I2NSF Network Security Function-Facing Interface YANG Data Model
draft-ietf-i2nsf-nsf-facing-interface-dm-18

quot; registry [RFC7950][RFC8525]:

   name: ietf-i2nsf-policy-rule-for-nsf
   namespace: urn:ietf:params:xml:ns:yang:ietf-i2nsf-policy-rule-for-nsf
   prefix: nsfintf
   reference: RFC XXXX

7.  Security Considerations

   The YANG module specified in this document defines a data schema
   designed to be accessed through network management protocols such as
   NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer is
   the secure transport layer, and the required secure transport is
   Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer is HTTPS,
   and the required secure transport is TLS [RFC8446].

   The NETCONF access control model [RFC8341] provides a means of
   restricting access to specific NETCONF or RESTCONF users to a
   preconfigured subset of all available NETCONF or RESTCONF protocol
   operations and content.

   There are a number of data nodes defined in this YANG module that are
   writable/creatable/deletable (i.e., config true, which is the
   default).  These data nodes may be considered sensitive or vulnerable

Kim, et al.               Expires 30 July 2022                 [Page 66]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   in some network environments.  Write operations (e.g., edit-config)
   to these data nodes without proper protection can have a negative
   effect on network operations.  These are the subtrees and data nodes
   and their sensitivity/vulnerability:

   *  ietf-i2nsf-policy-rule-for-nsf: Writing to almost any element of
      this YANG module would directly impact on the configuration of
      NSFs, e.g., completely turning off security monitoring and
      mitigation capabilities; altering the scope of this monitoring and
      mitigation; creating an overwhelming logging volume to overwhelm
      downstream analytics or storage capacity; creating logging
      patterns which are confusing; or rendering useless trained
      statistics or artificial intelligence models.

   Some of the readable data nodes in this YANG module may be considered
   sensitive or vulnerable in some network environments.  It is thus
   important to control read access (e.g., via get, get-config, or
   notification) to these data nodes.  These are the subtrees and data
   nodes and their sensitivity/vulnerability:

   *  ietf-i2nsf-policy-rule-for-nsf: The attacker may gather the
      security policy information of any target NSFs and misuse the
      security policy information for subsequent attacks.

   Policy rules identifying the specified users and user groups can be
   specified with "rules/condition/context/users".  As with other data
   in this YANG module, this user information is provided by the
   Security Controller to the NSFs and is protected via the transport
   and access control mechanisms described above.

8.  Acknowledgments

   This work was supported by Institute of Information & Communications
   Technology Planning & Evaluation (IITP) grant funded by the Korea
   MSIT (Ministry of Science and ICT) (R-20160222-002755, Cloud based
   Security Intelligence Technology Development for the Customized
   Security Service Provisioning).  This work was supported in part by
   the IITP (2020-0-00395, Standard Development of Blockchain based
   Network Management Automation Technology).

9.  Contributors

   This document is made by the group effort of I2NSF working group.
   Many people actively contributed to this document, such as Acee
   Lindem and Roman Danyliw.  The authors sincerely appreciate their
   contributions.

   The following are co-authors of this document:

Kim, et al.               Expires 30 July 2022                 [Page 67]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   Patrick Lingga Department of Electrical and Computer Engineering
   Sungkyunkwan University 2066 Seobu-ro Jangan-gu Suwon, Gyeonggi-do
   16419 Republic of Korea EMail: patricklink@skku.edu

   Hyoungshick Kim Department of Computer Science and Engineering
   Sungkyunkwan University 2066 Seobu-ro Jangan-gu Suwon, Gyeonggi-do
   16419 Republic of Korea EMail: hyoung@skku.edu

   Daeyoung Hyun Department of Computer Science and Engineering
   Sungkyunkwan University 2066 Seobu-ro Jangan-gu Suwon, Gyeonggi-do
   16419 Republic of Korea EMail: dyhyun@skku.edu

   Dongjin Hong Department of Electronic, Electrical and Computer
   Engineering Sungkyunkwan University 2066 Seobu-ro Jangan-gu Suwon,
   Gyeonggi-do 16419 Republic of Korea EMail: dong.jin@skku.edu

   Liang Xia Huawei 101 Software Avenue Nanjing, Jiangsu 210012 China
   EMail: Frank.Xialiang@huawei.com

   Tae-Jin Ahn Korea Telecom 70 Yuseong-Ro, Yuseong-Gu Daejeon, 305-811
   Republic of Korea EMail: taejin.ahn@kt.com

   Se-Hui Lee Korea Telecom 70 Yuseong-Ro, Yuseong-Gu Daejeon, 305-811
   Republic of Korea EMail: sehuilee@kt.com

10.  References

10.1.  Normative References

   [RFC0768]  Postel, J., "User Datagram Protocol", STD 6, RFC 768,
              DOI 10.17487/RFC0768, August 1980,
              <https://www.rfc-editor.org/info/rfc768>.

   [RFC0791]  Postel, J., "Internet Protocol", STD 5, RFC 791,
              DOI 10.17487/RFC0791, September 1981,
              <https://www.rfc-editor.org/info/rfc791>.

   [RFC0792]  Postel, J., "Internet Control Message Protocol", STD 5,
              RFC 792, DOI 10.17487/RFC0792, September 1981,
              <https://www.rfc-editor.org/info/rfc792>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

Kim, et al.               Expires 30 July 2022                 [Page 68]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   [RFC3261]  Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
              A., Peterson, J., Sparks, R., Handley, M., and E.
              Schooler, "SIP: Session Initiation Protocol", RFC 3261,
              DOI 10.17487/RFC3261, June 2002,
              <https://www.rfc-editor.org/info/rfc3261>.

   [RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
              DOI 10.17487/RFC3688, January 2004,
              <https://www.rfc-editor.org/info/rfc3688>.

   [RFC4340]  Kohler, E., Handley, M., and S. Floyd, "Datagram
              Congestion Control Protocol (DCCP)", RFC 4340,
              DOI 10.17487/RFC4340, March 2006,
              <https://www.rfc-editor.org/info/rfc4340>.

   [RFC4443]  Conta, A., Deering, S., and M. Gupta, Ed., "Internet
              Control Message Protocol (ICMPv6) for the Internet
              Protocol Version 6 (IPv6) Specification", STD 89,
              RFC 4443, DOI 10.17487/RFC4443, March 2006,
              <https://www.rfc-editor.org/info/rfc4443>.

   [RFC4960]  Stewart, R., Ed., "Stream Control Transmission Protocol",
              RFC 4960, DOI 10.17487/RFC4960, September 2007,
              <https://www.rfc-editor.org/info/rfc4960>.

   [RFC5595]  Fairhurst, G., "The Datagram Congestion Control Protocol
              (DCCP) Service Codes", RFC 5595, DOI 10.17487/RFC5595,
              September 2009, <https://www.rfc-editor.org/info/rfc5595>.

   [RFC6020]  Bjorklund, M., Ed., "YANG - A Data Modeling Language for
              the Network Configuration Protocol (NETCONF)", RFC 6020,
              DOI 10.17487/RFC6020, October 2010,
              <https://www.rfc-editor.org/info/rfc6020>.

   [RFC6241]  Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
              and A. Bierman, Ed., "Network Configuration Protocol
              (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
              <https://www.rfc-editor.org/info/rfc6241>.

   [RFC6242]  Wasserman, M., "Using the NETCONF Protocol over Secure
              Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
              <https://www.rfc-editor.org/info/rfc6242>.

Kim, et al.               Expires 30 July 2022                 [Page 69]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   [RFC6335]  Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S.
              Cheshire, "Internet Assigned Numbers Authority (IANA)
              Procedures for the Management of the Service Name and
              Transport Protocol Port Number Registry", BCP 165,
              RFC 6335, DOI 10.17487/RFC6335, August 2011,
              <https://www.rfc-editor.org/info/rfc6335>.

   [RFC6991]  Schoenwaelder, J., Ed., "Common YANG Data Types",
              RFC 6991, DOI 10.17487/RFC6991, July 2013,
              <https://www.rfc-editor.org/info/rfc6991>.

   [RFC7950]  Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
              RFC 7950, DOI 10.17487/RFC7950, August 2016,
              <https://www.rfc-editor.org/info/rfc7950>.

   [RFC8040]  Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
              Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
              <https://www.rfc-editor.org/info/rfc8040>.

   [RFC8075]  Castellani, A., Loreto, S., Rahman, A., Fossati, T., and
              E. Dijk, "Guidelines for Mapping Implementations: HTTP to
              the Constrained Application Protocol (CoAP)", RFC 8075,
              DOI 10.17487/RFC8075, February 2017,
              <https://www.rfc-editor.org/info/rfc8075>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8200]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", STD 86, RFC 8200,
              DOI 10.17487/RFC8200, July 2017,
              <https://www.rfc-editor.org/info/rfc8200>.

   [RFC8335]  Bonica, R., Thomas, R., Linkova, J., Lenart, C., and M.
              Boucadair, "PROBE: A Utility for Probing Interfaces",
              RFC 8335, DOI 10.17487/RFC8335, February 2018,
              <https://www.rfc-editor.org/info/rfc8335>.

   [RFC8340]  Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
              BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
              <https://www.rfc-editor.org/info/rfc8340>.

   [RFC8341]  Bierman, A. and M. Bjorklund, "Network Configuration
              Access Control Model", STD 91, RFC 8341,
              DOI 10.17487/RFC8341, March 2018,
              <https://www.rfc-editor.org/info/rfc8341>.

Kim, et al.               Expires 30 July 2022                 [Page 70]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   [RFC8407]  Bierman, A., "Guidelines for Authors and Reviewers of
              Documents Containing YANG Data Models", BCP 216, RFC 8407,
              DOI 10.17487/RFC8407, October 2018,
              <https://www.rfc-editor.org/info/rfc8407>.

   [RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
              Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
              <https://www.rfc-editor.org/info/rfc8446>.

   [RFC8519]  Jethanandani, M., Agarwal, S., Huang, L., and D. Blair,
              "YANG Data Model for Network Access Control Lists (ACLs)",
              RFC 8519, DOI 10.17487/RFC8519, March 2019,
              <https://www.rfc-editor.org/info/rfc8519>.

   [RFC8525]  Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
              and R. Wilton, "YANG Library", RFC 8525,
              DOI 10.17487/RFC8525, March 2019,
              <https://www.rfc-editor.org/info/rfc8525>.

   [I-D.ietf-tcpm-rfc793bis]
              Eddy, W. M., "Transmission Control Protocol (TCP)
              Specification", Work in Progress, Internet-Draft, draft-
              ietf-tcpm-rfc793bis-25, 7 September 2021,
              <https://www.ietf.org/archive/id/draft-ietf-tcpm-
              rfc793bis-25.txt>.

   [I-D.ietf-i2nsf-capability-data-model]
              Hares, S., Jeong, J. (., Kim, J. (., Moskowitz, R., and Q.
              Lin, "I2NSF Capability YANG Data Model", Work in Progress,
              Internet-Draft, draft-ietf-i2nsf-capability-data-model-22,
              22 January 2022, <https://www.ietf.org/archive/id/draft-
              ietf-i2nsf-capability-data-model-22.txt>.

   [I-D.ietf-i2nsf-nsf-monitoring-data-model]
              Jeong, J. (., Lingga, P., Hares, S., Xia, L. (., and H.
              Birkholz, "I2NSF NSF Monitoring Interface YANG Data
              Model", Work in Progress, Internet-Draft, draft-ietf-
              i2nsf-nsf-monitoring-data-model-12, 17 November 2021,
              <https://www.ietf.org/archive/id/draft-ietf-i2nsf-nsf-
              monitoring-data-model-12.txt>.

   [I-D.ietf-netmod-geo-location]
              Hopps, C., "A YANG Grouping for Geographic Locations",
              Work in Progress, Internet-Draft, draft-ietf-netmod-geo-
              location-11, 24 October 2021,
              <https://www.ietf.org/archive/id/draft-ietf-netmod-geo-
              location-11.txt>.

Kim, et al.               Expires 30 July 2022                 [Page 71]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

10.2.  Informative References

   [RFC4732]  Handley, M., Ed., Rescorla, E., Ed., and IAB, "Internet
              Denial-of-Service Considerations", RFC 4732,
              DOI 10.17487/RFC4732, December 2006,
              <https://www.rfc-editor.org/info/rfc4732>.

   [RFC4987]  Eddy, W., "TCP SYN Flooding Attacks and Common
              Mitigations", RFC 4987, DOI 10.17487/RFC4987, August 2007,
              <https://www.rfc-editor.org/info/rfc4987>.

   [RFC8329]  Lopez, D., Lopez, E., Dunbar, L., Strassner, J., and R.
              Kumar, "Framework for Interface to Network Security
              Functions", RFC 8329, DOI 10.17487/RFC8329, February 2018,
              <https://www.rfc-editor.org/info/rfc8329>.

   [I-D.ietf-i2nsf-consumer-facing-interface-dm]
              Jeong, J. (., Chung, C., Ahn, T., Kumar, R., and S. Hares,
              "I2NSF Consumer-Facing Interface YANG Data Model", Work in
              Progress, Internet-Draft, draft-ietf-i2nsf-consumer-
              facing-interface-dm-15, 15 September 2021,
              <https://www.ietf.org/archive/id/draft-ietf-i2nsf-
              consumer-facing-interface-dm-15.txt>.

   [ISO-3166] "Codes for the representation of names of countries and
              their subdivisions", ISO 3166, September 2018,
              <https://www.iso.org/iso-3166-country-codes.html>.

   [IEEE-802.3]
              Institute of Electrical and Electronics Engineers, "IEEE
              Standard for Ethernet", 2018,
              <https://ieeexplore.ieee.org/document/8457469/>.

Authors' Addresses

   Jinyong (Tim) Kim (editor)
   Department of Electronic, Electrical and Computer Engineering
   Sungkyunkwan University
   2066 Seobu-Ro, Jangan-Gu
   Suwon
   Gyeonggi-Do
   16419
   Republic of Korea

   Phone: +82 10 8273 0930
   Email: timkim@skku.edu

Kim, et al.               Expires 30 July 2022                 [Page 72]
Internet-Draft    NSF-Facing Interface YANG Data Model      January 2022

   Jaehoon (Paul) Jeong (editor)
   Department of Computer Science and Engineering
   Sungkyunkwan University
   2066 Seobu-Ro, Jangan-Gu
   Suwon
   Gyeonggi-Do
   16419
   Republic of Korea

   Phone: +82 31 299 4957
   Email: pauljeong@skku.edu
   URI:   http://iotlab.skku.edu/people-jaehoon-jeong.php

   Jung-Soo Park
   Electronics and Telecommunications Research Institute
   218 Gajeong-Ro, Yuseong-Gu
   Daejeon
   34129
   Republic of Korea

   Phone: +82 42 860 6514
   Email: pjs@etri.re.kr

   Susan Hares
   Huawei
   7453 Hickory Hill
   Saline, MI 48176
   United States of America

   Phone: +1-734-604-0332
   Email: shares@ndzh.com

   Qiushi Lin
   Huawei
   Huawei Industrial Base
   Shenzhen
   Guangdong 518129,
   China

   Email: linqiushi@huawei.com

Kim, et al.               Expires 30 July 2022                 [Page 73]