Subject: [Actn] ... and I2RS

From: Scott Brim <[email-masked]>
Date: Fri, 14 Mar 2014 17:22:37 -0400

I had to leave the ACTN meeting after only 30 minutes, unfortunately.
The design looks great ... but I wonder if you've considered
coordinating with I2RS. The goal is different, much of the design is
different, but you share many details. For example: mutual
authentication/authorization, privilege levels and roles in general,
and how you handle switch restarts.

Scott

---

From: Dhruv Dhody <[email-masked]>
Date: Mon, 17 Mar 2014 04:08:54 +0000

Hi Scott, 

I agree. 

IMO this fits well into 'requirements' [part of proposed charter (https://sites.google.com/site/actnbof/home/charter-propor)].
Further a gap analysis could guide in the effort to evaluate if modifications to existing protocol or borrowing some elements (from existing protocol) would suffice.

Regards,
Dhruv 

---------------------------------------------------------------
Dhruv Dhody 
System Architect, 
Huawei Technologies India Pvt. Ltd.,
Banagalore
Mobile: +91-9845062422
This e-mail and its attachments contain confidential information from HUAWEI, which 
is intended only for the person or entity whose address is listed above. Any use of the 
information contained herein in any way (including, but not limited to, total or partial 
disclosure, reproduction, or dissemination) by persons other than the intended 
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by 
phone or email immediately and delete it!

> -----Original Message-----
> From: ACTN [mailto:[email-masked]] On Behalf Of Scott Brim
> Sent: 15 March 2014 02:53
> To: [email-masked]
> Subject: [Actn] ... and I2RS
> 
> The design looks great ... but I wonder if you've considered coordinating
> with I2RS. The goal is different, much of the design is different, but you
> share many details. For example: mutual authentication/authorization,
> privilege levels and roles in general, and how you handle switch restarts.
> 
> Scott
> 
> _______________________________________________
> ACTN mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/actn

---

From: Leeyoung <[email-masked]>
Date: Mon, 17 Mar 2014 16:51:45 +0000

Hi Scott,

Sorry for my late response to your email. As Dhruv pointed out in his previous email in this thread, there will be a closer coordination with existing work to avoid duplicate efforts where possible. As you indicated, especially on the subject of authentication, authorization and security, ACTN has to be clear on these aspects and there is no expertise among the participants of ACTN in this area. Any interface work in IETF share this common issue and clearly there is a need for requirement/gap analysis for this work as well.

Thanks,
Young

-----Original Message-----
From: ACTN [mailto:[email-masked]] On Behalf Of Scott Brim
Sent: Friday, March 14, 2014 4:23 PM
To: [email-masked]
Subject: [Actn] ... and I2RS

I had to leave the ACTN meeting after only 30 minutes, unfortunately.
The design looks great ... but I wonder if you've considered coordinating with I2RS. The goal is different, much of the design is different, but you share many details. For example: mutual authentication/authorization, privilege levels and roles in general, and how you handle switch restarts.

Scott

---

From: Leeyoung <[email-masked]>
Date: Thu, 20 Mar 2014 21:54:07 +0000

Hi Scott,

One thought on the relationship with the I2RS mutual authentication/authorization and levels of privilege and roles is that ACTN has much less of these issues since it assumes that the customer end-points are already negotiated with the involved carriers/operators prior to the service instantiation. ACTN does not also deal with hundreds of ISP networks; it deals with perhaps a handful number of TE-based networks to which customer end-points (e.g., of the enterprise, DC's, etc.) are connected. 

Regards,
Young

-----Original Message-----
From: ACTN [mailto:[email-masked]] On Behalf Of Scott Brim
Sent: Friday, March 14, 2014 4:23 PM
To: [email-masked]
Subject: [Actn] ... and I2RS

Scott

---

From: "Diego R. Lopez" <[email-masked]>
Date: Thu, 20 Mar 2014 22:31:44 +0000

Hi,

Anyway, it would be good to have some degree of authentication/authorization to guarantee accountability. When you start virtualizing elements and exposing control interfaces to third parties is a more than advisable practice to keep a detail and secure log of who did what, when and approved by what rule or authority.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Leeyoung <[email-masked]>
Date: Thu, 20 Mar 2014 23:27:52 +0000

Hi Diego,

I don’t disagree on your point and Scott's. We definitely need to have some degree of authentication/authorization mechanisms. My point was that the necessary negotiation is not "random" or "on-the-fly" but is known prior to service instantiations. It entails more less a verification of the already established authentication similar to path key mechanism in multi-domain PCE. Keeping the log of what happens especially in case something goes wrong is a clear requirement here. It is not clear to me, however, if we need "on the fly" authentication/authorization mechanisms. This may be subject to further investigations. 

Thanks,
Young

-----Original Message-----
From: Diego R. Lopez [mailto:[email-masked]] 
Sent: Thursday, March 20, 2014 5:32 PM
To: Leeyoung
Cc: Scott Brim; [email-masked]
Subject: Re: [Actn] ... and I2RS

Hi,

Be goode,

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091

---

From: Scott Brim <[email-masked]>
Date: Thu, 20 Mar 2014 20:20:41 -0400

Yes, I believe you are right. I hadn't understood the ACTN use cases very
well into this afternoon. In I2RS, there will be applications connecting
with multiple I2RS clients connecting with multiple I2RS agents, from
multiple vendors and with diverse privileges required. Communication paths
will be protected but not absolutely secure. It's a significantly more
complex environment than that expected for ACTN.

Thanks... Scott
On Mar 20, 2014 7:27 PM, "Leeyoung" <[email-masked]> wrote:

> Hi Diego,
>
> I don't disagree on your point and Scott's. We definitely need to have
> some degree of authentication/authorization mechanisms. My point was that
> the necessary negotiation is not "random" or "on-the-fly" but is known
> prior to service instantiations. It entails more less a verification of the
> already established authentication similar to path key mechanism in
> multi-domain PCE. Keeping the log of what happens especially in case
> something goes wrong is a clear requirement here. It is not clear to me,
> however, if we need "on the fly" authentication/authorization mechanisms.
> This may be subject to further investigations.
>
> Thanks,
> Young
>
>
>
> Anyway, it would be good to have some degree of
> authentication/authorization to guarantee accountability. When you start
> virtualizing elements and exposing control interfaces to third parties is a
> more than advisable practice to keep a detail and secure log of who did
> what, when and approved by what rule or authority.
>
> Be goode,
>
> > One thought on the relationship with the I2RS mutual
> authentication/authorization and levels of privilege and roles is that ACTN
> has much less of these issues since it assumes that the customer end-points
> are already negotiated with the involved carriers/operators prior to the
> service instantiation. ACTN does not also deal with hundreds of ISP
> networks; it deals with perhaps a handful number of TE-based networks to
> which customer end-points (e.g., of the enterprise, DC's, etc.) are
> connected.
> >
> > Regards,
> > Young
> >
> authentication/authorization, privilege levels and roles in general, and
> how you handle switch restarts.
> >
> > Scott
> >
> Este mensaje se dirige exclusivamente a su destinatario. Puede consultar
> nuestra política de envío y recepción de correo electrónico en el enlace
> situado más abajo.
> This message is intended exclusively for its addressee. We only send and
> receive email on the basis of the terms set out at:

---

From: "Diego R. Lopez" <[email-masked]>
Date: Fri, 21 Mar 2014 15:07:41 +0000

Hi Young,

Agreed. What we are proposing for securing PCEP exchanges would be applicable here as well.

Be goode,

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091