Subject: [I2nsf] Request for Comments on I2NSF Security Policy Translation

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Sat, 21 Jul 2018 06:00:59 -0400

Hi I2NSF WG,

I would like to introduce our draft on I2NSF Security Policy Translation:
- Draft

https://tools.ietf.org/html/draft-yang-i2nsf-security-policy-translation-01

- Slides

https://datatracker.ietf.org/meeting/102/materials/slides-102-i2nsf-security-policy-translation-00

This draft gives I2NSF developers the guidelines for the design and
implementation
of I2NSF Security Controller.
One important functionality of the Security Controller is to automatically
translate
an I2NSF User's high-level policy to a low-level policy for NSFs.

In the past of our I2NSF Hackathon projects, we made an
XSLT-stylesheet-based translator.
But this translator has two limitations, such as static capability-and-NSF
mapping construction
and inefficient maintenance on such a mapping.

The first limitation is the difficult high-level policy construction.
By the XSLT-stylesheet approach, I2NSF User MUST manually selects target
NSFs to execute
the required security capabilities.
This means that I2NSF User needs to know each NSF's capabilities, so it is
difficult for
I2NSF User to construct a high-level security policy without the detailed
knowledge on NSFs.

The second limitation is an inefficient maintenance on the policy
translator.
If the data models on I2NSF NSF-facing Interface requires some updates,
the XSLT stylesheet and XML files need to be updated.
On the other hand, our new approach  provides I2NSF User with an efficient
maintenance.

To solve these two limitations, our draft proposes an automata-based policy
translator.
This translator consists of three components, such as Extractor, Data
Converter, and Generator.

First, when a high-level policy is delivered from I2NSF User to Security
Controller,
Translator extracts data about the policy at Extractor, and then converts
it at Data Converter
for NSF(s). Also, Data Converter can select proper NSFs automatically.
Finally, Generator generates low-level policies of target NSFs based on the
data from Data Converter.

I believe that this draft is valuable for IP2NSF WG adoption
to facilitate the development and deployment of I2NSF in the real world.

Please read this draft and give our authors your valuable comments.
We aim at making this proposal as an Informational RFC.

Thanks.

Best Regards,
Paul & Jinhyuk
-- 
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked], [email-masked]
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
<http://cpslab.skku.edu/people-jaehoon-jeong.php>

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sat, 21 Jul 2018 15:39:26 +0000

Hi Paul,

This is a rather interesting draft and I’d encourage you to continue and report your work in policy translation, as it constitutes one of the essential matters the I2NSF Controller has to deal with.

But I am afraid I don’t see this document progressing in the standards track (even as an experimental one), as the particular techniques for implementing the translation do not seem a proper subject for standardization. The only place I could see room for it in would be as part of the applicability draft, and I am not sure about it… What do others think?

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]<mailto:[email-masked]>
Tel:         +34 913 129 041
Mobile:  +34 682 051 091
----------------------------------

On 21/07/2018, 12:01, "I2nsf on behalf of Mr. Jaehoon Paul Jeong" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Hi I2NSF WG,

- Slides

This draft gives I2NSF developers the guidelines for the design and implementation
of I2NSF Security Controller.
One important functionality of the Security Controller is to automatically translate
an I2NSF User's high-level policy to a low-level policy for NSFs.

In the past of our I2NSF Hackathon projects, we made an XSLT-stylesheet-based translator.
But this translator has two limitations, such as static capability-and-NSF mapping construction
and inefficient maintenance on such a mapping.

The first limitation is the difficult high-level policy construction.
By the XSLT-stylesheet approach, I2NSF User MUST manually selects target NSFs to execute
the required security capabilities.
This means that I2NSF User needs to know each NSF's capabilities, so it is difficult for
I2NSF User to construct a high-level security policy without the detailed knowledge on NSFs.

The second limitation is an inefficient maintenance on the policy translator.
If the data models on I2NSF NSF-facing Interface requires some updates,
the XSLT stylesheet and XML files need to be updated.
On the other hand, our new approach  provides I2NSF User with an efficient
maintenance.

To solve these two limitations, our draft proposes an automata-based policy translator.
This translator consists of three components, such as Extractor, Data Converter, and Generator.

First, when a high-level policy is delivered from I2NSF User to Security Controller,
Translator extracts data about the policy at Extractor, and then converts it at Data Converter
for NSF(s). Also, Data Converter can select proper NSFs automatically.
Finally, Generator generates low-level policies of target NSFs based on the data from Data Converter.

Thanks.

Best Regards,
Paul & Jinhyuk
--
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php<http://cpslab.skku.edu/people-jaehoon-jeong.php>

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Sat, 21 Jul 2018 12:42:01 -0400

Hi Diego,
This draft is about the design and implementation of
I2NSF Security Policy Controller from a high-level YANG to a low-level YANG.

In my previous RFC about "IPv6 Router Advertisement Options for DNS
Configuration",
the implementation considerations are included for facilitating developers
for an easy implementation:
https://tools.ietf.org/html/rfc8106

As I mentioned in the previous email, we aim at an Informational RFC rather
than
a Standard-track or experimental RFC.
IMHO, this policy translation is a key technology for I2NSF, so it will be
beneficial
to have an Informational RFC on the security policy translation.

Thanks.

Paul

On Sat, Jul 21, 2018 at 11:39 AM, Diego R. Lopez <
[email-masked]> wrote:

> Hi Paul,
>
>
>
> This is a rather interesting draft and I’d encourage you to continue and
> report your work in policy translation, as it constitutes one of the
> essential matters the I2NSF Controller has to deal with.
>
>
>
> But I am afraid I don’t see this document progressing in the standards
> track (even as an experimental one), as the particular techniques for
> implementing the translation do not seem a proper subject for
> standardization. The only place I could see room for it in would be as part
> of the applicability draft, and I am not sure about it… What do others
> think?
>
>
>
> Be goode,
>
>
>
> --
>
> e-mail: [email-masked]
>
> Tel:         +34 913 129 041
>
> Mobile:  +34 682 051 091
>
> On 21/07/2018, 12:01, "I2nsf on behalf of Mr. Jaehoon Paul Jeong" <
> [email-masked] on behalf of [email-masked]> wrote:
>
>
>
> Hi I2NSF WG,
>
>
>
> ------------------------------
>
> Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario,
> puede contener información privilegiada o confidencial y es para uso
> exclusivo de la persona o entidad de destino. Si no es usted. el
> destinatario indicado, queda notificado de que la lectura, utilización,
> divulgación y/o copia sin autorización puede estar prohibida en virtud de
> la legislación vigente. Si ha recibido este mensaje por error, le rogamos
> que nos lo comunique inmediatamente por esta misma vía y proceda a su
> destrucción.
>
> The information contained in this transmission is privileged and
> confidential information intended only for the use of the individual or
> entity named above. If the reader of this message is not the intended
> recipient, you are hereby notified that any dissemination, distribution or
> copying of this communication is strictly prohibited. If you have received
> this transmission in error, do not read it. Please immediately reply to the
> sender that you have received this communication in error and then delete
> it.
>
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário,
> pode conter informação privilegiada ou confidencial e é para uso exclusivo
> da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário
> indicado, fica notificado de que a leitura, utilização, divulgação e/ou
> cópia sem autorização pode estar proibida em virtude da legislação vigente.
> Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique
> imediatamente por esta mesma via e proceda a sua destruição
>

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sat, 21 Jul 2018 17:45:30 +0000

Hi Paul,

Where are the high-level YANG and low-level YANG defined? Probably, as you suggest in the case of RFC8106, this could become implementation considerations on one of the YANG definitions.

Be goode,

Dr Diego R. Lopez
Telefonica I+D

On 21/07/2018, 18:42, "Mr. Jaehoon Paul Jeong" <[email-masked]<mailto:[email-masked]>> wrote:

Hi Diego,

In my previous RFC about "IPv6 Router Advertisement Options for DNS Configuration",
the implementation considerations are included for facilitating developers for an easy implementation:
https://tools.ietf.org/html/rfc8106

As I mentioned in the previous email, we aim at an Informational RFC rather than
a Standard-track or experimental RFC.
IMHO, this policy translation is a key technology for I2NSF, so it will be beneficial
to have an Informational RFC on the security policy translation.

Thanks.

Paul

On Sat, Jul 21, 2018 at 11:39 AM, Diego R. Lopez <[email-masked]<mailto:[email-masked]>> wrote:
Hi Paul,

Be goode,

Dr Diego R. Lopez
Telefonica I+D

Hi I2NSF WG,

- Slides

Thanks.

Best Regards,
Paul & Jinhyuk

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Sun, 22 Jul 2018 01:06:57 -0400

Hi Diego,
in our I2NSF security policy translator, a restconf xml file based on a
high-level policy YANG is translated into a netconf xml file based on a
low-level policy YANG.

RFC 8106 is an example to show that the implementation considerations are
useful to developers though RFC 8106 is about IPv6 DNS autoconfiguration.

Without our I2NSF security translation draft, it is hard for developers to
figure out the implementation of Security Controller that bridges
Consumer-Facing Interface and NSF-Facing Interface.

Thanks.

Paul

2018년 7월 21일 (토) 오후 1:45, Diego R. Lopez <[email-masked]>님이
작성:

> Hi Paul,
>
>
>
> Where are the high-level YANG and low-level YANG defined? Probably, as you
> suggest in the case of RFC8106, this could become implementation
> considerations on one of the YANG definitions.
>
>
>
> Be goode,
>
>
>
> --
>
> On 21/07/2018, 18:42, "Mr. Jaehoon Paul Jeong" <[email-masked]>
> wrote:
>
>
>
> Hi Diego,
>
> imediatamente por esta mesma via e proceda a sua destruição0
>

---

From: "Xialiang (Frank, Network Integration Technology Research Dept)" <[email-masked]>
Date: Mon, 23 Jul 2018 01:09:05 +0000

Hi,
I share the same concern with Diego. Although it’s a good example of how to translate the YANG models, but it’s just one of the possible system implementations, thus not suitable to be a specification.

My suggestion is you can consider to include its key contents into the I2NSF applicability draft.

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Diego R. Lopez
发送时间: 2018年7月21日 23:39
收件人: Mr. Jaehoon Paul Jeong <[email-masked]>; [email-masked]
抄送: SecCurator_Team <[email-masked]>
主题: Re: [I2nsf] Request for Comments on I2NSF Security Policy Translation

Hi Paul,

Be goode,

Dr Diego R. Lopez
Telefonica I+D

Hi I2NSF WG,

- Slides

Thanks.

Best Regards,
Paul & Jinhyuk

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Sun, 22 Jul 2018 22:45:33 -0400

Hi Frank,
As you know, the open source is dominant these days.
If IETF sticks to a general specification,
its position will get narrower and narrower in future.

To make I2NSF easily be used in the world, I believe the implementation
guidelines of the security policy translation is important and useful.
IMHO, without these guidelines, but with data models, I2NSF will not be
hard to be accepted.

As long as I understand, I2NSF Applicability draft should focus on how to
leverage I2NSF with other important aspects (e.g., SDN, SFC, and NFV) for
the deployment of I2NSF rather than the detailed specification of I2NSF
components, such as security policy translator.

I2NSF other people,
Let us know your opinions.

After collecting opinions and making consensus, let's move forward.

Thanks.

Paul

2018년 7월 22일 (일) 오후 9:09, Xialiang (Frank, Network Integration Technology
Research Dept) <[email-masked]>님이 작성:

> Hi,
>
> I share the same concern with Diego. Although it’s a good example of how
> to translate the YANG models, but it’s just one of the possible system
> implementations, thus not suitable to be a specification.
>
>
>
> *发件人:* I2nsf [mailto:[email-masked]] *代表 *Diego R. Lopez
> *发送时间:* 2018年7月21日 23:39
> *收件人:* Mr. Jaehoon Paul Jeong <[email-masked]>; [email-masked]
> *抄送:* SecCurator_Team <[email-masked]>
> *主题:* Re: [I2nsf] Request for Comments on I2NSF Security Policy
> Translation
>
>
>
> Hi Paul,
>
>
>