Subject: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

From: "[email-masked]" <[email-masked]>
Date: Thu, 2 Dec 2021 11:46:11 +0800

Hi everyone,

This is Penglin Yang from China Mobile Research Institute.  Recently, we composed a document named  trust enhanced I2NSF and submitted to the I2NSF group. (https://datatracker.ietf.org/doc/draft-yang-i2nsf-trust-enhanced-i2nsf/) The motivation of this document is trying to use remote attestation technology to augment the security and to enhance the trustworthiness of NSF. In this document we illustrated the architecture of trsuted enhanced I2NSF and the relevant interfaces. 

We sincerely welcome everyone to comment on this document. And if you are interested, we can work together to promote this idea to a better version.

BR
Penglin Yang
CMCC

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 3 Dec 2021 03:56:02 +0000

PengLin,

Thank you very much for posting the draft in I2NSF WG.
A few questions to your proposal:

  1.  Are the three threats in Section 3.2 specific to Network Security Functions? Or applicable to any network functions?
  2.  The Second Threat is the leak of policy rules and core asset of security knowledge.  Where do the  "policy rules" leaked to?  The "core asset of security knowledge" is from network operators? Or is it to the Network Security Functions?
  3.  The "third threat on potential spoofing attack to the NSF architecture". Are the spoofing attack also applicable to any network functions? Is "spoofing attack" addressed by RAT?

Thank you
Linda Dunbar

From: I2nsf <[email-masked]> On Behalf Of [email-masked]
Sent: Wednesday, December 1, 2021 9:46 PM
To: [email-masked]
Subject: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

Hi everyone,

BR
Penglin Yang
CMCC

---

From: "[email-masked]" <[email-masked]>
Date: Fri, 3 Dec 2021 16:45:34 +0800

Hi Linda，

Thank you for your concern about this proposal. I think your questions are very meaningful,  and here is my response. First of all, I think the three questions are all aobut if we trust the rmote environment in where deploys NSF. If we don't trust the environment, the threats may happen. So this document tries to figure out a general way to mitigate that kinds of threats and enhance the security of the NSF itself.

    1，These threats are applicable to any netowrk functions deployed in remote environment that the manager cannot make sure if it is trustworthy. But in this document we only focus on the NSF.
    2，Consider a secuiry company provides NSF in which contains lots of policy rules such as DDoS prevention, traffic filtering, etc. If the platform who carrys the NSF is malicious, it could steal this security asset for other purpose. The core asset of security knowledge is from the security controller, which provided by the security company. 
    3，The attackers in platfom could also disturb the action of NSF, and feedback the fake notification or event to security controller. That is what I mean spoofing attack. If the paltform is trusted, or has been remote attested, at least we can say the NSF is well deployed and its feedback is trustworthy. (In fact, about trust, there have more topics about static trust and runtime trust. Remote attestation could provide static trust like booting state of platform, installation of software, or file changing in system. Other techs like "confidential computing" could provide an isolated CPU and memory area that users can trust it during running time. This tech is still in developing stage, there is no standard yet. But I do think in the future security-sensitive scenarios will use it. )

Hope my answer could solve your problem.

BR
Penglin

From: Linda Dunbar
Date: 2021-12-03 11:56
To: [email-masked]; [email-masked]
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
PengLin, 

Are the three threats in Section 3.2 specific to Network Security Functions? Or applicable to any network functions? 
The Second Threat is the leak of policy rules and core asset of security knowledge.  Where do the  “policy rules” leaked to?  The “core asset of security knowledge” is from network operators? Or is it to the Network Security Functions? 
The “third threat on potential spoofing attack to the NSF architecture”. Are the spoofing attack also applicable to any network functions? Is “spoofing attack” addressed by RAT? 
 
Thank you
Linda Dunbar

Hi everyone,

 
BR
Penglin Yang
CMCC

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 3 Dec 2021 17:03:59 +0000

Penglin,

Your explanation is very helpful.

Can you please add them to the draft? Also, make sure the work is not in conflict with RAT.

Thank you,

Linda Dunbar

From: [email-masked] <[email-masked]>
Sent: Friday, December 3, 2021 2:46 AM
To: Linda Dunbar <[email-masked]>; [email-masked]
Subject: Re: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

Hi Linda，

BR
Penglin

From: Linda Dunbar<mailto:[email-masked]>
Date: 2021-12-03 11:56
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
PengLin,

2.  The Second Threat is the leak of policy rules and core asset of security knowledge.  Where do the  “policy rules” leaked to?  The “core asset of security knowledge” is from network operators? Or is it to the Network Security Functions?

3.  The “third threat on potential spoofing attack to the NSF architecture”. Are the spoofing attack also applicable to any network functions? Is “spoofing attack” addressed by RAT?

Thank you
Linda Dunbar

From: I2nsf <[email-masked]<mailto:[email-masked]>> On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, December 1, 2021 9:46 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

Hi everyone,

This is Penglin Yang from China Mobile Research Institute.  Recently, we composed a document named  trust enhanced I2NSF and submitted to the I2NSF group. (https://datatracker.ietf.org/doc/draft-yang-i2nsf-trust-enhanced-i2nsf/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-yang-i2nsf-trust-enhanced-i2nsf%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7Cb6ebadbdbfc146fa3c3d08d9b6394f30%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637741179539422179%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=LokE3SrpNN5lYxJVojc2XxPoZxJv%2BvFgdzTzfSWKj1s%3D&reserved=0>) The motivation of this document is trying to use remote attestation technology to augment the security and to enhance the trustworthiness of NSF. In this document we illustrated the architecture of trsuted enhanced I2NSF and the relevant interfaces.

BR
Penglin Yang
CMCC

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Sat, 4 Dec 2021 15:10:13 +0900

Hi Penglin,
I am Paul in charge of I2NSF YANG Data Models such as NSF Capability,
Consumer-Facing Interface,
NSF-Facing Interface, Monitoring Interface, and Registration Interface.

I have read through your draft about remote NSF attestation interfaces and
I became to know that your work is well-assigned to the next step of I2NSF
WG
for security management automation in the following draft:
https://datatracker.ietf.org/doc/draft-jeong-i2nsf-security-management-automation/

The NSF attestation is very important to provide customers with stable and
trustworthy
I2NSF-based security services.

However, we need to clarify the new components of your draft such as
Endorser, Verifier/Relying Party,
Reference Value Provider, and RoT (Root of Trust).
Endorser is defined in
https://datatracker.ietf.org/doc/html/draft-ietf-rats-architecture as
follows:
Endorser: A role performed by an entity (typically a manufacturer) whose
Endorsements help
Verifiers appraise the authenticity of Evidence.

I think Endorse can be part of Developer's Management System (DMS) because
DMS is
an entity to provide the capability information of its NSF to Security
Controller and also
a virtualized NSF image as a VNF or container to the I2NSF framework.

The overall structure of YANG modules of Trust Enhanced NSF Monitoring
Interface and
Trust Enhanced Registration interface look good to me.
However, we need to make sure that these two new interface data models need
to comply with
the structure of NSF Monitoring Interface (
https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-monitoring-data-model-12
)
and Registration Interface (
https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-registration-interface-dm-13
).

I have much interest in this work on remote NSF attestation for I2NSF WG
and
want to contribute to the development of this draft for I2NSF evolution
toward
security management automation.

Thanks.

Best Regards,
Paul

On Thu, Dec 2, 2021 at 12:46 PM [email-masked] <
[email-masked]> wrote:

> Hi everyone,
>
> This is Penglin Yang from China Mobile Research Institute.  Recently, we
> composed a document named  trust enhanced I2NSF and submitted to the I2NSF
> group. (
> https://datatracker.ietf.org/doc/draft-yang-i2nsf-trust-enhanced-i2nsf/)
> The motivation of this document is trying to use remote attestation
> technology to augment the security and to enhance the trustworthiness of
> NSF. In this document we illustrated the architecture of trsuted enhanced
> I2NSF and the relevant interfaces.
>
> We sincerely welcome everyone to comment on this document. And if you are
> interested, we can work together to promote this idea to a better version.
>
> BR
> Penglin Yang
> CMCC
>
> _______________________________________________
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 6 Dec 2021 10:39:26 +0800

Hi Paul,

It will be great that we could work together on this draft. Maybe we could set up a meeting sometime when you are available.
Since this draft is still in the early version, I think the suggestion about Endorser and interface compliance could be fully considered and make the final decison together. 

BR 
Penglin    

From: Mr. Jaehoon Paul Jeong
Date: 2021-12-04 14:10
To: [email-masked]
CC: [email-masked]; skku-iotlab-members; Mr. Jaehoon Paul Jeong
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
Hi Penglin,
I am Paul in charge of I2NSF YANG Data Models such as NSF Capability, Consumer-Facing Interface, 
NSF-Facing Interface, Monitoring Interface, and Registration Interface.

I have read through your draft about remote NSF attestation interfaces and 
I became to know that your work is well-assigned to the next step of I2NSF WG
for security management automation in the following draft:
https://datatracker.ietf.org/doc/draft-jeong-i2nsf-security-management-automation/

The NSF attestation is very important to provide customers with stable and trustworthy 
I2NSF-based security services.

However, we need to clarify the new components of your draft such as Endorser, Verifier/Relying Party, 
Reference Value Provider, and RoT (Root of Trust).
Endorser is defined in https://datatracker.ietf.org/doc/html/draft-ietf-rats-architecture as follows:
Endorser: A role performed by an entity (typically a manufacturer) whose Endorsements help
Verifiers appraise the authenticity of Evidence.

I think Endorse can be part of Developer's Management System (DMS) because DMS is 
an entity to provide the capability information of its NSF to Security Controller and also
a virtualized NSF image as a VNF or container to the I2NSF framework.

The overall structure of YANG modules of Trust Enhanced NSF Monitoring Interface and
Trust Enhanced Registration interface look good to me.
However, we need to make sure that these two new interface data models need to comply with
the structure of NSF Monitoring Interface (https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-monitoring-data-model-12)
and Registration Interface (https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-registration-interface-dm-13).

I have much interest in this work on remote NSF attestation for I2NSF WG and 
want to contribute to the development of this draft for I2NSF evolution toward 
security management automation.

Thanks.

Best Regards,
Paul

On Thu, Dec 2, 2021 at 12:46 PM [email-masked] <[email-masked]> wrote:
Hi everyone,

BR
Penglin Yang
CMCC

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 6 Dec 2021 10:41:47 +0800

Hi Linda,

Thanks for your suggestion.  I will add the explanation to the draft next update. And I also will make sure to keep align with RATs group.

BR
Penglin
 
From: Linda Dunbar
Date: 2021-12-04 01:03

 
Thank you, 
 
Linda Dunbar

Hi Linda，

 
BR
Penglin

From: Linda Dunbar
Date: 2021-12-03 11:56

 
Thank you
Linda Dunbar

Hi everyone,

 
BR
Penglin Yang
CMCC

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Mon, 6 Dec 2021 14:13:20 +0900

Hi Penglin,
I will be available for an online meeting next week.
Please let me know the meeting date and time.

Thanks.

Best Regards,
Paul

On Mon, Dec 6, 2021 at 11:39 AM [email-masked] <
[email-masked]> wrote:

> Hi Paul,
>
> It will be great that we could work together on this draft. Maybe we could
> set up a meeting sometime when you are available.
> Since this draft is still in the early version, I think the suggestion
> about Endorser and interface compliance could be fully considered and make
> the final decison together.
>
> BR
> Penglin
>
>
>
> ------------------------------
>
>
>
> *From:* Mr. Jaehoon Paul Jeong <[email-masked]>
> *Date:* 2021-12-04 14:10
> *To:* [email-masked]
> *CC:* [email-masked]; skku-iotlab-members
> <[email-masked]>; Mr. Jaehoon Paul Jeong
> <[email-masked]>
> *Subject:* Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
> Hi Penglin,

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 6 Dec 2021 15:31:41 +0800

Hi Paul,

Is next Tuesday 10 am GM +8 available for you?  ( If my guessing is right, you are in GM +9 timezone, that means your local time would be 11am ? )
Here is the meeting link by Microsoft Teams. I am not sure if it will work between us.  https://teams.live.com/meet/95442375483586 
Or if you have better e-meeting solutions we could follow your arrangement. That will be very appreciated.

BR
Penglin

Date: 2021-12-06 13:13

Thanks.

Best Regards,
Paul

On Mon, Dec 6, 2021 at 11:39 AM [email-masked] <[email-masked]> wrote:
Hi Paul,

BR 
Penglin    

Thanks.

Best Regards,
Paul

BR
Penglin Yang
CMCC

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Tue, 7 Dec 2021 16:22:31 +0900

Hi Penglin,
The time and the teams meeting tool are okay to me.

Thanks and see soon.

Best Regards,
Paul

On Mon, Dec 6, 2021 at 4:32 PM [email-masked] <
[email-masked]> wrote:

> Hi Paul,
>
> Is next Tuesday 10 am GM +8 available for you?  ( If my guessing is right,
> you are in GM +9 timezone, that means your local time would be 11am ? )
> Here is the meeting link by Microsoft Teams. I am not sure if it will work
> between us.  https://teams.live.com/meet/95442375483586
> Or if you have better e-meeting solutions we could follow your
> arrangement. That will be very appreciated.
>
> BR
> Penglin
>
>
> *Date:* 2021-12-06 13:13
>> It will be great that we could work together on this draft. Maybe we
>> could set up a meeting sometime when you are available.
>>> We sincerely welcome everyone to comment on this document. And if you
>>> are interested, we can work together to promote this idea to a better
>>> version.
>>>
>>> BR
>>> Penglin Yang
>>> CMCC
>>>
> --
> You received this message because you are subscribed to the Google Groups
> "skku-iotlab-members" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email-masked].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/skku-iotlab-members/2021120615314061519514%40chinamobile.com
> <https://groups.google.com/d/msgid/skku-iotlab-members/2021120615314061519514%40chinamobile.com?utm_medium=email&utm_source=footer>
> .
>

---

From: "[email-masked]" <[email-masked]>
Date: Tue, 7 Dec 2021 15:38:31 +0800

Hi Paul,

Great, see you soon.

BR
Penglin 

Date: 2021-12-07 15:22

Thanks and see soon.

Best Regards,
Paul

On Mon, Dec 6, 2021 at 4:32 PM [email-masked] <[email-masked]> wrote:
Hi Paul,

BR
Penglin

Thanks.

Best Regards,
Paul

BR 
Penglin    

Thanks.

Best Regards,
Paul

BR
Penglin Yang
CMCC 

_______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf
_______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf
-- 
You received this message because you are subscribed to the Google Groups "skku-iotlab-members" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
To view this discussion on the web visit https://groups.google.com/d/msgid/skku-iotlab-members/2021120615314061519514%40chinamobile.com.

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 7 Dec 2021 15:05:05 +0000

PengLin,

Can you send a calendar invite to me? I will try to join.

Linda

From: I2nsf <[email-masked]> On Behalf Of [email-masked]
Sent: Monday, December 6, 2021 1:32 AM
To: Mr. Jaehoon Paul Jeong <[email-masked]>
Cc: [email-masked]; skku-iotlab-members <[email-masked]>; Mr. Jaehoon Paul Jeong <[email-masked]>
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

Hi Paul,

Is next Tuesday 10 am GM +8 available for you?  ( If my guessing is right, you are in GM +9 timezone, that means your local time would be 11am ? )
Here is the meeting link by Microsoft Teams. I am not sure if it will work between us.  https://teams.live.com/meet/95442375483586<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fteams.live.com%2Fmeet%2F95442375483586&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326052809%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=tBlRLkLZiHUR8%2F%2BLvVtjQ8fTRMe%2BBoytLhQBec1fSS0%3D&reserved=0>
Or if you have better e-meeting solutions we could follow your arrangement. That will be very appreciated.

BR
Penglin

From: Mr. Jaehoon Paul Jeong<mailto:[email-masked]>
Date: 2021-12-06 13:13
To: [email-masked]<mailto:[email-masked]>
CC: [email-masked]<mailto:[email-masked]>; skku-iotlab-members<mailto:[email-masked]>; Mr. Jaehoon Paul Jeong<mailto:[email-masked]>
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
Hi Penglin,
I will be available for an online meeting next week.
Please let me know the meeting date and time.

Thanks.

Best Regards,
Paul

On Mon, Dec 6, 2021 at 11:39 AM [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>> wrote:
Hi Paul,

BR
Penglin

________________________________

From: Mr. Jaehoon Paul Jeong<mailto:[email-masked]>
Date: 2021-12-04 14:10
To: [email-masked]<mailto:[email-masked]>
CC: [email-masked]<mailto:[email-masked]>; skku-iotlab-members<mailto:[email-masked]>; Mr. Jaehoon Paul Jeong<mailto:[email-masked]>
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf
Hi Penglin,
I am Paul in charge of I2NSF YANG Data Models such as NSF Capability, Consumer-Facing Interface,
NSF-Facing Interface, Monitoring Interface, and Registration Interface.

I have read through your draft about remote NSF attestation interfaces and
I became to know that your work is well-assigned to the next step of I2NSF WG
for security management automation in the following draft:
https://datatracker.ietf.org/doc/draft-jeong-i2nsf-security-management-automation/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-jeong-i2nsf-security-management-automation%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326052809%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=pY26qOGhKFjz1YATL5EMnw1%2BGfQragLXb5mSfovrdT0%3D&reserved=0>

Endorser is defined in https://datatracker.ietf.org/doc/html/draft-ietf-rats-architecture<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-rats-architecture&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326062748%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=7VP6unhkeF%2BFxWAniYottlgaYtt4tg%2FIQ51fvn8YFLk%3D&reserved=0> as follows:

The overall structure of YANG modules of Trust Enhanced NSF Monitoring Interface and
Trust Enhanced Registration interface look good to me.
However, we need to make sure that these two new interface data models need to comply with
the structure of NSF Monitoring Interface (https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-monitoring-data-model-12<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-i2nsf-nsf-monitoring-data-model-12&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326072701%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=t1i52eaLH8qPmlipg0E0DaAVcQ4lFrkKov2TFhD0its%3D&reserved=0>)
and Registration Interface (https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-registration-interface-dm-13<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-i2nsf-registration-interface-dm-13&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326072701%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=VBGOVEtaNSz9Ux8ZbplvrJH70vp6DdHaM%2F%2B4ctqkRF4%3D&reserved=0>).

Thanks.

Best Regards,
Paul

On Thu, Dec 2, 2021 at 12:46 PM [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>> wrote:
Hi everyone,

This is Penglin Yang from China Mobile Research Institute.  Recently, we composed a document named  trust enhanced I2NSF and submitted to the I2NSF group. (https://datatracker.ietf.org/doc/draft-yang-i2nsf-trust-enhanced-i2nsf/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-yang-i2nsf-trust-enhanced-i2nsf%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326082655%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=igMJAwuxbF3ok6unQoeT9qbUJPaI4%2BTdh9%2BzoKcR2rY%3D&reserved=0>) The motivation of this document is trying to use remote attestation technology to augment the security and to enhance the trustworthiness of NSF. In this document we illustrated the architecture of trsuted enhanced I2NSF and the relevant interfaces.

BR
Penglin Yang
CMCC

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fi2nsf&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326082655%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=PO1FIpo92ihbVezK9VLM6UbrZLfprSZqa%2BUT%2FFzWSjY%3D&reserved=0>
_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fi2nsf&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C94215c21007e4cf61e8d08d9b88a82a0%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637743727326092614%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Pk4pWjlPn3hl6eQvkRBu03zC1MC9sIQz85ALGtuT9GM%3D&reserved=0>

---

From: "Diego R. Lopez" <[email-masked]>
Date: Thu, 9 Dec 2021 06:45:23 +0000

Hi,

Many thanks for this. The integration of I2NSF with the recent results in the area of remote attestation is one of the aspects we wanted to consider in an I2NSF rechartering proposal we are finalizing and will share on the list soon. Actually, our ideas go along the following issues to improve the I2NSF approach to security function management:

  *   The automation of security management procedures, considering the integration with general automation and autonomic mechanisms, as defined by the OPS Area
  *   Mechanisms for guiding and verifying policy translation
  *   The implications for security management of recent developments:
     *   Remote attestation procedures
     *   Trusted and oblivious execution models
     *   Container-based virtualization approaches
     *   Quantum-safe crypto (PQC, QKD…)
     *   Distributed trust and execution infrastructures (along the work of DINRG and COINRG)
  *   An extended capability model, suitable for the above items

As you can imagine, we very much welcome this document and would be extremely interested in collaborating with you in developing it and the general approach to enhance trust in SFs managed through I2NSF.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]<mailto:[email-masked]>
Mobile:  +34 682 051 091
----------------------------------

On 02/12/2021, 04:46, "I2nsf on behalf of [email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Hi everyone,

BR
Penglin Yang
CMCC

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "[email-masked]" <[email-masked]>
Date: Thu, 9 Dec 2021 16:28:22 +0800

HI  Diego,

Thank you for your interesting about this topic and very welcome to work on this document together.
I think the ideas of  new charter will improve the ability of NSF dramatically. In fact, I am also paying close attention to the DINGR and COINRG. I haven't have a clear clue about how to bring DIN or COIN in I2NSF yet. But for sure that is one of the main trends in future network. If there is something new, we could share to each other.

BR
Penglin

From: Diego R. Lopez
Date: 2021-12-09 14:45
 
Many thanks for this. The integration of I2NSF with the recent results in the area of remote attestation is one of the aspects we wanted to consider in an I2NSF rechartering proposal we are finalizing and will share on the list soon. Actually, our ideas go along the following issues to improve the I2NSF approach to security function management:
The automation of security management procedures, considering the integration with general automation and autonomic mechanisms, as defined by the OPS Area
Mechanisms for guiding and verifying policy translation
The implications for security management of recent developments:
Remote attestation procedures
Trusted and oblivious execution models
Container-based virtualization approaches
Quantum-safe crypto (PQC, QKD…)
Distributed trust and execution infrastructures (along the work of DINRG and COINRG)
An extended capability model, suitable for the above items

Be goode,

Dr Diego R. Lopez
Telefonica I+D
 
e-mail: [email-masked]
Mobile:  +34 682 051 091
----------------------------------
 
On 02/12/2021, 04:46, "I2nsf on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:
 
Hi everyone,

 
BR
Penglin Yang
CMCC

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 9 Dec 2021 16:08:57 +0000

Diego,

Thank you for the list. I have some questions inserted below:

Linda

From: I2nsf <[email-masked]> On Behalf Of Diego R. Lopez
Sent: Thursday, December 9, 2021 12:45 AM
To: [email-masked]; [email-masked]
Subject: Re: [I2nsf] topic about draft-yang-i2nsf-trust-enhanced-i2nsf

Hi,

[Linda] This seems a very big area. Are you talking about Best Practices for Security management procedures? Is it possible to carve out a portion related to network security functions?

  *   Mechanisms for guiding and verifying policy translation
[Linda] Can you elaborate what are the input and out of the  “Policy translation” so that we can understand the feasibility?

  *   The implications for security management of recent developments:
     *   Remote attestation procedures
[Linda] Is this within the scope of RATS WG? If not, can you explain?

     *   Trusted and oblivious execution models
[Linda] Do you mean execution models on the Network Security Functions?

     *   Container-based virtualization approaches
[Linda] Do you mean Container-based Network Security Functions?

Be goode,

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fdr2lopez%2F&data=04%7C01%7Clinda.dunbar%40futurewei.com%7C4d1986ef81e14703708a08d9badf85db%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637746291467800513%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yLOtmNQbfp5UMaROIeV1hUK3vNebpMGr5YnRIrwDb%2Bs%3D&reserved=0>

Hi everyone,

BR
Penglin Yang
CMCC