Deterministic Networking (DetNet) Security Considerations
draft-ietf-detnet-security-06
Internet Engineering Task Force T. Mizrahi
Internet-Draft HUAWEI
Intended status: Informational E. Grossman, Ed.
Expires: May 4, 2020 DOLBY
A. Hacker
MISTIQ
S. Das
Applied Communication Sciences
J. Dowdell
Airbus Defence and Space
H. Austad
SINTEF Digital
N. Finn
HUAWEI
November 1, 2019
Deterministic Networking (DetNet) Security Considerations
draft-ietf-detnet-security-06
Abstract
A deterministic network is one that can carry data flows for real-
time applications with extremely low data loss rates and bounded
latency. Deterministic networks have been successfully deployed in
real-time operational technology (OT) applications for some years.
However, such networks are typically isolated from external access,
and thus the security threat from external attackers is low. IETF
Deterministic Networking (DetNet) specifies a set of technologies
that enable creation of deterministic networks on IP-based networks
of potentially wide area (on the scale of a corporate network)
potentially bringing the OT network into contact with Information
Technology (IT) traffic and security threats that lie outside of a
tightly controlled and bounded area (such as the internals of an
aircraft). These DetNet technologies have not previously been
deployed together on a wide area IP-based network, and thus can
present security considerations that may be new to IP-based wide area
network designers. This draft, intended for use by DetNet network
designers, provides insight into these security considerations. In
addition, this draft collects all security-related statements from
the various DetNet drafts (Architecture, Use Cases, etc) into a
single location Section 8.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Mizrahi, et al. Expires May 4, 2020 [Page 1]
Internet-Draft DetNet Security November 2019
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on May 4, 2020.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . 5
3. Security Threats . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Threat Model . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Threat Analysis . . . . . . . . . . . . . . . . . . . . . 7
3.2.1. Delay . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2.1.1. Delay Attack . . . . . . . . . . . . . . . . . . 7
3.2.2. DetNet Flow Modification or Spoofing . . . . . . . . 7
3.2.3. Resource Segmentation or Slicing . . . . . . . . . . 7
3.2.3.1. Inter-segment Attack . . . . . . . . . . . . . . 8
3.2.4. Packet Replication and Elimination . . . . . . . . . 8
3.2.4.1. Replication: Increased Attack Surface . . . . . . 8
Show full document text