Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

From: Rakesh Kumar <[email-masked]>
Date: Fri, 1 Jul 2016 23:06:00 +0000

Based on my understanding of “Capability Layer” as defined in the I2NSF, is the  controller southbound interface.  it is the interface from controller to Network Security Function (NSF/vNSF).

Is that ok if we define southbound interface as set of interfaces with categorization along the functional line? Something like as following.

I2NSF Southbound Interfaces

  1.  Capability Interface: Interface to discover NSF/vNSF capability so that controller can determine whether a NSF is capable of enforcing a given policy. This could be either a query interface (controller queries from a NSF for specific functionality) or a report interface where each NSF sends its supported capabilities such as feature, scale, performance. The NSF state is not changed by this interface.
  2.  Programming Interface (or some other better name):  Interface used by controller to program a specific NSF to enforce a security policy. This might change the state of NSF if successful.
  3.  Notification Interface:  Interface used to send notification (event/alarm) by NSF to controller (if registered for). The controller may directly take an action based on the event. This is a report and registry interface. This does not change the state of NSF.
  4.  Telemetry Interface: Interface to get telemetry information from NSF. This could be query or report/registry interface. This does not change the state of NSF.

Any thoughts ?

Regards,
Rakesh

From: I2nsf <[email-masked]<mailto:[email-masked]>> on behalf of "Natale, Bob" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, June 29, 2016 at 9:38 PM
To: Susan Hares <[email-masked]<mailto:[email-masked]>>, DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>, John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

I would have gone with John’s first definition of the Capability Layer below. It is not a case of reusing the defined term in the definition. The “Capability Layer” is a distinct concept from “Capability” and, as John’s first definition says, consists of “the set of capabilities” and remembering that “Capability” is already defined as “a set of features”.

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of Susan Hares
Sent: Wednesday, June 22, 2016 4:42 PM
To: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>; John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; Xialiang (Frank) <[email-masked]<mailto:[email-masked]>>; Dacheng Zhang <[email-masked]<mailto:[email-masked]>>; Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

John and Diego

I agree the second one is better.

Sue

Sent via the Samsung Galaxy Note5, an AT&T 4G LTE smartphone
-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

In order to avoid using the defined term (even partially) into the definition I’d go for the second one…

Be goode,

On 16 Jun 2016, at 15:05 , John Strassner <[email-masked]<mailto:[email-masked]>> wrote:

Hi Dacheng,

I agree that "I2NSF system" is not well defined. Your definition is better, but it should apply for all NSFs (not 'the NSF'). In addition, the Capability Layer is not an abstraction layer, it a simply a collection of abstractions (the capabilities). So how about:

    Capability Layer:  Defines the set of capabilities available to the Controller for the set of NSFs that the Controller manages.

or

    Capability Layer:  Defines the set of features available to the Controller for the set of NSFs that the Controller manages.

regards,
John

On Wed, Jun 15, 2016 at 8:55 PM, Dacheng Zhang <[email-masked]<mailto:[email-masked]>> wrote:
I think I agree with Frank. The confusion is caused by the 'I2NSF system’. Maybe we should change the definition in the terminology draft to Capability Layer: Defines an abstraction layer that exposes a set of capabilities of the NSF?

发件人: I2nsf <[email-masked]<mailto:[email-masked]>> on behalf of "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>
日期: 2016年6月16日星期四上午11:47
至: Linda Dunbar <[email-masked]<mailto:[email-masked]>>, John Strassner <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, "DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>)" <[email-masked]<mailto:[email-masked]>>
抄送: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
主题: [I2nsf] 答复: questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Linda,
Frankly, I don’t see the essential difference for the meaning of terminology “capability” between  them.  We just need to make some modification in two places to keep consistence.
We can do it during the update of I2NSF terminology draft.

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Linda Dunbar
发送时间: 2016年6月15日 23:40
收件人: John Strassner; Susan Hares; DIEGO LOPEZ GARCIA ([email-masked]<mailto:[email-masked]>)
抄送: [email-masked]<mailto:[email-masked]>
主题: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Dear Authors:

The term “Capability Layer” defined by the “draft-ietf-i2nsf-terminology-00” carries different  meaning than the “Capability Layer” used by the I2NSF charter.

“draft-ietf-i2nsf-terminology-00”:
Capability: Defines a set of features that are available from a managed entity (see also I2NSF Capability).

Capability Layer: Defines an abstraction layer that exposes a set of capabilities of the I2NSF system.

I2NSF Charter:
I2NSF will specify interfaces at two functional levels for the control and monitoring of network security functions:
The I2NSF Capability Layer specifies how to control and monitor NSFs at a functional implementation level. The term "Functional Implementation" is used to emphasize that the rules (for control and monitor) of NSFs have to be implementable by most NSFs. I2NSF will standardize a set of interfaces by which a security controller can invoke, operate, and monitor NSFs.

The I2NSF Service Layer defines how clients' security policies may be expressed to a security controller. The controller implements its policies according to the various capabilities provided by the I2NSF Capability Layer. The I2NSF Service Layer also allows the client to monitor the client specific policies.

If we use the definitions by the “draft-ietf-i2nsf-terminology-00”, we should create a different terminology to represent the “South bound Interface” between Controller and NSF.

Thanks, Linda

_______________________________________________ I2nsf mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/i2nsf

--
regards,
John

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: John Strassner <[email-masked]>
Date: Sat, 2 Jul 2016 00:36:49 +0000

Based on my understanding of “Capability Layer” as defined in the I2NSF, is the  controller southbound interface.  it is the interface from controller to Network Security Function (NSF/vNSF). Is that ok if we define southbound interface as set of interfaces with categorization along the functional line?
...

<jcs>
No, both Diego and I have argued that "northbound" and "southbound" should not be used.
Please look at the mail thread. In addition, a Controller can announce its capabilities, just
like an NSF can.
</jcs>

regards,
John

From: I2nsf [mailto:[email-masked]] On Behalf Of Rakesh Kumar
Sent: Friday, July 01, 2016 4:06 PM
To: Natale, Bob; Susan Hares; DIEGO LOPEZ GARCIA; John Strassner
Cc: [email-masked]; Xialiang (Frank); Rakesh Kumar; Dacheng Zhang; Linda Dunbar
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sat, 2 Jul 2016 07:40:23 +0000

On 2 Jul 2016, at 03:36 , John Strassner <[email-masked]<mailto:[email-masked]>> wrote:

<jcs>

And I wholeheartedly support this idea of recursion. It is an essential part of any approach to a network functional moel.

Be goode,

regards,
John

Cc: [email-masked]<mailto:[email-masked]>; Xialiang (Frank); Rakesh Kumar; Dacheng Zhang; Linda Dunbar

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 4 Jul 2016 02:39:17 +0000

Hi all,
Firstly, I fully support John’s argument that we should avoid using the “northbound/southbound” concept here, since they are recursive and cannot be specific.
Secondly, I like the idea from Rakesh of a clear classification for the I2NSF NSF-Facing interface, I think his current naming is ok, but we can maybe find more better names. In addition, I think “capability interface” and “programming interface” are also applied to the I2NSF Consumer-Facing Interface.

Thanks!

B.R.
Frank

发件人: Diego R. Lopez [mailto:[email-masked]]
发送时间: 2016年7月2日 15:40
收件人: John Strassner
抄送: Rakesh Kumar; Natale, Bob; Susan Hares; John Strassner; [email-masked]; Xialiang (Frank); Dacheng Zhang; Linda Dunbar
主题: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

<jcs>

Be goode,

regards,
John

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

---

From: Rakesh Kumar <[email-masked]>
Date: Fri, 8 Jul 2016 18:56:45 +0000

Hi Frank,

Thanks for the comments.

IMHO, it would be great if our terminology

  1.  Align well with other work in the industry (I am pretty sure there are other service orchestration system/controller in the standard bodies  and open source).
  2.  Communicates clearly the intention of these interface  on  terminology we choose.
  3.  The end-customer/consumer find these interfaces intuitive. The end-customer could be
     *   An uber-controller that uses I2NSF defined security controller to provision security policies
     *   A GUI system used by admin to provision security policies
     *   OSS/BSS system from service provider
     *   Thirty party APP written on top of I2NSF controller

It would be great to discuss various options discussed so far in this group and see which ones are the most appropriate.

Once we agree on top level, it would be great to create classification/categories for these interfaces on either side of the controller so that  our work/drafts communicate clearly, the specific area[s] targeted.

I just sent this classification to start a wider discussion. I  look towards the group and help from chairs to see how to carry it forward and whether to fold this into existing draft or not.

It would be great if we bring this up in Berlin.

Thanks & Regards,
Rakesh

From: "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>
Date: Sunday, July 3, 2016 at 7:39 PM
To: "Diego R. Lopez" <[email-masked]<mailto:[email-masked]>>, John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: Rakesh Kumar <[email-masked]<mailto:[email-masked]>>, "Natale, Bob" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, John Strassner <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi all,

Thanks!

B.R.
Frank

发件人: Diego R. Lopez [mailto:[email-masked]]
发送时间: 2016年7月2日 15:40
收件人: John Strassner
抄送: Rakesh Kumar; Natale, Bob; Susan Hares; John Strassner; [email-masked]<mailto:[email-masked]>; Xialiang (Frank); Dacheng Zhang; Linda Dunbar
主题: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

<jcs>

Be goode,

regards,
John

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

---

From: John Strassner <[email-masked]>
Date: Mon, 11 Jul 2016 23:26:04 +0000

Hi Rakesh,

please see inline...

regards,
John

From: Rakesh Kumar [mailto:[email-masked]]
Sent: Friday, July 08, 2016 11:57 AM
To: Xialiang (Frank); Diego R. Lopez; John Strassner
Cc: Natale, Bob; Susan Hares; John Strassner; [email-masked]; Dacheng Zhang; Linda Dunbar; Rakesh Kumar
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Frank,

Thanks for the comments.

  1.  Align well with other work in the industry (I am pretty sure there are other service orchestration system/controller in the standard bodies  and open source).
<jcs>
What does a security terminology draft have to do with orchestration? While there might be some overlap
in some terms, many orchestration systems do not consider security at the level of detail that we need.
We have already identified terminology that we do not want to reuse (e.g., "northbound" and "southbound").
Finally, I personally think that it would be better to align with other security WGs in the IETF (e.g., sacm)
and THEN expand to outside of IETF security WGs.
If you disagree, it would be helpful for you to send a specific example of terminology from another SDO or
other open source project that you are worried about.
</jcs>
  2.  Communicates clearly the intention of these interface  on  terminology we choose.
<jcs>
This implies that the definition of these terms is incorrect. Please review the latest draft (-01) and
provide concrete suggestions to fix.
</jcs>
  3.  The end-customer/consumer find these interfaces intuitive. The end-customer could be

     *   An uber-controller that uses I2NSF defined security controller to provision security policies
     *   A GUI system used by admin to provision security policies
     *   OSS/BSS system from service provider
     *   Thirty party APP written on top of I2NSF controller
<jcs>
Or an end-user. However, my point is that the terminology document will not define interfaces;
it will only provide documentation on terms that interfaces use. Is there a specific point here
for the terminology document to address?
</jcs>

Thanks & Regards,
Rakesh

Hi all,

Thanks!

B.R.
Frank

<jcs>

Be goode,

regards,
John

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

---

From: Rakesh Kumar <[email-masked]>
Date: Tue, 12 Jul 2016 04:55:32 +0000

Hi John,

Thanks for your response.
Let me take a look the latest draft as you suggested and I would share my thoughts.
I think there is a discussion scheduled on terminology topic (If I remember the agenda sent out recently), we can discuss further there.

Thanks & Regards,
Rakesh

From: John Strassner <[email-masked]<mailto:[email-masked]>>
Date: Monday, July 11, 2016 at 4:26 PM
To: Rakesh Kumar <[email-masked]<mailto:[email-masked]>>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, "Diego R. Lopez" <[email-masked]<mailto:[email-masked]>>, John Strassner <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Cc: "Natale, Bob" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>
Subject: RE: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Hi Rakesh,

please see inline...

regards,
John

Cc: Natale, Bob; Susan Hares; John Strassner; [email-masked]<mailto:[email-masked]>; Dacheng Zhang; Linda Dunbar; Rakesh Kumar

Hi Frank,

Thanks for the comments.

Thanks & Regards,
Rakesh

Hi all,

Thanks!

B.R.
Frank

<jcs>

Be goode,

regards,
John

Any thoughts ?

Regards,
Rakesh

Avanti,
BobN

John and Diego

Sue

-------- Original message --------
From: DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>>
Date: 6/16/2016 2:07 AM (GMT-05:00)
To: John Strassner <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>, "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>, Susan Hares <[email-masked]<mailto:[email-masked]>>, Dacheng Zhang <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Subject: Re: [I2nsf] questions about some terminologies defined by draft-ietf-i2nsf-terminology-00

Be goode,

Hi Dacheng,

or

regards,
John

Hi Linda,

B.R.
Frank

Dear Authors:

I2NSF Charter:

Thanks, Linda

--
regards,
John

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D