- Nsi-wg - lists.ogf.org

minutes from today's NSI conf call...
by Guy Roberts 11 Dec '14

11 Dec '14

.... is available here: https://redmine.ogf.org/dmsf_files/13381 _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect GEANT Limited Email: guy.roberts(a)dante.net<mailto:guy.roberts@dante.net> Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 GEANT Limited is part of the GÉANT Association Networking. Services. People Learn more at: www.geant.org<http://www.geant.org/> and www.dante.net<http://www.dante.net/> GEANT Limited registered in England & Wales. Registration Number 2806796. Registered Office - City House, 126-130 Hills Road, Cambridge CB2 1PQ _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 10 Dec '14

10 Dec '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 ET, 15:00 GMT, 16:00 CET, 24:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - All to update their progress on NSI documentation - Security and request forwarding (discussion initiated by Henrik on mailing list) - John to update on his work on STPiD update to NSI extensions document. _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect GEANT Limited Email: guy.roberts(a)dante.net<mailto:guy.roberts@dante.net> Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 GEANT Limited is part of the GÉANT Association Networking. Services. People Learn more at: www.geant.org<http://www.geant.org/> and www.dante.net<http://www.dante.net/> GEANT Limited registered in England & Wales. Registration Number 2806796. Registered Office - City House, 126-130 Hills Road, Cambridge CB2 1PQ _____________________________________________________________________

2 1

Security and Request Forwarding
by Henrik Thostrup Jensen 03 Dec '14

03 Dec '14

Hi (this is the first in series of three planned emails on security and pathfinding) I have been thinking about request proxying / forwarding (where request are simply forwarded to another NSA), and I think they form a potentially serious security risk an NSI system. The problem is that when we allow request forwarding it practicallyh impossible to stop a misbehaving NSA making requests as one cannot simply revoke access for that NSA, as the misbehaving NSA can have multiple vectors for making requests. The peers of an NSA, and their peers (and so forth), all have to revoke access for the misbehaving NSA. This requires a very high degree of coordination to do global access revocation within a small timeframe, which just isn't realistic. Consider the following setup (excuse my ascii art): A / \ B C \ / D If D wants to revoke access from A it has to isolate itself by revoking access from B and C. When there is a tighly connected mesh, request forwarding is a very efficient attack vector to attack an NSI system. Only one NSA has to be compromised in order to get full access to the system. That is bad system design. This affects both tree and chain pathfinding: Tree relies on request forwarding in order to setup circuits on networks which is not directly available through control-plane peering. The consequence of disallowing request forwarding would be subpar circuit paths or not being able to setup paths due to reachability problems. Having all networks allow all other networks is not ideal either (but a solution none the less, and makes revocation possible). However that solution does not scale (similar to having all networks connect directly to all other networks). Chain relies on request forwarding to reach the source (or destination) of the circuit. From here on the request is broken up (chained). Chaining could be seen as a form of request forwarding, but unlike tree, endpoint authorization has to be done before the circuit can be setup (committed) end-to-end. This however, assumes that endpoint authZ is mandatory, which is currently not the case. Disallowing request forwarding, would that it might not be possible to setup circuits if the URA does not have a control plane peering with the NSA responsible for the source (or destination) STP. The fundemental problem here is really that we don't have a good security model for transit. BGP has similar conceptual issues, but the source and destination IPs are known, and filters are in place along with limitation such as max prefixes. Currently we don't really have any policies or best practices in place for request forwarding either. Having "blind" forwarding as several NSAs implement it now poses a security as revoking access from a certain NSA is close to impossible (the only effective strategy is to leave the NSI system or split it somehow). I don't have a ready made solution to the issue. Proxy request forwarding has been an integral way in how we think about an NSI system for a long time. I do think the issue is moderately serious, and we should do something about it. In particular, I think we should try to leave the "setup the circuit with all possible means" and instead focussing on providing them in way that is responsible security wise. Best regards, Henrik Henrik Thostrup Jensen <htj at nordu.net> Software Developer, NORDUnet

2 2

no NSI call this Wednesday
by Guy Roberts 03 Dec '14

03 Dec '14

There will be no NSI call this week, next call will be at the usual time on Wednesday 10th Dec. Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect GEANT Limited Email: guy.roberts(a)dante.net<mailto:guy.roberts@dante.net> Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 GEANT Limited is part of the GÉANT Association Networking. Services. People Learn more at: www.geant.org<http://www.geant.org/> and www.dante.net<http://www.dante.net/> GEANT Limited registered in England & Wales. Registration Number 2806796. Registered Office - City House, 126-130 Hills Road, Cambridge CB2 1PQ _____________________________________________________________________

1 0

Minutes from today's NSI conf call
by Guy Roberts 27 Nov '14

27 Nov '14

... are available here: https://redmine.ogf.org/dmsf_files/13378 _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect GEANT Limited Email: guy.roberts(a)dante.net<mailto:guy.roberts@dante.net> Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 GEANT Limited is part of the GÉANT Association Networking. Services. People Learn more at: www.geant.org<http://www.geant.org/> and www.dante.net<http://www.dante.net/> GEANT Limited registered in England & Wales. Registration Number 2806796. Registered Office - City House, 126-130 Hills Road, Cambridge CB2 1PQ _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 26 Nov '14

26 Nov '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 ET, 15:00 GMT, 16:00 CET, 24:00 JST NOTE TIME CHANGE! 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - All to update their progress on NSI documentation - Work objectives for remainder of 2014 - Review STPiD due date _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect GEANT Limited Email: guy.roberts(a)dante.net<mailto:guy.roberts@dante.net> Tel: +44 (0)1223 371316 Mob: +44 (0)7881 336417 GEANT Limited is part of the GÉANT Association Networking. Services. People Learn more at: www.geant.org<http://www.geant.org/> and www.dante.net<http://www.dante.net/> GEANT Limited registered in England & Wales. Registration Number 2806796. Registered Office - City House, 126-130 Hills Road, Cambridge CB2 1PQ _____________________________________________________________________

1 0

Open vSwitch Fall 2014 Conference- Eventbrite
by Sill, Alan 15 Nov '14

15 Nov '14

Perhaps of interest to these groups. Remote dial-in phone-based audio and webex slide streaming is apparently planned - see information at the link below. Topic: Open vSwitch Fall 2014 Conference Monday, November 17, 2014 at 8:00 AM - Tuesday, November 18, 2014 at 5:00 PM (PST) Palo Alto, CA Link: https://www.eventbrite.com/e/open-vswitch-fall-2014-conference-tickets-1316… Alan

1 0

No meeting today
by John MacAuley 12 Nov '14

12 Nov '14

Peoples, Sorry for the short notice, but I found a bunch of email from yesterday in my outbox that were unsent due to a problem with my mail server. Resending from my google account. Thanks, John

1 0

minutes from yesterday's NSI conf call...
by Guy Roberts 06 Nov '14

06 Nov '14

... can be found here: https://redmine.ogf.org/dmsf_files/13371 Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK Office +44 1223 371316 Mobile +44 7881336417 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

NSA Description Document
by John MacAuley 05 Nov '14

05 Nov '14

Peoples, I have an action to close on the definition of the <peersWith> element. I have added a few slides (13-18) to the end of the Uppsala slide pack for discussion. I think it more clearly shows what I was thinking when I wrote the document and implemented in path finding, but I have also included a slide describing what I believe Tomohiro may have asked for. John

1 0