Subject: Re: [Ideas] Comments on draft-ccm-ideas-identity-use-cases-02

From: Tom Herbert <[email-masked]>
Date: Tue, 17 Oct 2017 15:17:44 -0700

> Coming back to the IDEAS work, one of the goals is to create a standardized mapping system with various ID services (mobility, access security, pub/sub,  grouping etc).
> There are various enterprise deployments where these services are needed and the ability to authorize  who can update mapping and who can request mapping is critical for deploying some of  these services.
> For ILA or  for DC VM mobility some of the services may not be needed or Identity is an overhead (but I saw from your responses earlier, you need authorization on who can update in a multi tenenant environments)
and that can be made optional if not needed.  But, I see you are
arguing on both sides.  If you have a better solution to address the
above needs please share it.

Uma,

Authorization of operations on a mapping system is not optional,
however I don't see that this problem is unique to mapping systems nor
something that hasn't already been implemented. There are already many
built out networks that have implemented mapping systems that include
authorization of operations on the system. Google Cloud for instance
operates a huge multi-tenant network and I suspect they use LOAS to
authenticate access to the system since that is already what they use
for everything else anyway. And it makes sense for them to reuse the
authentication system that they are using for all of their other
services; I doubt anything defined IDEAS would change their minds on
authentication of their mapping system.

In my design for ILA, I'm fond of using TLS for communications which
provides both security (encryption) and verifiable identity in
certificates. The X.509 identity can be used to against ACLs to
control read and write access. Like Google, I also intend on using the
same method for other accessing shared critical services in my
network. If this is the same thing as identity being described in
IDEAS then I guess we're on the same page, but from the definitions of
identity being proposed I'm not sure it is equivalent.

Tom

---

From: Uma Chunduri <[email-masked]>
Date: Wed, 18 Oct 2017 16:44:09 +0000

Tom,

	>Google Cloud for instance operates a huge multi-tenant network and I suspect they use LOAS to authenticate access to 

Context here is not where to deploy this but how to make a mapping system where it's applicable for multiple environments (enterprise, DC,  etc..)   with flexibility to work with existing ID/LOC protocols.

	>In my design for ILA, I'm fond of using TLS for communications which provides both security (encryption) and verifiable identity in certificates. The X.509 identity can be used to against ACLs to control read and write access. 

Couple of things:
1. ILA is one of the data planes and lot of issues you raised in this thread applicable there too, IMO. What we thoroughly looked into were the existing IETF approved ID/LOC technologies (HIP & LISP), where there are multiple  immediate use cases
2. I would note -  DC/VM with multi-tenant mobility is only one of the use cases for IDEAS - and AFAIK you contributed a lot from ILA pov.
3. On using TLS/X.509  - we are jumping way ahead of ourselves - we can come back on this if we have *a wg*
4. The above also depends on the type of the device in question too (for low power devices #3 may not be applicable).
5. We also ought to see & learn why EAP-AKA is all over and used for decades in other SDOs (including for non-3GPP access)  and continue to play a significant & expanded role in 5G.

	>If this is the same thing as identity being described in IDEAS then I guess we're on the same page..

After months of discussion on this list on this topic - the above individual pre-pre-wg document was put together to allow structured feedback and to evolve our thinking around what has to be done for various requirements.
Any further feedback is welcome...

--
Uma C.

---

From: Tom Herbert <[email-masked]>
Date: Wed, 18 Oct 2017 10:34:45 -0700

> 1. ILA is one of the data planes and lot of issues you raised in this thread applicable there too, IMO. What we thoroughly looked into were the existing IETF approved ID/LOC technologies (HIP & LIS…

The deployment of HIP and LISP pale in comparison to the deployed uses
of VXLAN, nvgre, ILA, and a few hacked up internal protocols that do
identifier-locator. If I wanted to build something practical and that
scales I'd be more inclined to look at what is being used and what
lessons can be learned.

> 2. I would note -  DC/VM with multi-tenant mobility is only one of the use cases for IDEAS - and AFAIK you contributed a lot from ILA pov.

To be clear, ILA is suitable for both the DC _and_ public wireless
network use cases. We are designing and implementing both for both use
cases.

> 3. On using TLS/X.509  - we are jumping way ahead of ourselves - we can come back on this if we have *a wg*

Sure, but my point is that people may have already have a solution for
this part of the problem. To say that mapping systems today have no
solution to security doesn't seem not correct. As we learned well in
nvo3, the industry doesn't wait for IETF!

> 4. The above also depends on the type of the device in question too (for low power devices #3 may not be applicable).

IMO its unlikely that low powered or end devices would directly access
the mapping system. In both the design for DC and  (likely design) for
wireless mobile networks the infrastructure uses identifier-locator to
implement an overlay network. In the DC case this is consistent with
the nvo3 architecture (i.e. identifier-locator is transparent to VMs).
In the same manner, the mobility in the mobile networks can be
implemented in the infrastructure. This is where some reference
network architecture on what actual and practical deployment would
look like helps.