Re: [Secauth] Please be volunteer to comment--- Summary of Telco on 19 December 2014

[Gabriel López <[e-mail]>]

    Hi Hosnieh,

    sorry for the late response ...

El 08/01/15 a las 14:28, Hosnieh Rafiee escribió:

Folks,

Happy new year! I hope you start a good year and enjoyed your new year holiday and ready to activate the group again :-)

Here is the summary of the meeting
- Presentation of available standards, secauth use cases, its possible scope,  
- To remove use case 4 related to authentication of IoT to cloud system and only focus on SDN related solution
- Discussion about adding the exact place (a picture or slide) to show where a protocol is missing and the exact scope of secauth.

Enclosed you can find the revision of slides used for the telco discussion on 19 December to consider the comments received during telco. Again thanks Alex, Rafa, Gabriel, Alan for sharing their opinions. 

Comments are welcomed. If you see something is unclear on slide and need any discussion just share it on the mailinglist.

One of my concerns, probably a little one, but probably not, is that following your assumptions in #5 it seems (IMHO) that you are describing something more related with NFV (Network Function Virtualization) than with SDN. I means, it seems to me that you are trying to virtualize some kind of security function (authentication) rather than a policy-driven network behaviour.
SDNs controllers (including and beyond OpenFlow) runs over L2/L3 network devices, analyse incoming network traffic, take a decision about this traffic and enforce the decision into the network device, the traffic goes on or it is denied. Sometimes those controllers need the help for other services (Firewalls, Load balancers, IDS, etc), and then invoke the upper layer to use them.
Following your slides, your clients (APs) needs to invoke to an authentication service, which seems to be virtualized, the service takes an authentication decision and responds Yes or Not. The traffic does not go on or is denied, the service is the traffic's target. As said before, IMHO (and I can be probable wrong), this behaviour is more related with NFV than with SDNs.

Said that, On one hand, I agree with Alan in the way that the target scenario (without taking into account the use or not of SDNs) seems that could be solved making use of current technologies (note that I'm not saying it is not an interesting use case, on the contrary). 
On the other hand, if the objective is to solve this use case but making use of new technologies (i.e. SDNs) it would be nice to analyse the requirements driving this objective. I mean, we can not decide to use SDNs only because it will be the technology of the future.

Use case 2:

    "All SIP proxy needs to be configured in order to authenticate Alice’s phone to connect to another person". AFAIK that's not true. Only the home SIP proxy authenticates Alice.
    "since these SIP proxy servers are all also virtualized components" --> NFV
    Where SDNs could help in this scenario is in the management and enforcement of the required QoS parameters into the network devices for the media traffic.

Use case 3:

    Sorry, I do not see how this use case is related with the other ones.


    In summary, I think the use case is good enough to work on it, but I'm not sure about the standardization requirements.

    Best regards, Gabi.

Thanks,
Best,
Hosnieh

_______________________________________________
Secauth mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/secauth" rel="nofollow">https://www.ietf.org/mailman/listinfo/secauth

-- 
--------------------------------------------------------------
Gabriel López Millán
Departamento de Ingeniería de la Información y las Comunicaciones
University of Murcia
Spain
Tel: [phone]
Fax: [phone]
email: [e-mail]