national security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



While parallel issues start being discussed and better understood at WSIS, we have next week a meeting on Internet national security, sovereignty and innovation capacity.

The interest is not sites nor network protection layers, but nations protection from what happens on or with the networks. This is in line with the White House document http://whitehouse.gov/pcipb with the addition of the risks created by the US (and every other national) cyber security effort, and from not mastering the root. In most of the cases the identified risks root come from a centralized which has to be made distributed.

The target is to analyze if there is an urgent duty of precaution, in considering various scenarios and the way a nation may address them. They range from open conflict with "nsicanntiab" to catastrophic weather situation on the East Coast and black out due to Internet, terrorist attack on the USA, dramatic increase of the spam, war, etc.

Next step will be to identify and to work on a catalog of actions and project to reduce the risks and to protect the users and critical usages of the network in periods of emergency. Some propositions have no technical or remote technical impact. They are mostly the ones aiming at preventing human rooted risks in organizing a stable concerted (European meaning) governance.They range from a web information and services providers and a user network support organizations, the creation of an ITU-I to welcome the higher layers issues for the information society, a universal name system (uninames) and its generalization across network technologies [this would impact on the vernacularisation of e-mail names, IDNA, cultural areas in UDRP, etc.), a co-management of the international parts of the IANA and root file by the ccTLDs, etc.

Some others have technical implications. I would like to quote some suggestions listed in the preparatory document, to get advices I could quote at the meeting or in its report. Also to list the alternative and additional suggestions some might do.

1. a ".dir" emergency virtual TLD. (Directory of direct accesses). This would be a per country Host.txt file documenting critical sites and services. For example "cnn.dir" would route to the IP address of CNN. This file could be easily retrieved at a known IP. Quoting main commercial sites (while permitting its immediate use) would finance its organization.

2. a menu server system permitting to access sites though their IP address only. This would be a good promotion for IPv6 due to the easiness to support IP virtual hosts addresses. As a security oriented alternative to the NSI network unstabilization.

3. national mirrors of http://ns.internic.net . ISPs and corporations would be advised to load the root from these mirrors. In case of collapse of the US Internet, local authorities could patch an updated root in hours, keeping with the current situation. TTL histeresys is probably to be carefully considered.

4. national IANA files, from TLD Managers direct information collection. With a constant mutual consistency check among national copies and ICANN (to avoid the KP&Quest situation).

5. the possibility of a redundant DNS system. Today the Internet has two root files (the same file but presented on two main systems - DNS and FTP). If one is hacked there is not reference. A redundant system would consist in two or more root masters refereeing to different sets of TLD name servers (all of them carrying the same files, but possibly of different origins for security reasons).

6. an evolution towards an international root matrix supporting proximity root servers and proximity TLDs for abbreviated addressing through local TLDs. The organization and the procedure of the common authoritative root matrix should be internationally approved and subject to the ICP-3 proposed testing rules. A quoted example documents the target as "hart.sos" of pacemakers always resolving to the nearest hospital (as decided by local authorities). Local root servers would support teleurbanism and domotic usage. They could be installed at mobile and wi-fi stations.

7. the development of a GPL resolver for every operating systems. It will support both a private root and private TLDs. Private TLDs would be consistent with the RFC 920 and current consensus on schemes. gTLD use 3 letters and above. ccTLD are national and use 2 letters. Private TLD would local and use 1 letter. This would be consistent with the schemes. One letter schemes describe the private local disk space. One letter TLDs describe, at the other end of the URL, the private net space. This will permit everyone to use a family, a local or a community part of the Host.txt existing solution. Example ".h" could be commonly used for home, ".s" for school, ".c" for church and charity help, ".b" for business, ".d" for defense and protection, ".w" for local web and welfare.

8. an IPv6.010 second numbering plan conforming with RFC 2373. This plan will be nationally organized by network types. It would concatenate:
- national ID and network technology ID (internet, telephone, radio, TV, teletex, etc. ) permitting an immediate access to all the available means of communicating of the future NGN.
- a national part numerating the network operators and gateways. This would provide stable routing support as each country might adapt it to geography, administrative security organizations etc.
- a national host numbering scheme. With an immediate identification of any host on any network whatever the location change or connection organized.
This second would also protect IPv6 technology and equipment from a K2 like syndrome when a new plan could be discussed, as it would have permitted to validate the multiple plan possibility.


Thank you for your comments.
jfc









[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]