Subject: [CDNi] Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-18: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Tue, 05 Jul 2016 13:00:35 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-cdni-metadata-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cdni-metadata/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I can see why unauthorized access to content isn't a concern since this
draft is just about the metadata, but wouldn't billing/theft be a
possible avenue of attack to be listed as a consideration through
alterations of the metadata?

---

From: Kevin Ma J <[email-masked]>
Date: Tue, 5 Jul 2016 20:06:36 +0000

Hi Kathleen,

  Thanks for the review.  Could you expand on your thoughts wrt billing/theft?  I think the idea for billing was that it would be based on the logging data, not metadata.  DoS against metadata could prevent the content delivery and therefore prevent content owners and CDNs from recognizing revenue, but I'm not sure if that's the theft angle to which you refer?

thanx!

--  Kevin J. Ma

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Tuesday, July 05, 2016 4:01 PM
> To: The IESG
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-18:
> (with COMMENT)
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 5 Jul 2016 16:16:39 -0400

>   Thanks for the review.  Could you expand on your thoughts wrt billing/theft?  I think the idea for billing was that it would be based on the logging data, not metadata.  DoS against metadata coul…

I was wondering if there were attacks possible other than DoS.  I was
surprised I didn't see any related to theft of service if there was a
way to do that with metadata.  I didn't realize logging information
was used for billing and had assumed metadata would wind up being
logged and could cause an issue.  If that's not possible, that's fine
and that's why I just included this question as a comment.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Kevin Ma J <[email-masked]>
Date: Tue, 5 Jul 2016 20:39:47 +0000

Hi Kathleen,

  I think that if an attacker could remove any of the ACL metadata, you could enable service in different regions, at different times, and to different end points, possibly in violation of the content owner's distribution rights (and possibly causing the content owner to incur excess delivery charges); but I would expect a premium content provider to have a DRM system outside the CDN delivery that enforces licensing restrictions and otherwise prevents hijacking the service as part of a criminal enterprise.  We will look at updating the threats in the next revision.

thanx!

--  Kevin J. Ma

> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Tuesday, July 05, 2016 4:17 PM
> To: Kevin Ma J
> Cc: The IESG; [email-masked]; [email-masked];
> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-cdni-metadata-
> 18: (with COMMENT)
> 
> >   Thanks for the review.  Could you expand on your thoughts wrt
> billing/theft?  I think the idea for billing was that it would be based on
> the logging data, not metadata.  DoS against metadata could prevent the
> content delivery and therefore prevent content owners and CDNs from
> recognizing revenue, but I'm not sure if that's the theft angle to which
> you refer?
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 6 Jul 2016 10:12:38 -0400

Hi Kevin,

These threats sound important enough to include now.  Can you add a
paragraph about these threats?

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Kevin Ma J <[email-masked]>
Date: Wed, 6 Jul 2016 15:14:04 +0000

Hi Kathleen,

  Will do.

thanx.

--  Kevin J. Ma

> Sent: Wednesday, July 06, 2016 10:13 AM
> To: Kevin Ma J
> >   I think that if an attacker could remove any of the ACL metadata, you
> could enable service in different regions, at different times, and to
> different end points, possibly in violation of the content owner's
> distribution rights (and possibly causing the content owner to incur
> excess delivery charges); but I would expect a premium content provider to
> have a DRM system outside the CDN delivery that enforces licensing
> restrictions and otherwise prevents hijacking the service as part of a
> criminal enterprise.  We will look at updating the threats in the next
> revision.
> >
> > thanx!
> >
> > --  Kevin J. Ma
> >
> >> >> Subject: Kathleen Moriarty's No Objection on draft-ietf-cdni-
> metadata-
> >> 18:
> >> >> (with COMMENT)
> >> >>

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 6 Jul 2016 11:55:53 -0400

>   Will do.

Thank you.

-- 

Best regards,
Kathleen