Subject: [MSEC] Case clarifications on group neighborship defined in draft-liu-gdoi-extensions-00.txt

From: Liu Ya <[email-masked]>
Date: Mon, 16 Oct 2006 20:32:37 +0800

Hi all,

Following are some case clarifications on NEIGHBORSHIP-NOTIFY and
GROUPKEY-SHARE exchanges defined in
http://www.ietf.org/internet-drafts/draft-liu-gdoi-extensions-00.txt. 

For a GDOI group, a member may be shortly offline with GCKS for some
reasons, such as rebooting, network route flapping, etc. During that
interval, the GCKS might either create and push new rekeying messages, or do
nothing. When the unlucky member is online again, it does not know what
happened. For assurance, it should contact the GCKS to see whether the group
SAs (including data security SA and Re-key SA) have been updated. If yes, it
must initiate another two-party exchange with the GCKS to download the
latest SAs. In some environments (e.g. OSPF router groups), it is usual that
group members happen to be offline shortly. If the group size is large, the
GCKS would have to expend much computation power and network bandwidth to
deal with members' requests. 

For some GDOI groups like an OSPF router group, a trust and stable group
membership exists. That characteristic can be utilized to alleviate GCKS's
workload: Firstly, group neighborship is established. Then, whenever a group
member is not sure whether its local SAs are in synchronization with GCKS,
it first contacts its neighbors, not GCKS. By this method, the requests from
members to GCKS decrease greatly. The neighborship can be either manually
configured on group members side, or centrally managed at GCKS. If the
second method is used, the neighborship is notified to the involved members
using the NEIGHBORSHIP-NOTIFY Exchange. Another exchange, GROUPKEY-SHARE, is
used by group members to contact its neighbors for latest group SAs. How to
establish the group neighborship is out of the doc's scope, determined by
particular group policy. 

Any comments and questions would be appreciated.

Thanks,
Liu Ya

_______________________________________________
MSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/msec