Subject: [savi] asking for comments on "SAVI Requirements and Solutions for ISP IPv6 Access Network"

From: Qiong <[email-masked]>
Date: Wed, 16 Nov 2011 00:39:21 +0800

WARNING: contains banned part

Subject: [savi] asking for comments on "SAVI Requirements and Solutions for ISP IPv6 Access Network"
From: Qiong <[email-masked]>
To: [email-masked]
Cc: shifan <[email-masked]>
Date: Wed, 16 Nov 2011 00:39:21 +0800

Dear all,

I'm Qiong Sun from China Telecom. I'm sincerely sorry for missing my slot
on "SAVI Requirements and Solutions for ISP IPv6 Access Network". It is my
fault to discuss outside of the door with Tina for longer than I thought.
Apologize again to every one :(

Here, I still would like to ask for comments on our draft: "SAVI
Requirements and Solutions for ISP IPv6 Access Network". We do regard SAVI
as an essential mechanism for ISPs to guarantee security of its network and
customers' privacy. This document describes five scenarios of ISPs' IPv6
access network, moreover, states its SAVI requirements and according
tentative solutions. These scenarios will cover the most of the Internet
access scenes in China Telecom. And maybe the reference to other ISPs.

Please find the slides in the attachment, and please contact me if you have
any question on it. I'll also be in the IETF meeting until Friday. We can
arrange a face-to-face talk if necessary.

Thanks in advance.

Best wishes

Qiong

---

From: "Joel M. Halpern" <[email-masked]>
Date: Tue, 15 Nov 2011 20:18:57 -0500

If I have understood the slide deck you distributed, there appear to be 
two general classes of situations.
One class is where a BRAS is allocating addresses to the home 
collectively or to individual devices in the home.  And the devices use 
the allocated devices.
The second class is where teh end devices tunnel other traffic over the 
allocated IPv6 address.

 From talking with operators, and with BRAS developers, it does not 
appear that there is any need for additional mechanisms in order to 
provide address enforcement for the first case.  Many BRAS already do 
that, using existing mechanisms.  And because the home is under control 
of a single BRAS, there does not seem to be an interoperability issue.

As was discussed in the meeting, while the tunnel address validation 
question is important, it also has many complexities as the tunnel 
end-point may not even be under control of the BRAS operator, making it 
difficult to reliably know what should be verified, or what constitutes 
validity.

Yours,
Joel M. halpern

---

From: Qiong <[email-masked]>
Date: Wed, 16 Nov 2011 23:14:58 +0800

Hi Joel,

Thanks for your comments. Please see inline.

On Wed, Nov 16, 2011 at 9:18 AM, Joel M. Halpern <[email-masked]>wrote:

> One class is where a BRAS is allocating addresses to the home collectively
> or to individual devices in the home.  And the devices use the allocated
> devices.
 In my understanding, what BRAS is doing today is to do subscriber
back-tracing, which mean we still can not avoid DoS attack from
subscribers. The request to avoid address spoofing exists in IPv4 and the
situation would be even worse in IPv6.

>
> From talking with operators, and with BRAS developers, it does not appear
> that there is any need for additional mechanisms in order to provide
> address enforcement for the first case.  Many BRAS already do that, using
> existing mechanisms.  And because the home is under control of a single
> BRAS, there does not seem to be an interoperability issue.
>
> For tunneling situation, there are two cases:
1) The tunnel service provider and address allocation provider
are separated, which means provider A would offer the basic Internet access
service and assigning IP addresses(either IPv4 or IPv6), while provider B
would offer tunnel service based on the previous one.  In this case,
provider B would not be able to do address authentication and access
control, unless provider A is willing to offer its database to provider B.
2) The tunnel service provider and address allocation provider is a unique
one. In that case, the tunnel service provider can fully control of the
user's original IP address.

Best wishes

Qiong