Re: [DNA] Issue 8: Modify Security Considerations

[Vijay Devarapalli <vijayd@iprg.nokia.com>]

I am not sure I understood the issue. I agree that some secure
mechanism is need to detect crossing security boundaries before
a personal firewall is turned off. but why is this tied to SEND?
I dont see anything in SEND for detecting crossing security
boundaries.

it might suffice to say, in the Security Considerations section,
that a secure mechanism is needed to detect crossing security
boundaries before taking actions like turning off personal
firewall and that DNA mechanisms might not be sufficient.

Vijay

JinHyeock Choi wrote:

> Dear DNA WG 
>  
> This is an attempt to resolve this issue:
> 
> Issue 8 
> Jari Arkko proposed to modify Security Consideration 
>  
>    "You may want to add something like what Bernard wrote in his DNAv4 
>    document about not trusting the DNA procedures to turn on/off your personal 
>     firewall based on "recognizing" your home network."
> 
> Suggested resolution: We propose  to modify Security Considerations as belows. 
>  
>    Because DNA schemes are based on Neighbor Discovery, its trust models
>    and threats are similar to the ones presented in [9].  Nodes
>    connected over wireless interfaces may be particularly susceptible to
>    jamming, monitoring and packet insertion attacks.
> 
>    As a result, when Neighbor Discovery is not secured, it is
>    inadvisable for a host to adjust its security based on which network
>    it believes it is attached to.  For example, it would be
>    inappropriate for a host to disable its personal firewall based on
>    the belief that it had connected to a home network.
> 
>    Use of [7] to secure Neighbor Discovery is important in achieving
>    reliable detecting network attachment.  DNA schemes SHOULD
>    incorporate the solutions developed in IETF SEND WG if available,
>    where assessment indicates such procedures are required.
> 
> * We  add something like what Bernard  wrote in DNAv4 I-D between 
>    "... packet insertion attacks' and 'Use of...'
>  
> Please register your opinion if you have any comments, otherwise 
> we'll update the goals draft accordingly and move it forward.
>  
> Thanks to Greg's kind work, we now have the issue list at 
>  
> http://ctieware.eng.monash.edu.au/twiki/bin/view/DNA/DNAGoals
>  
> Thanks for your kind consideration. 
>  
> Best Regards
>  
> JinHyeock