Re: [secdir] Review of draft-ietf-ccamp-wson-impairments-07

[Leeyoung <[e-mail]>]

Hi Nicole,

As you indicated in the latest response, this document is first of all informational and does not define any new protocols beyond the family of OSPF-TE, RSVP-TE and PCEP. There are no new requirements caused by IA-RWA other than the need for processing additional routing/signaling related data beyond the regular TE networks. 
These additional data would not add any particular security requirements in my opinion. 

Anyhow, please see the following changes if you would be satisfied with them. 
------------------------------------------------------------------------
This document discusses a number of control plane architectures that
incorporate knowledge of impairments in optical networks. If such
architecture is put into use within a network it will by its nature
contain details of the physical characteristics of an optical
network. Such information would need to be protected from intentional
or unintentional disclosure similar to other network information used
within intra-domain protocols.

This document does not require changes to the security models within
GMPLS and associated protocols.  That is, the OSPF-TE, RSVP-TE, and
PCEP security models could be operated unchanged. However, satisfying
the requirements for impairment information dissemination using the existing
protocols may significantly affect the loading of those protocols.
This may make the operation of the network more vulnerable to active attacks 
such as injections, impersonation, and MITMs. Therefore, additional care maybe
required to ensure that the protocols are secure in the impairment-aware
WSON environment.

Furthermore, the additional information distributed in order to
address impairment information represents a disclosure of network
capabilities that an operator may wish to keep private. Consideration
should be given to securing this information.  For a general discussion
on MPLS- and GMPLS-related security issues, see the MPLS/GMPLS security
framework [RFC5920].
-------------------------------------------------------------------------------

Best Regards,
Young

-----Original Message-----
From: Nico Williams [mailto:[e-mail]] 
Sent: Wednesday, October 12, 2011 1:01 PM
To: Leeyoung
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Re: Review of draft-ietf-ccamp-wson-impairments-07

On Wed, Oct 12, 2011 at 12:30 PM, Leeyoung <[e-mail]> wrote:
> Modified security section reads:
>
>   This document discusses a number of control plane architectures that
>   incorporate knowledge of impairments in optical networks. If such
>   architecture is put into use within a network it will by its nature
>   contain details of the physical characteristics of an optical
>   network. Such information would need to be protected from intentional
>   or unintentional disclosure similar to other network information used
>   within intra-domain protocols.
>
>   This document does not require changes to the security models within
>   GMPLS and associated protocols.  That is, the OSPF-TE, RSVP-TE, and
>   PCEP security models could be operated unchanged. However, satisfying
>   the requirements for impairment information dissemination using the existing
>   protocols may significantly affect the loading of those protocols.
>   This may make the operation of the network more vulnerable to denial-
>   of-service attacks or active attacks.  Therefore, additional care maybe
>   required to ensure that the protocols are secure in the impairment-aware
>   WSON environment.
>
>   Furthermore, the additional information distributed in order to
>   address impairment information represents a disclosure of network
>   capabilities that an operator may wish to keep private. Consideration
>   should be given to securing this information.  For a general discussion
>   on MPLS- and GMPLS-related security issues, see the MPLS/GMPLS security
>   framework [RFC5920].
>
> Please suggest some texts if these are not satisfactory to your need. Thanks.

I'm not concerned about denial of service attacks in particular as it
is often the case that there are denial of service attack surfaces
about which there's little we can do.  What I'm concerned about is
whether the framework can handle active attacks such as injections,
impersonation, and MITMs.  The reference to OSPF and friends is
probably sufficient in this regard for me to figure out an answer,
though saying something to the effect that a) you rely on such
protocols for security (your proposed change says so), and b) that
those protocols meet whatever you think the requirements ought to be
for IA-RWA.  Oh, and I suppose you should c) list what you think those
requirements are.  Of course, if these protocols don't today meet
those requirements, then that'd be a problem, but I suspect that won't
prove to be the case.

This is one of those occasions where it's good to ask "what's your
threat model" too.  My guess is that there isn't that much of a threat
from eavesdropping on IA-RWA, so passive attackers are not part of the
threat model.  What active attacks might be in the threat model?

Nico
--