Re: [pcp] PCP security model

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

   > between subscribers:
   >  - a subscribe is not authorized to steal another subscriber PFs.
   >   So the PCP server of a CGN is required to keep its state
   >   (PFs and subscriber identities) in stable storage.
   
   The actual requirement is to not give the mapping to another 
   subscriber until the lifetime expires.

=> in fact it is lifetime + hold down but this doesn't change
the problem (i.e., it is an implementation detail).

   That can be implemented by using stable storage, true.

=> I am afraid stable storage is required for other reasons
(legal constraints for instance) so I don't worry too much
about this. And we can put a MUST for the reason and a SHOULD
for the solution: this will make everybody happy.

   Two *examples* of ways to implement
   that requirement, without stable storage of PCP-mappings:
   
     * algorithmically assigning certain ports to certain 
       subscribers -- like A+P (port range routing) does for 
       its dynamic connections.
     * using a completely different pool of IPv4 addresses upon 
       NAT server restart, as explained for dynamic connections
       with cold standby in Section 6 of 
       draft-xu-behave-stateful-nat-standby.
   
=> interesting (BTW these solves the deep issue, i.e., they work
for the legal stuff too).

   >  - if the subscriber identity is the HG address on the infrastructure,
   >   some measures must be taken to ensure a subscriber can't use
   >   the address of another subscriber, i.e., access control on the
   >   infrastructure including ingress filtering.
   >   (with other words the identification should be able to provide
   >    authentication)
   
   That's needed anyway, without PCP -- to prevent subscribers from 
   clobbering each others sessions.
   
=> yes and IMHO it is a good thing PCP doesn't add new constraints.

   >  - the support of subscriber renumbering requires a subscriber
   >   authentication which is not based on addresses (proposal in PPS).
   
   I don't care about maintaining PCP mappings during a subscriber 
   renumbering event.

=> I agree it is a minor goal but if we can get it for free there
is no reason to not provide it. And I believe we agree it must
not be provided in a not-secure way.

Thanks

[e-mail]

PS: can you provide a better wording for the stable storage for CGN
requirement?