Internet DRAFT - draft-chen-secure-routing-requirements

draft-chen-secure-routing-requirements







Internet Engineering Task Force                                Chen, Ed.
Internet-Draft                                                     L. Su
Intended status: Informational                              China Mobile
Expires: 19 May 2024                                    16 November 2023


                The Requirements for Secure Routing Path
               draft-chen-secure-routing-requirements-02

Abstract

   Both ISPs and users have put forward requirements for secure routing,
   the scenarios are analyzed in the draft draft-chen-secure-routing-
   use-cases (https://datatracker.ietf.org/doc/draft-chen-secure-
   routing-use-cases/).  This draft analyzes the functions required to
   implement secure routing.

   Attack detection and users security requirements translateion are out
   of scope.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 19 May 2024.

Copyright Notice

   Copyright (c) 2023 IETF Trust and the persons identified as the
   document authors.  All rights reserved.










Chen & Su                  Expires 19 May 2024                  [Page 1]

Internet-Draft                Requirements                 November 2023


   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Requirements for Secure Routing Path  . . . . . . . . . . . .   3
     2.1.  Appraise node trustworthiness . . . . . . . . . . . . . .   3
     2.2.  Expression of security capability . . . . . . . . . . . .   4
     2.3.  Node security capability collection protocol  . . . . . .   4
     2.4.  Distribution of security policy . . . . . . . . . . . . .   4
     2.5.  Secure path validation  . . . . . . . . . . . . . . . . .   4
   3.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   4

1.  Introduction

   Starting from the requirements of network operators and users, it is
   necessary to take the security attribute as the key factor to select
   the route and transmission path to measure the link transmission
   security.  To achieve this goal, the following contents need to be
   studied.

   1.  Static node security, by appraising the trustworthiness, then it
       can be determined whether the node is secure and whether the node
       has security abilities;

   2.  Dynamic Security, by path scheduling, then it can be determined
       whether the path is secure and whether the path have the
       abilities to anti-cyberattack;

   3.  Close-loop validation, by path validation, then it can check
       whether the selected path and the executed path are consistent;

   Implementing a secure routing path will involve multiple protocols:

   1.  Expression of node security capability and trustworthiness, by
       YANG Model;

   2.  Collect node trust and security factors, and advertise through
       extending the BGP protocol;



Chen & Su                  Expires 19 May 2024                  [Page 2]

Internet-Draft                Requirements                 November 2023


   3.  Collect available status information of security devices and
       resources through network nodes, such as extending BGP-LS;

   4.  Collect JSON messages carrying security resource information
       through the Restful;

   5.  Distribute security policy configuration through the Netconf;

   6.  Distribute traffic forwarding paths through programming, such as
       SRv6;

   7.  Perform consistency verification on paths and security services,
       such as extending the SFC.

                             +-------------------+
                             |Network Programming|
         ------------------->|Controller AND     |
                             |Secure Routing     |
                             +---------+---------+
                                       |
                                       |
                                       |
       +----------------------+--------+---------------+--------------+
       |                      |                        |              |
       |                      |                        |              |
3.Distribute routing policy   |        2.collect node information     |
  with security policy        |          include security capability  |
       |                      |                        |              |
   +---+----+              +--+---+                 +--+---+          |
   |Ingress |              |Node2 |                 |Node1 |       +--+--+
   |Node    |              |IPS   |                 |WAF   |       |Node2|
   +--------+              +------+                 +------+       +-----+
                                       1.YANG Model: expression of
                                         Node security information

2.  Requirements for Secure Routing Path

2.1.  Appraise node trustworthiness

   Evaluate routing nodes, such as whether they are secure boot and the
   security level of the nodes.  By Performing static security
   assessment on routing nodes, can provide a foundation for forming
   trusted or secure paths.  In another draft, the concept of trusted
   path routing in draft-voit-rats-trustworthy-path-routing
   (https://datatracker.ietf.org/doc/draft-voit-rats-trustworthy-path-
   routing/) was mentioned, which addresses the issue of security
   evaluation for node self initiation.




Chen & Su                  Expires 19 May 2024                  [Page 3]

Internet-Draft                Requirements                 November 2023


2.2.  Expression of security capability

   YANG model is used to describe the security capability of nodes, such
   as security service type and remaining capacity.

2.3.  Node security capability collection protocol

   Collect the security capabilities of all nodes in the network, one
   solution is through BGP-LS, draft-chen-idr-bgp-ls-security-capability
   (https://datatracker.ietf.org/doc/draft-chen-idr-bgp-ls-security-
   capability/) extend BGP-LS to carry security capability information.

2.4.  Distribution of security policy

   Security policies can be distributed through extended SRv6 SRH.

2.5.  Secure path validation

   Perform consistency verification on paths and security services, At
   present, this draft-liu-on-network-path-validation
   (https://datatracker.ietf.org/doc/draft-liu-on-network-path-
   validation/) provides ideas for path validation.

3.  IANA Considerations

   This memo includes no request to IANA.

4.  Security Considerations

   TBD

Authors' Addresses

   Meiling Chen (editor)
   China Mobile
   BeiJing
   China
   Email: chenmeiling@chinamobile.com


   Li Su
   China Mobile
   BeiJing
   China
   Email: suli@chinamobile.com






Chen & Su                  Expires 19 May 2024                  [Page 4]