Subject: [pcp] FW: New Version Notification for draft-merged-i2nsf-framework-00.txt

From: Linda Dunbar <[email-masked]>
Date: Tue, 21 Apr 2015 22:55:35 +0000

This document describes the framework for Interface to Network Security Functions and defines a reference model along with functional components.

Copy to DOTS/PCP/SACM audience in hope for getting feedback from wider audience. I2NSF is about security functions management, i.e. how customers can request & monitor their desired security policies from security service providers and interface to manage/monitor packet based security functions from multiple vendors, whereas DOTS is the information exchange between multiple AntiDoS functions.

There are two aspects of I2NSF:
1)  the security policy information exchange between customers and the service provider that offers the hosted security functions
2) the secure channel for the information exchange, (which can be achieved by TLS or SASL or combination of them )

I2NSF's first step will focus on 1) above. The "communication security" (2) above is secondary.

The I2NSF framework utilizes the categories characterized by draft-lopez-i2nsf-packet-00 for NSF:

•       Subject – match values based on packet data
      Packet header - Can be standardized
      Packet payload - Provided by NSF capabilities
•       Object – match values based on context
      Ex.: State, time, geo-location, etc.
      Many can (and should) be standardized, but many also from NSF capabilities
•       Function – invoked security function
      Defined by NSF capabilities
      Function:Instance (ex. IPS:<signature base> which can be provided by vendors)
•       Action – egress processing
      Invoke signaling
      Packet forwarding and/or transformation
      Possibility for SDN/NFV integration

Any feedback, comments or suggestions are greatly appreciated.

Cheers,
Linda

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, April 21, 2015 5:35 PM
To: Joe Parrott; Seetharama Rao Durbha; Xiaojun Zhuang; Linda Dunbar; Linda Dunbar; Diego Lopez; Seetharama Rao Durbha; Ram (Ramki) Krishnan; Diego Lopez; XiaoJun Zhuang; Joe Parrott; Ramki Krishnan
Subject: New Version Notification for draft-merged-i2nsf-framework-00.txt

A new version of I-D, draft-merged-i2nsf-framework-00.txt
has been successfully submitted by Linda Dunbar and posted to the IETF repository.

Name:           draft-merged-i2nsf-framework
Revision:       00
Title:          Framework for Interface to Network Security Functions
Document date:  2015-04-21
Group:          Individual Submission
Pages:          16
URL:            http://www.ietf.org/internet-drafts/draft-merged-i2nsf-framework-00.txt
Status:         https://datatracker.ietf.org/doc/draft-merged-i2nsf-framework/
Htmlized:       http://tools.ietf.org/html/draft-merged-i2nsf-framework-00

Abstract:
   This document describes the framework for Interface to Network
   Security Functions and defines a reference model along with
   functional components.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat