Subject: [ANCP] ANCP Security Requirements Draft

From: "MOUSTAFA Hassnaa RD-CORE-ISS" <[email-masked]>
Date: Wed, 18 Oct 2006 10:21:55 +0200

Hi,
 
A new draft is submitted, discussing the ANCP security requirements.

       Title           : Security Threats and Security Requirements for
the Access Node Control Protocol (ANCP)
       Author(s)       : H. Moustafa, H. Tschofenig and S. De Cnodder
       Filename        : draft-moustafa-ancp-security-threats-00.txt
    
The Access Node Control Protocol (ANCP) aims to communicate QoS-,
service- and subscriber-related operations 
between a Network Access Server (NAS) and an Access Node (e.g., a
Digital Subscriber Line Access Multiplexer (DSLAM)).  
The main goal of this protocol is to configure and manage access
equipments and allow them to report information to the NAS 
in order to enable and optimize configuration. This document
investigates security threats that all ANCP nodes could encounter, 
developing a threat model for ANCP security aiming to decide which
security functions are required at the ANCP level.
Based on this, security requirements regarding the Access Node Control
Protocol are defined.

URL for this daft:
http://www.ietf.org/internet-drafts/draft-moustafa-ancp-security-threats
-00.txt
 
Thanks for your comments.

Hassnaa Moustafa

_______________________________________________
ANCP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ancp

---

From: "Kim Hyldgaard \(ST/LMD\)" <[email-masked]>
Date: Wed, 18 Oct 2006 11:42:34 +0200

Hi,
 
Two comments:
 
1)
- I think this document is very good and thorough. - Great work!
 
2)
I don't understand this requirement from section 7:
"The protocol solution SHOULD distinguish the control messages from
the data."

What is defined as a control message and what is defined as data?

In section 5.7 I found
"...as for example capturing control messages
sent from the AN to the NAS announcing that a DSL line is up..."

So if a PORT UP message from the topology discovery use case
is a control message, which messages would be data?

>From my point of view "control message" in this context are messages
related to maintaining the protocol, and all messages related to
use cases are "data".

Please enlighten me if my reasoning is wrong... :-)

Kind regards
Kim Hyldgaard

________________________________

From: MOUSTAFA Hassnaa RD-CORE-ISS
[mailto:[email-masked]] 
Sent: 18. oktober 2006 10:22
To: [email-masked]
Subject: [ANCP] ANCP Security Requirements Draft

Hi,

    

URL for this daft:

Hassnaa Moustafa