Deterministic Networking (DetNet) Security Considerations
draft-ietf-detnet-security-05
Internet Engineering Task Force T. Mizrahi
Internet-Draft HUAWEI
Intended status: Informational E. Grossman, Ed.
Expires: March 1, 2020 DOLBY
A. Hacker
MISTIQ
S. Das
Applied Communication Sciences
J. Dowdell
Airbus Defence and Space
H. Austad
Cisco Systems
K. Stanton
INTEL
N. Finn
HUAWEI
August 29, 2019
Deterministic Networking (DetNet) Security Considerations
draft-ietf-detnet-security-05
Abstract
A deterministic network is one that can carry data flows for real-
time applications with extremely low data loss rates and bounded
latency. Deterministic networks have been successfully deployed in
real-time operational technology (OT) applications for some years
(for example [ARINC664P7]). However, such networks are typically
isolated from external access, and thus the security threat from
external attackers is low. IETF Deterministic Networking (DetNet)
specifies a set of technologies that enable creation of deterministic
networks on IP-based networks of potentially wide area (on the scale
of a corporate network) potentially bringing the OT network into
contact with Information Technology (IT) traffic and security threats
that lie outside of a tightly controlled and bounded area (such as
the internals of an aircraft). These DetNet technologies have not
previously been deployed together on a wide area IP-based network,
and thus can present security considerations that may be new to IP-
based wide area network designers. This draft, intended for use by
DetNet network designers, provides insight into these security
considerations. In addition, this draft collects all security-
related statements from the various DetNet drafts (Architecture, Use
Cases, etc) into a single location Section 8.
Mizrahi, et al. Expires March 1, 2020 [Page 1]
Internet-Draft DetNet Security August 2019
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on March 1, 2020.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
2. Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . 6
3. Security Threats . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Threat Model . . . . . . . . . . . . . . . . . . . . . . 6
3.2. Threat Analysis . . . . . . . . . . . . . . . . . . . . . 7
3.2.1. Delay . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2.1.1. Delay Attack . . . . . . . . . . . . . . . . . . 7
3.2.2. DetNet Flow Modification or Spoofing . . . . . . . . 7
3.2.3. Resource Segmentation or Slicing . . . . . . . . . . 8
3.2.3.1. Inter-segment Attack . . . . . . . . . . . . . . 8
Show full document text