The Use Cases for Secure Routing

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 7 September 2023.¶

Copyright Notice

Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

With the frequent occurrence of network security events, users' demand for network security is increasingly strong, there is no doubt that multi-level security is needed to ensure the security of users. The current security risk mainly comes from attacks, users need security services to ensure the normal use of business.¶

Some companies build security centers by themselves, some buy third-party cloud security services, and some hope that ISPs can provide security services by secure routing. Security routing provided by ISPs can be implemented which can guide traffic through security devices. With the development of programmable network and SRv6 technology, the forwarding requirements of the upper layer can be completed through routing programming; Accessibility and security in the routing process can be processed synchronously to provide users with secure routing.¶

In addition to special security equipment, network devices are also updating and integrated security functions to cope with complex security environments, such as routers with anti DDoS attack functions, the switch has detection (IDS) function and firewall function.¶

2. Analysis of security requirements

For ISPs, the user's credibility is different, it is necessary to strategy path from the security protection of the basic network.¶

For users, different users have different security requirements which depend on their business. For example, e-commerce and Internet companies focus on phishing prevention, anti-DDoS attacks, and data security; Medical companies focus on data security and security isolation, and so on. In a word, users have differentiated security requirements.¶

3. Security and network convergence

If security functions and network functions are highly integrated, security can be as flexible as network connection. Optimize existing routing protocols to obtain information about security devices in the network, security routing can be realized by taking into account the security policy when routing strategy. The following figure describes the relationship between the controller and network devices and security devices.¶

                 +-----------+
                 |    IP     |
                 |programming|
                 | controller|
                 +-----x-----+
                       x
                       x
     xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
     x                                  x
     x            +---------+           x
 +---x----+       |security |       +---x----+
 | router +-------+ device  +-------+ router |
 +---+----+       +---------+       +--------+
     |
+----+----+
|security |
| device  |
+---------+

Figure 1: Secure routing model

4. Secure Routing Use Cases

Two use cases are described below.¶

1. Strategy routing path ensure basic network security, and network node security evaluation ensures the security of the transmission node itself;¶
2. Differentiated security path to meet user requirements.¶

            +-------------+
            |  Controller |
            +------+------+
           appraise|trustworthiness
    +--------------+---------------+
    |              |               |
+---+----+     +---+---+      +----+---+
| Node1  +-----+ Node2 +------+ Node3  |
+--------+     +-------+      +--------+

Figure 2: Node security appraisement

                  Ingress
                                 +---------+
+--------+  1    +------+   5    |   Key   |  6  +------+
| User A +------>| Node1+-------->  Node3  +-----+ Node5|
+--------+       +---+--+        +----+----+     +---+--+
                     |                |              |
                     |                |              |
                     | 2              |7             |8
                     |                |              |
                     |                |              |
                     |                |              |
                 +---+--+     3   +---v--+    4  +---+--+
                 | Node2+---------+ Node4+-------> Node6+---->
                 +------+         +------+       +------+
                                                  Egress

            Figure 3: Key network node protection

                  Ingress
                                 +---------+
+--------+  1    +------+   5    | Node3   |  6  +------+
| User A +------>| Node1+-------->Anti-ddos+-----+ Node5|
+--------+       +---+--+        +----+----+     +---+--+
                     |                |              |
                     |                |              |
                     | 2              |7             |8
                     |                |              |
                     |                |              |
                     |                |              |
                 +---+--+     3   +---v--+    4  +---+--+
                 | Node2+---------+ Node4+-------> Node6+---->
                 | WAF  |         | IPS  |       +------+
                 +------+         +------+        Egress

           Figure 4: User require anti-ddos and IPS service

5. IANA Considerations

This memo includes no request to IANA.¶

6. Security Considerations

TBD¶

Authors' Addresses