Subject: [homegate] What's a "Home Gateway"?

From: Sabahattin Gucukoglu <[email-masked]>
Date: Thu, 25 Jun 2009 11:20:55 +0100

Can we start with a definition of a homegate-compliant home gateway  
that avoids lots of the issues we're discussing here, like who gets to  
own it?

Here's my shot at it (in very rough): that device or part of a device  
which is between the user's connection to the wider Internet and his  
local network infrastructure, and provides a means of reaching or of  
being reached from the Internet on a typically exclusive basis.

Now it's easy to define where are work is guided: toward the LAN  
side.  We can say things like, "We want conformance in the gateway  
part, but you can do what you like to your modem part" or whatever  
satisfies both camps.  It means we can easily distinguish a DSL  
"Router" from a cable modem, since the former incorporates a home  
gateway and the latter clearly doesn't.  And we can now leave  
everybody in the broadband SIGs of the world to continue doing  
horrible things to their infrastructure just so long as we get ECN and  
working multicast.  Consumers can now be left with a to-the-door  
connection and buy their own gateway, or can be given one and can  
understand that using a second gateway is bad without the necessary  
bridging treatment (or whatever).

Cheers,
Sabahattin

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Thu, 25 Jun 2009 09:28:31 -0400

Regarding second gateways, the problem is that there's a trust boundary
between that which the service provider manages and that which the home
user manages - and neither can completely trust the other...

Consider the following scenario:

A service provider provides a gateway integrated into a cable modem that
the service providers manages (say following the CableLabs eRouter
specification) to protect the service provider network from malicious
users.  However, this gateway can operate in routing mode or bridging
mode, but the end customer has absolutely no way of detecting whether
the gateway is a router or a bridge.

Now the customer has sensitive documents (like tax records) on a local
network drive, and tries to access them across the network.  Since the
customer has no way of knowing whether the eRouter is in router or
bridge mode, he doesn't know whether copies of the sensitive documents
are being sent across the service provider's network.  To protect
himself, he installs a second gateway behind the first gateway - a
gateway that he manages - and can be assured that routed traffic (like
the sensitive documents) is not being copied on the service provider
network.

All of a sudden, you have the possibility of two gateway/routers on the
same network - one behind the other - at the trust boundary.

- Wes

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Sabahattin Gucukoglu
Sent: Thursday, June 25, 2009 6:21 AM
To: [email-masked]
Subject: [homegate] What's a "Home Gateway"?

Can we start with a definition of a homegate-compliant home gateway that
avoids lots of the issues we're discussing here, like who gets to own
it?

Now it's easy to define where are work is guided: toward the LAN side.
We can say things like, "We want conformance in the gateway part, but
you can do what you like to your modem part" or whatever satisfies both
camps.  It means we can easily distinguish a DSL "Router" from a cable
modem, since the former incorporates a home gateway and the latter
clearly doesn't.  And we can now leave everybody in the broadband SIGs
of the world to continue doing horrible things to their infrastructure
just so long as we get ECN and working multicast.  Consumers can now be
left with a to-the-door connection and buy their own gateway, or can be
given one and can understand that using a second gateway is bad without
the necessary bridging treatment (or whatever).

Cheers,
Sabahattin

_______________________________________________
homegate mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/homegate

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 25 Jun 2009 16:42:08 +0200

> same network - one behind the other - at the trust boundary.

Seems that we need to require that any and all boxes provided by  
service providers be able to function in a modem-only mode, where the  
user provides the actual home gateway themselves.

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Thu, 25 Jun 2009 11:36:10 -0400

>> All of a sudden, you have the possibility of two gateway/routers on 
>> the same network - one behind the other - at the trust boundary.

> Seems that we need to require that any and all boxes provided by
service providers be able to function in a 
> modem-only mode, where the user provides the actual home gateway
themselves.

If you want to enforce the "one router in the home" rule, then you need
to explicitly tell the service provider that when there is a router
provided by the user, then the box provided by the service provider MUST
be operating in bridge mode.  I'm not sure that all service providers
that deploy eRouters will trust that the users have configured their
home router properly...

- Wes

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Thu, 25 Jun 2009 17:03:50 +0100

> user manages - and neither can completely trust the other...

[...]
> the

We choose to standardise the gateway (LAN) part, and make it a  
requirement that the part be distinct, whether physically or by design  
of the software inside a single box.  That's all.  We can disclaim  
responsibility for ISP management of the non-gateway bits.  In fact,  
consumers can grow used to purchasing two-part appliances whose one  
half is on their side and whose other isn't.  We recognise the two  
parts independently, treat them independently.  We can now set more  
reasonable goals, and establish principles and policies applicable to  
consumer-focused applications, including that of for instance being  
conservative about updates, if we feel that way, without regard to ISP  
needs.  Simple as.

Or we can go v6/e6 and ethernet, and suddenly we don't need gateways  
anymore because the ISP rules all. :-)  It occurs to me that all our  
glorious work will come to nothing if this happens, and that it will  
all seem a bit overmuch in light of such an obvious inevitability.

Cheers,
Sabahattin