Subject: draft-macaulay-6man-packet-stain-00 High Level Questions

From: "Martin, Steve" <[email-masked]>
Date: Thu, 16 Feb 2012 21:23:01 +0000

Hi Tyson,
I've just read your ITEF paper on Packet Staining, a very interesting idea and relevant to an area of research that I'm looking at.

Something that I've been considering is how might IPv6 impact individuals, i.e. home users who typically have limited internet security.  Under IPv4 NAT has provided an "accidental" firewall that has been very beneficial to such subscribers. As the migration to IPv6 takes hold, it strikes me that specific firewalls will become mandatory (and critical that they are kept up to date), but those subscribers won't perceive any benefit from such devices (at least not until it is too late) and will simply connect devices directly to the internet with insufficient protection.

So, and this is where you paper is relevant, I have been pondering how IPv6 can be deployed to these subscribers with the added benefit of the "built-in" security that they have been used to with the likes of NAT.

Am I right in understanding that you packet staining could provide service provision that might include any number of the following:

  *   Spam Assessment
  *   Parental Controls
  *   Malware Detection
  *   Forged Certificates
  *   etc

Some of the above would require deep packet inspection, at least as far as protocol, and in some cases of the actual data.  Is this within scope of what you envisage ?

It strikes me that your Packet Staining concept could enable the provision of services that meet the needs of these subscribers in a manner that will enable them to "configure and forget", much like they already experience with Anti-Virus products which regularly download updates), except that they would get the benefit of a more intelligent process that has a re timely updates and the potential for filtering at the perimeter or the endpoint.

Finally, it is not clear to me whether there is any impact if IPsec is involved, which would prevent such a level of packet inspection.

Many thanks for you contribution and thoughts.

Regards
Steve Martin

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 17 Feb 2012 13:50:02 +1300

On 2012-02-17 10:23, Martin, Steve wrote:
...
> So, and this is where you paper is relevant, I have been pondering how IPv6 can be deployed to these subscribers with the added benefit of the "built-in" security that they have been used to with t…

This was the subject matter of RFC 4864. Also see RFC 6092.

I will refrain from the standard rant about the assertion that
NAT is a security mechanism, since that is covered in RFC 4864.

    Brian

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 16 Feb 2012 17:52:54 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Martin, Steve
> Sent: Thursday, February 16, 2012 1:23 PM
> To: [email-masked]
> Subject: draft-macaulay-6man-packet-stain-00 High Level Questions
> 
> Hi Tyson,
> I've just read your ITEF paper on Packet Staining, a very interesting
> idea and relevant to an area of research that I'm looking at.
> 
> Something that I've been considering is how might IPv6 impact
> individuals, i.e. home users who typically have limited internet
> security.  Under IPv4 NAT has provided an "accidental" firewall that
> has been very beneficial to such subscribers. As the migration to IPv6
> takes hold, it strikes me that specific firewalls will become mandatory
> (and critical that they are kept up to date), but those subscribers
> won't perceive any benefit from such devices (at least not until it is
> too late) and will simply connect devices directly to the internet with
> insufficient protection.

RFC6092, "Recommended Simple Security Capabilities in Customer Premises
Equipment (CPE) for Providing Residential IPv6 Internet Service", recommends
that equipment filter by default.  And I know both Apple and Linksys ship
with IPv6 filters by default.  I expect other vendors (e.g., D-Link) have
IPv6 filters by default, too.  The proverbial "Grandma" does not want her
IPv6 NAS or IPv6 television accessed by someone on the Internet by default.
Grandma should have to do something on the NAS or the television to enable
that remote access if she wanted it.

-d

> So, and this is where you paper is relevant, I have been pondering how
> IPv6 can be deployed to these subscribers with the added benefit of the
> "built-in" security that they have been used to with the likes of NAT.
> 
> Am I right in understanding that you packet staining could provide
> service provision that might include any number of the following:
> 
> *	Spam Assessment
> *	Parental Controls
> *	Malware Detection
> *	Forged Certificates
> *	etc
> 
> Some of the above would require deep packet inspection, at least as far
> as protocol, and in some cases of the actual data.  Is this within
> scope of what you envisage ?
> 
> It strikes me that your Packet Staining concept could enable the
> provision of services that meet the needs of these subscribers in a
> manner that will enable them to "configure and forget", much like they
> already experience with Anti-Virus products which regularly download
> updates), except that they would get the benefit of a more intelligent
> process that has a re timely updates and the potential for filtering at
> the perimeter or the endpoint.
> 
> Finally, it is not clear to me whether there is any impact if IPsec is
> involved, which would prevent such a level of packet inspection.
>