Internet DRAFT - draft-park-nmrg-ibn-network-management-srv6
draft-park-nmrg-ibn-network-management-srv6
Network Management Research Group J. Park, Ed.
Internet-Draft Y. Choi
Intended status: Informational ETRI
Expires: 10 May 2024 J. Jeong
Sungkyunkwan University
7 November 2023
Intent-Based Network Management in SRv6 network
draft-park-nmrg-ibn-network-management-srv6-01
Abstract
This document describes secure network management in Segment Routing
version six (SRv6) network. It proposes a framework empowered with
Intent-Based Networking (IBN). The Intent-based Network Management
(IBNM) in this document specifies an architectural framework with
system components and interfaces. Also, this framework builds on
Interface to Network Security Functions(I2NSF).
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 10 May 2024.
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.
Park, et al. Expires 10 May 2024 [Page 1]
Internet-Draft IBN Network Management November 2023
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Intent based Network Management in SRv6 Network . . . . . . . 4
3.1. Components with IBNM Framework in SRv6 Network . . . . . 5
3.2. Interfaces for the IBNM Framework . . . . . . . . . . . . 6
4. Network Policy Translation . . . . . . . . . . . . . . . . . 7
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
6. Security Considerations . . . . . . . . . . . . . . . . . . . 7
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
7.1. Normative References . . . . . . . . . . . . . . . . . . 7
7.2. Informative References . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11
1. Introduction
Interface to Network Security Functions (I2NSF) defines a framework
and interfaces for interacting with Network Security Functions (NSFs)
[RFC8192][RFC8329]. Note that an NSF is defined as software that
provides a set of security-related services, such as (i) detecting
unwanted activity, (ii) blocking or mitigating the effect of such
unwanted activity in order to fulfill service requirements, and (iii)
supporting communication stream integrity and confidentiality
[RFC8329]. Th e NSF can be implemented as a Virtual Network Function
(VNF) in a Network Functions Virtualization (NFV) environment
[ETSI-NFV][I-D.ietf-i2nsf-applicability].
The term "intent" is defined as "an abstract, high-level policy used
to operate the network" in the context of autonomic networks
[RFC7575]. According to this definition, an intent is a specific
type of policy provided by a user to provide guidance to the
autonomic network that would otherwise operate without human
intervention.
Intent-Based Networking (IBN) Management (IBNM) aims to lead towards
networks that are fundamentally simpler to manage and operate,
requiring only minimal outside intervention. The IBNM supports a
closed-loop network control architecture that can adapt to the
Park, et al. Expires 10 May 2024 [Page 2]
Internet-Draft IBN Network Management November 2023
current status of a target network by collecting and analyzing
monitoring data from Network Service Functions (NSFs) of I2NSF
framework. NSFs can be either Virtual Network Functions (VNFs) or
Physical Network Functions (PNFs) in cloud and edge computing
environments.
Segment Routing (SR) [RFC8402] allows a node to steer a packet flow
along any path. The headend (i.e., ingress router) is a node where
the instructions for source routing (i.e., segments) are written into
the packet. It hence becomes the starting node for a specific
segment routing path. Intermediate per-path states are eliminated
thanks to source routing. [RFC8754] and [RFC8986] describe the same
for Segment Routing over IPv6 (SRv6) with the use of the Segment
Routing Header (SRH).
Therefore, the instructions for source routing is made by a Segment
Routing Policy (SR Policy) [RFC8402]. The SR policy is an ordered
list of segments and come from the Intent, which is given by users
(i.e., network operators). According to the Intent, IBNM will
support several funtionalities.
2. Terminology
This document uses the terminology described in [RFC8329],
[I-D.ietf-i2nsf-applicability],
[I-D.jeong-i2nsf-security-management-automation], and
[I-D.jeong-nmrg-ibn-network-management-automation]. In addition, the
following terms are defined below:
* Autonomous Network Management (ANM): It means that an intent from
a user (or administrator or network operator) is well-enforced in
a target SRv6 network. The intent can be aligned with high-level
network policy and then high-level network policy can be
translated into the corresponding low-level network policy
(including SRv6 Policy) by a network policy translator and
dispatched to appropriate NSFs. Through the monitoring of the
NSFs, the activity and performace of the NSFs is monitored and
analyzed whether or not NSFs are operating well according to the
intent of the users. If needed, the network rules of the low-
level network and SRv6 policy are augmented or new network rules
are generated and configured to appropriate NSFs.
* Network Policy Translation (NPT): It means that a high-level
network policy is translated to a low-level network policy
(including SRv6 policy) that can be understood and configured by
an NSF for autonomous network services, such as self-
configuration, self-optimization, self-healing, and self-
protection.
Park, et al. Expires 10 May 2024 [Page 3]
Internet-Draft IBN Network Management November 2023
* Feedback-Based Network Management (FNM): It means that a network
service in SRv6 network is evolved by updating a network policy
(i.e., a set of network rules) and adding new network rules for
resolving network problems, which were detected by monitoring and
analzing data from NSFs.
+-------------+ +-----------------------------+
| IBN User | | Global Distributed Database |
+-------------+ +-----------------------------+
^ ^
| Consumer-Facing Software Update |
| Interface Interface (Up) |
v v
+-------------------+ Registration +-----------------------+
| IBN Controller |<-------------------->| Vendor's Mgmt System |
+-------------------+ Interface +-----------------------+
^ ^ ^
| | Software Update Interface |
| | (Down) |
| | Analytics Interface +----------------+ |
| +------------------------>| IBN Analyzer | |
| +----------------+ |
| NSF-Facing Interface ^ |
| | |
| +---------------------+ |
| | Monitoring Interface |
| | |
+---------+------------------+--------------------------------+----+
| v v SRv6 Nodes v |
| +---------------+ +---------------+ +---------------+ |
| | NSF-1 |--| NSF-2 | ....... | NSF-n | |
| |(Policy Control| | (Monitoring | | (Application | |
| | Function, PCF)| | Function, MF)| | Function, AF) | |
| +---------------+ +---------------+ +---------------+ |
+------------------------------------------------------------------+
Figure 1: Intent based Network Management in SRv6 Network
3. Intent based Network Management in SRv6 Network
This section describes an IBNM framework in SRv6 network. Note that
this IBNM Framework is based on the Framework for Interface to
Network Security Functions (I2NSF)
[RFC8329][I-D.jeong-i2nsf-security-management-automation]. As shown
in Figure 1, an IBN User can use network functions by delivering
high-level network intents, which specify network requirements that
the IBNM User wants to enforce, to the IBN Controller via the
Consumer-Facing Interface (CFI).
Park, et al. Expires 10 May 2024 [Page 4]
Internet-Draft IBN Network Management November 2023
3.1. Components with IBNM Framework in SRv6 Network
The following are the system components for the IBNM framework in
SRv6 network.
* IBN User: An entity (e.g., End User or Network Operator) that
delivers a high-level network policy (including SRv6 policy) to
Security Controller. It is assumed that (i) an intent in a
natural language (e.g., English) can be translated into a high-
level network policy through a Natural Language Processing (called
NLP) technique (e.g., Lumi [USENIX-ATC-Lumi]) (ii) an intent as a
network service (e.g., self-configuration, optimization, and
healing) can be also translated into a high-level network policy.
* IBN Controller: An entity that controls and manages other system
components in the IBNM framework. It translates a high-level
network policy into the corresponding low-level network policy and
selects appropriate NSFs to execute the network rules of the low-
level network policy. And then these NSFs are distributed and
enabled into SRv6 nodes according to SRv6 policy (i.e., list of
source routing).
* Vendor's Management System (VMS): An entity that provides an image
of of a virtualized NSF for a network service to the IBNM
framework, registers the capability and access information of an
NSF with IBN Controller, and downloads NSFs into appropriate SRv6
nodes. These downloaded NSFs will be updated dynamically if
needed but is controlled by IBN controller. These virtualized
NSFs are managed through the cloud-based distribed database.
Also, this dynamic downloading NSFs could be realized by using
Software Updates for Internet of Things (SUIT) framework
[RFC9019][RFC9124].
* Network Service Function (NSF): An entity that is a Virtual
Network Function (called VNF), Physical Network Function (called
PNF) and Container Network Function (CNF), which is also called
Cloud-native Network Function, for a autonomous network service.
* IBN Analyzer: An entity that collects monitoring data from NSFs
and analyzes such data for checking the activity and performance
of the NSFs using machine learning techniques (e.g., Deep Learning
[Deep-Learning]). If there is a suspicious network problem (e.g.,
traffic congestion and QoS degradation) for the target network or
NSF, IBN Analyzer delivers a report of the augmentation or
generation of network rules to IBN Controller.
Park, et al. Expires 10 May 2024 [Page 5]
Internet-Draft IBN Network Management November 2023
For IBN-based network services with Feedback-Based Network Management
(FNM), IBN Analyzer is a key component for the IBNM framework
[RFC9315] to collect monitoring data from NSFs and analyzing the
monitoring data. In here, SRv6 is used to distinguish the monitoring
data. Ingress node (i.e., Headend) in SRv6 domain adds monitoring
information (e.g., intent and monitoring tag) into SRv6 headers. And
then, intermediate nodes monitor and analyze IPv6 packets with
monitoring information. The actual implementation of the analysis of
monitoring data is out of the scope of this document.
3.2. Interfaces for the IBNM Framework
The following are the interfaces for the IBNM framework. Note that
the interfaces can be modeled with YANG [RFC6020] and network
policies are delivered through either RESTCONF [RFC8040] or NETCONF
[RFC6241]. In addition, REST API [REST] can be supported for those
software update interfaces.
* Consumer-Facing Interface (CFI): An interface between IBN User and
IBN Controller for the delivery of a high-level network policy or
a intent [I-D.ietf-i2nsf-consumer-facing-interface-dm].
* NSF-Facing Interface (NFI): An interface between IBN Controller
and an NSF for the delivery of a low-level network policy
[I-D.ietf-i2nsf-nsf-facing-interface-dm].
* Registration Interface (RI): An interface between a VMS and IBN
Controller for the registration of an NSF's capability and access
information with the IBN Controller or the query of an NSF for a
required low-level network policy
[I-D.ietf-i2nsf-registration-interface-dm].
* Software Update Interface (Up) (SUI-U): An interface between a VMS
and global distribed database for NSF management.
* Software Update Interface (Down) (SUI-D): An interface between a
VMS and a SRv6 node for delivery of a NSF. The NSF is just
downloaded and does not work. After the command of IBN Controller
through NFI, it works.
* Monitoring Interface (MI): An interface between an NSF and IBN
Analyzer for collecting monitoring data from an NSF to check the
activity and performance of an NSF for a possible network problem
[I-D.ietf-i2nsf-nsf-monitoring-data-model]. In here, IPv6 packets
with monitoring information in SRv6 heeder is only collected.
Park, et al. Expires 10 May 2024 [Page 6]
Internet-Draft IBN Network Management November 2023
* Analytics Interface (AI): An interface between IBN Analyzer and
IBN Controller for the delivery of an analytics report of the
augmentation or generation of network rules to IBN Controller,
which lets IBN Controller apply the report for network rules to
its network policy management.
For IBN-based network services with FSM, Analytics Interface is a key
interface in the IBNM framework to deliver an analytics report of the
augmentation or generation of network rules to IBN Controller through
the analysis of the monitoring data from NSFs. For analyzing, user's
intent of monitoring information in SRv6 header will compare with
just monitoring data from NSFs.
4. Network Policy Translation
To facilitate Network Policy Translation (NPT), IBN Controller needs
to have a network policy translator that performs the translation of
a high-level network policy into the corresponding low-level network
policy (i.e. SRv6 policy [RFC9256]). For the automatic NPT
services, the IBN framework needs to bridge a high-level YANG data
model and a low-level YANG data model in an automatic manner
[I-D.ietf-spring-sr-policy-yang],
[I-D.yang-i2nsf-security-policy-translation]. Note that a high-level
YANG data model is for the IBN Consumer-Facing Interface, and a low-
level YANG data model is for the IBN NSF-Facing Interface.
5. IANA Considerations
This document does not require any IANA actions.
6. Security Considerations
The same security considerations for the IBN framework [RFC8329] are
applicable to this document.
7. References
7.1. Normative References
[RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for
the Network Configuration Protocol (NETCONF)", RFC 6020,
DOI 10.17487/RFC6020, October 2010,
<https://www.rfc-editor.org/info/rfc6020>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<https://www.rfc-editor.org/info/rfc6241>.
Park, et al. Expires 10 May 2024 [Page 7]
Internet-Draft IBN Network Management November 2023
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<https://www.rfc-editor.org/info/rfc8040>.
[RFC8329] Lopez, D., Lopez, E., Dunbar, L., Strassner, J., and R.
Kumar, "Framework for Interface to Network Security
Functions", RFC 8329, DOI 10.17487/RFC8329, February 2018,
<https://www.rfc-editor.org/info/rfc8329>.
[RFC9315] Clemm, A., Ciavaglia, L., Granville, L. Z., and J.
Tantsura, "Intent-Based Networking - Concepts and
Definitions", RFC 9315, DOI 10.17487/RFC9315, October
2022, <https://www.rfc-editor.org/info/rfc9315>.
[RFC7575] Behringer, M., Pritikin, M., Bjarnason, S., Clemm, A.,
Carpenter, B., Jiang, S., and L. Ciavaglia, "Autonomic
Networking: Definitions and Design Goals", RFC 7575,
DOI 10.17487/RFC7575, June 2015,
<https://www.rfc-editor.org/info/rfc7575>.
[RFC8192] Hares, S., Lopez, D., Zarny, M., Jacquenet, C., Kumar, R.,
and J. Jeong, "Interface to Network Security Functions
(I2NSF): Problem Statement and Use Cases", RFC 8192,
DOI 10.17487/RFC8192, July 2017,
<https://www.rfc-editor.org/info/rfc8192>.
[RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L.,
Decraene, B., Litkowski, S., and R. Shakir, "Segment
Routing Architecture", RFC 8402, DOI 10.17487/RFC8402,
July 2018, <https://www.rfc-editor.org/info/rfc8402>.
[RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J.,
Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header
(SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020,
<https://www.rfc-editor.org/info/rfc8754>.
[RFC8986] Filsfils, C., Ed., Camarillo, P., Ed., Leddy, J., Voyer,
D., Matsushima, S., and Z. Li, "Segment Routing over IPv6
(SRv6) Network Programming", RFC 8986,
DOI 10.17487/RFC8986, February 2021,
<https://www.rfc-editor.org/info/rfc8986>.
[RFC9256] Filsfils, C., Talaulikar, K., Ed., Voyer, D., Bogdanov,
A., and P. Mattes, "Segment Routing Policy Architecture",
RFC 9256, DOI 10.17487/RFC9256, July 2022,
<https://www.rfc-editor.org/info/rfc9256>.
7.2. Informative References
Park, et al. Expires 10 May 2024 [Page 8]
Internet-Draft IBN Network Management November 2023
[I-D.ietf-i2nsf-consumer-facing-interface-dm]
Jeong, J. P., Chung, C., Ahn, T., Kumar, R., and S. Hares,
"I2NSF Consumer-Facing Interface YANG Data Model", Work in
Progress, Internet-Draft, draft-ietf-i2nsf-consumer-
facing-interface-dm-31, 15 May 2023,
<https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-
consumer-facing-interface-dm-31>.
[I-D.ietf-i2nsf-nsf-facing-interface-dm]
Kim, J. T., Jeong, J. P., Jung-Soo, J., Hares, S., and Q.
Lin, "I2NSF Network Security Function-Facing Interface
YANG Data Model", Work in Progress, Internet-Draft, draft-
ietf-i2nsf-nsf-facing-interface-dm-29, 1 June 2022,
<https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-
nsf-facing-interface-dm-29>.
[I-D.ietf-i2nsf-registration-interface-dm]
Hyun, S., Jeong, J. P., Roh, T., Wi, S., and J. Jung-Soo,
"I2NSF Registration Interface YANG Data Model for NSF
Capability Registration", Work in Progress, Internet-
Draft, draft-ietf-i2nsf-registration-interface-dm-26, 10
May 2023, <https://datatracker.ietf.org/doc/html/draft-
ietf-i2nsf-registration-interface-dm-26>.
[I-D.ietf-i2nsf-nsf-monitoring-data-model]
Jeong, J. P., Lingga, P., Hares, S., Xia, L., and H.
Birkholz, "I2NSF NSF Monitoring Interface YANG Data
Model", Work in Progress, Internet-Draft, draft-ietf-
i2nsf-nsf-monitoring-data-model-20, 1 June 2022,
<https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-
nsf-monitoring-data-model-20>.
[I-D.ietf-i2nsf-applicability]
Jeong, J. P., Hyun, S., Ahn, T., Hares, S., and D. Lopez,
"Applicability of Interfaces to Network Security Functions
to Network-Based Security Services", Work in Progress,
Internet-Draft, draft-ietf-i2nsf-applicability-18, 16
September 2019, <https://datatracker.ietf.org/doc/html/
draft-ietf-i2nsf-applicability-18>.
[I-D.jeong-i2nsf-security-management-automation]
Jeong, J. P., Lingga, P., Jung-Soo, J., Lopez, D., and S.
Hares, "Security Management Automation of Cloud-Based
Security Services in I2NSF Framework", Work in Progress,
Internet-Draft, draft-jeong-i2nsf-security-management-
automation-06, 24 July 2023,
<https://datatracker.ietf.org/doc/html/draft-jeong-i2nsf-
security-management-automation-06>.
Park, et al. Expires 10 May 2024 [Page 9]
Internet-Draft IBN Network Management November 2023
[I-D.yang-i2nsf-security-policy-translation]
Jeong, J. P., Lingga, P., and J. Yang, "Guidelines for
Security Policy Translation in Interface to Network
Security Functions", Work in Progress, Internet-Draft,
draft-yang-i2nsf-security-policy-translation-15, 24 July
2023, <https://datatracker.ietf.org/doc/html/draft-yang-
i2nsf-security-policy-translation-15>.
[I-D.ietf-spring-sr-policy-yang]
Raza, S., Sawaya, R., Shunwan, Z., Voyer, D., Durrani, M.,
Matsushima, S., and V. P. Beeram, "YANG Data Model for
Segment Routing Policy", Work in Progress, Internet-Draft,
draft-ietf-spring-sr-policy-yang-02, 23 September 2022,
<https://datatracker.ietf.org/doc/html/draft-ietf-spring-
sr-policy-yang-02>.
[RFC9019] Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A
Firmware Update Architecture for Internet of Things",
RFC 9019, DOI 10.17487/RFC9019, April 2021,
<https://www.rfc-editor.org/info/rfc9019>.
[RFC9124] Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest
Information Model for Firmware Updates in Internet of
Things (IoT) Devices", RFC 9124, DOI 10.17487/RFC9124,
January 2022, <https://www.rfc-editor.org/info/rfc9124>.
[I-D.jeong-nmrg-ibn-network-management-automation]
Jeong, J. P., Ahn, Y., Kim, Y., and J. Jung-Soo, "Intent-
Based Network Management Automation in 5G Networks", Work
in Progress, Internet-Draft, draft-jeong-nmrg-ibn-network-
management-automation-03, 6 November 2023,
<https://datatracker.ietf.org/doc/html/draft-jeong-nmrg-
ibn-network-management-automation-03>.
[ETSI-NFV] "Network Functions Virtualisation (NFV); Architectural
Framework", Available:
https://www.etsi.org/deliver/etsi_gs/
nfv/001_099/002/01.02.01_60/gs_nfv002v010201p.pdf,
December 2014.
[USENIX-ATC-Lumi]
Jacobs, A., Pfitscher, R., Ribeiro, R., Ferreira, R.,
Granville, L., Willinger, W., and S. Rao, "Hey, Lumi!
Using Natural Language for Intent-Based Network
Management", USENIX Annual Technical Conference,
Available:
https://www.usenix.org/conference/atc21/presentation/
jacobs, July 2021.
Park, et al. Expires 10 May 2024 [Page 10]
Internet-Draft IBN Network Management November 2023
[REST] Fielding, R. and R. Taylor, "Principled Design of the
Modern Web Architecture", ACM Transactions on Internet
Technology, Vol. 2, Issue 2,,
Available: https://dl.acm.org/doi/10.1145/514183.514185,
May 2002.
[Deep-Learning]
Goodfellow, I., Bengio, Y., and A. Courville, "Deep
Learning", Publisher: The MIT Press,
URL: https://www.deeplearningbook.org/, November 2016.
Authors' Addresses
Jungsoo Park (editor)
Electronics and Telecommunications Research Institute
218 Gajeongno, Yuseung-gu
Daejeon
34129
South Korea
Phone: +82 42 860 6514
Email: pjs@etri.re.kr
Yunchul Choi
Electronics and Telecommunications Research Institute
218 Gajeongno, Yuseung-gu
Daejeon
34129
South Korea
Phone: +82 42 860 5978
Email: cyc79@etri.re.kr
Jaehoon Paul Jeong
Department of Computer Science and Engineering
Sungkyunkwan University
2066 Seobu-Ro, Jangan-Gu
Suwon
Gyeonggi-Do
16419
South Korea
Phone: +82 31 299 4957
Email: pauljeong@skku.edu
URI: http://iotlab.skku.edu/people-jaehoon-jeong.php
Park, et al. Expires 10 May 2024 [Page 11]
