Subject: [saag] APN presentation in SAAG on Thursday.

From: "Pengshuping (Peng Shuping)" <[email-masked]>
Date: Wed, 10 Mar 2021 14:46:39 +0000

Hi Folks,

Thanks to the ADs and the Chairs, we are going to present APN (Application-aware Networking) in the SAAG working group at 13:00-15:00 (UTC+1) Thursday.

APN is focused on developing a framework and set of mechanisms to derive, convey and use an attribute information to allow for the implementation of fine-grain user (group)-, application (group)-, and service-level requirements at the network layer. APN works within a limited trusted domain, which typically is defined as a service provider's limited domain in which MPLS, VXLAN, SR/SRv6 and other tunnel technologies are adopted to provide services.

In the presentation, we would like to introduce the concepts, clarify the scope, attract people to understand and discuss the topic, and collect feedback and suggestions on this work, to further address the main concerns that were raised by the IESG.

For the SECers, we would like to especially know about what the security issues are when the APN attribute is used within a limited operator's controlled domain.

Please find the latest version of the key draft, clarifying the scope and the gap analysis.
https://datatracker.ietf.org/doc/html/draft-peng-apn-scope-gap-analysis-01

We have been discussing in the APN mailing list regarding the various aspects of APN. If you have not subscribed, you are very welcome to subscribe. You can also find the archived discussions.
https://datatracker.ietf.org/wg/apn/about/

More information about APN can be found here.
https://github.com/APN-Community

Best Regards,
Shuping

---

From: Joey S <[email-masked]>
Date: Thu, 11 Mar 2021 07:51:59 -0600

Hi Shuping,

Thank you for the presentation in saag today, a couple of follow up
questions;

What type of user identifying information is included in the
implementation of 'fine-grain user' and 'application' groups?

How is the mapping of '5-tuple to SLA/policy' generated? How
would a CPE treat an application whose 5-tuple information is
not included/defined in the APN attribute?

Thank you,

--
Joey Salazar
Digital Sr. Programme Officer
ARTICLE 19
6E9C 95E5 5BED 9413 5D08 55D5 0A40 4136 0DF0 1A91

On 10-Mar-21 8:46 AM, Pengshuping (Peng
Shuping) wrote:

Hi Folks,

Thanks to the ADs and
the Chairs, we are going to present APN (Application-aware
Networking) in the SAAG working group at 13:00-15:00 (UTC+1)
Thursday.

APN is focused on
developing a framework and set of mechanisms to derive,
convey and use an attribute information to allow for the
implementation of fine-grain user (group)-, application
(group)-, and service-level requirements at the network
layer. APN works within a limited trusted domain, which
typically is defined as a service provider’s limited domain
in which MPLS, VXLAN, SR/SRv6 and other tunnel technologies
are adopted to provide services.

In the presentation, we
would like to introduce the concepts, clarify the scope,
attract people to understand and discuss the topic, and
collect feedback and suggestions on this work, to further
address the main concerns that were raised by the IESG.

For the SECers, we
would like to especially know about what the security
issues are when the APN attribute is used within a limited
operator’s controlled domain.

Please find the latest
version of the key draft, clarifying the scope and the gap
analysis.

We have been discussing
in the APN mailing list regarding the various aspects of
APN. If you have not subscribed, you are very welcome to
subscribe. You can also find the archived discussions.

More information about
APN can be found here.

Best Regards,

Shuping

---

From: "Pengshuping (Peng Shuping)" <[email-masked]>
Date: Thu, 11 Mar 2021 15:18:28 +0000

Hi Joey,

Thank you for your questions. Please find in line below.

From: Joey S [mailto:[email-masked]]
Sent: Thursday, March 11, 2021 9:52 PM
To: Pengshuping (Peng Shuping) <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [Apn] APN presentation in SAAG on Thursday.

Hi Shuping,

Thank you for the presentation in saag today, a couple of follow up questions;

  *   What type of user identifying information is included in the implementation of 'fine-grain user' and 'application' groups?
APN is not about identifying either the particular user or application. It is about applying policies on the differentiated traffic flow based on the APN attribute information in the various nodes/service functions along the path more efficiently. For identifying the user group the access port on the network edge devices could be used by the network operators such as VLAN ID or QinQ.
The attribute is an opaque value and just a bit string against which the policies are applied within the network. No need to say who the user is and what the application is. Those type of information is not useful for the policy enforcement on the network nodes either.

  *   How is the mapping of '5-tuple to SLA/policy' generated?
This mapping can be generated by the configuration or the controller.
How would a CPE treat an application whose 5-tuple information is not included/defined in the APN attribute?
CPE is the network device which tags the APN attribute. On this network edge device, the information already in the packet header such as 5-tuple can be used to generate the APN attribute.
Best regards,
Shuping

Thank you,

--

Joey Salazar

ARTICLE 19

6E9C 95E5 5BED 9413 5D08 55D5 0A40 4136 0DF0 1A91
On 10-Mar-21 8:46 AM, Pengshuping (Peng Shuping) wrote:
Hi Folks,

Best Regards,
Shuping