Subject: [ipfix] security requirement for IPFIX protocol

From: "Wang, Cliff" <[email-masked]>
Date: Mon, 7 Jan 2002 01:17:09 -0000

In draft <draft-ietf-ipfix-reqs-00.txt>, Sec 5.3.3. Security
 
   Confidentiallity of transferred IPFIX data SHOULD be ensured.
 
   Integrity of transferred IPFIX data MUST be ensured.
 
   Authenticity of transferred IPFIX data MUST be ensured.

Since we have started on the Architecture doc, I would like to further
discuss the possible transport security solutions.
At this point we potentially have several options:
1) The IPFIX protocol doesn't specify any security mechanism within the
protocol. If security is desired (authentication/encryption/integrity), use
the protection mechanism provided by other IETF WG solutions such as IPsec
or TLS.
2) The IPFIX protocol specify the protection mechanism. Then the question
will be at what level? At the data record level or at the packet level?
Authentication only or encryption as well?

Also Section 8 discusses some security considerations. Client (probe) to
server (collection station) host level mutual authentication has not been
fully discussed. I think this should fit into the WG charter:
"Identify and address any security privacy concerns affecting flow data.
Determine technology for securing the flow information
export data, e.g. TLS. ".
 
What in my mind is that in order to secure IPFIX data, you got to provide
both host security (where data is stored) and transport security (where data
is sent). However, we should only try to provide requirement and use
existing solutions rather than building solutions from ground up.

---

From: [email-masked]
Date: Tue, 08 Jan 2002 10:48:23 -0500

"Wang, Cliff" wrote:
> 1) The IPFIX protocol doesn't specify any security mechanism within
> the protocol. If security is desired
> (authentication/encryption/integrity), use the protection mechanism
> provided by other IETF WG solutions such as IPsec or TLS.
> 2) The IPFIX protocol specify the protection mechanism. Then the
> question will be at what level? At the data record level or at the
> packet level? Authentication only or encryption as well?

	If you look at the Internet draft for LFAP it has an 
	extensive section on security. We could use that as
	a **starting** point. In a nutshell it says use IPsec where
	possible. But also includes a lightweight way to transport
	the data securely via the protocol itself. It also describes
	the various attacks that are intended to be prevented with
	the lightweight version. 
> 
> 
> Also Section 8 discusses some security considerations. Client (probe)
> to server (collection station) host level mutual authentication has
> not been fully discussed. I think this should fit into the WG charter:
> "Identify and address any security privacy concerns affecting flow
> data. Determine technology for securing the flow information
> What in my mind is that in order to secure IPFIX data, you got to
> provide both host security (where data is stored) and transport
> security (where data is sent). However, we should only try to provide
> requirement and use existing solutions rather than building solutions
> from ground up.

	I don't think protection of data stored on the server or
	the client is in our charter. We only need to deal with
	transporting the data securely.

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/