Re: [Model-t] ICN as an example (was: Re: (meta) Trust, and threat vs vulnerability models)

[Robin Wilton <[e-mail]>]

Thanks, both... just for clarity, my question/point wasn’t about ICN per se.
It was an attempt to find a (maybe poor) example of an innovation that changes the function of network nodes, increases the attack surface, and therefore potentially invalidates some of the reasons why I might previously have trusted the network to behave in a particular way.

Here’s the hypothetical I was trying to explore: maybe I previously trusted intermediate nodes not to prioritise other users’ traffic over mine, because those nodes were too dumb to do so. However, let’s suppose that an intermediate node now starts to make “reputational” judgements about the behaviour of other nodes, and starts to prioritise particular routes for some kinds of traffic. That potentially creates a situation in which an adversary could manipulate the “reputation” data so as to influence the node’s decisions about prioritisation, in ways that weren’t previously an option.

Like I say, this isn’t so much about whether ICN makes that possible (though I’ve heard something similar described as an R&D idea); it’s about whether increased functionality at intermediate nodes (as opposed to endpoints) materially changes the threat model.

Hope this helps,
Robin

________________________________
From: Benjamin Kaduk <[e-mail]>
Sent: Friday, February 14, 2020 8:23:13 PM
To: Stephen Farrell <[e-mail]>
Cc: Robin Wilton <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: [Model-t] ICN as an example (was: Re: (meta) Trust, and threat vs vulnerability models)

On Fri, Feb 14, 2020 at 08:18:28PM +0000, Stephen Farrell wrote:
>
> Hi Robin,
>
> I'm not sure I'm following your argument TBH, but that
> might be because I think the answer to:
>
> On 14/02/2020 17:52, Robin Wilton wrote:
> > "does a shift towards information-centric networking change the
> > reasons why I should or should not trust the network to behave as I
> > expect?"
>
> ...is fairly straightforwardly a "no."
>
> Without straying too far into ICN weeds (but I am a bit,
> hence the change to the subject line:-), ICN has no real
> conception of confidentiality nor access control that
> doesn't bring it right back to host-based networking (in
> terms of risks). I guess in future someone might figure
> out "pure" ICN-oriented solutions for such services, but
> afaik, they've not. I think the same is also still true
> for how any PKI might be used to support ICN, so even
> the signed-data doesn't really change many of the risks
> that much.
>
> So I'm not clear that consideration of ICN will be that
> enlightening for us.

I'm not super-versed in ICN, but it seems like it would be more of an
object security model than a connection-oriented one, so it might become
hard to know that you have received the latest information of a given kind.

-Ben