/similar solutions
  - NAT (DP-only) *** How is ILA different from NAT and why doesn't it have
the same problems of NAT?
  - ILNP, 8+8 *** Similar identifier/locator split protocols have been
proposed. How is ILA different and better then these?
  - Encapsulation protocols and segment routing

- Compatibility and conformance
  - Standards conformance
  - Proper ICMP handling (possible security issues)
  - Interoperability with existing hardware, software, protocol
optimizations (DP-only)
  - Interaction with firewalls (security) (DP-only for applying rules to
ILA addresses)
  - Interaction with diffserv, ECN, other fields in IP header, NFV
  - Transport layer pseudo checksum/checksum neutral mapping (DP-only)

- Identifier/locator mapping system
  - Overall architecture
  - Number of mappings in system (scalability) *** Mappings are
non-aggregable and effectively become host routes. How does this scale?
  - Number of ILA routers needed (scalability) *** What infrastructure
investment needed in large deployments to scale?
  - Thoughput, CPU on routers (scalability)
  - Control plane (scalability, security)
  - Use of databases as the routing protocol (scalability, security)
  - Use of TCP for control protocols (possible scalability)

- Mapping caches
  - Cache maintainence, sizing (scalability)
  - Denial of Service threat (security) *** Untrusted entities may try to
DOS a cache by exhausting its memory or causing flood of control messages.
What are mitigations for DOS attack?
  - Pull vs. push vs. redirect model (scalability)
  - Security of mapping protocol (security)
  - Load from control messages to manage cache (scalability)

- Implementation
  - Open source availability
  - Multiple implemenations
  - Hardware considerations
  - Effects on logging, network tools, diagnostics

- Inter domain support
  - How does ILA work across domains?
  - How is roaming achieved?
  - What if ILA is being done in one direction, or both for a flow?

- Domain isolation
   - Preventing untrusted nodes from spoofing ILA addressed packets
(security)
   - Prevent exposing locators to third parties (security, privacy)

- Datacenter use case
  - Number of addressed objects starting with address per container
(scalability)

- Alternative address encodings (DP-only)
  - Virtualization, multicast, IPv4 address encoding (DP-only)
  - Mechanism of network prefix assignment encoding (DP-only) *** Proposed
solution involves encoding identifier into upper 64 bit of a SIR address
and a layer of indirection in ILA to SIR address transformation. Is this
solution feasible?
  - Non-local address identifiers (DP-only)

- Network virtualization
  - Number of VMs and tenants supported? (scalability)
  - Number of addresses (or address prefix) assign per VM (scalability)
  - Encoding tenant preifx (VNID) assignment in ILA
  - Isolation between tenants (security)
  - Access to common network services

- Mobile use case
  - End user privacy (prevent inferences of PII by third parties)
  - Intregation into technology specific architecure (ILA 3GPP 5G for
instance)
  - Address assignment privacy (single addresses vs. prefix, DHCPv6 vs.
SLAAC) *** Do current practices for network address provide sufficient user
privacy? Can ILA and singleton address assignment address this?
  - UEs may be assigned multiple (may 1000s) singleton addresses *** How
does this scale? Is there possibility to implement hidden aggregation by
something like CGA?
  - Protection of user identity and location in mapping system (privacy)
  - Law enforcement, policy requirements (security, privacy)