Computing Resource Authenticity Evaluation in Computing-Aware Traffic Steering
Internet-Draft draft-ma-cats-computing-authenticity-evaluation-00
Xiaoting Ma
China Telecom
Beijing
China
maxt3@chinatelecom.cn
Shuai Gao
Beijing Jiaotong University
Beijing
China
shgao@bjtu.edu.cn
Zixuan Lei
Beijing Jiaotong University
Beijing
China
zixuanlei@bjtu.edu.cn
Ziheng Xu
China Telecom
Beijing
China
xuzh24@chinatelecom.cn
6 November 2024
routing
cats
Internet-Draft
This draft introduces an evaluation scheme for computing resource authenticity. The scheme aims to verify and evaluate the authenticity of computing resources in the network using application layer method. This draft describes the basic principle of the scheme and authentication mechanism.
Introduction
Computing resources play an important role in Computing-Aware Traffic Steering. Attackers may publish false computing resources advertisements for profit or malicious purposes, which will cause security issues.
This security issue was also mentioned in [I-D.ietf-cats-usecases-requirements]:
The behavior of the network can be adversely affected by modifying or interfering with advertisements of computing resource availability. Such attacks could deprive users of the services they desire, and might be used to divert traffic to interception points. Therefore,
R23: secure advertisements are REQUIRED to prevent rogue nodes from participating in the network.
Many security requirements are also mentioned in [I-D.wang-cats-security-considerations]. The security mechanism needs to be able to address the anonymity and uniqueness issues of service identification.
In traditional networks, routing information is commonly regarded as a publicly verifiable resource, which can enable rapid detection. However, the false advertisements of computing resource are difficult to detect.
Considering the particularity of CATS work scenarios and requirements, this scheme chooses to use application layer technology to solve this security issue. This scheme proposed in this draft aims to solve this problem by coming up with a bilateral evaluation mechanism in the network. The main steps of this scheme are node registration, task allocation and bilateral evaluation.
The structural design is shown in Figure 1.
Structural Design

                    +---------+               +---------+
                    |  Client |               |  Client |
                    +----+----+               +----+----+
                         |                         |
           +---+---------+---------+-----+---------+---------+---+
           |   | CATS Path Selector|     | CATS Path Selector|   |
           |   +-------------------+     +-------------------+   |
           |                                                     |
           |                                                     |
           |                      Underlay                       |
           |                   Infrastructure                    |
           |                                                     |
           |                                                     |
           |   +-------------------+     +-------------------+   |
           |   | CATS Path Selector|     | CATS Path Selector|   |
           +---+---------+---------+-----+---------+---------+---+
                         |                         |
                +--------+--------+       +--------+--------+
                |  Service site 1 |       |  Service site 2 |
                +-----------------+       +-----------------+

Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
The Definition of Terms
This document makes use of the following terms. The terminology echoes what is in [I-D.ietf-cats-framework]:
Computing-Aware Traffic Steering (CATS): A traffic engineering approach [I-D.ietf-teas-rfc3272bis] that takes into account the dynamic nature of computing resources and network state to optimize service-specific traffic forwarding towards a given service contact instance. Various relevant metrics may be used to enforce such computing-aware traffic steering policies.
Client: An endpoint that is connected to a service provider network.
Service instance: An instance of running resources according to a given service logic. Many such instances can be enabled by a provider. Instances that adhere to the same service logic provide the same service. An instance is typically running in a service site. Clients' requests are serviced by one of these instances.
Service site: A location that hosts the resources that are required to offer a service. A service site may be a node or a set of nodes. A CATS-serviced site is a service site that is connected to a CATS-Forwarder.
CATS Path Selector (C-PS): CATS Path Selectors (C-PSes) use information to select where to forward traffic for a given service request. C-PSes also determine the best paths (possibly using tunnels) to forward traffic, according to various criteria that include network state and traffic congestion conditions. There might be one or more C-PSes used to compute CATS paths in a CATS infrastructure.
Trust Value: a parameter to quantify the trust of clients and service sites.
Node Registration
Client Node Registration
When a client node connects to the network, to protect the privacy of users, the scheme employs a hashing algorithm to generate unique anonymous identity identifiers for each client during the registration process.
When updating task states information, only anonymous identity identifiers are used and the real identity information of clients is not disclosed.
The client node that has completed registration will be assigned an initialized trust value.
Service Site Node Registration
When the service site node connects to the network, in order to verify the computing resources owned by the service site, the service site will be required to complete a set of valid tasks.
After receiving the valid task results from the service site, the computing resources of the service site are validated based on the valid task execution time and the correctness of the computation results.
In order to protect the privacy of service site, this scheme will use a hash algorithm to generate a unique anonymous identity identifier for each verified service site node during the registration process.
The service site node that has completed registration will be assigned an initialized trust value. Afterwards, the service site node can be assigned computing tasks.
Service Instance Allocation
According to client requirements, computing resource information of service sites and trust values, the service instance will be assigned.
The entire process of service instance publishing, allocation, completion, and feedback is recorded, which will be used for resolving business disputes and tracing attacks.
Bilateral Evaluation Mechanism
Bilateral Evaluation
When service site provides feedback on service instance completion, this scheme can verify whether the task has been completed within the specified time interval and obtain service site's evaluation of the client.
After client s receive feedback, they are required to evaluate the service site that completed the service instance.
Following the bilateral evaluation by the client and assuming the service instance was completed on time, the scheme can calculate the trust value of both the client and service site based on that evaluation information.
Data Updating
After each service instance is completed, the scheme will update the trust values of all participating clients and service sites in record.
The magnitude of the trust value will affect service instance allocation priority, motivating clients and service sites to provide highly accurate computing resource information to maximize their rewards.
Unresolved Issues
TBD
Security Considerations
Security Risk
Traffic sniffing: Attackers may use computing resource information to analyze network traffic patterns to infer sensitive information.
Identity impersonation: Attackers may impersonate trusted nodes and launch denial of service or man in the middle attacks.
Information tampering: Attackers may tamper with information in records for malicious purposes such as traffic hijacking.
Response
Encryption: Deploying encryption technology to ensure that only authorized network entities can parse and use this information.
Access control: Deploy access control mechanism, only requests from registered clients and service sites will be responded to by the network.
Identity authentication: Using public key infrastructure and digital signatures for identity authentication.
Integrity protection: Using hash functions, block chain and other methods to ensure the integrity of information.
Monitoring and auditing: Implement monitoring systems to detect and record for tracking and responding to security incidents as they occur.
References
Normative References
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
Informative References
[I-D.ietf-cats-usecases-requirements]

Computing-Aware Traffic Steering (CATS) Problem Statement, Use Cases, and Requirements
Kehan Yao
China Mobile
Dirk Trossen
Huawei Technologies
Luis M. Contreras
Telefonica
Hang Shi
Huawei Technologies
Yizhou Li
Huawei Technologies
Shuai Zhang
China Unicom
Qing An
Alibaba Group
3 July 2024
Internet-Draft draft-ietf-cats-usecases-requirements-03
[I-D.ietf-cats-framework]

A Framework for Computing-Aware Traffic Steering (CATS)
Cheng Li
Huawei Technologies
Zongpeng Du
China Mobile
Mohamed Boucadair
Orange
Luis M. Contreras
Telefonica
John Drake
Juniper Networks, Inc.
17 October 2024
Internet-Draft draft-ietf-cats-framework-04
[I-D.wang-cats-security-considerations]

Security Considerations for Computing-Aware Traffic Steering
Cuicui Wang
China Unicom
Yu Fu
China Unicom
21 October 2024
Internet-Draft draft-wang-cats-security-considerations-01
Acknowledgements
TBD