Subject: [nmrg] Managing Routing Protocol Security

From: William Atwood <[email-masked]>
Date: Tue, 27 Jan 2015 11:09:42 -0500

Dear participants in NMRG,

As part of an ongoing project on managing security for routing
protocols, my students and I have been developing ways of automating the
management of keys and other security parameters for routers, with an
emphasis on the policies for doing the management, rather than the
actual key-distribution protocols.

We have posted draft-atwood-rtgwg-secure-rtg, and presented it briefly
in Hawaii to rtgwg.  However, it seems likely to us that NMRG is the
right place for this work at this time.  This email is to introduce the
work to the NMRG participants, and to solicit their comments.

So far, we have considered routing from the perspective of four levels:
1 Routing Protocol
      (exchange of routing packets)
2 Keys and Security Protocol
      (how to provide authentication and integrity)
3 Key and Security Association Management
      (how to negotiate the keys that will be used)
4 Configuration Management
      (how to push the parameters for Layer 3 onto the router)

Many routing protocols are defined (level 1).
Many routing protocols have a security option defined in their
specification (level 2).
Some key negotiation protocols have been proposed for the routing
protocol security problem, but no method for conveniently managing them
has been put forth (level 3).
No work has been done (to our knowledge) outside of our group
specifically on configuring security for routing protocols (general
configuration approaches clearly exist) (level 4).

We suspect that there is one more level above this: mapping from
corporate policies to configurations (i.e., going from something that a
middle to senior executive can understand, to an actual security
configuration on a router).

We have outlined an overall framework for security management and for
the interactions among the central controller and the individual
routers.  We have shown the proposed interactions to be secure, using
formal modeling.  Part of this work puts forth the idea of "keying
groups", which encompasses the idea of the scope of a key and,
therefore, the extent of the potential damage if a key is compromised.

We have used the Crypto-Key-Table (CKT) from the KARP Working Group,
defined in RFC 7210.  Based on an idea that was first proposed in a KARP
document, we have defined two additional databases, the Router Security
Parameter Database (RSPD) and the Router Peer Authorization Database
(RPAD).  Together these three databases form our Routing Protocol
Security (RPsec) framework.  While the CKT, RSPD and RPAD have obvious
parallels in the SAD, SPD and PAD of IPsec, the environment in which
RPsec operates is quite different from the environment in which IPsec
operates.

We have defined YANG modules to correspond to the contents of the CKT,
the RSPD and the RPAD.  Version -00 of our draft contains most of the
motivation.  We expect that version -01 will contain details of the
proposed RSPD and RPAD contents, along with the YANG models.

We have outlined (NETCONF-based) procedures for distributing the
configuration data from a central point to the individual routers.
These procedures are intended to be aware of "permitted adjacencies" for
a particular router, although we have not yet worked through the details
of the management of this aspect.

We believe that the use of RPsec will enable no-hands-on management
(after initial configuration of router identities) of routing protocol
security, with configurable key hygiene, independence of a router from
the central controller when re-booting, and centralized control over
permitted adjacencies.

Comments from the community will be most welcome.

Bill Atwood
Nitin Prajapati
Ron Brash
Revathi Bangalore Somanatha

-- 
Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
Department of Computer Science
   and Software Engineering
Concordia University EV 3.185     email:[email-masked]
1455 de Maisonneuve Blvd. West    http://users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8