Subject: [I2nsf] relationship between draft-hares-i2nsf-capability-data-model-03 & draft-kim-i2nsf-nsf-facing-interface-data-model-02? (was RE: Request for Timeslots in I2NSF WG Meeting

From: Linda Dunbar <[email-masked]>
Date: Fri, 7 Jul 2017 23:24:07 +0000

Paul and Sue:

You requested slots for both draft-hares-i2nsf-capability-data-model-03 & draft-kim-i2nsf-nsf-facing-interface-data-model-02.

The abstract of draft-kim-i2nsf-nsf-facing-interface-data-model-02 stated that the draft defines the data model for network security functions), such as network security control, content security control, and attack mitigation control,..

The draft-hares-i2nsf-capability-data-model-03 has specified the High-Level YANG for Network Security Control, Content Security Control and Attack Mitigation Control.

How are those two drafts related?  I have a vague memory that those two drafts are to be merged, are they?

Thank you very much,

Linda

From: Mr. Jaehoon Paul Jeong [mailto:[email-masked]]
Sent: Thursday, July 06, 2017 7:54 AM
To: Linda Dunbar <[email-masked]>; Adrian Farrel <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Request for Timeslots in I2NSF WG Meeting

Hi Linda and Adrian,
I would like to ask the timeslots for our 7 drafts as follows:

draft-hares-i2nsf-capability-data-model-03
- Presenter: Sue Hares
- Time: 10 min

draft-kim-i2nsf-nsf-facing-interface-data-model-02
- Presenter: Jaehoon Paul Jeong
- Time: 10 min

draft-jeong-i2nsf-consumer-facing-interface-dm-02
- Presenter: Jaehoon Paul Jeong
- Time: 10 min

draft-jeong-i2nsf-applicability-00
- Presenter: Jaehoon Paul Jeong
- Time: 15 min

draft-hyun-i2nsf-nsf-triggered-steering-03
- Presenter: Sangwon Hyun
- Time: 10 min

draft-hyun-i2nsf-registration-interface-im-02
draft-hyun-i2nsf-registration-interface-dm-01
- Presenter: Sangwon Hyun
- Time: 10 min

Thanks.

Best Regards,
Paul
--
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php<http://cpslab.skku.edu/people-jaehoon-jeong.php>

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Tue, 11 Jul 2017 00:20:36 +0900

Hi Linda,
Here is the clarification between NSF-facing interface YANG data model and
Capability YANG data model.

NSF-facing YANG data model is used to configure the rules of a policy into
NSFs.
This YANG data model is a standard interface for Security Controller to
manipulate NSFs
developed by various vendors.

Capability YANG data model is used to retrieve capability information of an
NSF.
For example, after an NSF for network security control (i.e., firewall)
inspects a packet and
needs an additional security function such as deep packet inspection (DPI),
it can ask Security Controller the location of such an additional security
function and
the corresponding IT resources with the Capability YANG data model.

In summary, Capability YANG data model is used to query the capability
information of
a requested NSF and NSF-facing YANG data model is used to configure the
rules of
a policy (e.g., add/delete/update/read) based on an ECA paradigm.

Thus, since these two models have different purposes, I think that we need
to have two YANG drafts.

Thanks.

Best Regards,
Paul

On Sat, Jul 8, 2017 at 8:24 AM, Linda Dunbar <[email-masked]>
wrote:

> Paul and Sue:
>
>
>
> You requested slots for both draft-hares-i2nsf-capability-data-model-03 &
> draft-kim-i2nsf-nsf-facing-interface-data-model-02.
>
>
>
> The abstract of draft-kim-i2nsf-nsf-facing-interface-data-model-02 stated
> that the draft defines the data model for network security functions), such
> as network security control, content security control, and attack
> mitigation control,..
>
>
>
> The draft-hares-i2nsf-capability-data-model-03 has specified the
> High-Level YANG for Network Security Control, Content Security Control and
> Attack Mitigation Control.
>
>
>
> *From:* Mr. Jaehoon Paul Jeong [mailto:[email-masked]]
> *Sent:* Thursday, July 06, 2017 7:54 AM
> *To:* Linda Dunbar <[email-masked]>; Adrian Farrel <
> [email-masked]>
> *Cc:* [email-masked]; [email-masked]
> *Subject:* Request for Timeslots in I2NSF WG Meeting
>
>
>
> Hi Linda and Adrian,
>
> Email: [email-masked], [email-masked]
> Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
> <http://cpslab.skku.edu/people-jaehoon-jeong.php>
>
> _______________________________________________
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>
>

-- 
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked], [email-masked]
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
<http://cpslab.skku.edu/people-jaehoon-jeong.php>

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Wed, 12 Jul 2017 09:54:33 +0000

Hi Paul,
Thanks for your clear clarification. I share the same idea with you.
Actually, in the latest draft-xibassnez-i2nsf-capability, we have separated capability and security policy information model distinctly.

So, my further question is what is the relationship between the capability DM draft and registration interface DM?

Thanks!

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Mr. Jaehoon Paul Jeong
发送时间: 2017年7月10日 23:21
收件人: Linda Dunbar
抄送: [email-masked]; Adrian Farrel; [email-masked]
主题: Re: [I2nsf] relationship between draft-hares-i2nsf-capability-data-model-03 & draft-kim-i2nsf-nsf-facing-interface-data-model-02? (was RE: Request for Timeslots in I2NSF WG Meeting

Hi Linda,
Here is the clarification between NSF-facing interface YANG data model and Capability YANG data model.

NSF-facing YANG data model is used to configure the rules of a policy into NSFs.
This YANG data model is a standard interface for Security Controller to manipulate NSFs
developed by various vendors.

Capability YANG data model is used to retrieve capability information of an NSF.
For example, after an NSF for network security control (i.e., firewall) inspects a packet and
needs an additional security function such as deep packet inspection (DPI),
it can ask Security Controller the location of such an additional security function and
the corresponding IT resources with the Capability YANG data model.

In summary, Capability YANG data model is used to query the capability information of
a requested NSF and NSF-facing YANG data model is used to configure the rules of
a policy (e.g., add/delete/update/read) based on an ECA paradigm.

Thus, since these two models have different purposes, I think that we need to have two YANG drafts.

Thanks.

Best Regards,
Paul

On Sat, Jul 8, 2017 at 8:24 AM, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
Paul and Sue:

Thank you very much,

Linda

From: Mr. Jaehoon Paul Jeong [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Thursday, July 06, 2017 7:54 AM
To: Linda Dunbar <[email-masked]<mailto:[email-masked]>>; Adrian Farrel <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Request for Timeslots in I2NSF WG Meeting

Hi Linda and Adrian,

Thanks.

Best Regards,
Paul

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Thu, 13 Jul 2017 23:38:38 +0900

Hi Frank,

In the I2NSF framework, the basic purpose of the registration interface is
to register an NSF into the system.
In addition to this purpose, however, the registration interface can be
also utilized for dynamic life cycle management of NSFs.
For example, the security controller can request the developer's management
system (DMS) to create a new NSF instance.
The registration interface DM defines the data model that is required to
enable this additional functionality of the registration interface.

On the other hand, the capability DM can be used to describe the security
capability of a new NSF instance to be created by the DMS along with its
location and IT resources.

Thanks.

Best Regards,
Paul

On Wed, Jul 12, 2017 at 6:54 PM, Xialiang (Frank) <[email-masked]

> Actually, in the latest draft-xibassnez-i2nsf-capability, we have
> separated capability and security policy information model distinctly.
>
>
>
> *发件人:* I2nsf [mailto:[email-masked]] *代表 *Mr. Jaehoon Paul Jeong
> *发送时间:* 2017年7月10日 23:21
> *收件人:* Linda Dunbar
> *抄送:* [email-masked]; Adrian Farrel; [email-masked]
> *主题:* Re: [I2nsf] relationship between draft-hares-i2nsf-capability-data-model-03
> & draft-kim-i2nsf-nsf-facing-interface-data-model-02? (was RE: Request
> for Timeslots in I2NSF WG Meeting
>
>
>
> Hi Linda,
>

---

From: John Strassner <[email-masked]>
Date: Sun, 16 Jul 2017 11:29:59 -0700

> Capability YANG data model is used to retrieve capability information of

This is not quite correct.

Capabilities are used to express functions that can be performed. An NSF
may have multiple Capabilities. Capabilities are first **registered** using
the Registration Interface. I would have expected this model to do that.

> Capability YANG data model is used to query the capability information of
> a requested NSF and NSF-facing YANG data model is used to configure
> the rules of a policy

I find this confusing. Any YANG module should be able to get and set
information. Assuming that "query" means "get" here, I see no reason to
have a separate YANG module for that.

I do, however, see a need for a separate YANG module for
**registering** the capability information.

Note: please be careful in your wording (i.e., "model" vs. "module").

regards,
John

On Mon, Jul 10, 2017 at 8:20 AM, Mr. Jaehoon Paul Jeong <
[email-masked]> wrote:

>> The abstract of draft-kim-i2nsf-nsf-facing-interface-data-model-02
>> stated that the draft defines the data model for network security
>> functions), such as network security control, content security control, and
>> attack mitigation control,..
>>
>>
>>
>> Office: +82-31-299-4957 <+82%2031-299-4957>
> Office: +82-31-299-4957 <+82%2031-299-4957>

-- 
regards,
John

---

From: John Strassner <[email-masked]>
Date: Sun, 16 Jul 2017 12:33:55 -0700

> In the I2NSF framework, the basic purpose of the registration
> interface is to register an NSF into the system.

The registration interface is also used to register NSF Capabilities.

> In addition to this purpose, however, the registration interface
> can be also utilized for dynamic life cycle management of NSFs.

I disagree. The only operations that this interface should support
are register and deregister, for both NSFs and Capabilities.
Operational status SHOULD NOT be put in this interface.

> For example, the security controller can request the developer's
> management system (DMS) to create a new NSF instance.
> The registration interface DM defines the data model that is
> required to enable this additional functionality of the
> registration interface.

That is not, imo, "dynamic lifecycle management". That is simply
performing a registration operation. OAM info SHOULD NOT
be put into a registration interface.

> On the other hand, the capability DM can be used to describe
> the security capability of a new NSF instance to be created by
> the DMS along with its location and IT resources.

Again, this is **just** a registration operation. I fail to see how
this has anything to do with lifecycle management.

regards,
John

On Thu, Jul 13, 2017 at 7:38 AM, Mr. Jaehoon Paul Jeong <
[email-masked]> wrote:

> On Wed, Jul 12, 2017 at 6:54 PM, Xialiang (Frank) <
> [email-masked]> wrote:
>
>> Hi Paul,
>>
>> So, my further question is what is the relationship between the
>> capability DM draft and registration interface DM?
>>
>>
>>
>> Thanks!
>>
>>
>>
>> B.R.
>>
>> Frank
>>
>>
>>

-- 
regards,
John

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sun, 16 Jul 2017 22:34:46 +0000

Hi Paul,

For sure we need two YANG models. Whether we need two drafts, a single one, or a distribution of the different proposed models in a certain number of drafts is something that the WG has to decide.

Be goode,

On 10 Jul 2017, at 17:20 , Mr. Jaehoon Paul Jeong <[email-masked]<mailto:[email-masked]>> wrote:

Hi Linda,

Thanks.

Best Regards,
Paul

Thank you very much,

Linda

Hi Linda and Adrian,

Thanks.

Best Regards,
Paul

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener informaci?n privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilizaci?n, divulgaci?n y/o copia sin autorizaci?n puede estar prohibida en virtud de la legislaci?n vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma v?a y proceda a su destrucci?n.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinat?rio, pode conter informa??o privilegiada ou confidencial e ? para uso exclusivo da pessoa ou entidade de destino. Se n?o ? vossa senhoria o destinat?rio indicado, fica notificado de que a leitura, utiliza??o, divulga??o e/ou c?pia sem autoriza??o pode estar proibida em virtude da legisla??o vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destrui??o

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sun, 16 Jul 2017 23:05:15 +0000

Hi,

I am under the impression we have here a misunderstanding caused by the concepts in NFV and what we are defining in I2NSF. I agree with John in that the Registration Interface should not be used for exchanging operational status, just to register and deregister NSFs and their capabilities. But there is an NFV process (the so-called “onboarding”, essentially including it in a catalog of available software-based functions) that should imply an exchange through the Registration Interface, and could be seen as an operational exchange. Anyway, this misinterpretation can be solved if we realize such onboarding is not a lifecycle operation, but the pre-condition for starting the function lifecycle.

Be goode,

regards,
John

On Thu, Jul 13, 2017 at 7:38 AM, Mr. Jaehoon Paul Jeong <[email-masked]<mailto:[email-masked]>> wrote:
Hi Frank,

Thanks.

Best Regards,
Paul

On Wed, Jul 12, 2017 at 6:54 PM, Xialiang (Frank) <[email-masked]<mailto:[email-masked]>> wrote:
Hi Paul,
Thanks for your clear clarification. I share the same idea with you.
Actually, in the latest draft-xibassnez-i2nsf-capability, we have separated capability and security policy information model distinctly.

Thanks!

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]<mailto:[email-masked]>] 代表 Mr. Jaehoon Paul Jeong
发送时间: 2017年7月10日 23:21
收件人: Linda Dunbar
抄送: [email-masked]<mailto:[email-masked]>; Adrian Farrel; [email-masked]<mailto:[email-masked]>
主题: Re: [I2nsf] relationship between draft-hares-i2nsf-capability-data-model-03 & draft-kim-i2nsf-nsf-facing-interface-data-model-02? (was RE: Request for Timeslots in I2NSF WG Meeting

Hi Linda,

Thanks.

Best Regards,
Paul

Thank you very much,

Linda

Hi Linda and Adrian,

Thanks.

Best Regards,
Paul
Office: +82-31-299-4957<tel:+82%2031-299-4957>

Office: +82-31-299-4957<tel:+82%2031-299-4957>

Office: +82-31-299-4957<tel:+82%2031-299-4957>

Dr Diego R. Lopez
Telefonica I+D

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 17 Jul 2017 04:26:21 +0000

Agree!

From: Diego R. Lopez [mailto:[email-masked]]
Sent: Monday, July 17, 2017 1:05 AM
To: John Strassner
Cc: Mr. Jaehoon Paul Jeong; [email-masked]; Adrian Farrel; Xialiang (Frank); Linda Dunbar
Subject: Re: [I2nsf] 答复: relationship between draft-hares-i2nsf-capability-data-model-03 & draft-kim-i2nsf-nsf-facing-interface-data-model-02? (was RE: Request for Timeslots in I2NSF WG Meeting

Hi,

Be goode,

regards,
John

Thanks.

Best Regards,
Paul

Thanks!

B.R.
Frank

Hi Linda,

Thanks.

Best Regards,
Paul

Thank you very much,

Linda

Hi Linda and Adrian,

Thanks.

Best Regards,
Paul

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------