Host Identification/Address Problem in Service Function Chaining Use Cases
draft-xie-hiaps-hostid-in-sfc-00.txt

Abstract

The purpose of this document is to present host identification problem due to the address and prefix sharing in service function chaining. We have identified this problem in the use cases of the parental control service and offloading service in home networks and also some use cases in mobile networks.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on September 5, 2015.

Copyright Notice

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Conventions and Terminology
• 3. Service Function Execution
• 4. Issue Description
• 4.1. Parental Control Use Case
• 4.2. Traffic Offload Use Case
• 4.3. Port Quota Enforcer Use Case
• 4.4. Mobile Network Use Cases
• 4.5. Home Network Applications Use Cases
• 5. IANA Considerations
• 6. Security Considerations
• 7. Acknowledgements
• 8. References
• 8.1. Normative References
• 8.2. Informative References
• Authors' Addresses

1. Introduction

The use cases described in this document belong to service function chaining (SFC) area [I-D.ietf-sfc-long-lived-flow-use-cases], [I-D.liu-sfc-use-cases], [I-D.ietf-sfc-use-case-mobility]. Service functions like Parental Control, Traffic Offloader, Web Proxy, Load Balancer, etc. can be executed in a chained fashion. The order of execution of each function is controlled by an abstract entity called Service function Forwarder (SFF) [I-D.merged-sfc-architecture]. Each service function is directly connected to an SFF.

Traffic policy control, such as Parental Control Function and Traffic Offloader are commonly used by operators to enable flexible service to the customers. The architecture we assume is shown in Figure 1. It is a typical home network architecture.

Address sharing/host identification issue comes up if the residential gateway (RG) is a NAT box in IPv4 or a single prefix is assigned to the RG in DHCPv6-Prefix Delegation in IPv6 [I-D.boucadair-intarea-host-identifier-scenarios]. Multiple hosts are sharing the same public IPv4 address or single IPv6 prefix.

In a related document, [I-D.boucadair-sfc-design-analysis], the issue of host id or subscriber id being part of Service Function Chaining header is discussed. This discussion is motivated by the same reason as we have in this document: address and prefix sharing in service function chaining.

Some earlier solution approaches to the host identification problem are analysed in [RFC6967]. It is not clear if those approaches can also be used in the service function chaining use cases.

2. Conventions and Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

3. Service Function Execution

We assume a service function chaining architecture similar to [I-D.merged-sfc-architecture]. In its simplified form, possibly suitable in home networks, the service function forwarder is also the ingress router or edge router, e.g. Broadband Network Gateway. In this case parental control function and all other functions are directly connected to SFF. There is an egress router that routes traffic to the edge router, see Figure 1.

Parental control service function is needed to filter the traffic from the Internet for certain content. Home users connect to the Internet after getting their address from RG. In case of NAT at the RG, all outgoing traffic carries the same address for all users, i.e. RG address for its WAN interface. In case RG is assigned a single prefix, all outgoing IPv6 packets contain the same prefix.

Encrypted web traffic (https) represents a very significant part of Web traffic and is likely to become the main or even the only method to carry Web data over the Internet. Service functions MUST be able to decrypt such encrypted traffic, e.g. using Secure Socket Layer (SSL) [SD326]. In case of address sharing/host identification, being able to decrypt encrypted data becomes a requirement in order to be able to access the URL and user information to filter. However this issue is out of scope.

With data services rapidly increasing, the traditional cellular network becomes the bottleneck in providing mobile services mainly because of the increasing bandwidth demand. Operators are trying to offload the data traffic from the mobile subscribers to the broadband network. Traffic offloader service function is needed in the broadband access network for this purpose.

One common broadband access network for offload is home network. Traffic offloader service function decides on each flow/service coming from the hosts at home if they should be routed to the broadband network, i.e. offloaded or they should be sent to the packet data network gateway fo the mobile network.

         +--------+  +---------+  +---------+                     
 Service |Parental|  | Traffic |  |  Other  |                     
 Function|Control |  |Offloader|  |Functions|          ----       
 Chain   +--------+  +---------+  +---------+        /      \     
              |           |             |           |Internet|    
              |           |             |           |        |    
              +-----------+-------------+            \      /     
                          |                            --+-       
    ----   +----+         |              ----            |        
  /      \ |Rout|   +-------------+    /      \   +-------------+ 
 |  Home  || ed |---| Edge Router |---|Network |--|    Router   | 
 | Network|| RG |   +-------------+   |        |  |   (Egress)  | 
  \      / +----+                      \      /   +-------------+ 
    ----                                 ----                     
        

      
                            |      +---(S)Gi-LAN -----------+
                            |      |                        |
                            |      |  +---[SF1]-[SF3]-[SF5]--
                            |      | /                      |
  [UE]---[eNB]===[S-GW]===[P-GW+NAT]------[SF2]-[SF4]-[SF6]--
                            |        \                      |
                            |         +---[SF7]-[SF8]-[SF9]--
                            |