Subject: [NSIS] Security threats - NTLP awareness of upstream path

From: "Geib, Ruediger" <[email-masked]>
Date: Thu, 27 Feb 2003 15:14:59 +0100

Hi Hannes,

instead of answering my question you seem to have raised
a different issue. I'll reply to it with another mail.
Still I'd like to know whether you (or others) expect
NTLP to be aware of the upstream route to the next
NTLP router.
 
RG> What is important to me is, that end to end signaling is a 
| > requirement. It seems acceptable to process e2e signaling 
| > messages by all NTLP units along a path. As long as 
| > intermediate NSLPs aren't required to process them. As a 
| > consequence, NTLP must be able to construct the downstream 
| > and upstream signaling path between NI and NR on its own. 
| > Otherwise your above assumption on peer to peer protection 
| > securing e2e signaling is broken. Do you assume that?
| 
| there seems to be an additional issue namely the "we skip 
| some NF nodes along the path". this seems to be an issue 
| of discovery. an example: 

[skipped]
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 27 Feb 2003 15:51:00 +0100

hi guediger. 

sorry for introducing some confusion. 

my very short conclusion: 

if you want to have end-to-end signaling then you also need to provide
end-to-end security. 
(it is important to see this in the context of the description i included my
previous mail.)

since this issues is, however, more complex i tried to illustrate my
thoughts. your previous mail gave me the impression that we have a different
understanding of end-to-end. hence i cannot give you a clear answer to your
question in the last paragraph: 

"
What is important to me is, that end to end signaling is a requirement. It
seems acceptable to process e2e signaling messages by all NTLP units along a
path. As long as intermediate NSLPs aren't required to process them. As a
consequence, NTLP must be able to construct the downstream and upstream
signaling path between NI and NR on its own. Otherwise your above assumption
on peer to peer protection securing e2e signaling is broken. Do you assume
that?
"

ciao
hannes

---

From: "Geib, Ruediger" <[email-masked]>
Date: Thu, 27 Feb 2003 16:06:18 +0100

Hi Hannes
 
| if you want to have end-to-end signaling then you also need to provide
| end-to-end security. 

Allright. That coincides with the conclusions the last signaling 
design team drew I was working with.

I've illustrated my end to end signaling scenario with an example
in an earlier reply, but I'm happy to repeat it:

Lets assume a customer network with two
sites, making a QoS reservation to be used for VoIP calls 
accross a carrier network. To limit his backbone signaling 
processing requirements the carrier may prefer to stay out 
of per VoIP call signaling. So signaling aggregation is
applied between his edge nodes. Let's ignore how that 
is done with regard to QoS. With regard to signaling it
means that the carrier routers only maintain state for a 
single reservation between the two customer sites. Per 
VoIP call NSIS state maintenance is restricted to the 
customer domain. Still, all related NSIS signaling messages
traverse the carrier network. Path coupled, meaning NSIS 
path coupled (i.e. downstream and especially upstream).

The best solution to this would be one where neither the 
carrier routers NSLP nor the NTLP must process the per VoIP 
call NSIS signaling. 

Regards, Rüdiger