[secdir] Review of draft-ietf-detnet-flow-information-model-10

[Shawn Emery <[e-mail]>]

Reviewer: Shawn M. Emery
Review result: Ready with nits

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This informational draft specifies an information model for Deterministic
Networking
(DetNet), specifically for data at the IP/MPLS layer.

The security considerations section does exist and recommends
confidentiality
for DetNet's external interfaces and that the knowledge of flows and
services
associated with customers and network operators could be used by an
adversary
to launch attacks against these networks.  The section defers mitigation of
said attacks
to the ietf-detnet-security draft and defers to RFC 8655 for DetNet's
overall security
considerations.  These documents provide some coverage in regards to the
data model
presented in this draft, but unfortunately does not describe how draft
specific attributes, e.g.
DnServiceRank could be used as a DoS attack.  Having said this, when the
data model does
become a YANG model then DetNet will need to explicitly call out each of
these attributes that
have security implications, per YANG model guidelines.

General comments:

Having the draft-ietf-detnet-security draft is a really good idea to help
augment this
and other DetNet drafts.  Having a comprehensive set of threats and how to
mitigate
against them provides a good foundation for other authors to think about.

Editorial comments:

s/can distinguished/can be distinguished/
s/flow using,/flow, using/
s/result data/result in data/

Shawn.
--