Subject: [Detnet] DetNet Use Case Statements - Security must allow for long leases

From: "Grossman, Ethan A." <[email-masked]>
Date: Fri, 3 Jun 2016 20:37:41 +0000

Statement:
Security must allow for long leases
(I am honestly not sure what I meant by this line - I think it is a reference to the following, but I don't see what the question would be)

Text from (Cellular Radio) Use Case:
Establishing time-sensitive streams in the network entails reserving networking resources for long periods of time. It is important that these reservation requests be authenticated to prevent malicious reservation attempts from hostile nodes (or accidental misconfiguration).

Discussion:
I would imagine that any reservation of resources in a secure network would require authentication, regardless of how long or short of an amount of time the lease may be for. Is there anything specific to DetNet about this?

---

From: Jouni Korhonen <[email-masked]>
Date: Tue, 7 Jun 2016 13:39:47 -0700

Hi Ethan,

I think I am not the original author of this text but anyway. You are
correct the security framework would be the same for all uses. I don't
think there is anything DetNet specific per se.. just that there are use
cases (like the cellular) where "exceptionally long" lease expiration times
are potentially practiced. One could hog the resources with far less
rogue/hostile reservations compared to a deployment where lease times are
capped (not authorized beyond some number).

I would argue that the authentication does not protect against "lease
misconfiguration", when the security happens to be configured properly.
Authorization step might help here, though.

- Jouni

On Fri, Jun 3, 2016 at 1:37 PM, Grossman, Ethan A. <[email-masked]> wrote:

> (I am honestly not sure what I meant by this line – I think it is a
> reference to the following, but I don’t see what the question would be)
>
> Establishing time-sensitive streams in the network entails reserving
> networking resources for long periods of time. It is important that these
> reservation requests be authenticated to prevent malicious reservation
> attempts from hostile nodes (or accidental misconfiguration).
>
> Discussion:
> I would imagine that any reservation of resources in a secure network
> would require authentication, regardless of how long or short of an amount
> of time the lease may be for. Is there anything specific to DetNet about
> this?
>
>
>
>
>
>
>
> _______________________________________________
> detnet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/detnet
>
>

-- 
Jouni Korhonen, Broadcom Ltd.

---

From: Jouni Korhonen <[email-masked]>
Date: Tue, 7 Jun 2016 13:30:14 -0700

Hi Ethan,

I think I am not the original author of this piece of text but anyway..

6/3/2016, 1:37 PM, Grossman, Ethan A. kirjoitti:
> networking resources for long periods of time. It is important that
> these reservation requests be authenticated to prevent malicious
> reservation attempts from hostile nodes (or accidental misconfiguration).
>
> Discussion:
> would require authentication, regardless of how long or short of an
> amount of time the lease may be for. Is there anything specific to
> DetNet about this?

Nothing really specific to Detnet. The security framework in that sense 
should be the same for everyone. I guess the intention here was to 
indicate that some use cases (cellular for example) would most likely to 
ask for a lease that has 'exceptionally long validity time' and the 
security policy should be configurable for such.