Subject: new controlled load draft

From: John Wroclawski <[email-masked]>
Date: Wed, 28 May 1997 20:54:38 -0400

Hi, I posted a new controlled-load spec to internet-drafts@ietf; also

ftp://mercury.lcs.mit.edu/pub/intserv/drafts/draft-ietf-intserv-ctrl-load-svc-05.txt

The only change from -04 is the security section, which now says:

   A network element implementing the service described here is
   intentionally and explicitly expected to give preferential treatment
   to selected packet traffic. This memo does not describe the mechanism
   used to indicate which traffic is to receive the preferential
   treatment - rather, the controlled-load service described here may be
   invoked by a number of mechanisms, including RSVP, SNMP network
   management software, or proprietary control software. However, any
   mechanism used to invoke the controlled load service must provide
   security sufficient to guard against use of this preferential
   treatment capability by undesired or unauthorized traffic.

   A correct implementation of the controlled-load service is *not*
   susceptable to a denial-of-service attack based on maliciously
   requesting a very small resource allocation for the attacked traffic
   flow. This is because the service specification requires that traffic
   in excess of the requested level be carried on a best-effort basis,
   rather than being dropped. This requirement is discussed further in
   Section 7 of this memo. [policing]

   Of necessity, giving preferential service to certain traffic flows
   implies giving less service to other traffic flows.  Thus, it is
   possible to conduct a denial of service attack by maliciously
   reconfiguring the controlled-load "admission control algorithm" to
   allow overallocation of available bandwidth or other forwarding
   resources, starving non-controlled-load flows. In general, this is
   unlikely to increase the network's vulnerability to attack, because
   many other reconfigurations of a router or host can cause denial of
   service. It is reasonable to assume that whatever means is used to
   protect against other reconfiguration attacks will be adequate to
   protect against this one as well.

-cheers,
-john