Internet-Draft IBN Network Management July 2023
Park, et al. Expires 11 January 2024 [Page]
Workgroup:
Network Management Research Group
Internet-Draft:
draft-park-nmrg-ibn-network-management-srv6-00
Published:
Intended Status:
Informational
Expires:
Authors:
J. Park, Ed.
ETRI
Y. Choi
ETRI
J. Jeong
Sungkyunkwan University

Intent-Based Network Management in SRv6 network

Abstract

This document describes secure network management in Segment Routing version six (SRv6) network. It proposes a framework empowered with Intent-Based Networking (IBN). The Intent-based Network Management (IBNM) in this document deals with a closed-loop network control, network policy translation, and network management audit. To support these three features, it specifies an architectural framework with system components and interfaces. Also, this framework can support the use cases in SRv6 network.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 11 January 2024.

Table of Contents

1. Introduction

Interface to Network Security Functions (I2NSF) defines a framework and interfaces for interacting with Network Security Functions (NSFs) [RFC8192][RFC8329]. Note that an NSF is defined as software that provides a set of security-related services, such as (i) detecting unwanted activity, (ii) blocking or mitigating the effect of such unwanted activity in order to fulfill service requirements, and (iii) supporting communication stream integrity and confidentiality [RFC8329]. Th e NSF can be implemented as a Virtual Network Function (VNF) in a Network Functions Virtualization (NFV) environment [ETSI-NFV][I-D.ietf-i2nsf-applicability].

The term "intent" is defined as "an abstract, high-level policy used to operate the network" in the context of autonomic networks [RFC7575]. According to this definition, an intent is a specific type of policy provided by a user to provide guidance to the autonomic network that would otherwise operate without human intervention.

Intent-Based Networking (IBN) Management (IBNM) aims to lead towards networks that are fundamentally simpler to manage and operate, requiring only minimal outside intervention. The IBNM supports a closed-loop network control architecture that can adapt to the current status of a target network by collecting and analyzing monitoring data from Network Service Functions (NSFs) of I2NSF framework. NSFs can be either Virtual Network Functions (VNFs) or Physical Network Functions (PNFs) in cloud and edge computing environments.

Segment Routing (SR) [RFC8402] allows a node to steer a packet flow along any path. The headend (i.e., ingress router) is a node where the instructions for source routing (i.e., segments) are written into the packet. It hence becomes the starting node for a specific segment routing path. Intermediate per-path states are eliminated thanks to source routing. [RFC8754] and [RFC8986] describe the same for Segment Routing over IPv6 (SRv6) with the use of the Segment Routing Header (SRH).

Therefore, the instructions for source routing is made by a Segment Routing Policy (SR Policy) [RFC8402]. The SR policy is an ordered list of segments and come from the Intent, which is given by users (i.e., network operators). According to the Intent, IBNM will support several funtionalities.

2. Terminology

This document uses the terminology described in [RFC8329], [I-D.ietf-i2nsf-applicability], [I-D.jeong-i2nsf-security-management-automation], and [I-D.jeong-nmrg-ibn-network-management-automation]. In addition, the following terms are defined below:

   +-------------+                   +-----------------------------+
   |  IBN User   |                   | Global Distributed Database |
   +-------------+                   +-----------------------------+
          ^                                                     ^
          | Consumer-Facing                    Software Update  |
          | Interface                            Interface (Up) |
          v                                                     v
+-------------------+     Registration     +-----------------------+
|   IBN Controller  |<-------------------->|  Vendor's Mgmt System |
+-------------------+      Interface       +-----------------------+
          ^      ^                                            ^
          |      |                  Software Update Interface |
          |      |                                     (Down) |
          |      |   Analytics Interface   +----------------+ |
          |      +------------------------>|  IBN Analyzer  | |
          |                                +----------------+ |
          | NSF-Facing Interface                   ^          |
          |                                        |          |
          |                  +---------------------+          |
          |                  |  Monitoring Interface          |
          |                  |                                |
+---------+------------------+--------------------------------+----+
|         v                  v         SRv6 Nodes             v    |
|  +---------------+  +---------------+         +---------------+  |
|  |     NSF-1     |--|     NSF-2     | ....... |     NSF-n     |  |
|  |(Policy Control|  | (Monitoring   |         | (Application  |  |
|  | Function, PCF)|  |  Function, MF)|         | Function, AF) |  |
|  +---------------+  +---------------+         +---------------+  |
+------------------------------------------------------------------+
Figure 1: Intent based Network Management in SRv6 Network

3. Intent based Network Management in SRv6 Network

This section describes an IBNM framework in SRv6 network. Note that this IBNM Framework is based on the Framework for Interface to Network Security Functions (I2NSF) [RFC8329][I-D.jeong-i2nsf-security-management-automation]. As shown in Figure 1, an IBN User can use network functions by delivering high-level network intents, which specify network requirements that the IBNM User wants to enforce, to the IBN Controller via the Consumer-Facing Interface (CFI).

3.1. Components with IBNM Framework in SRv6 Network

The following are the system components for the IBNM framework in SRv6 network.

  • IBN User: An entity (e.g., End User or Network Operator) that delivers a high-level network policy (including SRv6 policy) to Security Controller. It is assumed that (i) an intent in a natural language (e.g., English) can be translated into a high-level network policy through a Natural Language Processing (called NLP) technique (e.g., Lumi [USENIX-ATC-Lumi]) (ii) an intent as a network service (e.g., self-configuration, optimization, and healing) can be also translated into a high-level network policy.
  • IBN Controller: An entity that controls and manages other system components in the IBNM framework. It translates a high-level network policy into the corresponding low-level network policy and selects appropriate NSFs to execute the network rules of the low-level network policy. And then these NSFs are distributed and enabled into SRv6 nodes according to SRv6 policy (i.e., list of source routing).
  • Vendor's Management System (VMS): An entity that provides an image of of a virtualized NSF for a network service to the IBNM framework, registers the capability and access information of an NSF with IBN Controller, and downloads NSFs into appropriate SRv6 nodes. These downloaded NSFs will be updated dynamically if needed but is controlled by IBN controller. These virtualized NSFs are managed through the cloud-based distribed database.
  • Network Service Function (NSF): An entity that is a Virtual Network Function (called VNF), Physical Network Function (called PNF) and Container Network Function (CNF), which is also called Cloud-native Network Function, for a autonomous network service.
  • IBN Analyzer: An entity that collects monitoring data from NSFs and analyzes such data for checking the activity and performance of the NSFs using machine learning techniques (e.g., Deep Learning [Deep-Learning]). If there is a suspicious network problem (e.g., traffic congestion and QoS degradation) for the target network or NSF, IBN Analyzer delivers a report of the augmentation or generation of network rules to IBN Controller.

For IBN-based network services with Feedback-Based Network Management (FNM), IBN Analyzer is a key component for the IBNM framework [RFC9315] to collect monitoring data from NSFs and analyzing the monitoring data. In here, SRv6 is used to distinguish the monitoring data. Ingress node (i.e., Headend) in SRv6 domain adds monitoring information (e.g., intent and monitoring tag) into SRv6 headers. And then, intermediate nodes monitor and analyze IPv6 packets with monitoring information. The actual implementation of the analysis of monitoring data is out of the scope of this document.

3.2. Interfaces for the IBNM Framework

The following are the interfaces for the IBNM framework. Note that the interfaces can be modeled with YANG [RFC6020] and network policies are delivered through either RESTCONF [RFC8040] or NETCONF [RFC6241]. In addition, REST API [REST] can be supported for those software update interfaces.

  • Consumer-Facing Interface (CFI): An interface between IBN User and IBN Controller for the delivery of a high-level network policy or a intent [I-D.ietf-i2nsf-consumer-facing-interface-dm].
  • NSF-Facing Interface (NFI): An interface between IBN Controller and an NSF for the delivery of a low-level network policy [I-D.ietf-i2nsf-nsf-facing-interface-dm].
  • Registration Interface (RI): An interface between a VMS and IBN Controller for the registration of an NSF's capability and access information with the IBN Controller or the query of an NSF for a required low-level network policy [I-D.ietf-i2nsf-registration-interface-dm].
  • Software Update Interface (Up) (SUI-U): An interface between a VMS and global distribed database for NSF management.
  • Software Update Interface (Down) (SUI-D): An interface between a VMS and a SRv6 node for delivery of a NSF. The NSF is just downloaded and does not work. After the command of IBN Controller through NFI, it works.
  • Monitoring Interface (MI): An interface between an NSF and IBN Analyzer for collecting monitoring data from an NSF to check the activity and performance of an NSF for a possible network problem [I-D.ietf-i2nsf-nsf-monitoring-data-model]. In here, IPv6 packets with monitoring information in SRv6 heeder is only collected.
  • Analytics Interface (AI): An interface between IBN Analyzer and IBN Controller for the delivery of an analytics report of the augmentation or generation of network rules to IBN Controller, which lets IBN Controller apply the report for network rules to its network policy management.

For IBN-based network services with FSM, Analytics Interface is a key interface in the IBNM framework to deliver an analytics report of the augmentation or generation of network rules to IBN Controller through the analysis of the monitoring data from NSFs. For analyzing, user's intent of monitoring information in SRv6 header will compare with just monitoring data from NSFs.

4. Network Policy Translation

To facilitate Network Policy Translation (NPT), IBN Controller needs to have a network policy translator that performs the translation of a high-level network policy into the corresponding low-level network policy. For the automatic NPT services, the IBN framework needs to bridge a high-level YANG data model and a low-level YANG data model in an automatic manner [I-D.yang-i2nsf-security-policy-translation]. Note that a high-level YANG data model is for the IBN Consumer-Facing Interface, and a low-level YANG data model is for the IBN NSF-Facing Interface.

Figure 2 shows automatic mapping of high-level and low-level data models for network policies. Automatic Data Model Mapper takes a high-level YANG data module for the Consumer-Facing Inteface and a low-level YANG data module for the NSF-Facing Interface. It then constructs a mapping table associating the data attributes (or variables) of the high-level YANG data module with the corresponding data attributes (or variables) of the low-level YANG data module. Also, it generates a set of production rules of the grammar for the construction of an XML file of low-level network policy rules.


       High-level YANG Data Module   Low-level YANG Data Model
                   |                              |
                   V                              V
         +---------+------------------------------+---------+
         |             Policy Data Model Mapper             |
         +------------------------+-------------------------+
                                  |
               Mapping Model (Data Model Mapping Table)
                                  |
                                  V
         +--------------------------------------------------+
         |               local NSF Database                 |
         +--------------------------------------------------+
Figure 2: Automatic Mapping of High-level and Low-level Data Models

5. Network Audit System

The IBN framework is weak to both an insider attack and a supply chain attack since it trusts in NSFs provided by VMS and assumes that NSFs work for their network services appropriately [I-D.ietf-i2nsf-applicability].

To detect the malicious activity of either an insider attack by a malicious VMS or a supply chain attack by a compromised VMS, a network audit system is required by the IBN framework. This network audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the IBN framework.

A network audit system has the following four main objectives:

+-----------------------------+                   +----------------+
|           IBN User          |                   |  Vendor's Mgmt |
|                             +------------+      |     System     |
+--------------+--------------+            |      +--------+-------+
               | Consumer-Facing Interface |               |
               |                           |  Remote       |
   High-level Security Policy              |  Attestation  |
               |                           |  Interface    |
               |                           |               |
               V                           |               V
+--------------+--------------+            |     +---------+--------+
|                             |            V     |      Network     |
|        IBN Controller       +------------+---->|       Audit      |
|                             |            ^     |      System      |
+--------------+--------------+            |     +---------+--------+
               |  NSF-Facing Interface     |               ^
               |                           |  Remote       |
   Low-level Security Policy               |  Attestation  |
               |                           |  Interface    |
               V                           |               |
+--------------+--------------+            |      +--------+-------+
|            NSF(s)           +------------+      |  IBN Analyzer  |
|                             +------------------>|                |
+-----------------------------+    Monitoring     +----------------+
                                   Interface
Figure 3: Activity Auditing with Network Audit System

Figure 3 shows activity auditing with a network audit system in the IBN framework. All the components in the IBN framwork report its activities (such as configuration commands and monitoring data) to Network Audit System as transactions through Remote Attestation Interface [I-D.yang-i2nsf-remote-attestation-interface-dm]. The network audit system can analyze the reported activities from the IBN components to detect malicious activities such as an insider attack and a supply chain attack. Note that such a network audit system can be implemented by remote attestation [RFC9334][I-D.yang-i2nsf-remote-attestation-interface-dm] or Blockchain [Bitcoin]. The details of the implementation of the network audit system are out of the scope of this document.

In order to determine a minimum set of controls required to reduce the risks from either an insider attack or a supply chain attack, the network audit system should analyze the activities of all the components in the IBN framework periodically, evaluate possible risks, and take an action to such risks since vulnerabilities and threats may change in different environments over time.

6. IANA Considerations

This document does not require any IANA actions.

7. Security Considerations

The same security considerations for the IBN framework [RFC8329] are applicable to this document.

8. References

8.1. Normative References

[RFC6020]
Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, , <https://www.rfc-editor.org/info/rfc6020>.
[RFC6241]
Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, , <https://www.rfc-editor.org/info/rfc6241>.
[RFC8040]
Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, , <https://www.rfc-editor.org/info/rfc8040>.
[RFC8329]
Lopez, D., Lopez, E., Dunbar, L., Strassner, J., and R. Kumar, "Framework for Interface to Network Security Functions", RFC 8329, DOI 10.17487/RFC8329, , <https://www.rfc-editor.org/info/rfc8329>.
[RFC9315]
Clemm, A., Ciavaglia, L., Granville, L. Z., and J. Tantsura, "Intent-Based Networking - Concepts and Definitions", RFC 9315, DOI 10.17487/RFC9315, , <https://www.rfc-editor.org/info/rfc9315>.
[RFC7575]
Behringer, M., Pritikin, M., Bjarnason, S., Clemm, A., Carpenter, B., Jiang, S., and L. Ciavaglia, "Autonomic Networking: Definitions and Design Goals", RFC 7575, DOI 10.17487/RFC7575, , <https://www.rfc-editor.org/info/rfc7575>.
[RFC8192]
Hares, S., Lopez, D., Zarny, M., Jacquenet, C., Kumar, R., and J. Jeong, "Interface to Network Security Functions (I2NSF): Problem Statement and Use Cases", RFC 8192, DOI 10.17487/RFC8192, , <https://www.rfc-editor.org/info/rfc8192>.
[RFC8402]
Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., Decraene, B., Litkowski, S., and R. Shakir, "Segment Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, , <https://www.rfc-editor.org/info/rfc8402>.
[RFC8754]
Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header (SRH)", RFC 8754, DOI 10.17487/RFC8754, , <https://www.rfc-editor.org/info/rfc8754>.
[RFC8986]
Filsfils, C., Ed., Camarillo, P., Ed., Leddy, J., Voyer, D., Matsushima, S., and Z. Li, "Segment Routing over IPv6 (SRv6) Network Programming", RFC 8986, DOI 10.17487/RFC8986, , <https://www.rfc-editor.org/info/rfc8986>.

8.2. Informative References

[I-D.ietf-i2nsf-consumer-facing-interface-dm]
Jeong, J. P., Chung, C., Ahn, T., Kumar, R., and S. Hares, "I2NSF Consumer-Facing Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-consumer-facing-interface-dm-31, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-consumer-facing-interface-dm-31>.
[I-D.ietf-i2nsf-nsf-facing-interface-dm]
Kim, J. T., Jeong, J. P., Jung-Soo, J., Hares, S., and Q. Lin, "I2NSF Network Security Function-Facing Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-nsf-facing-interface-dm-29, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-facing-interface-dm-29>.
[I-D.ietf-i2nsf-registration-interface-dm]
Hyun, S., Jeong, J. P., Roh, T., Wi, S., and J. Jung-Soo, "I2NSF Registration Interface YANG Data Model for NSF Capability Registration", Work in Progress, Internet-Draft, draft-ietf-i2nsf-registration-interface-dm-26, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-registration-interface-dm-26>.
[I-D.ietf-i2nsf-nsf-monitoring-data-model]
Jeong, J. P., Lingga, P., Hares, S., Xia, L., and H. Birkholz, "I2NSF NSF Monitoring Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-nsf-monitoring-data-model-20, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-monitoring-data-model-20>.
[I-D.ietf-i2nsf-applicability]
Jeong, J. P., Hyun, S., Ahn, T., Hares, S., and D. Lopez, "Applicability of Interfaces to Network Security Functions to Network-Based Security Services", Work in Progress, Internet-Draft, draft-ietf-i2nsf-applicability-18, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-applicability-18>.
[I-D.jeong-i2nsf-security-management-automation]
Jeong, J. P., Lingga, P., Jung-Soo, J., Lopez, D., and S. Hares, "Security Management Automation of Cloud-Based Security Services in I2NSF Framework", Work in Progress, Internet-Draft, draft-jeong-i2nsf-security-management-automation-05, , <https://datatracker.ietf.org/doc/html/draft-jeong-i2nsf-security-management-automation-05>.
[I-D.yang-i2nsf-security-policy-translation]
Jeong, J. P., Lingga, P., Yang, J., and J. Kim, "Guidelines for Security Policy Translation in Interface to Network Security Functions", Work in Progress, Internet-Draft, draft-yang-i2nsf-security-policy-translation-14, , <https://datatracker.ietf.org/doc/html/draft-yang-i2nsf-security-policy-translation-14>.
[RFC9334]
Birkholz, H., Thaler, D., Richardson, M., Smith, N., and W. Pan, "Remote ATtestation procedureS (RATS) Architecture", RFC 9334, DOI 10.17487/RFC9334, , <https://www.rfc-editor.org/info/rfc9334>.
[I-D.yang-i2nsf-remote-attestation-interface-dm]
Yang, P., chenmeiling, Su, L., Lopez, D., Jeong, J. P., and L. Dunbar, "I2NSF Remote Attestation Interface YANG Data Model", Work in Progress, Internet-Draft, draft-yang-i2nsf-remote-attestation-interface-dm-01, , <https://datatracker.ietf.org/doc/html/draft-yang-i2nsf-remote-attestation-interface-dm-01>.
[I-D.jeong-nmrg-ibn-network-management-automation]
Jeong, J. P., Kim, J., Noh, Y., and Y. Kim, "Intent-Based Network Management Automation in 5G Networks", Work in Progress, Internet-Draft, draft-jeong-nmrg-ibn-network-management-automation-01, , <https://datatracker.ietf.org/doc/html/draft-jeong-nmrg-ibn-network-management-automation-01>.
[ETSI-NFV]
"Network Functions Virtualisation (NFV); Architectural Framework", Available: https://www.etsi.org/deliver/etsi_gs/nfv/001_099/002/01.02.01_60/gs_nfv002v010201p.pdf, .
[Bitcoin]
Nakamoto, S., "Bitcoin: A Peer-to-Peer Electronic Cash System", Available: https://bitcoin.org/bitcoin.pdf, .
[USENIX-ATC-Lumi]
Jacobs, A., Pfitscher, R., Ribeiro, R., Ferreira, R., Granville, L., Willinger, W., and S. Rao, "Hey, Lumi! Using Natural Language for Intent-Based Network Management", USENIX Annual Technical Conference, Available: https://www.usenix.org/conference/atc21/presentation/jacobs, .
[REST]
Fielding, R. and R. Taylor, "Principled Design of the Modern Web Architecture", ACM Transactions on Internet Technology, Vol. 2, Issue 2,, Available: https://dl.acm.org/doi/10.1145/514183.514185, .
[Deep-Learning]
Goodfellow, I., Bengio, Y., and A. Courville, "Deep Learning", Publisher: The MIT Press, URL: https://www.deeplearningbook.org/, .

Authors' Addresses

Jungsoo Park (editor)
Electronics and Telecommunications Research Institute
218 Gajeongno, Yuseung-gu
Daejeon
34129
Republic of Korea
Yunchul Choi
Electronics and Telecommunications Research Institute
218 Gajeongno, Yuseung-gu
Daejeon
34129
Republic of Korea
Jaehoon Paul Jeong
Department of Computer Science and Engineering
Sungkyunkwan University
2066 Seobu-Ro, Jangan-Gu
Suwon
Gyeonggi-Do
16419
Republic of Korea