Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-05.txt

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Wed, 4 Feb 2015 14:39:04 +0000

Rob,

> 
> 
>> - The security considerations section mostly discusses solutions, but doesn’t present the potential risks. As an example: While I appreciate you mandating the dCDN to support TLS, the fact that you don’t mandate its use I think requires you to at least list the potential risks of not doing so. I imagine having some entity sends illegitimate purge requests can have quite an impact on the CDNs, and it wouldn’t hurt pointing out these issues. Especially since this not only impacts the dCDN, but the uCDN as well, since the dCDN will have the re-fetch to content. The same goes for having a third party send metadata invalidation requests. 
> 
> Added "This is intended to prevent unauthorised users from generating unnecessary load in dCDN or uCDN due to revalidation, reacquisition, or unnecessary acquisition."
> 
> [Ray] Thanks for adding this line. Still, I expect the IESG will have some comments on the security section. In its current form, it presents some (optional) solutions, but doesn’t present arguments or recommendations on when to use them, nor does it explain the potential problems.

I think Ray brings up a valid point and we need to tweak the security section before requesting IESG review.

In particular, I notice that the first paragraph of 8.1 only mentions authentication. This implies that there is no concerns about confidentiality or integrity protection. If you feel this is the case, then can you state it and explain why? If you feel this is not the case, can you bring up the concerns in case integrity of confidentiality is compromised (and make sure that the phrase “such protection” in the 2nd paragraph calls for protection against those also).

Also, I generally agree with Ray, that it’d be useful to discuss first what are the concerns with the various CI/T commands being compromised.

Could you address that?

Francois

---

From: Rob Murray <[email-masked]>
Date: Sun, 15 Feb 2015 18:58:51 +0000

> On 4 Feb 2015, at 14:39, Francois Le Faucheur (flefauch) <[email-masked]> wrote:
> 
> Rob,
> 
>> 
>> 

Hi Francois, Ray, all - how's this extra intro text for the Security Considerations section of the CI/T draft, does it address everything it needs to?

8. Security Considerations 

The CI/T interface provides a mechanism to allow a uCDN to inspect its own CI/T requests and their current state. The CI/T interface does not allow access to or modification of the uCDN or dCDN metadata relating to content delivery, or to the content itself. It can only control the presence of that metadata in the dCDN, and the processing work and network utilisation involved in ensuring that presence.

By examining pre-positioning requests to a dCDN, and correctly interpreting content and metadata URLs, an attacker could learn the uCDN or content owner's predictions for future content popularity. By examining invalidate or purge requests, an attacker could learn about changes in the content owner's catalogue.

By injecting CI/T commands an attacker, or a misbehaving uCDN, would generate work in the dCDN as it processes those requests. That would decrease the dCDN's caching efficiency by causing it to unnecessarily acquire or re-acquire content metadata and content.

A dCDN implementation of CI/T MUST restrict the actions of a uCDN to its own data. Failure to do so would allow uCDNs to detrimentally affect each other's efficiency by generating unnecessary acquisition or re-acquisition load.

<< Then the existing text, https://tools.ietf.org/html/draft-ietf-cdni-control-triggers-05#section-8 >>

Many thanks,
Rob.

---

From: "Brandenburg, R. (Ray) van" <[email-masked]>
Date: Mon, 16 Feb 2015 09:33:13 +0000

Hi Rob,

Thanks for addressing my comments. The proposed text addresses the concerns I had. One additional comment:

> By injecting CI/T commands an attacker, or a misbehaving uCDN, would generate work in the dCDN as it processes those requests.

Maybe you could change this to 'would generate work in the dCDN and uCDN…'. Any re-acquiring of content generates load on both the uCDN as well as dCDN.

Thanks,

Ray

-----Original Message-----
From: Rob Murray [mailto:[email-masked]]
Sent: zondag 15 februari 2015 19:59
To: Francois Le Faucheur (flefauch); Brandenburg, R. (Ray) van
Cc: [email-masked]
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-05.txt

> On 4 Feb 2015, at 14:39, Francois Le Faucheur (flefauch) <[email-masked]<mailto:[email-masked]>> wrote:
>
> Rob,
>
>>
>>

Many thanks,
Rob.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. TNO accepts no liability for the content of this e-mail, for the manner in which you use it and for damage of any kind resulting from the risks inherent to the electronic transmission of messages.

---

From: Rob Murray <[email-masked]>
Date: Mon, 16 Feb 2015 09:58:52 +0000

Good point, thanks Ray - will do.

On 16 Feb 2015, at 09:33, Brandenburg, R. (Ray) van <[email-masked]<mailto:[email-masked]>> wrote:

Hi Rob,

Thanks,

Ray

-----Original Message-----
From: Rob Murray [mailto:[email-masked]]
Sent: zondag 15 februari 2015 19:59
To: Francois Le Faucheur (flefauch); Brandenburg, R. (Ray) van
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-05.txt

Many thanks,
Rob.

---

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Mon, 16 Feb 2015 10:28:57 +0000

Rob, Ray and all,

Thanks for progressing on this.

I agree with Ray’s suggested change.

I have a few additional suggestions & comments:

OLD:
“
The CI/T interface provides a mechanism to allow a uCDN to inspect its own CI/T requests and their current state.
“
NEW:
“
The CI/T interface provides a mechanism to allow a uCDN to generate requests into the dCDN and to inspect its own CI/T requests and their current state.
“

OLD:
“
By injecting CI/T commands an attacker, or a misbehaving uCDN, would generate work in the dCDN as it processes those requests. That would decrease the dCDN's caching efficiency by causing it to unnecessarily acquire or re-acquire content metadata and content.
“
NEW:
“
By injecting CI/T commands an attacker, or a misbehaving uCDN, would generate work in the dCDN and uCDN as it processes those requests. And so would a man in the middle attacker modifying valid CI/T commands generated by the uCDN. In both cases, that would decrease the dCDN caching efficiency by causing it to unnecessarily acquire or re-acquire content metadata and/or content.
“

OLD:
“
A dCDN implementation of CI/T MUST restrict the actions of a uCDN to its own data.
”
NEW:
"
A dCDN implementation of CI/T MUST restrict the actions of a uCDN to the data corresponding to that uCDN.
”

Regarding << Then the existing text, https://tools.ietf.org/html/draft-ietf-cdni-control-triggers-05#section-8 >>
We have received a number of comments from the IESG (as part of the cdni-logging IESG Review) on the generic (i.e. cross-CDNI interfaces) recommendations re TLS + John Mattsson’s recent comment. This will be followed up by a specific thread to get it to resolution, so please keep an eye on that thread and update when it has settled.

On 16 Feb 2015, at 10:33, Brandenburg, R. (Ray) van <[email-masked]<mailto:[email-masked]>> wrote:

Hi Rob,

Thanks,

Ray

-----Original Message-----
From: Rob Murray [mailto:[email-masked]]
Sent: zondag 15 februari 2015 19:59
To: Francois Le Faucheur (flefauch); Brandenburg, R. (Ray) van
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-05.txt

Many thanks,
Rob.

---

From: Rob Murray <[email-masked]>
Date: Mon, 23 Feb 2015 08:34:52 +0000

Thanks all, I've posted a "-06" with the "Security Considerations" improvements discussed (and an extra ref to the JSON RFC).

https://tools.ietf.org/html/draft-ietf-cdni-control-triggers-06

Cheers,
Rob.

On 16 Feb 2015, at 10:28, Francois Le Faucheur (flefauch) <[email-masked]<mailto:[email-masked]>> wrote:

Rob, Ray and all,

OLD:
“

OLD:
“

OLD:
“

Hi Rob,

Thanks,

Ray

-----Original Message-----
From: Rob Murray [mailto:[email-masked]]
Sent: zondag 15 februari 2015 19:59
To: Francois Le Faucheur (flefauch); Brandenburg, R. (Ray) van
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-control-triggers-05.txt

Many thanks,
Rob.