Subject: [I2nsf] Need a contribution on I2NSF Requirements for extensions to existing (& new) protocols

From: Linda Dunbar <[email-masked]>
Date: Tue, 5 Jul 2016 22:50:55 +0000

I2NSF participants,

Our I2NSF charter has a deliverable on "Requirements for Extensions to Protocols": https://datatracker.ietf.org/wg/i2nsf/charter/:

Jun 2016

Adopt requirements for extensions to protocols as WG document

Many  I2NSF drafts have mentioned requirement in conjunction with other information. Our next step is to pull those requirements together into one separate ID.
We need I2NSF contributors to piece out the requirement from their draft, and post them on the i2NSF mailing list.
We also need a volunteer to consolidate those requirement into an ID.

For example, here are some requirements from the "i2nsf-framework" draft:

Requirement on the Client Facing Interface:

-        A mutual authentication of clients and the Security Controller MUST be performed, establishing the desired level of assurance. This level of assurance will determine how stringent are the requirements for authentication (in both directions), and how detailed any other attestation procedures (as described in [Remote-Attestation]) will be.

-        Client Facing Interface should support capability discovery or inquiry mechanism for the clients to discover if the needed flow polices can be supported or not.

Requirement on the NSFs Facing Interface:

-        The transport mechanism used to carry the control messages and monitoring information should provide reliable message delivery.  Transport redundancy mechanisms such as Multipath TCP (MPTCP) [MPTCP] and the Stream Control Transmission Protocol (SCTP) [RFC3286] will need to be evaluated for applicability.  Latency requirements for control message delivery must also be evaluated.

-        When running in an open environment, I2NSF needs to provide identity information, along with additional data that Authentication, Authorization, and Accounting (AAA) frameworks can use. This enables those frameworks to perform AAA functions on the I2NSF traffic.

-        When an NSF cannot perform the desired provisioning (e.g., due to resource constraints), it MUST inform the controller.

We will discuss the I2NSF requirement at Berlin I2NSF F2F meeting.

Cheers,

Linda & Adrian