Subject: [I2nsf] Request for Comments on New Internet Draft for I2NSF BoF

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Tue, 28 Oct 2014 09:42:30 +0900

Hi all,
I submitted a new Internet Draft about
"Requirements for Security Services based on Software-Defined Networking".

In this draft, we suggest requirements for security services
(such as Firewall and DDoS attack mitigation) using SDN.

Actually we are standardizing this topic in ITU-T Study Group 17 as a
working item
in the viewpoint of telco.
Also, we want to proceed with this topic in IETF in the viewpoint of
protocol
implementer.

The following is our draft information:
Title: Requirements for Security Services based on Software-Defined
Networking
       draft-jeong-i2nsf-sdn-security-services-00

https://datatracker.ietf.org/doc/draft-jeong-i2nsf-sdn-security-services/

Abstract:
   This document provides requirements for security services based on
   Software-Defined Networking (SDN) with two representative use cases:
   (i) centralized firewall system for intra-domain networks and (ii)
   centralized DDoS-attack mitigation system between inter-domain
   networks.  For the centralized firewall system, this document raises
   challenging issues in existing firewalls and a use case of
   centralized firewall system based on SDN.  For the centralized DDoS-
   attack mitigation system, this document also raises challenging
   issues in existing DDoS-attack mitigation techniques and a use case
   of centralized DDoS-attack mitigation system based on SDN.

I would like to ask you to take a look at our new draft and give me your
valuable feedback.

In this IETF 91 meeting, I will present this draft and discuss with you
for further progress.

Thanks.

Best Regards,
Paul
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software /
Department of Computer Engineering
Sungkyunkwan University
Office: +82-31-299-4957
Mobile: +82-10-4758-1765
Fax: +82-31-290-5119
Email: [email-masked], [email-masked]
CPS Lab Website: http://cpslab.skku.edu
Personal Homepage: http://cpslab.skku.edu/people-jaehoon-jeong.php

---

From: Dave Hood <[email-masked]>
Date: Tue, 28 Oct 2014 15:09:47 +0000

For clarification:

The DDOS use case text reads, in part:
   The centralized DDoS-attack mitigation system defends servers against
   DDoS attacks outside private network, that is, from public network.

It is important to understand that the provider is resopnsible to isolate external traffic from the private network, eg by VxLAN or MPLS encapsulation. Interfering traffic from outside the private network can only result from failure of the provider to properly isolate it, so the appropriate response to detecting external traffic interference into the private network would be to notify the provider.

Arguably a more interesting use case would be the discovery of leakage of internal traffic into other networks. More interesting because the severity of the leakage could be far more severe, but also because it is not clear how a tenant could monitor for this problem.

Dave

From: I2nsf [mailto:[email-masked]] On Behalf Of Mr. Jaehoon Paul Jeong
Sent: Monday, October 27, 2014 5:43 PM
To: [email-masked]
Cc: Geumhwan David Cho; Dr. Paik Eun Kyung; Dr. JungSoo Park; Prof. Hyoungshick Kim; Jihyeok Seo; Mr. Jaehoon Paul Jeong
Subject: [I2nsf] Request for Comments on New Internet Draft for I2NSF BoF

Hi all,

Actually we are standardizing this topic in ITU-T Study Group 17 as a working item
in the viewpoint of telco.
Also, we want to proceed with this topic in IETF in the viewpoint of protocol
implementer.

The following is our draft information:
Title: Requirements for Security Services based on Software-Defined Networking
       draft-jeong-i2nsf-sdn-security-services-00
       https://datatracker.ietf.org/doc/draft-jeong-i2nsf-sdn-security-services/

Abstract:

I would like to ask you to take a look at our new draft and give me your valuable feedback.

Thanks.

Best Regards,
Paul
Email: [email-masked]<mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 29 Oct 2014 19:51:16 +0000

Dave,

Questions are inserted below:

From: I2nsf [mailto:[email-masked]] On Behalf Of Dave Hood
Sent: Tuesday, October 28, 2014 10:10 AM
To: Mr. Jaehoon Paul Jeong; [email-masked]
Cc: Geumhwan David Cho; Prof. Hyoungshick Kim; Jihyeok Seo; Dr. Paik Eun Kyung; Dr. JungSoo Park
Subject: Re: [I2nsf] Request for Comments on New Internet Draft for I2NSF BoF

For clarification:

[Linda] Is the use case you stated about client (tenant) asking (requesting) for security monitoring service from provider? Or is it about Network Operators requesting some function to monitor traffic from their own equipment to detect suspicious traffic generated by the equipment to sent to parties outsize provider domain?

Linda

Dave

To: [email-masked]<mailto:[email-masked]>

Hi all,

Abstract:

Thanks.

Best Regards,
Paul

---

From: Dave Hood <[email-masked]>
Date: Wed, 29 Oct 2014 19:54:52 +0000

Fair question, but I think it is for the authors of the I-D to answer. The text I quote below implies that it is a tenant attempting to protect its own traffic. Although the service might be offered by the provider, it would still be bounded by the tenant’s virtual network space.

Dave

From: Linda Dunbar [mailto:[email-masked]]
Sent: Wednesday, October 29, 2014 12:51 PM
To: Dave Hood; Mr. Jaehoon Paul Jeong; [email-masked]
Cc: Geumhwan David Cho; Prof. Hyoungshick Kim; Jihyeok Seo; Dr. Paik Eun Kyung; Dr. JungSoo Park
Subject: RE: [I2nsf] Request for Comments on New Internet Draft for I2NSF BoF

Dave,

To: Mr. Jaehoon Paul Jeong; [email-masked]<mailto:[email-masked]>

For clarification:

Linda

Dave

Hi all,

Abstract:

Thanks.

Best Regards,
Paul

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Thu, 30 Oct 2014 10:47:47 +0900

Hi Dave,
First of all, thanks for your valuable comments and input.

I intented that an administered network (e.g., a Google data center
network) having the server is defined as a private network. A better term
will be used in next draft version.

Preventing the leakage of internal traffic into the outside networks is
another good use case of SDN-based security services.
We will include this as another use case in next draft version.

Thanks.

Paul
 2014. 10. 29. 오전 12:09에 "Dave Hood" <[email-masked]>님이 작성:

> It is important to understand that the provider is resopnsible to isolate
> external traffic from the private network, eg by VxLAN or MPLS
> encapsulation. Interfering traffic from outside the private network can
> only result from failure of the provider to properly isolate it, so the
> appropriate response to detecting external traffic interference into the
> private network would be to notify the provider.
>
>
>
> Arguably a more interesting use case would be the discovery of leakage of
> internal traffic into other networks. More interesting because the severity
> of the leakage could be far more severe, but also because it is not clear
> how a tenant could monitor for this problem.
>
>
>
> Dave
>
>
>
> *From:* I2nsf [mailto:[email-masked]] *On Behalf Of *Mr. Jaehoon
> Paul Jeong
> *Sent:* Monday, October 27, 2014 5:43 PM
> *To:* [email-masked]
> *Cc:* Geumhwan David Cho; Dr. Paik Eun Kyung; Dr. JungSoo Park; Prof.
> Hyoungshick Kim; Jihyeok Seo; Mr. Jaehoon Paul Jeong
> *Subject:* [I2nsf] Request for Comments on New Internet Draft for I2NSF
> BoF
>
>
>
> Hi all,
>