Subject: Document Action: Content Internetworking (CDI) Scenarios to Informational

From: The IESG <[email-masked]>
Date: Thu, 22 May 2003 15:05:25 -0400

The IESG has approved the Internet-Draft 'Content Internetworking (CDI)
Scenarios' <draft-ietf-cdi-scenarios-01.txt> as an Informational RFC.
This document is the product of the Content Distribution 
Internetworking Working Group. The IESG contact persons are Ned Freed 
and Ted Hardie.

Technical Summary

This document presents scenarios for content internetworking,
in order to provide concrete examples of what may happen
when two content networks interconnect. This work was originally
intended to be part of the evaluation process for a standards-track
protocol for content internetworking. While the IETF does not
foresee pursuing continued work on content internetworking
at this time, this document provides both useful scenarios for 
understanding the rational behind the original work and a record of 
the working group's thinking.

Working Group Summary

There was consensus in the working group for this as
an Informational document.

Protocol Quality

This document was reviewed for the IESG by Ted Hardie.

RFC Editor Note:

Dear RFC Editor,
     Please update the text of draft ietf-cdi-scenarios,
recently approved as an informational RFC, so that the reference
to draft-ietf-cdi-architecture is removed entirely and the
existing Security Considerations section is replaced with
the following text. My apologies for such a long adjustment;
I would normally ask the authors for a replacement draft,
but that was not practical in this case.
                            regards,
                                Ted Hardie

5. Security Considerations

     Security concerns with respect to Content Internetworking can be
     generally categorized into trust within the system and protection of
     the system from threats. The trust model utilized with Content
     Internetworking is predicated largely on transitive trust between
     the ORIGIN, REQUEST-ROUTING PEERING SYSTEM, DISTRIBUTION PEERING
     SYSTEM, ACCOUNTING PEERING SYSTEM and SURROGATES. Network elements
     within the Content Internetworking system are considered to be
     "insiders" and therefore trusted.

5.1 Threats to Content Internetworking

     The following sections document key threats to CLIENTs, PUBLISHERs,
     and CNs. The threats are classified according to the party that they
     most directly harm, but, of course, a threat to any party is
     ultimately a threat to all. (For example, having a credit card
     number stolen may most directly affect a CLIENT; however, the
     resulting dissatisfaction and publicity will almost certainly cause
     some harm to the PUBLISHER and CN, even if the harm is only to those
     organizations' reputations.)

5.1.1 Threats to the CLIENT

5.1.1.1 Defeat of CLIENT's Security Settings

     Because the SURROGATE's location may differ from that of the ORIGIN,
     the use of a SURROGATE may inadvertently or maliciously defeat any
     location-based security settings employed by the CLIENT. And since
     the SURROGATE's location is generally transparent to the CLIENT, the
     CLIENT may be unaware that its protections are no longer in force.
     For example, a CN may relocate CONTENT from a Internet Explorer
     user's "Internet Web Content Zone" to that user's "Local Intranet
     Web Content Zone." If the relocation is visible to the Internet
     Explorer browser but otherwise invisible to the user, the browser
     may be employing less stringent security protections than the user
     is expecting for that CONTENT. (Note that this threat differs, at
     least in degree, from the substitution of security parameters threat
     below, as Web Content Zones can control whether or not, for example,
     the browser executes unsigned active content.)

5.1.1.2 Delivery of Bad Accounting Information

     In the case of CONTENT with value, CLIENTs may be inappropriately
     charged for viewing content that they did not successfully access.
     Conversely, some PUBLISHERs may reward CLIENTs for viewing certain
     CONTENT (e.g. programs that "pay" users to surf the Web). Should a
     CN fail to deliver appropriate accounting information, the CLIENT
     may not receive appropriate credit for viewing the required CONTENT.

5.1.1.3 Delivery of Bad CONTENT

     A CN that does not deliver the appropriate CONTENT may provide the
     user misleading information (either maliciously or inadvertently).
     This threat can be manifested as a failure of either the
     DISTRIBUTION SYSTEM (inappropriate content delivered to appropriate
     SURROGATEs) or REQUEST-ROUTING SYSTEM (request routing to
     inappropriate SURROGATEs, even though they may have appropriate
     CONTENT), or both. A REQUEST-ROUTING SYSTEM may also fail by
     forwarding the CLIENT request when no forwarding is appropriate, or
     by failing to forward the CLIENT request when forwarding is
     appropriate.

5.1.1.4 Denial of Service

     A CN that does not forward the CLIENT appropriately may deny the
     CLIENT access to CONTENT.

5.1.1.5 Exposure of Private Information

     CNs may inadvertently or maliciously expose private information
     (passwords, buying patterns, page views, credit card numbers) as it
     transits from SURROGATEs to ORIGINs and/or PUBLISHERs.

5.1.1.6 Substitution of Security Parameters

     If a SURROGATE does not duplicate completely the security facilities
     of the ORIGIN (e.g. encryption algorithms, key lengths, certificate
     authorities) CONTENT delivered through the SURROGATE may be less
     secure than the CLIENT expects.

5.1.1.7 Substitution of Security Policies

     If a SURROGATE does not employ the same security policies and
     procedures as the ORIGIN, the CLIENT's private information may be
     treated with less care than the CLIENT expects. For example, the
     operator of a SURROGATE may not have as rigorous protection for the
     CLIENT's password as does the operator of the ORIGIN server. This
     threat may also manifest itself if the legal jurisdiction of the
     SURROGATE differs from that of the ORIGIN, should, for example,
     legal differences between the jurisdictions require or permit
     different treatment of the CLIENT's private information.

5.1.2 Threats to the PUBLISHER

5.1.2.1 Delivery of Bad Accounting Information

     If a CN does not deliver accurate accounting information, the
     PUBLISHER may be unable to charge CLIENTs for accessing CONTENT or
     it may reward CLIENTs inappropriately. Inaccurate accounting
     information may also cause a PUBLISHER to pay for services (e.g.
     content distribution) that were not actually rendered.) Invalid
     accounting information may also effect PUBLISHERs indirectly by, for
     example, undercounting the number of site visitors (and, thus,
     reducing the PUBLISHER's advertising revenue).

5.1.2.2 Denial of Service

     A CN that does not distribute CONTENT appropriately may deny CLIENTs
     access to CONTENT.

5.1.2.3 Substitution of Security Parameters

     If a SURROGATE does not duplicate completely the security services
     of the ORIGIN (e.g. encryption algorithms, key lengths, certificate
     authorities, client authentication) CONTENT stored on the SURROGATE
     may be less secure than the PUBLISHER prefers.

5.1.2.4 Substitution of Security Policies

     If a SURROGATE does not employ the same security policies and
     procedures as the ORIGIN, the CONTENT may be treated with less care
     than the PUBLISHER expects. This threat may also manifest itself if
     the legal jurisdiction of the SURROGATE differs from that of the
     ORIGIN, should, for example, legal differences between the
     jurisdictions require or permit different treatment of the CONTENT.

5.1.3 Threats to a CN

5.1.3.1 Bad Accounting Information

     If a CN is unable to collect or receive accurate accounting
     information, it may be unable to collect compensation for its
     services from PUBLISHERs.

5.1.3.2 Denial of Service

     Misuse of a CN may make that CN's facilities unavailable, or
     available only at reduced functionality, to legitimate customers or
     the CN provider itself. Denial of service attacks can be targeted at
     a CN's ACCOUNTING SYSTEM, DISTRIBUTION SYSTEM, or REQUEST-ROUTING
     SYSTEM.

5.1.3.3 Transitive Threats

     To the extent that a CN acts as either a CLIENT or a PUBLISHER (such
     as, for example, in transitive implementations) such a CN may be
     exposed to any or all of the threats described above for both roles.