Internet-Draft Requirements November 2023
Chen & Su Expires 19 May 2024 [Page]
Workgroup:
Internet Engineering Task Force
Internet-Draft:
draft-chen-secure-routing-requirements-02
Published:
Intended Status:
Informational
Expires:
Authors:
Chen, Ed.
China Mobile
L. Su
China Mobile

The Requirements for Secure Routing Path

Abstract

Both ISPs and users have put forward requirements for secure routing, the scenarios are analyzed in the draft draft-chen-secure-routing-use-cases. This draft analyzes the functions required to implement secure routing.

Attack detection and users security requirements translateion are out of scope.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 19 May 2024.

1. Introduction

Starting from the requirements of network operators and users, it is necessary to take the security attribute as the key factor to select the route and transmission path to measure the link transmission security. To achieve this goal, the following contents need to be studied.

  1. Static node security, by appraising the trustworthiness, then it can be determined whether the node is secure and whether the node has security abilities;

  2. Dynamic Security, by path scheduling, then it can be determined whether the path is secure and whether the path have the abilities to anti-cyberattack;

  3. Close-loop validation, by path validation, then it can check whether the selected path and the executed path are consistent;

Implementing a secure routing path will involve multiple protocols:

  1. Expression of node security capability and trustworthiness, by YANG Model;

  2. Collect node trust and security factors, and advertise through extending the BGP protocol;

  3. Collect available status information of security devices and resources through network nodes, such as extending BGP-LS;

  4. Collect JSON messages carrying security resource information through the Restful;

  5. Distribute security policy configuration through the Netconf;

  6. Distribute traffic forwarding paths through programming, such as SRv6;

  7. Perform consistency verification on paths and security services, such as extending the SFC.

                             +-------------------+
                             |Network Programming|
         ------------------->|Controller AND     |
                             |Secure Routing     |
                             +---------+---------+
                                       |
                                       |
                                       |
       +----------------------+--------+---------------+--------------+
       |                      |                        |              |
       |                      |                        |              |
3.Distribute routing policy   |        2.collect node information     |
  with security policy        |          include security capability  |
       |                      |                        |              |
   +---+----+              +--+---+                 +--+---+          |
   |Ingress |              |Node2 |                 |Node1 |       +--+--+
   |Node    |              |IPS   |                 |WAF   |       |Node2|
   +--------+              +------+                 +------+       +-----+
                                       1.YANG Model: expression of
                                         Node security information

2. Requirements for Secure Routing Path

2.1. Appraise node trustworthiness

Evaluate routing nodes, such as whether they are secure boot and the security level of the nodes. By Performing static security assessment on routing nodes, can provide a foundation for forming trusted or secure paths. In another draft, the concept of trusted path routing in draft-voit-rats-trustworthy-path-routing was mentioned, which addresses the issue of security evaluation for node self initiation.

2.2. Expression of security capability

YANG model is used to describe the security capability of nodes, such as security service type and remaining capacity.

2.3. Node security capability collection protocol

Collect the security capabilities of all nodes in the network, one solution is through BGP-LS, draft-chen-idr-bgp-ls-security-capability extend BGP-LS to carry security capability information.

2.4. Distribution of security policy

Security policies can be distributed through extended SRv6 SRH.

2.5. Secure path validation

Perform consistency verification on paths and security services, At present, this draft-liu-on-network-path-validation provides ideas for path validation.

3. IANA Considerations

This memo includes no request to IANA.

Authors' Addresses

Meiling Chen (editor)
China Mobile
BeiJing
China
Li Su
China Mobile
BeiJing
China