Subject: [I2nsf] draft-zhang-gap-analysis - security

From: "Susan Hares" <[email-masked]>
Date: Wed, 10 Jun 2015 14:52:18 -0400

Hi all

The gap  analysis took time to really look at how the security work in the
IETF work fits together.   I published this draft, and I've received no
input on the security area gap analysis.   I'd really like feedback. 

Sue 

=========

   On early focus on ACL policy enforcement on traffic entering a
   network is the 1990s COPS design (PEP and PDP) as shown in figure 1.
   The Policy decision point kept network-wide policy (E.g. ACLs) and
   sent it to Policy enforcements who then would control what data flows
   between the two These decision points controlled flow from PEP to
   PEP.

                 PDP
      +-----+    /  \    +-----+
      |PEP1 |--/     \---|PEP2 |
      |     | ACL/policy |     |
      |     |                |     |
    --| ----|------------|-----|-----
      +-----+  data flow +-----+
 
              Figure 1
   Today's security devices in 2015 replicate the same concept.The I2NSF
   Security provisioning policy/filter decision point (SPDP) and the
   I2NSF Agent Security Enforcement point (SEP) still look to control
   this flow through secure devices (see figure 2.).

                +---------+
                | I2NSF   |
                | SPDP    |
                |         |
                +---------+
      +-----+    /  \    +-----+
      | SEP |--/     \---| SEP |
      |     |            |     |
    --| ----|------------|-----|-----
      +-----+  data flow +-----+
 
        Figure 2
   The other security protocols work to interact to create the
   additional pieces of security the flows for users as follows (see
 
   figure 3):
 
   o SACM - examines if policy and reality match.It asks the questions
   "Have proper policies been pushed to the proper place", and "Has any
   policy been compromised?"
 
   o MILE - looks at events that go Bump in night in the Security 2015.
   MILE examines when events need to be reported or correlated.A MILE
   configuration is a policy pushed out by the SPDP
 
   o DOTS - picks up security the flow for when things go really wrong
   during security attacks.In this case, an SEP needs to be able to
   SCREAM for help, to get other SEP to ease its pain.DOTS policy is
   pushed out via SPDP.
 
   o I2NSF may connect to all of these devices to gather information
   about the security policy that is pushes down to I2NSF agent. I2NSF
   provides a common interface between an I2NSF client as a SPDP and the
   NSF security boxes with SEP agents (which may also DOTS agent or Mile
   agent).
 
                +---------+     +------+
      +------+  | I2NSF   |=====| DOTS |
      |SCAM  |  | SPDP    |     |client|----
      |client|==|         |     +------+   |
      +------+  |         |     +------+   |
                |         |     |MILES |   |
    +------+    |         |     |client|   |
    |SCAM  |    +---------+     +----:-+   |
    |Agent |       / \               :     |
    +------+      /   \              :     |
      +-----+    /     \    +-----+  :     |
      | SEP |--/        \---| SEP |  :     |
      |     |               |     |  :     |
      |     |               |MILES|..:     |
      |     |               |Agent|        |
      |     |               |DOTS |        |
      |     |               |Agent|---------
    --| ----|---------------|-----|-----
      +-----+  data flow    +-----+
 
        Figure 3