Re: [Last-Call] Review of draft-ietf-detnet-flow-information-model-10

[Balázs Varga A <balazs.a.varga=40ericsson.com@xxxxxxxxxxxxxx>]

Hi Shawn,

 

Many thanks for your review. Draft-ietf-detnet-flow-information-model is an

informational draft and describes only the flow and service information model

for DetNet. The WG is working on the YANG model which will call out the security

implications of attributes, per YANG model guidelines.

(https://datatracker.ietf.org/doc/draft-ietf-detnet-yang/)

 

Thanks for the editorial comments, I will fix them.

 

Thanks & Cheers

Bala’zs

 

 

From: Shawn Emery <shawn.emery@xxxxxxxxx>
Sent: Saturday, September 5, 2020 12:27 AM
To: secdir <secdir@xxxxxxxx>
Cc: last-call@xxxxxxxx; draft-ietf-detnet-flow-information-model.all@xxxxxxxx; Shawn Emery <semery@xxxxxxxx>
Subject: Review of draft-ietf-detnet-flow-information-model-10

 

Reviewer: Shawn M. Emery

Review result: Ready with nits

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This informational draft specifies an information model for Deterministic Networking

(DetNet), specifically for data at the IP/MPLS layer.

 

The security considerations section does exist and recommends confidentiality

for DetNet's external interfaces and that the knowledge of flows and services

associated with customers and network operators could be used by an adversary

to launch attacks against these networks.  The section defers mitigation of said attacks

to the ietf-detnet-security draft and defers to RFC 8655 for DetNet's overall security

considerations.  These documents provide some coverage in regards to the data model

presented in this draft, but unfortunately does not describe how draft specific attributes, e.g.

DnServiceRank could be used as a DoS attack.  Having said this, when the data model does

become a YANG model then DetNet will need to explicitly call out each of these attributes that

have security implications, per YANG model guidelines.

 

General comments:

 

Having the draft-ietf-detnet-security draft is a really good idea to help augment this

and other DetNet drafts.  Having a comprehensive set of threats and how to mitigate

against them provides a good foundation for other authors to think about.

 

Editorial comments:

 

s/can distinguished/can be distinguished/

s/flow using,/flow, using/

s/result data/result in data/

 

Shawn.

--

-- 
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call