Subject: [I2nsf] [I2NSF] Two levels of I2NSF interface:

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 26 Jan 2015 07:24:25 +0000

Hi all,
When we discuss the scope of I2NSF, we need to identify the new interface to support and design. By my understanding, there are two levels of interface we need to consider, actually:

1.       NBI of Adaptor (or Controller): it's a more service-oriented interface between I2NSF clients and I2NSF adaptor. Its main objective is to unify the communication channel and the security service request information model the various high-level application (e.g., openstack, various BSS/OSS, etc), and decouple the various kind of security device and specific security functions of them. The intent-driven information model approach derived from RBAC model maybe a feasible way;

2.       NBI of security devices (e.g., FW, IPS, etc): it's a more function-oriented interface between I2NSF clients/I2NSF adaptors with specific security devices. It's used for decoupling the variable security services by the high level application and focusing on the unified interface and security functions information model provided by the variable security devices.

So, my questions are: How we consider these two levels of interface? Should they all be in scope of I2NSF work?
Glad to get your experts thought and suggestions, thanks!

B.R.
Frank

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 26 Jan 2015 17:33:48 +0000

Frank,

Thank you very much for proposing the two levels. It definitely more clear to have two different types of interfaces for the I2NSF consolidated use case:

Maybe "Functional Oriented Interface" should be more like "Match & Action" style, whereas the "Service Oriented Interface" can be the NIST endorsed Role Based Access Control style.

Any other opinions?

Linda

From: Xialiang (Frank)
Sent: Monday, January 26, 2015 1:24 AM
To: [email-masked]
Cc: Romascanu, Dan (Dan); Joseph Salowey; John Strassner; Linda Dunbar
Subject: [I2NSF] Two levels of I2NSF interface:

Hi all,

B.R.
Frank

---

From: "Natale, Bob" <[email-masked]>
Date: Mon, 26 Jan 2015 17:49:50 +0000

Hi Linda,

I have employed the distinction between these two different types of interfaces in related work, but recommend using "Service Interface" and "Capability Interface", respectively.

("Service Oriented" carries implications that might or might not be applicable in any given case.)

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of Linda Dunbar
Sent: Monday, January 26, 2015 12:34 PM
To: Xialiang (Frank); [email-masked]
Cc: Romascanu, Dan (Dan); Joseph Salowey; John Strassner
Subject: Re: [I2nsf] [I2NSF] Two levels of I2NSF interface:

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)
Sent: Monday, January 26, 2015 1:24 AM
To: [email-masked]<mailto:[email-masked]>
Cc: Romascanu, Dan (Dan); Joseph Salowey; John Strassner; Linda Dunbar
Subject: [I2NSF] Two levels of I2NSF interface:

Hi all,

B.R.
Frank

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 26 Jan 2015 18:19:39 +0000

Bob,

Can you give some examples of your "Service Interface"?

And some examples of "Capability Interface"?

Thanks, Linda

From: Natale, Bob [mailto:[email-masked]]
Sent: Monday, January 26, 2015 11:50 AM
To: Linda Dunbar
Cc: [email-masked]
Subject: RE: [I2NSF] Two levels of I2NSF interface:

Hi Linda,

Avanti,
BobN

To: Xialiang (Frank); [email-masked]<mailto:[email-masked]>

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank

---

From: "Natale, Bob" <[email-masked]>
Date: Mon, 26 Jan 2015 18:49:10 +0000

Hi Linda,

Just to be clear, I was only recommending labels for the two interface types in my previous message ... nothing more.

However, using O&M as an example domain (can be easily mapped to the security domain), a "service interface" might support a (fabricated here) request to "Instantiate service chain <x>" coming from an OSS/BSS application into the "Management Sub-Stratum" interface in the diagram below, and that in turn (and possibly via interfaces with the "Policy Sub-Stratum") communicating  (perhaps iteratively) with the "capability interface" in the "Control Sub-Stratum" to for OAM-level actions such as  provision resources, activate connections, launch monitoring, etc., and report status back up through the "Management Sub-Stratum".

[Note: I owe credit for the "sub-stratum" construct and terminology to someone else, but I could not find the source expeditiously at this time.]

Avanti,
BobN

From: Linda Dunbar [mailto:[email-masked]]
Sent: Monday, January 26, 2015 1:20 PM
To: Natale, Bob
Cc: [email-masked]
Subject: RE: [I2NSF] Two levels of I2NSF interface:

Bob,

Thanks, Linda

From: Natale, Bob [mailto:[email-masked]]
Sent: Monday, January 26, 2015 11:50 AM
To: Linda Dunbar
Cc: [email-masked]<mailto:[email-masked]>
Subject: RE: [I2NSF] Two levels of I2NSF interface:

Hi Linda,

Avanti,
BobN

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank

---

From: John Strassner <[email-masked]>
Date: Mon, 26 Jan 2015 23:13:11 +0000

Hi Linda,

In general I agree with you. See my earlier note to Diego. Elements of RBAC **could** be exposed in the intent-based interface, but RBAC itself shouldn't, as its specificity doesn't really align with (at least my notion of) an intent-based interface.
In other words, the intent-based interface could refer to Roles and Objects (and hence, define access control indirectly), but should not talk about lower-level access control functions directly.

regards,
John

Dr. John Strassner, Ph.D.
CTO, Software Laboratory, CRD

Futurewei Technologies
US R&D Center
2330 Central Expressway
Building A, office A2-2143
Santa Clara, California   95050

  Office:  +1.408.330.4923
  Email:   [email-masked]<mailto:[email-masked]>

From: Linda Dunbar
Sent: Monday, January 26, 2015 9:34 AM
To: Xialiang (Frank); [email-masked]<mailto:[email-masked]>
Cc: Romascanu, Dan (Dan); Joseph Salowey; John Strassner
Subject: RE: [I2NSF] Two levels of I2NSF interface:

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank

---

From: John Strassner <[email-masked]>
Date: Mon, 26 Jan 2015 23:16:10 +0000

Hi Bob,

I like these names. Service is what we care about, and we need capabilities (and constraints, of course) to determine what services can be offered at any given time.

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923
  Email:   [email-masked]

From: I2nsf [mailto:[email-masked]] On Behalf Of Natale, Bob
Sent: Monday, January 26, 2015 9:50 AM
To: Linda Dunbar
Cc: [email-masked]
Subject: Re: [I2nsf] [I2NSF] Two levels of I2NSF interface:

Hi Linda,

Avanti,
BobN

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank

---

From: John Strassner <[email-masked]>
Date: Mon, 26 Jan 2015 23:51:17 +0000

Hi Bob,

Continuing your example, if we had a policy rule DSL that was "RBAC-enabled", then:

*         Roles that can define, instantiate, execute, etc. the service chain are defined

*         Roles representing various actors that have appropriate permissions are defined

*         Capabilities are represented as managed objects that have their own permissions

*         The beauty of the policy language would then be to tie the various parts of your example together (either imperatively or declaratively, depending on the nature of the policy language):

o   Service interface == request from authorized Role

o   Policy engine translates to set of protected objects for the service chain

o   Policy engine looks for Roles that have appropriate permissions to operate on those protected objects

o   Policy engine issues commands that tell one or more Roles to take the OAM actions that they are authorized to execute

Is this more or less what you were talking about Bob?

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

From: I2nsf [mailto:[email-masked]] On Behalf Of Natale, Bob
Sent: Monday, January 26, 2015 10:49 AM
To: Linda Dunbar
Cc: [email-masked]
Subject: Re: [I2nsf] [I2NSF] Two levels of I2NSF interface:

Hi Linda,

Avanti,
BobN

Bob,

Thanks, Linda

Hi Linda,

Avanti,
BobN

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 27 Jan 2015 04:59:06 +0000

Yes, John ... precisely ... realizing, of course, that we are speaking only at an outline level here ... e.g., from broader perspectives, even more elements of the "policy continuum" [1] for programmable networks would come into play ... but for the service and capability interfaces at the SDN control plane level your outline fits perfectly.

[1] Just for the benefit of those who might not be familiar with this (IMHO) seminal work, http://www.tssg.org/files/archives/2007_MACE_SDavy_Jennings_final.pdf.

Avanti,
BobN

From: John Strassner [mailto:[email-masked]]
Sent: Monday, January 26, 2015 6:51 PM
To: Natale, Bob; Linda Dunbar; John Strassner
Cc: [email-masked]
Subject: RE: [I2NSF] Two levels of I2NSF interface:

Hi Bob,

regards,
John

Futurewei Technologies
US R&D Center
2330 Central Expressway

  Office:  +1.408.330.4923

Hi Linda,

Avanti,
BobN

Bob,

Thanks, Linda

Hi Linda,

Avanti,
BobN

Frank,

Any other opinions?

Linda

From: Xialiang (Frank)

Hi all,

B.R.
Frank