Subject: [NSIS] Tying the requests to the flows exploiting them

From: "Elwyn Davies"<[email-masked]>
Date: Fri, 18 Jan 2002 17:45:56 -0000

Hi.

Nsis is targeting the setup of QoS paths across multiple domains potentially
belonging to several organisations that don't trust each other.  This has
been reflected in the proposals for the internal operation of the protocol
where extensive security requirements are proposed (Sec 5.8).  What appears
to be missing are equivalently stringent means for ensuring that domains
that authorise a QoS path can tell that the packets using that path are
actually the ones that should be using it.

In the simpler world of Intserv and Diffserv, requested QoS is invoked by
simple pattern matching on some combination of the packet header fields, but
even here thare has been a good deal of heart searching about how to ensure
that only the right packets can exploit better treatment from a network
(sub-text: only get what they paid for).  To do this properly seems to need
two things:

- The QoS protocol must be able to carry back to the end host making the
request from each QoS domain, a seed for unforgeable tokens which can be
attached to packets belonging to flow(s) which are to exploit the QoS path
setup by the request.

- The end host must be able to generate and attach suitable unforgeable
tokens to each packet in a flow that should receive the requested treatment,
which may then be tested by each QoS domain through which the packet passes.

Regards,
Elwyn  

----------------------------------------------------------------------------
------

Elwyn B Davies

        Routing and Addressing Strategy Prime
        Portfolio Integration			Solutions Ready		

        Nortel Networks plc			Email:
[email-masked]
        Harlow Laboratories     			ESN
6-742-5498
        London Road, Harlow,    		Direct Line
+44-1279-405498
        Essex, CM17 9NA, UK     		Fax
+44-1279-402047
        Registered Office: 			Maidenhead Office Park,
Westacott Way,
        Company No. 3937799			Maidenhead, Berkshire, SSL6
3QH
----------------------------------------------------------------------------
This message may contain information proprietary to Nortel Networks plc so
any
unauthorised disclosure, copying or distribution of its contents is strictly
prohibited.
----------------------------------------------------------------------------
"The Folly is mostly mine"
and the opinions are mine and not those of my employer.
============================================================================
======

---

From: Marcus Brunner <[email-masked]>
Date: Fri, 25 Jan 2002 17:49:30 +0100

Elwynd,

This is a very critical point, and we have been thinking about it for quite 
some time, but found no solution which is suitable (some or to expensive in 
terms of a overhead, others are only peodo secure :-). It is getting very 
important at the time a user pays for QoS (as you said).

I think it boils down to the problem, that an source IP address does not 
tell you something about the user sittin behind.

Marcus

--On Friday, January 18, 2002 5:45 PM +0000 Elwyn Davies 
<[email-masked]> wrote:

>
> Hi.
>
> Nsis is targeting the setup of QoS paths across multiple domains
> potentially belonging to several organisations that don't trust each
> other.  This has been reflected in the proposals for the internal
> operation of the protocol where extensive security requirements are
> proposed (Sec 5.8).  What appears to be missing are equivalently
> stringent means for ensuring that domains that authorise a QoS path can
> tell that the packets using that path are actually the ones that should
> be using it.
>
> simple pattern matching on some combination of the packet header fields,
> but even here thare has been a good deal of heart searching about how to
> ensure that only the right packets can exploit better treatment from a
> network (sub-text: only get what they paid for).  To do this properly
> seems to need two things:
>
> attached to packets belonging to flow(s) which are to exploit the QoS
> path setup by the request.
>
> tokens to each packet in a flow that should receive the requested
> treatment, which may then be tested by each QoS domain through which the
> packet passes.
>
> Regards,
> Elwyn
>
> -------------------------------------------------------------------------
> ---------
>
> Elwyn B Davies
>
> [email-masked]          Harlow Laboratories
> ESN                     6-742-5498          London Road, Harlow,
> Direct Line             +44-1279-405498          Essex, CM17 9NA, UK
> Fax                     +44-1279-402047          Registered Office:
> Maidenhead Office Park, Westacott Way,          Company No. 3937799
> Maidenhead, Berkshire, SSL6 3QH
> -------------------------------------------------------------------------
> ---  This message may contain information proprietary to Nortel Networks
> plc so any  unauthorised disclosure, copying or distribution of its
> contents is strictly prohibited.
> -------------------------------------------------------------------------
> ---  "The Folly is mostly mine"
> =========================================================================
> =========
>
>
>

--------------------------------------
Dr. Marcus Brunner
Network Laboratories
NEC Europe Ltd.

E-Mail: [email-masked]
WWW:    http://www.ccrle.nec.de/
personal home page: http://www.brubers.org/marcus

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis