Subject: draft-fang-ppvpn-security-framework-01

From: Ron Bonica <[email-masked]>
Date: Thu, 24 Jul 2003 21:12:50 -0400

Authors,

In Section 2 (Security Reference Model) you define the following terms:

1) PPVPN core network
2) PPVPN user
3) PPVPN service
4) Extranets
5) trusted zone

The first four terms (or equivalent terms) are already defined in previous
WG documents. So, you might want to focus on the concept of a trusted zone
or security perimeter.

The following text isn't very polished, but it approximates what I am
driving at:

Trusted zones and security perimeters are central concepts in the security
reference model. A trusted zone can contain networks, users and services. By
definition, entities contained by a trusted zone need not protect themselves
from attack by other members of the same trusted zone.

A logical or physical security perimeter isolates the trusted zone from
entities outside of the trusted zone. Mechanisms implemented on the security
perimeter protect the trusted zone from attack by outside entities.

Figure 1 depicts the concept of a trusted zone withing the PPVPN framework.
Two sites belonging to the same VPN reside in a common trusted zone. In
order to maintain the integrity of this trusted zone, the SP network must
form a security perimeter, isolating interfaces to these VPN sites from
interfaces that support other VPN sites.

The VPN SP network resides within its own trusted zone. A security perimeter
surrounds it, preventing attack from VPN sites.

===========================================
Ronald P. Bonica       Ph: 703 886 1681
vBNS Engineering       page: 1 888 268 8021
Ashburn, Va.
===========================================
"If a man marches out of step with his
fellows it may be that he hears the sound
of a different drummer or, perhaps that
he has a poor sense of rhythm."
            -- Henry David Thoreau

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Tue, 29 Jul 2003 15:01:11 -0700

>WG documents. So, you might want to focus on the concept of a trusted zone

raft-ietf-l3vpn-framework uses different terms than the security 
framework document. For example, the l3vpn framework document doesn't 
define "core network", but this is an important and heavily-used 
concept in the security framework document.

It might be OK to leave the current definitions in the security 
framework document. Otherwise, it will take a great deal of work to 
harmonize the two sets of definitions.

--Paul Hoffman, Director
--VPN Consortium

---

From: Ron Bonica <[email-masked]>
Date: Tue, 29 Jul 2003 21:00:20 -0400

Paul

Doesn't draft-ietf-l3vpn-framework use the term "SP Network"? Isn't that the
same as the "core network"?

                                        Ron

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Paul Hoffman / VPNC
> Sent: Tuesday, July 29, 2003 6:01 PM
> To: [email-masked]
> Subject: Re: draft-fang-ppvpn-security-framework-01
>
>

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Tue, 29 Jul 2003 20:44:44 -0700

>same as the "core network"?

It doesn't appear to be. In the l3vpn-framework document, it appears 
that the "SP Network" include the PE boxes, but in the 
security-framework document, the "core network" does not. That's a 
pretty significant difference when you are trying to delineate where 
various security services happen.

Of course, I could be reading one or both of the documents wrong, 
particularly because the l3vpn-framework document doesn't directly 
define "SP network": you have to infer it from the ASCII art.

--Paul Hoffman, Director
--VPN Consortium

---

From: Ron Bonica <[email-masked]>
Date: Wed, 30 Jul 2003 08:53:50 -0400

Paul,

You may be right. However, I would not have infered that meaning from the
following definition
which was lifted from draft-fang-ppvpn-security-framework

   "A PPVPN core network is defined here as the central network
   infrastructure over which PPVPN services are delivered. All network
   elements in the core are under the operational control of one or
   more PPVPN service providers. PPVPN services can also be delivered
   over the Internet, in which case the Internet forms a logical part
   of the PPVPN core."

If that was the meaning of this paragraph, it should include some specific
verbage excluding PE routers. Then the term becomes significantly different
from the term "SP network".

                                           Ron
                                           /individual contributor

> Sent: Tuesday, July 29, 2003 11:45 PM
> To: Ron Bonica; [email-masked]
> Subject: RE: draft-fang-ppvpn-security-framework-01
>
>