Re: [DNA] Issue 8: Modify Security Considerations

[JinHyeock Choi <jinchoe@samsung.com>]

Vijay 

Thanks for your feedback. 

> I am not sure I understood the issue. I agree that some secure
> mechanism is need to detect crossing security boundaries before
> a personal firewall is turned off. but why is this tied to SEND?
> I dont see anything in SEND for detecting crossing security
> boundaries.
> 
> it might suffice to say, in the Security Considerations section,
> that a secure mechanism is needed to detect crossing security
> boundaries before taking actions like turning off personal
> firewall and that DNA mechanisms might not be sufficient.

Our line of thoughts are like below.

1. With SEND, we can secure Router Discovery, such as Router 
    Advertisement. 
2. With secured RA messages, we can secure DNA.  
3. With secured DNA mechanisms, a host can safely adjust its 
    security based on which network link it believe it is attached to. 
4. Without secured DNA schemes, it's inadvisable to do so.  

We think that DNA schemes can be used to detect crossing security 
boundaries indirectly and SEND can be used to secure DNA, so the 
connection.  
 
It seems, however, that the phrases need clarification. How about this? 

   Because DNA schemes are based on Neighbor Discovery, its trust models
   and threats are similar to the ones presented in [9].  Nodes
   connected over wireless interfaces may be particularly susceptible to
   jamming, monitoring and packet insertion attacks.

   Use of [7] to secure Neighbor Discovery is important in achieving
   reliable detecting network attachment.  DNA schemes SHOULD
   incorporate the solutions developed in IETF SEND WG if available,
   where assessment indicates such procedures are required.

   With unsecured DNA schemes, it is inadvisable for a host to adjust
   its security based on which network it believes it is attached to.
   For example, it would be inappropriate for a host to disable its
   personal firewall based on the belief that it had connected to a home
   network.

I exchanged the second and the third part with slight modification to clarify 
the paragraphs. Kindly comment on it. 

Thanks for your kind consideration. 

Best Regards

JinHyeock