Subject: [fun] WG Review: Home Networks (homenet)

From: IESG Secretary <[email-masked]>
Date: Tue, 5 Jul 2011 09:35:28 -0700 (PDT)

A new IETF working group has been proposed in the Internet Area.  The 
IESG has not made any determination as yet. The following draft charter 
was submitted, and is provided for informational purposes only. Please 
send your comments to the IESG mailing list ([email-masked]) by Tuesday, 
July 12, 2011.                              

Home Networks (homenet)
-----------------------------------
Current Status: Proposed Working Group
Last Edit: Thursday, June 30th, 2011

Chairs:
TBD

Internet Area Directors:
Ralph Droms <[email-masked]>
Jari Arkko <[email-masked]>

Internet Area Advisor:
Jari Arkko <[email-masked]>

Routing Area Technical Advisor:
TBD

Security Area Technical Advisor:
TBD

Mailing Lists:
General Discussion: [email-masked]
To Subscribe: https://www.ietf.org/mailman/listinfo/fun
Archive: http://www.ietf.org/mail-archive/web/fun

Description of Working Group:

This working group focuses on the evolving networking technology
within and among relatively small Òresidential homeÓ networks. For
example, an obvious trend in home networking is the proliferation of
networking technology in an increasingly broad range and number of
devices. This evolution in scale and diversity sets some requirements
on IETF protocols. Some of the relevant trends include:

o  Multiple segments: While less complex L3-toplogies involving as few
  subnets as possible are preferred in home networks for a variety of
  reasons including simpler management and service discovery, the
  introduction of more than one subnet into a home network is enough
  to add complexity that needs to be addressed, and multiple
  dedicated segments are necessary for some cases.  For instance, a
  common feature in modern home routers in the ability to support
  both guest and private network segments. Also, link layer
  networking technology is poised to become more heterogeneous, as
  networks begin to employ both traditional Ethernet technology and
  link layers designed for low-powered sensor networks. Finally,
  similar needs for segmentation may occur in other cases, such as
  separating building control or corporate extensions from the
  Internet access network. Different segments may be associated with
  subnets that have different routing and security policies.

o  Service providers are deploying IPv6, and support for IPv6 is
  increasingly available in home gateway devices. While IPv6 resembles
  IPv4 in many ways, it changes address allocation principles and allows
  direct IP addressability and routing to devices in the home from the
  Internet. This is a promising area in IPv6 that has proved challenging
  in IPv4 with the proliferation of NAT.

o  End-to-end communication is both an opportunity and a concern as it
  enables new applications but also exposes nodes in the internal
  networks to receipt of unwanted traffic from the Internet. Firewalls
  that restrict incoming connections may be used to prevent exposure,
  however, this reduces the efficacy of end-to-end connectivity that
  IPv6 has the potential to restore.

Home networks need to provide the tools to handle these situations in
a manner accessible to all users of home networks. Manual
configuration is rarely, if at all, possible, as the necessary skills
and in some cases even suitable management interfaces are missing.

The purpose of this working group is to focus on this evolution, in
particular as it addresses the introduction of IPv6, by developing an
architecture addressing this full scope of requirements:

o  prefix configuration for routers
o  managing routing
o  name resolution
o  service discovery
o  network security

The task of the group is to produce an architecture document that
outlines how to construct home networks involving multiple routers and
subnets. This document is expected to apply the IPv6 addressing
architecture, prefix delegation, global and ULA addresses, source
address selection rules and other existing components of the IPv6
architecture. The architecture document should drive what protocols
changes, if any, are necessary. Specific protocol work described below
is expected to be within the scope of the working group once the
architecture work is complete. However, the group is required to
review its charter and milestones with the IESG and IETF community
before submitting documents that make protocol changes. It is expected
that the group has to discuss some of the below solutions, however, in
order to complete the architecture work.

The group will apply existing protocols to handle the five
requirements above. For prefix configuration, existing protocols are
likely sufficient, and at worst may need some small enhancements, such
as new options. For automatic routing, it is expected that existing
routing protocols can be used as is, however, a new mechanism may be
needed in order to turn a selected protocol on by default. For name
resolution and service discovery, extensions to existing
multicast-based name resolution protocols are needed to enable them to
work across subnets.

For network security, the group shall document the concept of
"advanced security" as a further development of "simple security" from
RFC 6092. The main goal of this work is to enable a security policy
that adapts to IPv6 threats as they emerge, taking into account not
only traffic from the Internet at large, but within and leaving the
home network itself.

It is expected that the working group will define a set of protocol
specifications to accomplish the five requirements from
above. However, it is not in the scope of the working group to define
entirely new routing protocols or address allocation protocols. As
noted, additional options or other small extensions may be necessary
to use the existing protocols in these new configuration tasks. The
working group shall also not make any changes to IPv6 protocols or
addressing architecture. Prefix configuration, routing, and security
related work shall not cause any changes that are not backwards
compatible to existing IPv6 hosts. There may be host visible changes
in the work on naming and discovery protocols, however. In its design,
the working group shall also consider security aspects and the impact
on manageability. The main focus of the working group is home
networks, but the group's results may also find applications in other
small networks.

The working group will liaise with the relevant IETF working
groups. In particular, the group should work closely with the V6OPS
working group, review any use or extension of DHCP with the DHC
working group, and work with additional DNS requirements with the
DNSEXT and DNSOP working groups. If it turns out that additional
options are needed for a routing protocol, they will be developed in
the appropriate Routing Area working group, with the HOMENET working
group providing the architecture and requirements for such
enhancements. The working group will also liase with external
standards bodies where it is expected that there are normative
dependencies between the specifications of the two bodies.
It is expected that in the architecture definition stage liaising
with the Broadband Forum, DLNA, and UPnP Forum is necessary.

Milestones:

Jul 2011 Formation of the working group
Sep 2011 First WG draft on the architecture
Dec 2011 Submission of the architecture draft to the IESG as 
         Informational RFC
Dec 2011 Charter re-evaluation based on the architecture work
Dec 2011 First WG draft on prefix configuration
Dec 2011 First WG draft on routing
Jan 2012 First WG draft on name resolution
Feb 2012 First WG draft on service discovery
Feb 2012 First WG draft on perimeter security
Feb 2012 Start of routing related work in the relevant routing area 
         working group, if needed
Mar 2012 Submission of the prefix configuration draft to the IESG as 
         Standards Track RFC
Apr 2012 Submission of the routing draft to the IESG as Informational 
         RFC
Sep 2012 Submission of the name resolution draft to the IESG as 
         Standards Track RFC
Nov 2012 Submission of the service discovery draft to the IESG as 
         Standards Track RFC
Dec 2012 Submission of the perimeter security draft to the IESG as 
         Informational RFC

---

From: Keith Moore <[email-masked]>
Date: Tue, 5 Jul 2011 13:18:21 -0400

> o  prefix configuration for routers

it seems like host/device security, as distinguished from network security, should also be in this list.

ease of configuration would appear to be paramount, and this touches on the interface between hosts/devices and the home network, particularly any perimeter based security mechanisms.  I'm thinking that when someone gets a new device, they might need to "pair" it with their network (similar to Bluetooth devices) so that the perimeter security devices know to allow traffic for it (and what kinds of traffic to allow).  similarly, hosts which have permission to access such devices from outside of the home network might also need to be "paired". 

one of the questions that I have is: to what extent is it reasonable to expect that network-accessible devices made for use in homes (and hosts that talk to them) are different than network-accessible devices used in other environments (and the hosts that talk to them)?  offhand I'm thinking that you want to be able to support ordinary hosts, devices, and applications on home networks, but it might take a bit more work to get their traffic through perimeter security.  similarly, you want to be able to enable ordinary hosts to talk to things on the home network, but doing so might be more cumbersome than for hosts with the appropriate support built-in.   there are multiple approaches for external access that could be considered: proxies, IPsec, tunnels, etc.  one thing that should be clear up front, is that using ip addresses for authentication tokens is a bad idea, no matter how widespread the practice is.

I guess I think that there's a real need to develop a standard means to arrange for secure external access to internal devices that are granted permission for such access.

> architecture.

I don't think it should be presumed that ULA's are applicable.  Perhaps, but not certainly.  ULAs should be limited to devices for which there is never any need to be accessed from outside the network, or to access external hosts, and offhand I can't think of a situation that makes it reasonable to impose this limitation on every device on a network segment..  If ULAs can be doled out to only those devices that do not have permission for external access, independent of network segment, that might be fine. 

Keith