A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN)

Marin-Lopez, Rafael; López-Millán, Gabriel; Pereñíguez-García, Fernando

doi:10.17487/rfc9061

Cited by 5 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Especially, a first usecase and testbed implementation of I2NSF's main operations is given in [12]. However, I2NSF's scope goes beyond this use case (e.g., IPSec automation [13]). Listing 1: High-level policy example in I2NSF (simplified version), from [12] Listing 1 shows an example of a simplified high-level policy expressing a security requirement: employees cannot access SNS (Social Network Site) during working time.…”

Section: B the I2nsf Frameworkmentioning

confidence: 99%

A Robust Approach for the Detection and Prevention of Conflicts in I2NSF Security Policies

Nguyen

Autrel

Bouabdallah

et al. 2023

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

In order to maintain a sufficient protection level of their infrastructure, automating security management is at the core of current operators issues. The Interface to Network Security Function (I2NSF) is a framework that takes part of the Intent-Based Networking (IBN) paradigm. It consists of automating the translation of high-level policies into low-level configurations of Network Security Functions (NSF) and appears as a promising way to overcome the complexity of this challenging task. However, if the I2NSF framework provides a comprehensive architectural and data model for such an automation, it provides neither detection nor prevention mechanisms against conflicting security requirements. In this paper, we assess to what extent state-of-the-art mechanisms can shift the initial I2NSF proposal toward a robust framework. As such, we extend (1) the reference architecture to integrate some checking components and (2) the consumer-facing data model to enforce separation constraints and partial ordering relationships. By considering a large set of rules and conflicting situations, we evaluate the performance of our solution within an early implementation of I2NSF achieved in an IETF Hackathon.

show abstract

Section: B the I2nsf Frameworkmentioning

confidence: 99%

A Robust Approach for the Detection and Prevention of Conflicts in I2NSF Security Policies

Nguyen

Autrel

Bouabdallah

et al. 2023

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

show abstract

“…The attractive feature of NETCONF is the use of the YANG object model, which is fully extensible with custom adaptations. One of the example applications of NETCONF for a security mechanism configuration is IPsec operations based on NETCONF proposed in RFC 9061 [29]. We propose to structure the configuration options of the security controls with the YANG object model and utilize the NETCONF protocol for advertising capabilities, negotiations, and security configuration of network elements.…”

Section: E2e Security Orchestrationmentioning

confidence: 99%

5G-Enabled Defence-in-Depth for Multi-domain Operations

Kukliński

Szczypiorski

Wrona

et al. 2022

MILCOM 2022 - 2022 IEEE Military Communications Conference (MILCOM)

View full text Add to dashboard Cite

In many civil and military use cases, 5G can be a segment of a more complex end-to-end solution. In such a configuration, properly using the 5G security mechanisms to achieve defence-in-depth and compliance with zero-trust architecture is challenging. In our paper, we discuss the existing 5G security mechanisms related to the connection of trusted and untrusted non-3GPP access networks (wireless and wired), 5G roaming, and the 3GPP approach to support Uncrewed Aerial Services, which provides authentication between the mobile terminal and an external server. The identified use cases show the need and opportunities for reusing 5G security mechanisms beyond the 5G network domain. We discuss the options for end-to-end defencein-depth security provisioning in multi-domain networks, and we present two approaches to providing end-to-end defence-in-depth mechanisms. The first relies on the alignment of security policies in multiple domains and is based on security proxies. The second is based on the multi-domain network slices.

show abstract

“…This work has been adopted by the IETF I2NSF working group and as of this writing, undergoes the evaluation process to become a standard specification. has been recently published as Proposed Standard RFC (RFC 9061) by the IETF [24].…”

Section: Related Workmentioning

confidence: 99%

A Framework for Dynamic Configuration of TLS Connections Based on Standards

et al. 2022

View full text Add to dashboard Cite

The Transport Layer Security (TLS) protocol is widely used for protecting end-to-end communications between network peers (applications or nodes). However, the administrators usually have to configure parameters (e.g., cryptography algorithms or authentication credentials) to establish TLS connections manually. However, this way of managing security connections becomes infeasible when the number of network peers is high. This paper proposes a TLS management framework that configures and manages TLS connections in a dynamic and autonomous manner. The solution is based on well-known standardized protocols and models that allow providing the necessary configuration parameters to establish a TLS connection between two network nodes. Nowadays, this is required in several application scenarios such as virtual private networks, virtualized network functions, or service function chains. Our framework is based on standard elements of the Software Defined Networking paradigm, widely adopted to provide flexibility to network management, such as for the scenarios aforementioned. The proposed framework has been implemented in a proof of concept to validate the suitability of the proposed solution to manage the dynamic configuration of TLS connections. The experimental results confirm that the implementation of this framework enables an operable and flexible procedure to manage TLS connections between network nodes in different scenarios.

show abstract

A YANG Data Model for IPsec Flow Protection Based on Software-Defined Networking (SDN)

Cited by 5 publications

References 0 publications

A Robust Approach for the Detection and Prevention of Conflicts in I2NSF Security Policies

A Robust Approach for the Detection and Prevention of Conflicts in I2NSF Security Policies

5G-Enabled Defence-in-Depth for Multi-domain Operations

A Framework for Dynamic Configuration of TLS Connections Based on Standards

Contact Info

Product

Resources

About