Re: [Secauth] Please be volunteer to comment--- Summary of Telco on 19 December 2014

Hi Hosnieh:

Let me focus in the use case 1 to provide my comments.

The communication between SDN controllers (east-west interface) may be based in several protocols: RADIUS and Diameter. Or for example JSON (that is the case of trust routers https://tools.ietf.org/html/draft-mrw-abfab-trust-router-02 ). For Diameter, most probably there is no Diameter application of doing that but I am not sure. What it is true is 3g/4g operators have already defined ways of doing roaming so they may exchange SLA information in some way. It would be worthy asking them. 

For the case of southbound API, and the use case 1, I may use CAPWAP (http://tools.ietf.org/html/rfc5415). In fact, it seems others have thought about it https://wiki.opendaylight.org/view/Project_Proposals:CAPWAP. By the way, for the fast handoff and security between access points, IEEE 802.21a may be used since it allows a centralized way of doing authentication that (http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6704478) . So the PoS could be part of the SDN controller.

Another alternative, as well, it is to extend OpenFlow to provide this kind of function (e.g. distribution security policies and cryptographic material to the switch). Unfortunately, OpenFlow is not standardized in the IETF. For example, we are considering here at the University a model where IKE is in the SDN controller and IPsec in the switch. Now, how do we enforce IPsec security policies and cryptographic keys to the "switch"? Most probably an extension of OpenFlow would be the best and easier. But again that extension should be discussed in other place.

Best Regards.

El 08/01/2015, a las 14:28, Hosnieh Rafiee <hosnieh.rafiee@huawei.com> escribió:

> Folks,
> 
> Happy new year! I hope you start a good year and enjoyed your new year holiday and ready to activate the group again :-)
> 
> Here is the summary of the meeting
> - Presentation of available standards, secauth use cases, its possible scope,  
> - To remove use case 4 related to authentication of IoT to cloud system and only focus on SDN related solution
> - Discussion about adding the exact place (a picture or slide) to show where a protocol is missing and the exact scope of secauth.
> 
> Enclosed you can find the revision of slides used for the telco discussion on 19 December to consider the comments received during telco. Again thanks Alex, Rafa, Gabriel, Alan for sharing their opinions. 
> 
> Comments are welcomed. If you see something is unclear on slide and need any discussion just share it on the mailinglist.
> 
> 
> Thanks,
> Best,
> Hosnieh
> <secauth_SDN architecture_8.1.2015.pdf>_______________________________________________
> Secauth mailing list
> Secauth@ietf.org
> https://www.ietf.org/mailman/listinfo/secauth

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------