Subject: [Detnet] DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

From: "Grossman, Ethan A." <[email-masked]>
Date: Thu, 8 Nov 2018 03:34:26 +0000

Hi All,
Here is my summary of the DetNet Security Considerations for IP and MPLS meetup yesterday. If you have any comments or additions, please let us know.
Best,
Ethan (as DetNet Security Considerations Draft Editor).
P.S. Ehsan, get on the list! :- )
---------------------------------------------------
Meeting: DetNet Security - IP and MPLS dataplane technologies security  considerations.
Date: IETF 103 -  7Nov18.
Present: David Black, Ethan Grossman, Norm Finn, Ehsan Mohammadpour, Tal Mizrahi
Agenda: Enumerate security considerations that are specific to the use of IP and MPLS as DetNet data plane technologies.

  1.  It may be possible for an attacker to add additional fields to (or use specific values for) an IP header (outside of the 5-tuple and DSCP value) resulting in routers diverting such packets away from DetNet data path to the router's control processor to figure out what to do with them. This could be used to mount a delay attack on a DetNet. IPv6 has such header extensions.
  2.  IP is store-and-forward, thus there are queues and the allowed possibility that packets arriving late will be queued. This is in contrast to MPLS which has very low tolerance for variance in packet timing, i.e. late packets will be dropped since there is essentially no buffering (ask Stewart Bryant about where it says this in the MPLS spec?). One implication is that buffering provides an attack surface for delaying packets. Another is that because IP can be run over links that are more subject to delays, it is likely that it will be run over such links, and as noted above, such links provide a larger attack surface for delay attacks.
  3.  DetNet over IP will require an "MPLS-class" control plane for routing over fixed paths, which is relatively new to IP, and thus likely to be exploited.
  4.  Attacking the control plane is an obvious way to attack DetNet. One way to mitigate this is to isolate the control plane from outside interference as much as possible.
  5.  We agreed that this material was appropriate for inclusion in the IP dataplane draft (as opposed to the existing DetNet Security draft).
  6.  It was opined that comparisons should be between what an IP router would do by default against DetNet requirements, i.e. not compared against MPLS. It was also noted that there are places in the IP draft that mention MPLS, and that perhaps such comparisons are in some way informative. Ethan currently feels that such comparisons are informative and so they have not been eliminated from these notes, although they could be eliminated from the final text if the group decides to.
  7.  IP can run over badly managed gear, though DetNet requires/assumes a well-managed network. The mitigation is "don't do that". Controlled Environment (RFC 8085 UDP guidelines, applies beyond UDP), removes a lot of things that can go wrong with IP networks because something is watching out for it.
  8.  There was a discussion about whether we can defer discussion of time base security to e.g. Time Protocols Security draft. This is not specific to IP or MPLS and is thus not included here.
  9.  The point was raised that if DetNet is running on a link for which there is arbitration for access to the link that this could be an attack surface. However DetNet requires a deterministic link, i.e. not an arbitrated one, so this was not considered a valid concern.
  10. We would like to get Stewart (for his deep MPLS knowledge) and David in same room - could sort out some things in more detail. Stewart and David to figure out when to do this, e.g. at the DetNet session.
-----------------------------------------------

---

From: "Grossman, Ethan A." <[email-masked]>
Date: Fri, 9 Nov 2018 04:24:48 +0000

Regarding item #2 below, we checked with Stewart and it turns out that both MPLS and IP running on a given device use the same buffers, so there is no intrinsic difference between them in that respect. Thus item #2 now looks like:

  1.  IP is store-and-forward, thus there are queues and the allowed possibility that packets arriving late will be queued. This is in contrast to MPLS which has very low tolerance for variance in packet timing, i.e. late packets will be dropped since there is essentially no buffering (ask Stewart Bryant about where it says this in the MPLS spec?). One implication is that buffering provides an attack surface for delaying packets. Another is that because IP can be run over links that are more subject to delays, it is likely that it will be run over such links, and as noted above, such links provide a larger attack surface for delay attacks.
Ethan.

From: Grossman, Ethan A.
Sent: Thursday, November 08, 2018 10:34 AM
To: [email-masked]' <[email-masked]>; 'Ehsan MohammadPour' <[email-masked]>
Subject: DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

Hi All,

---

From: "Grossman, Ethan A." <[email-masked]>
Date: Fri, 9 Nov 2018 04:29:26 +0000

Another security-related item arose from later discussion: the possibility of an attack on a DetNet with the goal being to use the DetNet to attack other networks. I am not sure what to do with this yet, but I thought the concept was novel. If anyone wants to provide any more detailed elaboration I'd love to hear about it.
Ethan.
From: Grossman, Ethan A.
Sent: Friday, November 09, 2018 11:25 AM
To: [email-masked]' <[email-masked]>; 'Ehsan MohammadPour' <[email-masked]>
Subject: RE: DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

From: Grossman, Ethan A.
Sent: Thursday, November 08, 2018 10:34 AM
To: [email-masked]' <[email-masked]<mailto:[email-masked]>>; 'Ehsan MohammadPour' <[email-masked]<mailto:[email-masked]>>
Subject: DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

Hi All,

---

From: "Black, David" <[email-masked]>
Date: Fri, 9 Nov 2018 04:37:04 +0000

Hi Ethan,
By coincidence, I just posted a note to the list about this sort of attack in the context of the architecture draft.
My 0.02 is that this concern should be dealt with separately from the security draft and security considerations sections of the protocol drafts.   For worked examples of how this can be done, please see the Congestion Considerations sections in RFC 7510 (MPLS/UDP) and RFC 8086 (GRE/UDP).
Thanks, --David

From: detnet [mailto:[email-masked]] On Behalf Of Grossman, Ethan A.
Sent: Thursday, November 8, 2018 11:29 PM
To: [email-masked]; Ehsan MohammadPour
Subject: Re: [Detnet] DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

[EXTERNAL EMAIL]
Please report any suspicious attachments, links, or requests for sensitive information.

Regarding item #2 below, we checked with Stewart and it turns out that both MPLS and IP running on a given device use the same buffers, so there is no intrinsic difference between them in that respect. Thus item #2 now looks like:
2)      IP is store-and-forward, thus there are queues and the allowed possibility that packets arriving late will be queued. This is in contrast to MPLS which has very low tolerance for variance in packet timing, i.e. late packets will be dropped since there is essentially no buffering (ask Stewart Bryant about where it says this in the MPLS spec?). One implication is that buffering provides an attack surface for delaying packets. Another is that because IP can be run over links that are more subject to delays, it is likely that it will be run over such links, and as noted above, such links provide a larger attack surface for delay attacks.
Ethan.

From: Grossman, Ethan A.
Sent: Thursday, November 08, 2018 10:34 AM
To: [email-masked]' <[email-masked]<mailto:[email-masked]>>; 'Ehsan MohammadPour' <[email-masked]<mailto:ehsanmpd@gmail..com>>
Subject: DetNet Security Considerations for IP and MPLS meetup notes - IETF 103 7Nov18

Hi All,
Here is my summary of the DetNet Security Considerations for IP and MPLS meetup yesterday. If you have any comments or additions, please let us know.
Best,
Ethan (as DetNet Security Considerations Draft Editor).
P.S. Ehsan, get on the list! :- )
---------------------------------------------------
Meeting: DetNet Security - IP and MPLS dataplane technologies security  considerations.
Date: IETF 103 -  7Nov18.
Present: David Black, Ethan Grossman, Norm Finn, Ehsan Mohammadpour, Tal Mizrahi
Agenda: Enumerate security considerations that are specific to the use of IP and MPLS as DetNet data plane technologies.
1)      It may be possible for an attacker to add additional fields to (or use specific values for) an IP header (outside of the 5-tuple and DSCP value) resulting in routers diverting such packets away from DetNet data path to the router's control processor to figure out what to do with them. This could be used to mount a delay attack on a DetNet. IPv6 has such header extensions.
2)      IP is store-and-forward, thus there are queues and the allowed possibility that packets arriving late will be queued. This is in contrast to MPLS which has very low tolerance for variance in packet timing, i.e. late packets will be dropped since there is essentially no buffering (ask Stewart Bryant about where it says this in the MPLS spec?). One implication is that buffering provides an attack surface for delaying packets. Another is that because IP can be run over links that are more subject to delays, it is likely that it will be run over such links, and as noted above, such links provide a larger attack surface for delay attacks.
3)      DetNet over IP will require an "MPLS-class" control plane for routing over fixed paths, which is relatively new to IP, and thus likely to be exploited.
4)      Attacking the control plane is an obvious way to attack DetNet. One way to mitigate this is to isolate the control plane from outside interference as much as possible.
5)      We agreed that this material was appropriate for inclusion in the IP dataplane draft (as opposed to the existing DetNet Security draft).
6)      It was opined that comparisons should be between what an IP router would do by default against DetNet requirements, i.e. not compared against MPLS. It was also noted that there are places in the IP draft that mention MPLS, and that perhaps such comparisons are in some way informative. Ethan currently feels that such comparisons are informative and so they have not been eliminated from these notes, although they could be eliminated from the final text if the group decides to.
7)      IP can run over badly managed gear, though DetNet requires/assumes a well-managed network. The mitigation is "don't do that". Controlled Environment (RFC 8085 UDP guidelines, applies beyond UDP), removes a lot of things that can go wrong with IP networks because something is watching out for it.
8)      There was a discussion about whether we can defer discussion of time base security to e.g. Time Protocols Security draft. This is not specific to IP or MPLS and is thus not included here.
9)      The point was raised that if DetNet is running on a link for which there is arbitration for access to the link that this could be an attack surface. However DetNet requires a deterministic link, i.e. not an arbitrated one, so this was not considered a valid concern.
10)   We would like to get Stewart (for his deep MPLS knowledge) and David in same room - could sort out some things in more detail. Stewart and David to figure out when to do this, e.g. at the DetNet session.
-----------------------------------------------