Security Considerations for Computing-Aware Traffic Steering
Internet-Draft draft-wang-cats-security-considerations-01
Cuicui Wang
China Unicom
Beijing
China
wangcc107@chinaunicom.cn
Yu Fu
China Unicom
Beijing
China
fuy186@chinaunicom.cn
21 October 2024
routing
cats
Internet-Draft
Computing-Aware Traffic Steering (CATS) inherits potential security vulnerabilities from the network, computing nodes as well as workflows of CATS procedures. This document describes various threats and security concerns related to CATS and existing approaches to solve these threats.
Introduction
The CATS framework is an ingress-based overlay framework for the selection of the suitable service instance(s) from a set of instance candidates. By taking into account both networking and computing metrics, the CATS framework achieve a global of dispatching service demands over the various and available edge computing resources. However, ubiquitous distributed computing resources in CATS also pose challenges to security protection. The operators of CATS may not have complete control over the nodes and therefore guarantee the security and credibility of the computing nodes themselves. Moreover, there are great differences in the security capabilities provided by computing nodes in the network, which greatly improves the breadth and difficulty of security protection.
This document describes various threats and security concerns related to CATS networks and existing approaches to solve these threats.
Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
Terminology
This document makes use of the following terms:
Computing-Aware Traffic Steering (CATS): A traffic engineering approach [I-D ietf-teas-rfc3272bis] that takes into account the dynamic nature of computing resources and network state to optimize service-specific traffic forwarding towards a given service instance. Various relevant metrics may be used to enforce such computing-aware traffic steering policies. [I-D.ldbc-cats-framework]
CATS Service ID (CS-ID): An identifier representing a service, which the clients use to access it.
Service: An offering provided by a service provider and which is delivered using one or more service functions [RFC7665].
CATS Service Metric Agent (C-SMA): An agent that is responsible for collecting service capabilities and status, and for reporting them to a CATS Path Selector (C-PS).
Service request: The request for a specific service instance.
Security Issues of The Computing Resource
The ubiquitous and flexible characterictics of computing resource and the frequent connections to the computing resource will lead to the increasing risks of resource attacks. At the same time, network attack patterns are constantly iterating and upgrading, which will also increases the probability of computing resources being attacked. Therefore security solutions of CATS must support identity authentication and access control against these attacks. Identity authentication is required for clients of CATS. Zero trust is the preferred approach to meet this demand. Besides, security monitoring and auditing of computing resources should be carried out using technologies such as security log management and intrusion detection to monitor the security status of computing resources.
Computing Path Selector Security Issues
The operation of a C-PS could be damaged through a variety of denial-of-service attacks. Such attacks can cause the C-PS to become congested with the result that traffic forwarding are too slowly . In extreme cases, it may be that service requests are not satisfied. C-PS could be the target of the following attacks [RFC5440]:
- interception of C-PS service requests or responses;
- impersonation of C-PS;
- falsification of computing service information, policy information, or C-PS capabilities; and
- denial-of-service attacks on C-PS communication mechanisms.
Additionally, snooping of C-PS requests and responses may give an attacker information about the operation of the network. Simply by viewing the C-PS messages someone can know where traffic is being routed, thereby making the network susceptible to targeted attacks. It is expected that C-PS solutions will address these issues in detail using authentication and security techniques.
Computing Service Announcement Security Issues
A computing service is associated with a unique identifier called a CS-ID. The CS-ID should keep confidentiality of the service, for example, using an IP address as the CS-ID may expose the location of the edge node. The mapping of CS-IDs to network identifiers may be learned through a NRS(Name Resolution Service), such as DNS, so it is important for the NRS to support access control for certain name mapping records, and authentication of the computing service that want to be registered with the NRS must be required so that only authenticated entities can store and update name mapping records. Besides, the NRS should be resilient against denial-of- service attacks and other common attacks.
Metrics Distribution Security Issues
The C-SMA aggregates both service-related capabilities and then advertises the CS-IDs along with the metrics to be received by all C-PS in the network. The service metrics include computing-related metrics and potentially other service-specific metrics like the number of end-users who access the service instance at any given time, their location, etc. Therefore, verification mechanism is needed for both C-SMA and C-PS to ensure the authenticity and integrity of the infomation they received.
The information distributed by the C-SMA and C-NMA may be sensitive. Such information could indeed disclose intel about the network and the location of computing resources hosted in edge sites. Furthermore, such information may be modified by an attacker resulting in disrupted service delivery for the clients, including misdirection of traffic to an attacker's service implementation.
The computing resource information changes over time very frequently, especially with the creation and termination of service instances. When such an information is carried in a routing protocol, too many updates may affect network stability. This issue could be exploited by an attacker (e.g. by spawning and deleting service instances very rapidly). CATS solutions must support guards against such misbehaviors. For example, these solutions should support aggregation techniques, dampening mechanisms, and threshold triggered distribution updates.
Security-related Metrics
The service and network metrics could include the security-related capabilities which could be used by the CATS Path selector to compute paths with security guarantee.
The security capabilities of nodes could be one of the metrics for C-PS to computing the traffic forwarding path and form a secure routing path. And C-PS will fetch the real-time awareness of the security capabilities available in the network and computing services and finally provide security protection for users. Clients with high security requirements could choose the service with desired security attributes and achieve dependable forwarding on top of only devices that satisfies certain trust requirements, which will avoid the risks of traffic eavesdropping, sensitive data leakage etc.
Security Considerations
The security considerations of CATS are presented throughout this document. .
IANA Considerations
This document has no IANA actions.
References
Normative References
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
[RFC5440]

Path Computation Element (PCE) Communication Protocol (PCEP)
JP. Vasseur, Ed.
JL. Le Roux, Ed.
March 2009
RFC 5440
DOI 10.17487/RFC5440
Informative References
[I-D.ldbc-cats-framework]

A Framework for Computing-Aware Traffic Steering (CATS)
Cheng Li
Huawei Technologies
Zongpeng Du
China Mobile
Mohamed Boucadair
Orange
Luis M. Contreras
Telefonica
John Drake
Juniper Networks, Inc.
8 February 2024
Internet-Draft draft-ldbc-cats-framework-06
[RFC7665]

Service Function Chaining (SFC) Architecture
J. Halpern, Ed.
C. Pignataro, Ed.
October 2015
RFC 7665
DOI 10.17487/RFC7665
Acknowledgements
TBD