RE: draft-macaulay-6man-packet-stain-00 High Level Questions

["Dan Wing" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Martin, Steve
> Sent: Thursday, February 16, 2012 1:23 PM
> To: [e-mail]
> Subject: draft-macaulay-6man-packet-stain-00 High Level Questions
> 
> Hi Tyson,
> I've just read your ITEF paper on Packet Staining, a very interesting
> idea and relevant to an area of research that I'm looking at.
> 
> Something that I've been considering is how might IPv6 impact
> individuals, i.e. home users who typically have limited internet
> security.  Under IPv4 NAT has provided an "accidental" firewall that
> has been very beneficial to such subscribers. As the migration to IPv6
> takes hold, it strikes me that specific firewalls will become mandatory
> (and critical that they are kept up to date), but those subscribers
> won't perceive any benefit from such devices (at least not until it is
> too late) and will simply connect devices directly to the internet with
> insufficient protection.

RFC6092, "Recommended Simple Security Capabilities in Customer Premises
Equipment (CPE) for Providing Residential IPv6 Internet Service", recommends
that equipment filter by default.  And I know both Apple and Linksys ship
with IPv6 filters by default.  I expect other vendors (e.g., D-Link) have
IPv6 filters by default, too.  The proverbial "Grandma" does not want her
IPv6 NAS or IPv6 television accessed by someone on the Internet by default.
Grandma should have to do something on the NAS or the television to enable
that remote access if she wanted it.

-d

> So, and this is where you paper is relevant, I have been pondering how
> IPv6 can be deployed to these subscribers with the added benefit of the
> "built-in" security that they have been used to with the likes of NAT.
> 
> Am I right in understanding that you packet staining could provide
> service provision that might include any number of the following:
> 
> *	Spam Assessment
> *	Parental Controls
> *	Malware Detection
> *	Forged Certificates
> *	etc
> 
> Some of the above would require deep packet inspection, at least as far
> as protocol, and in some cases of the actual data.  Is this within
> scope of what you envisage ?
> 
> It strikes me that your Packet Staining concept could enable the
> provision of services that meet the needs of these subscribers in a
> manner that will enable them to "configure and forget", much like they
> already experience with Anti-Virus products which regularly download
> updates), except that they would get the benefit of a more intelligent
> process that has a re timely updates and the potential for filtering at
> the perimeter or the endpoint.
> 
> Finally, it is not clear to me whether there is any impact if IPsec is
> involved, which would prevent such a level of packet inspection.
> 
> Many thanks for you contribution and thoughts.
> 
> Regards
> Steve Martin