Subject: [I2nsf] Solicit comments on the new design of capability inteface information model:

From: "Xialiang (Frank)" <[email-masked]>
Date: Tue, 28 Apr 2015 03:10:21 +0000

Hi all,
We are updating the -01 version of draft-xia-i2nsf-capability-interface-im now. We consider all the comments and discussions related in mailing list, especially the packet-based paradigm proposed in draft-lopez-i2nsf-packet-00, are all very good inputs for this interface.
So, we propose a new information model of I2NSF capability(function) interface, which aligns the existing design with all comments and is based on the packet-based paradigm:
                                            +-------------+
                                          +->  User/tenant|
                                          | |  /VN-id     |
                                          | +-------------+
                                          | +---------+
                                          | |Address/ |
                                          +->address  |
                                          | |group    |
                                          | +---------+
                                          | +-----------+
                                          | |Layer 2/3/4|
                                          +->header, or |
                                          | |payload    |
                                 +------+ | +-----------+
                                 |Packet| | +---------+
                               +->based |-+-> Service |
                               | |match | | +---------+
                               | +------+ | +-----------+
                               |          +->Application|
                               |            +-----------+
             +----+    +-----+ |
             |    |  +->Match|-+             +----------+
          +-->Rule|  | +-----+ |           +-> Session  |
          |  |    |  |         |           | | state    |
          |  +----+  |         | +-------+ | +----------+
          |          |         | |context| | +----------+
          |    *     |         +->based  +-+-> Schedule |
          |    *     |           |match  | | +----------+
          |    *     |           +-------+ | +---------+
          |          |                     | |Region/  |
          |          |                     +->region   |
+------+     +----+  |                       |group    |
|      |  |  |    |  |                       +---------+
|Policy+--+-->Rule+--+
|      |  |  |    |  |                         +-------+
+------+  |  +----+  |                       +->Permit +
          |          |                       | +-------+
          |    *     |             +-------+ | +-------+
          |    *     |           +->Basic  +-+-> Deny  |
          |    *     |           | |actions| | +-------+
          |          |           | +-------+ | +-------+
          |          |           |           +-> Mirror|
          |          |           |             +-------+
          |          |           |
          |          |           |              +----------+
          |          |           |            +->Antivirus:|
          |  +----+  |           |            | |profile   |
          |  |    |  | +-------+ |            | +----------+
          +-->Rule|  +->Actions+-+            | +---------+
             |    |    +-------+ |            +->  IPS:   |
             +----+                           | |signature|
                                 |            | +---------+
                                 |            | +----------+
                                 |            | | URL      |
                                 |            +->Filtering:|
                                              | |data base |
                                 |            | +----------+
                                 | +--------+ | +----------+
                                 +->Advanced+-+ |  File    |
                                   |actions | +->Blocking: |
                                   +--------+ | |profile   |
                                              | +----------+
                                              | +----------+
                                              | |  Data    |
                                              +->Filtering:|
                                              | |profile   |
                                              | +----------+
                                              | +-----------+
                                              | |Application|
                                              +->  control  |
                                              | +-----------+
                                              |   *
                                              +-> *
                                                  *

We hope to get your comments on this new IM design, to help us to go forward.
Thanks a lot!

B.R.
Frank

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 28 Apr 2015 14:57:23 +0000

Frank,

In a nutshell, you are proposing using draft-lopez-i2nsf-packet-00 proposal as the base solution for I2NSF, i.e. having the following 4 categories for provisioning to network security functions:
Subject - Match values based on packet data Packet header or Packet payload
Object - Match values based on context. E.g. State, time, geo-location, etc.
Action- Egress processing, such as Invoke signaling; Packet forwarding and/or transformation; Possibility for SDN/NFV integration
Functional Profile - E.g. IPS:<Profile>, signature file, Anti-virus file, URL filtering file, etc. Integrated and one-pass checks on the content of packets.
The functional profile is vendor specific and differentiates vendor unique innovation.

Does anyone have comments or other suggestions?

Linda

From: I2nsf [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Monday, April 27, 2015 10:10 PM
To: [email-masked]
Subject: [I2nsf] Solicit comments on the new design of capability inteface information model:

Hi all,

B.R.
Frank

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Thu, 30 Apr 2015 07:46:22 +0000

Hi,

As a result of the SECURED project we have a policy model that operates at two layers, which is reasonably mature, including language specification and implementation. The highest, functional one, is based on a (Subject, Object, Action, Condition) tuple and I think close to draft-lopez-i2nsf-packet. The lowest, service layer, is based on the concept of describing the "capabilities", within a capability hierarchy, of each function, and a meta-model for associating configuration actions with those capabilities.

We are working on transferring this to a (couple of) draft(s) that we will contribute soon.

Be goode,

On 28 Apr 2015, at 16:57 , Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:

Frank,

Functional Profile – E.g. IPS:<Profile>, signature file, Anti-virus file, URL filtering file, etc. Integrated and one-pass checks on the content of packets.

Linda

From: I2nsf [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Monday, April 27, 2015 10:10 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [I2nsf] Solicit comments on the new design of capability inteface information model:

Hi all,

B.R.
Frank
_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição