Subject: Re: [I2nsf] I2NSF Scope discussion -- RBAC, ABAC ... PBAC?

From: "Natale, Bob" <[email-masked]>
Date: Tue, 3 Feb 2015 06:49:51 +0000

Hi John,

I agree … (and I know you are way ahead on this topic), but maybe we could cast that “generic” model at the PBAC level on the “Increasing Policy Basis…” axis below, with subsumption of appropriates aspects of ABAC, RBAC, and ACL (working from right to left on the “Granularity” axis of the diagram below).  Note that most people (that I work with) understand that ABAC and RBAC are not mutually exclusive (i.e., we generally use attributes in RBAC models and roles in ABAC models, explicitly or implicitly).

Diagram is from “A Survey of Access Control Models”, http://csrc.nist.gov/news_events/privilege-management-workshop/PvM-Model-Survey-Aug26-2009.pdf, and see also “Research on Policy-based Access Control Model”, http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4908431.

Note that the NIST Access Control Policy Tool (ACPT), http://csrc.nist.gov/groups/SNS/acpt/,  and the NIST Policy Machine, http://csrc.nist.gov/pm/,  _might_ be helpful in this respect.

Avanti,
BobN

From: John Strassner [mailto:[email-masked]]
Sent: Monday, February 02, 2015 8:49 PM
To: Dacheng Zhang; Linda Dunbar; Natale, Bob; John Strassner; [email-masked]
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: RE: [I2nsf] I2NSF Scope discussion

Hi Dacheng,

RBAC is **one** way to govern which operations a particular user (playing a role, in this case) is permitted to execute on a set of objects.

Bob has pointed out that his group (and indeed, NIST) currently prefers ABAC (attribute-based access control).

There are advantages and disadvantages of each of these approaches. There are also other approaches.

I’m currently thinking that perhaps, a **generic** model for representing which operations a given user can perform on a given object is required; then, appropriate models, such as RBAC and ABAC, could be “plugged into” this framework.

Comments?

regards,
John

Dr. John Strassner, Ph.D.
CTO, Software Laboratory, CRD

Futurewei Technologies
US R&D Center
2330 Central Expressway
Building A, office A2-2143
Santa Clara, California   95050

  Office:  +1.408.330.4923
  Email:   [email-masked]<mailto:[email-masked]>

From: I2nsf [mailto:[email-masked]] On Behalf Of Dacheng Zhang
Sent: Saturday, January 31, 2015 6:07 AM
To: Linda Dunbar; [email-masked]<mailto:[email-masked]>
Cc: Romascanu, Dan (Dan); [email-masked]<mailto:[email-masked]>
Subject: Re: [I2nsf] I2NSF Scope discussion

I like most of the idea. Only one quick question .
Could you please give some additional description about   "Develop a Role Based Access Control to express the Security Intent by Applications/Administrators/OSS”. Do you indicate that we need to provide an authorization mechanism for the interface?

Cheers

Dacheng

发件人: Linda Dunbar <[email-masked]<mailto:[email-masked]>>
日期: 2015年1月29日 星期四 上午10:43
至: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
抄送: "Romascanu, Dan (Dan)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
主题: [I2nsf] I2NSF Scope discussion

Over the email discussion on the I2NSF list, it becomes clear that there are two distinct interfaces for I2NSF:

-          Capability or Functional Oriented interface between Controller and Devices (or devices’ adaptor), which focuses more on the functional security policies for the functions listed above.

-          Service Oriented interface between Applications/Users and the Controller, which is more intent description for service requests, monitor, reports, etc.

It is envisioned that clients of the I2NSF include security administrators, management systems, applications (or its controller), or security functions that detect suspicious threat triggering more vigorous security resources.

http://www.ietf.org/internet-drafts/draft-xia-i2nsf-capability-interface-im-00 provides a concrete set of content going through the functional interface:

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           +-->  Rule  |    +---------+  | +---------+

           |  |        |  +-> Objects +--+-> Service |

           |  +--------+  | +---------+  | +---------+

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

+-------+  |  +--------+  |              | +----------+

|       |  |  |        |  |              +-> Schedule |

|Policy +--+-->  Rule  +--+              | +----------+

|       |  |  |        |  |              |

+-------+  |  +--------+  |              |            +---------+

           |              |              |   *      +->Antivirus|

           |      *       |              +-> *      | +---------+

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

              +--------+  |               +-------+ | +----------+

                          |             +->Permit +-+

                          | +---------+ | +-------+ | +----------+

                          +-> Actions +-+           +->   File   |

                            +---------+ | +-------+ | | Blocking |

                                        +-> Deny  | | +----------+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *
Figure 1 The overall Information Model for I2NSF Capability Interface

For the Functional/Capability Interface, I2NSF deliverables should include:
•       Develop a comprehensive set of informational Models for the functions listed above with regard to different aspects of OAM (Operations/Administration/Maintenance) including polices requests, monitoring, reports, fault/consistency management, etc.
•       Develop the corresponding Data Models, e.g. YANG model.
•       Compare with existing IETF protocols for “OBJECTs, ACTIONs, FILTERING, etc” (e.g. PCP, Radius, etc)
•       Specify the secure mechanisms to carry the content identified by the informational models. E.g. TLS to carry the information.
•       Authentication and registration mechanism
E.g. who is legitimate to issue security policies or monitor reports over the Functional Interface.

For the Service Layer Interface, I2NSF deliverables should include:
•       Develop a Role Based Access Control to express the Security Intent by Applications/Administrators/OSS
•       Develop comprehensive set of “TARGETs” for the Security Intent
–       e.g. Security Target in Data Centers network, in Access Network, in Wide Area network, etc
–      Develop informational model for “Users”, “Roles”, “Permissions”
•       Develop the corresponding Data Models, e.g. YANG model.
•       Compare with existing IETF protocols for “Roles”, “Users”, “Permissions”, etc.

In addition, the I2NSF working group will
•        Document a high-level architecture that will describe the functional building blocks for the dynamic negotiation of security service parameters, the dynamic and subsequent allocation of network security resources and the operation of such resources, including means to assess that what has been allocated complies with what has been negotiated.
•       Document small and well-scoped use cases to constrain the scope of the work and achieve sufficient focus for the working group to deliver successful outcomes. And
•        Analyze candidate protocols that may carry the information to be exchanged through the various interfaces.

Any more suggestions?

Cheers,

Linda Dunbar
_______________________________________________ I2nsf mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/i2nsf

---

From: John Strassner <[email-masked]>
Date: Tue, 3 Feb 2015 07:22:19 +0000

Hi Bob,

I agree. I can model DAC and MAC with RBAC, and I can model most of RBAC with ABAC. Things like context-awareness (e.g., my DEN-ng model or the ZOOM work) are, I **think**, a bit beyond the current level of PBAC. However, (and I know I’m preaching to the choir) the most important thing of PBAC is, of course, policies.

I will take a first shot at revising both the capability and service interface drafts to reflect this, and hope that others besides you can help in this effort.

One question: while I would rather work at the information model level, I believe that data models are (1) a bit easier to understand and (2) more palatable in the IETF. Comments?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923
  Email:   [email-masked]

From: Natale, Bob [mailto:[email-masked]]
Sent: Monday, February 02, 2015 10:50 PM
To: John Strassner; Dacheng Zhang; Linda Dunbar; [email-masked]
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: RE: [I2nsf] I2NSF Scope discussion -- RBAC, ABAC ... PBAC?

Hi John,

Avanti,
BobN

Hi Dacheng,

Comments?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Cheers

Dacheng

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions?

Cheers,

Linda Dunbar

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 3 Feb 2015 07:27:54 +0000

Thanks, John …

I recognize the apparent IETF preference for data models … personally, I’d much rather know the information model before delving in to conforming data models … I find it very hard to work the other way around (given my “bias” toward coherent solutions for large-scale operational domains).

That’s just one data point, of course!,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of John Strassner
Sent: Tuesday, February 03, 2015 2:22 AM
To: Natale, Bob; Dacheng Zhang; Linda Dunbar; John Strassner; [email-masked]
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: Re: [I2nsf] I2NSF Scope discussion -- RBAC, ABAC ... PBAC?

Hi Bob,

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

To: John Strassner; Dacheng Zhang; Linda Dunbar; [email-masked]<mailto:[email-masked]>

Hi John,

Avanti,
BobN

To: Dacheng Zhang; Linda Dunbar; Natale, Bob; John Strassner; [email-masked]<mailto:[email-masked]>

Hi Dacheng,

Comments?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Cheers

Dacheng

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions?

Cheers,

Linda Dunbar

---

From: "Susan Hares" <[email-masked]>
Date: Tue, 3 Feb 2015 05:48:33 -0500

John: 

The netmod ACL specification is at the ACL level.  At what level do you consider the following specifications that considered to handle switches/routers with their firewall and DDoS function? 

·          <http://tools.ietf.org/html/draft-shaikh-rtgwg-policy-model-00> http://tools.ietf.org/html/draft-shaikh-rtgwg-policy-model-00   - Operators model 

·         draft-yan-rtgwg-routing-policy-yang-00 – Proposed for routing policy 

·          <http://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/> http://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/ - approved ACL policy 

·          <http://datatracker.ietf.org/doc/draft-hares-i2rs-bnp-info-model/> http://datatracker.ietf.org/doc/draft-hares-i2rs-bnp-info-model/ - an I2RS policy (Sue’s personal draft) .

Sue 

From: I2nsf [mailto:[email-masked]] On Behalf Of Natale, Bob
Sent: Tuesday, February 03, 2015 1:50 AM
To: John Strassner; Dacheng Zhang; Linda Dunbar; [email-masked]
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: Re: [I2nsf] I2NSF Scope discussion -- RBAC, ABAC ... PBAC?

Hi John,

 

Avanti,

BobN

Hi Dacheng,

Comments?

regards,

John

logo.gif

Futurewei Technologies

US R&D Center

2330 Central Expressway

  Office:  +1.408.330.4923

 

To: Linda Dunbar; [email-masked]

Cheers

Dacheng

 

发件人: Linda Dunbar <[email-masked]>
日期: 2015年1月29日 星期四 上午10:43
至: "[email-masked]" <[email-masked]>
抄送: "Romascanu, Dan (Dan)" <[email-masked]>, "[email-masked]" <[email-masked]>
主题: [I2nsf] I2NSF Scope discussion

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions? 

Cheers, 

Linda Dunbar

_______________________________________________ I2nsf mailing list [email-masked] https://www.ietf.org/mailman/listinfo/i2nsf

---

From: "Susan Hares" <[email-masked]>
Date: Tue, 3 Feb 2015 05:52:04 -0500

Bob and John: 

Would you help provide link between the ACL, RBAC, ABAC, PBAC and existing IETF work in routing/switching and netmod? 

Are you familiar with the PBR Devices in networks?  If so, at what level do you consider these devices to exist?  I understand ACL, RBAC, and ABAC from your references and IETF drafts.   At what level is the PCIM work from the IETF?  Can you give an example of the PBAC level in the IETF?   

Thank you for your aid, 

Sue 

Hi John,

 

Avanti,

BobN

Hi Dacheng,

Comments?

regards,

John

logo.gif

Futurewei Technologies

US R&D Center

2330 Central Expressway

  Office:  +1.408.330.4923

 

Cheers

Dacheng

 

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions? 

Cheers, 

Linda Dunbar

---

From: "Susan Hares" <[email-masked]>
Date: Tue, 3 Feb 2015 06:42:45 -0500

John: 

A bit of feedback from my experience with I2RS on information models and data models.   Data models work fine if there is an existing template of what you want to do.  For example, as we revise existing mechanism to work automatically. 

When we are inventing radically different pieces of technology, a brief information model can help.  RBNF provides structure, but causes real problems. Skip this and go to the Yang high-level modeling and drawings.  

Sue 

Hi Bob,

 

regards,

John

logo.gif

Futurewei Technologies

US R&D Center

2330 Central Expressway

  Office:  +1.408.330.4923

 

Hi John,

 

Avanti,

BobN

Hi Dacheng,

Comments?

regards,

John

logo.gif

Futurewei Technologies

US R&D Center

2330 Central Expressway

  Office:  +1.408.330.4923

 

Cheers

Dacheng

 

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions? 

Cheers, 

Linda Dunbar

---

From: John Strassner <[email-masked]>
Date: Tue, 3 Feb 2015 18:21:43 +0000

Hi Bob,

You know I agree with you. I’m just pessimistic that we can get an information model through quickly. However, if that is what people would rather do, then I’m game!

For those of you that are unsure what the difference is:

·         An information model is a representation of managed entities and their relationships independent of platform, language, and protocol. Examples: UML, DEN-ng, SID

·         A data model is a representation of managed entities and their relationships in a form that is dependent on platform, language, and/or protocol (typically all 3). Examples: Yang, Tosca, MIB

Also, please see RFC3198.

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Sent: Monday, February 02, 2015 11:28 PM

Thanks, John …

Hi Bob,

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Hi John,

Avanti,
BobN

Hi Dacheng,

Comments?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Cheers

Dacheng

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions?

Cheers,

Linda Dunbar

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 3 Feb 2015 18:33:13 +0000

Understood, John … especially in light of your experience and expertise, perhaps there is something we can adopt/adapt at the info model level … I’m not sure we even have to formalize it as a deliverable (although that would be best if the level of “adaptation” or innovation is appreciable), but just need it as a reference for the group’s data modeling and related work…?

Hurried,
BobN

From: John Strassner [mailto:[email-masked]]
Sent: Tuesday, February 03, 2015 1:22 PM
To: Natale, Bob; John Strassner; Dacheng Zhang; Linda Dunbar; [email-masked]
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: RE: [I2nsf] I2NSF Scope discussion -- RBAC, ABAC ... PBAC?

Hi Bob,

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Thanks, John …

To: Natale, Bob; Dacheng Zhang; Linda Dunbar; John Strassner; [email-masked]<mailto:[email-masked]>

Hi Bob,

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Hi John,

Avanti,
BobN

Hi Dacheng,

Comments?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Cheers

Dacheng

                                           +---------+

                                           |Src/dest |

                                         +-> address |

                                         | |  scope  |

                                         | +---------+

                                         |

                                         | +---------+

                                         +->  User   |

              +--------+                 | +---------+

              |        |                 |

           |              |              |

           |      *       |              | +-----------+

           |      *       |              +->Application|

           |      *       |              | +-----------+

           |              |              |

|       |  |  |        |  |              |

           |              |              |   *      +->Antivirus|

           |      *       |                  *      |

           |      *       |                         | +---------+

           |              |                         +->  IPS    |

           |              |                         | +---------+

           |  +--------+  |                         |

           |  |        |  |                         | +----------+

           +-->  Rule  |  |                         +->  URL     |

              |        |  |                         | | Filtering|

                          |             +->Permit +-+

                                          +-------+ |

                                                    | +----------+

                                                    | |   Data   |

                                                    +-> Filtering|

                                                    | +----------+

                                                    |

                                                    | +------------+

                                                    | | Application|

                                                    +->   control  |

                                                    | +------------+

                                                    |

                                                    |   *

                                                    +-> *

                                                        *

Any more suggestions?

Cheers,

Linda Dunbar