doc: Add RFC documents

1 files changed, 1011 insertions, 0 deletions

diff --git a/doc/rfc/rfc5713.txt b/doc/rfc/rfc5713.txt
new file mode 100644
index 0000000..a76a4c1
--- /dev/null
+++ b/doc/rfc/rfc5713.txt
@@ -0,0 +1,1011 @@
+
+
+
+
+
+
+Internet Engineering Task Force (IETF)                       H. Moustafa
+Request for Comments: 5713                                France Telecom
+Category: Informational                                    H. Tschofenig
+ISSN: 2070-1721                                   Nokia Siemens Networks
+                                                           S. De Cnodder
+                                                          Alcatel-Lucent
+                                                            January 2010
+
+
+           Security Threats and Security Requirements for the
+                  Access Node Control Protocol (ANCP)
+
+Abstract
+
+   The Access Node Control Protocol (ANCP) aims to communicate Quality
+   of Service (QoS)-related, service-related, and subscriber-related
+   configurations and operations between a Network Access Server (NAS)
+   and an Access Node (e.g., a Digital Subscriber Line Access
+   Multiplexer (DSLAM)).  The main goal of this protocol is to allow the
+   NAS to configure, manage, and control access equipment, including the
+   ability for the Access Nodes to report information to the NAS.
+
+   This present document investigates security threats that all ANCP
+   nodes could encounter.  This document develops a threat model for
+   ANCP security, with the aim of deciding which security functions are
+   required.  Based on this, security requirements regarding the Access
+   Node Control Protocol are defined.
+
+
+Status of This Memo
+
+   This document is not an Internet Standards Track specification; it is
+   published for informational purposes.
+
+   This document is a product of the Internet Engineering Task Force
+   (IETF).  It represents the consensus of the IETF community.  It has
+   received public review and has been approved for publication by the
+   Internet Engineering Steering Group (IESG).  Not all documents
+   approved by the IESG are a candidate for any level of Internet
+   Standard; see Section 2 of RFC 5741.
+
+   Information about the current status of this document, any errata,
+   and how to provide feedback on it may be obtained at
+   http://www.rfc-editor.org/info/rfc5713.
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                      [Page 1]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+Copyright Notice
+
+   Copyright (c) 2010 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (http://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.  Code Components extracted from this document must
+   include Simplified BSD License text as described in Section 4.e of
+   the Trust Legal Provisions and are provided without warranty as
+   described in the Simplified BSD License.
+
+Table of Contents
+
+
+   1. Introduction ....................................................3
+   2. Specification Requirements ......................................3
+   3. System Overview and Threat Model ................................4
+   4. Objectives of Attackers .........................................7
+   5. Potential Attacks ...............................................7
+      5.1. Denial of Service (DoS) ....................................7
+      5.2. Integrity Violation ........................................8
+      5.3. Downgrading ................................................8
+      5.4. Traffic Analysis ...........................................8
+      5.5. Management Attacks .........................................8
+   6. Attack Forms ....................................................9
+   7. Attacks against ANCP ...........................................10
+      7.1. Dynamic Access-Loop Attributes ............................11
+      7.2. Access-Loop Configuration .................................12
+      7.3. Remote Connectivity Test ..................................14
+      7.4. Multicast .................................................14
+   8. Security Requirements ..........................................16
+   9. Security Considerations ........................................16
+   10. Acknowledgments ...............................................17
+   11. References ....................................................17
+      11.1. Normative References .....................................17
+      11.2. Informative References ...................................17
+
+
+
+
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                      [Page 2]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+1.  Introduction
+
+   The Access Node Control Protocol (ANCP) aims to communicate QoS-
+   related, service-related, and subscriber-related configurations and
+   operations between a Network Access Server (NAS) and an Access Node
+   (e.g., a Digital Subscriber Line Access Multiplexer (DSLAM)).
+
+   [ANCP-FRAME] illustrates the framework, usage scenarios, and general
+   requirements for ANCP.  This document focuses on describing security
+   threats and deriving security requirements for the Access Node
+   Control Protocol, considering the ANCP use cases defined in
+   [ANCP-FRAME] as well as the guidelines for IETF protocols' security
+   requirements given in [RFC3365].  Section 5 and Section 6,
+   respectively, describe the potential attacks and the different attack
+   forms that are liable to take place within ANCP, while Section 7
+   applies the described potential attacks to ANCP and its different use
+   cases.  Security policy negotiation, including authentication and
+   authorization to define the per-subscriber policy at the policy/AAA
+   (Authentication, Authorization, and Accounting) server, is out of the
+   scope of this work.  As a high-level summary, the following aspects
+   need to be considered:
+
+   Message Protection:
+
+      Signaling message content can be protected against eavesdropping,
+      modification, injection, and replay while in transit.  This
+      applies to both ANCP headers and payloads.
+
+   Prevention against Impersonation:
+
+      It is important that protection be available against a device
+      impersonating an ANCP node (i.e., an unauthorized device
+      generating an ANCP message and pretending it was generated by a
+      valid ANCP node).
+
+   Prevention of Denial-of-Service Attacks:
+
+      ANCP nodes and the network have finite resources (state storage,
+      processing power, bandwidth).  It is important to protect against
+      exhaustion attacks on these resources and to prevent ANCP nodes
+      from being used to launch attacks on other network elements.
+
+2.  Specification Requirements
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119], with the
+
+
+
+
+Moustafa, et al.             Informational                      [Page 3]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   qualification that, unless otherwise stated, they apply to the design
+   of the Access Node Control Protocol (ANCP), not its implementation or
+   application.
+
+   The relevant components are described in Section 3.
+
+3.  System Overview and Threat Model
+
+   As described in [ANCP-FRAME] and schematically shown in Figure 1, the
+   Access Node Control system consists of the following components:
+
+   Network Access Server (NAS):
+
+      A NAS provides access to a service (e.g., network access) and
+      operates as a client of the AAA protocol.  The AAA client is
+      responsible for passing authentication information to designated
+      AAA servers and then acting on the response that is returned.
+
+   Authentication, Authorization, and Accounting (AAA) server:
+
+      A AAA server is responsible for authenticating users, authorizing
+      access to services, and returning authorization information
+      (including configuration parameters) back to the AAA client to
+      deliver service to the user.  As a consequence, service usage
+      accounting might be enabled and information about the user's
+      resource usage will be sent to the AAA server.
+
+   Access Node (AN):
+
+      The AN is a network device, usually located at a service provider
+      central office or street cabinet, that terminates access-loop
+      connections from subscribers.  In case the access loop is a
+      Digital Subscriber Line (DSL), this is often referred to as a DSL
+      Access Multiplexer (DSLAM).
+
+   Customer Premises Equipment (CPE):
+
+      A CPE is a device located inside a subscriber's premise that is
+      connected at the LAN side of the Home Gateway (HGW).
+
+   Home Gateway (HGW):
+
+      The HGW connects the different Customer Premises Equipments (CPEs)
+      to the Access Node and the access network.  In case of DSL, the
+      HGW is a DSL Network Termination (NT) that could either operate as
+      a layer 2 bridge or as a layer 3 router.  In the latter case, such
+      a device is also referred to as a Routing Gateway (RG).
+
+
+
+
+Moustafa, et al.             Informational                      [Page 4]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   Aggregation Network:
+
+      The aggregation network provides traffic aggregation from multiple
+      ANs towards the NAS.  ATM or Ethernet transport technologies can
+      be used.
+
+   For the threat analysis, this document focuses on the ANCP
+   communication between the Access Node and the NAS.  However,
+   communications with the other components (such as HGW, CPE, and the
+   AAA server) play a role in the understanding of the system
+   architecture and of what triggers ANCP communications.  Note that the
+   NAS and the AN might belong to two different administrative realms.
+   The threat model and the security requirements in this document
+   consider this latter case.
+
+
+                                                             +--------+
+                                                             | AAA    |
+                                                             | Server |
+                                                             +--------+
+                                                                  |
+                                                                  |
+      +---+   +---+   +------+    +-----------+    +-----+   +--------+
+      |CPE|---|HGW|---|      |    |Aggregation|    |     |   |        |
+      +---+   +---+   |Access|    | Network   |    |     |   |Internet|
+                      | Node |----|           |----| NAS |---|   /    |
+      +---+   +---+   | (AN) |    |           |    |     |   |Regional|
+      |CPE|---|HGW|---|      |    |           |    |     |   |Network |
+      +---+   +---+   +------+    +-----------+    +-----+   +--------+
+
+                         Figure 1: System Overview
+
+   In the absence of an attack, the NAS receives configuration
+   information from the AAA server related to a CPE attempting to access
+   the network.  A number of parameters, including Quality of Service
+   information, need to be conveyed to the Access Node in order to
+   become effective.  The Access Node Control Protocol is executed
+   between the NAS and the AN to initiate control requests.  The AN
+   returns responses to these control requests and provides information
+   reports.
+
+   For this to happen, the following individual steps must occur:
+
+   o  The AN discovers the NAS.
+
+   o  The AN needs to start the protocol communication with the NAS to
+      announce its presence.
+
+
+
+
+Moustafa, et al.             Informational                      [Page 5]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   o  The AN and the NAS perform a capability exchange.
+
+   o  The NAS sends requests to the AN.
+
+   o  The AN processes these requests, authorizes the actions, and
+      responds with the appropriate answer.  In order to fulfill the
+      commands, it might be necessary for the AN to communicate with the
+      HGW or other nodes, for example, as part of a keep-alive
+      mechanism.
+
+   o  The AN provides status reports to the NAS.
+
+   Attackers can be:
+
+   o  off-path, i.e., they cannot see the messages exchanged between the
+      AN and the NAS;
+
+   o  on-path, i.e., they can see the messages exchanged between the AN
+      and the NAS.
+
+   Both off-path and on-path attackers can be:
+
+   o  passive, i.e., they do not participate in the network operation
+      but rather listen to all transfers to obtain the maximum possible
+      information;
+
+   o  active, i.e., they participate in the network operation and can
+      inject falsified packets.
+
+   We assume the following threat model:
+
+   o  An off-path adversary located at the CPE or the HGW.
+
+   o  An off-path adversary located on the Internet or a regional
+      network that connects one or more NASes and associated access
+      networks to Network Service Providers (NSPs) and Application
+      Service Providers (ASPs).
+
+   o  An on-path adversary located at network elements between the AN
+      and the NAS.
+
+   o  An on-path adversary taking control over the NAS.
+
+   o  An on-path adversary taking control over the AN.
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                      [Page 6]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+4.  Objectives of Attackers
+
+   Attackers may direct their efforts either against an individual
+   entity or against a large portion of the access network.  Attacks
+   fall into three classes:
+
+   o  Attacks to disrupt the communication for individual customers.
+
+   o  Attacks to disrupt the communication of a large fraction of
+      customers in an access network.  These also include attacks to the
+      network itself or a portion of it, such as attacks to disrupt the
+      network services or attacks to destruct the network functioning.
+
+   o  Attacks to gain profit for the attacker through modifying the QoS
+      settings.  Also, through replaying old packets (of another
+      privileged client, for instance), an attacker can attempt to
+      configure a better QoS profile on its own DSL line, increasing its
+      own benefit.
+
+5.  Potential Attacks
+
+   This section discusses the different types of attacks against ANCP,
+   while Section 6 describes the possible means of their occurrence.
+
+   ANCP is mainly susceptible to the following types of attacks:
+
+5.1.  Denial of Service (DoS)
+
+   A number of denial-of-service (DoS) attacks can cause ANCP nodes to
+   malfunction.  When state is established or certain functions are
+   performed without requiring prior authorization, there is a chance to
+   mount denial-of-service attacks.  An adversary can utilize this fact
+   to transmit a large number of signaling messages to allocate state at
+   nodes and to cause consumption of resources.  Also, an adversary,
+   through DoS, can prevent certain subscribers from accessing certain
+   services.  Moreover, DoS can take place at the AN or the NAS
+   themselves, where it is possible for the NAS (or the AN) to
+   intentionally ignore the requests received from the AN (or the NAS)
+   through not replying to them.  This causes the sender of the request
+   to retransmit the request, which might allocate additional state at
+   the sender side to process the reply.  Allocating more state may
+   result in memory depletion.
+
+
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                      [Page 7]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+5.2.  Integrity Violation
+
+   Adversaries gaining illegitimate access on the transferred messages
+   can act on these messages, causing integrity violation.  Integrity
+   violation can cause unexpected network behavior, leading to a
+   disturbance in the network services as well as in the network
+   functioning.
+
+5.3.  Downgrading
+
+   Protocols may be useful in a variety of scenarios with different
+   security and functional requirements.  Different parts of a network
+   (e.g., within a building, across a public carrier's network, or over
+   a private microwave link) may need different levels of protection.
+   It is often difficult to meet these (sometimes conflicting)
+   requirements with a single mechanism or fixed set of parameters;
+   thus, often a selection of mechanisms and parameters is offered.  A
+   protocol is required to agree on certain (security) mechanisms and
+   parameters.  An insecure parameter exchange or security negotiation
+   protocol can give an adversary the opportunity to mount a downgrading
+   attack to force selection of mechanisms weaker than those mutually
+   desired.  Thus, without binding the negotiation process to the
+   legitimate parties and protecting it, ANCP might only be as secure as
+   the weakest mechanism provided (e.g., weak authentication) and the
+   benefits of defining configuration parameters and a negotiation
+   protocol are lost.
+
+5.4.  Traffic Analysis
+
+   An adversary can be placed at the NAS, the AN, or any other network
+   element capturing all traversing packets.  Adversaries can thus have
+   unauthorized information access.  As well, they can gather
+   information relevant to the network and then use this information in
+   gaining later unauthorized access.  This attack can also help
+   adversaries in other malicious purposes -- for example, capturing
+   messages sent from the AN to the NAS announcing that a DSL line is up
+   and containing some information related to the connected client.
+   This could be any form of information about the client and could also
+   be an indicator of whether or not the DSL subscriber is at home at a
+   particular moment.
+
+5.5.  Management Attacks
+
+   Since the ANCP sessions are configured in the AN and not in the NAS
+   [ANCP-FRAME], most configurations of ANCP are done in the AN.
+   Consequently, the management attacks to ANCP mainly concern the AN
+   configuration phase.  In this context, the AN MIB module could create
+   disclosure- and misconfiguration-related attacks.  [ANCP-MIB] defines
+
+
+
+Moustafa, et al.             Informational                      [Page 8]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   the vulnerabilities on the management objects within the AN MIB
+   module.  These attacks mainly concern the unauthorized changes of the
+   management objects, leading to a number of attacks such as session
+   deletion, a session using an undesired/unsupported protocol,
+   disabling certain ANCP capabilities or enabling undesired
+   capabilities, ANCP packets being sent out to the wrong interface (and
+   thus being received by an unintended receiver), harming the
+   synchronization between the AN and the NAS, and impacting traffic in
+   the network other than ANCP.
+
+6.  Attack Forms
+
+   The attacks mentioned above in Section 5 can be carried out through
+   the following means:
+
+   Message Replay:
+
+      This threat scenario covers the case in which an adversary
+      eavesdrops, collects signaling messages, and replays them at a
+      later time (or at a different place or in a different way; e.g.,
+      cut-and-paste attacks).  Through replaying signaling messages, an
+      adversary might mount denial-of-service and theft-of-service
+      attacks.
+
+   Faked Message Injection:
+
+      An adversary may be able to inject false error or response
+      messages, causing unexpected protocol behavior and succeeding with
+      a DoS attack.  This could be achieved at the signaling-protocol
+      level, at the level of specific signaling parameters (e.g., QoS
+      information), or at the transport layer.  An adversary might, for
+      example, inject a signaling message to request allocation of QoS
+      resources.  As a consequence, other users' traffic might be
+      impacted.  The discovery protocol, especially, exhibits
+      vulnerabilities with regard to this threat scenario.
+
+   Messages Modification:
+
+      This involves integrity violation, where an adversary can modify
+      signaling messages in order to cause unexpected network behavior.
+      Possible related actions an adversary might consider for its
+      attack are the reordering and delaying of messages, causing a
+      protocol's process failure.
+
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                      [Page 9]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   Man-in-the-Middle:
+
+      An adversary might claim to be a NAS or an AN, acting as a man-in-
+      the-middle to later cause communication and services disruption.
+      The consequence can range from DoS to fraud.  An adversary acting
+      as a man-in-the-middle could modify the intercepted messages,
+      causing integrity violation, or could drop or truncate the
+      intercepted messages, causing DoS and a protocol's process
+      failure.  In addition, a man-in-the-middle adversary can signal
+      information to an illegitimate entity in place of the right
+      destination.  In this case, the protocol could appear to continue
+      working correctly.  This may result in an AN contacting a wrong
+      NAS.  For the AN, this could mean that the protocol failed for
+      unknown reasons.  A man-in-the-middle adversary can also cause
+      downgrading attacks through initiating faked configuration
+      parameters and through forcing selection of weak security
+      parameters or mechanisms.
+
+   Eavesdropping:
+
+      This is related to adversaries that are able to eavesdrop on
+      transferred messages.  The collection of the transferred packets
+      by an adversary may allow traffic analysis or be used later to
+      mount replay attacks.  The eavesdropper might learn QoS
+      parameters, communication patterns, policy rules for firewall
+      traversal, policy information, application identifiers, user
+      identities, NAT bindings, authorization objects, network
+      configuration, performance information, and more.
+
+7.  Attacks against ANCP
+
+   ANCP is susceptible to security threats, causing disruption/
+   unauthorized access to network services, manipulation of the
+   transferred data, and interference with network functions.  Based on
+   the threat model given in Section 3 and the potential attacks
+   presented in Section 5, this section describes the possible attacks
+   against ANCP, considering the four use cases defined in [ANCP-FRAME].
+
+   Although ANCP is not involved in the communication between the NAS
+   and the AAA/policy server, the secure communication between the NAS
+   and the AAA/policy server is important for ANCP security.
+   Consequently, this document considers the attacks that are related to
+   the ANCP operation associated with the communication between the NAS
+   and the AAA/Policy server.  In other words, the threat model and
+   security requirements in this document take into consideration the
+   data transfer between the NAS and the AAA server, when this data is
+   used within the ANCP operation.
+
+
+
+
+Moustafa, et al.             Informational                     [Page 10]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   Besides the attacks against the four ANCP use cases described in the
+   following subsections, ANCP is susceptible to a number of attacks
+   that can take place during the protocol-establishment phase.  These
+   attacks are mainly on-path attacks, taking the form of DoS or man-in-
+   the-middle attacks, which could be as follows:
+
+   o  Attacks during the session initiation from the AN to the NAS:
+      DoS attacks could take place affecting the session-establishment
+      process.  Also, man-in-the-middle attacks could take place,
+      causing message truncation or message modification and leading to
+      session-establishment failure.
+
+   o  Attacks during the peering establishment:
+      DoS attacks could take place during state synchronization between
+      the AN and the NAS.  Also, man-in-the-middle attacks could take
+      place through message modification during identity discovery,
+      which may lead to loss of contact between the AN and the NAS.
+
+   o  Attacks during capabilities negotiation:
+      Message replay could take place, leading to DoS.  Also, man-in-
+      the-middle attacks could take place, leading to message
+      modification, message truncation, or downgrading through
+      advertising lesser capabilities.
+
+7.1.  Dynamic Access-Loop Attributes
+
+   This use case concerns the communication of access-loop attributes
+   for dynamic, access-line topology discovery.  Since the access-loop
+   rate may change over time, advertisement is beneficial to the NAS to
+   gain knowledge about the topology of the access network for QoS
+   scheduling.  Besides data rates and access-loop links identification,
+   other information may also be transferred from the AN to the NAS
+   (examples in case of a DSL access loop are DSL type, maximum
+   achievable data rate, and maximum data rate configured for the access
+   loop).  This use case is thus vulnerable to a number of on-path and
+   off-path attacks that can be either active or passive.
+
+   On-path attacks can take place between the AN and the NAS, on the AN
+   or on the NAS, during the access-loop attributes transfer.  These
+   attacks may be:
+
+   o  Active, acting on the transferred attributes and injecting
+      falsified packets.  The main attacks here are:
+
+      *  Man-in-the-middle attacks can cause access-loop attributes
+         transfer between the AN and a forged NAS or a forged AN and the
+         NAS, which can directly cause faked attributes and message
+         modification or truncation.
+
+
+
+Moustafa, et al.             Informational                     [Page 11]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+      *  Signaling replay, by an attacker between the AN and the NAS, on
+         the AN or on the NAS itself, causing DoS.
+
+      *  An adversary acting as man-in-the-middle can cause downgrading
+         through changing the actual data rate of the access loop, which
+         impacts the downstream shaping from the NAS.
+
+   o  Passive, only learning these attributes.  The main attacks here
+      are caused by:
+
+      *  Eavesdropping through learning access-loop attributes and
+         information about the clients' connection state, and thus
+         impacting their privacy protection.
+
+      *  Traffic analysis allowing unauthorized information access,
+         which could allow later unauthorized access to the NAS.
+
+   Off-path attacks can take place on the Internet, affecting the
+   access-loop attribute sharing between the NAS and the AAA/policy
+   server.  These attacks may be:
+
+   o  Active attacks, which are mainly concerning:
+
+      *  DoS through flooding the communication links to the AAA/policy
+         server, causing service disruption.
+
+      *  Man-in-the-middle, causing access-loop configuration retrieval
+         by an illegitimate NAS.
+
+   o  Passive attacks, gaining information on the access-loop
+      attributes.  The main attacks in this case are:
+
+      *  Eavesdropping through learning access-loop attributes and
+         learning information about the clients' connection states, and
+         thus impacting their privacy protection.
+
+      *  Traffic analysis allowing unauthorized information access,
+         which could allow later unauthorized access to the NAS.
+
+7.2.  Access-Loop Configuration
+
+   This use case concerns the dynamic, local-loop line configuration
+   through allowing the NAS to change the access-loop parameters (e.g.,
+   rate) in a dynamic fashion.  This allows for centralized, subscriber-
+   related service data.  This dynamic configuration can be achieved,
+   for instance, through profiles that are pre-configured on ANs.  This
+   use case is vulnerable to a number of on-path and off-path attacks.
+
+
+
+
+Moustafa, et al.             Informational                     [Page 12]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   On-path attacks can take place where the attacker is between the AN
+   and the NAS, is on the AN, or is on the NAS.  These can be as
+   follows:
+
+   o  Active attacks, taking the following forms:
+
+      *  DoS attacks of the AN can take place by an attacker, through
+         replaying the Configure Request messages.
+
+      *  An attacker on the AN can prevent the AN from reacting on the
+         NAS request for the access-loop configuration, leading to the
+         NAS continually sending the Configure Request message and,
+         hence, allocating additional states.
+
+      *  Damaging clients' profiles at ANs can take place by adversaries
+         that gained control on the network through discovery of users'
+         information from a previous traffic analysis.
+
+      *  An adversary can replay old packets, modify messages, or inject
+         faked messages.  Such adversary can also be a man-in-the-
+         middle.  These attack forms can be related to a privileged
+         client profile (having more services) in order to configure
+         this profile on the adversary's own DSL line, which is less
+         privileged.  In order that the attacker does not expose its
+         identity, he may also use these attack forms related to the
+         privileged client profile to configure a number of illegitimate
+         DSL lines.  The adversary can also force configuration
+         parameters other than the selected ones, leading to, for
+         instance, downgrading the service for a privileged client.
+
+   o  Passive attacks, where the attacker listens to the ANCP messages.
+      This can take place as follows:
+
+      *  Learning configuration attributes is possible during the update
+         of the access-loop configuration.  An adversary might profit to
+         see the configuration that someone else gets (e.g., one ISP
+         might be interested to know what the customers of another ISP
+         get and therefore might break into the AN to see this).
+
+   Off-path attacks can take place as follows:
+
+   o  An off-path passive adversary on the Internet can exert
+      eavesdropping during the access-loop configuration retrieval by
+      the NAS from the AAA/policy server.
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                     [Page 13]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   o  An off-path active adversary on the Internet can threaten the
+      centralized subscribers-related service data in the AAA/policy
+      server through, for instance, making subscribers' records
+      inaccessible.
+
+7.3.  Remote Connectivity Test
+
+   In this use case, the NAS can carry out a Remote Connectivity Test
+   using ANCP to initiate an access-loop test between the AN and the
+   HGW.  Thus, multiple access-loop technologies can be supported.  This
+   use case is vulnerable to a number of active attacks.  Most of the
+   attacks in this use case concern the network operation.
+
+   On-path active attacks can take place in the following forms:
+
+   o  Man-in-the-middle attack during the NAS's triggering to the AN to
+      carry out the test, where an adversary can inject falsified
+      signals or can truncate the triggering.
+
+   o  Message modification can take place during the Subscriber Response
+      message transfer from the AN to the NAS announcing the test
+      results, causing failure of the test operation.
+
+   o  An adversary on the AN can prevent the AN from sending the
+      Subscriber Response message to the NAS announcing the test
+      results, and hence the NAS will continue triggering the AN to
+      carry out the test, which results in more state being allocated at
+      the NAS.  This may result in unavailability of the NAS to the ANs.
+
+   Off-path active attacks can take place as follows:
+
+   o  An adversary can cause DoS during the access-loop test, in case of
+      an ATM-based access loop, when the AN generates loopback cells.
+      This can take place through signal replaying.
+
+   o  Message truncating can take place by an adversary during the
+      access-loop test, which can lead to service disruption due to
+      assumption of test failures.
+
+7.4.  Multicast
+
+   In this use case, ANCP could be used in exchanging information
+   between the AN and the NAS, allowing the AN to perform replication
+   inline with the policy and configuration of the subscriber.  Also,
+   this allows the NAS to follow subscribers' multicast (source, group)
+   membership and control replication performed by the AN.  Four
+   multicast use cases are expected to take place, making use of ANCP;
+   these are typically multicast conditional access, multicast admission
+
+
+
+Moustafa, et al.             Informational                     [Page 14]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   control, multicast accounting, and spontaneous admission response.
+   This section gives a high-level description of the possible attacks
+   that can take place in these cases.  Attacks that can occur are
+   mostly active attacks.
+
+   On-path active attacks can be as follows:
+
+   o  DoS attacks, causing inability for certain subscribers to access
+      particular multicast streams or only access the multicast stream
+      at a reduced bandwidth, impacting the quality of the possible
+      video stream.  This can take place through message replay by an
+      attacker between the AN and the NAS, on the AN or on the NAS.
+      Such DoS attacks can also be done by tempering, for instance, with
+      white/black list configuration or by placing attacks to the
+      bandwidth-admission-control mechanism.
+
+   o  An adversary on the NAS can prevent the NAS from reacting on the
+      AN requests for white/black/grey lists or for admission control
+      for the access line.  The AN in this case would not receive a
+      reply and would continue sending its requests, resulting in more
+      states being allocated at the AN.  A similar case happens for
+      admission control when the NAS can also send requests to the AN.
+      When the NAS does not receive a response, it could also retransmit
+      requests, resulting in more state being allocated at the NAS side
+      to process responses.  This may result in the unavailability of
+      the NAS to the ANs.
+
+   o  Man-in-the-middle, causing the exchange of messages between the AN
+      and a forged NAS or a forged AN and the NAS.  This can lead to the
+      following:
+
+      *  Message modification, which can cause service downgrading for
+         legitimate subscribers -- for instance, an illegitimate change
+         of a subscriber's policy.
+
+      *  Message truncation between the AN and the NAS, which can result
+         in the non-continuity of services.
+
+      *  Message replay between the AN and the NAS, on the AN or on the
+         NAS, leading to a DoS or services fraud.
+
+      *  Message modification to temper with accounting information, for
+         example, in order to avoid service charges or, conversely, in
+         order to artificially increase service charges on other users.
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                     [Page 15]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+   An off-path active attack is as follows:
+
+   o  DoS could take place through message replay of join/leave requests
+      by the HGW or CPE, frequently triggering the ANCP activity between
+      the AN and the NAS.  DoS could also result from generating heaps
+      of IGMP join/leaves by the HGW or CPE, leading to very high rate
+      of ANCP query/response.
+
+8.  Security Requirements
+
+   This section presents a number of requirements motivated by the
+   different types of attacks defined in the previous section.  These
+   requirements are as follows:
+
+   o  The protocol solution MUST offer authentication of the AN to the
+      NAS.
+
+   o  The protocol solution MUST offer authentication of the NAS to the
+      AN.
+
+   o  The protocol solution MUST allow authorization to take place at
+      the NAS and the AN.
+
+   o  The protocol solution MUST offer replay protection.
+
+   o  The protocol solution MUST provide data-origin authentication.
+
+   o  The protocol solution MUST be robust against denial-of-service
+      (DoS) attacks.  In this context, the protocol solution MUST
+      consider a specific mechanism for the DoS that the user might
+      create by sending many IGMP messages.
+
+   o  The protocol solution SHOULD offer confidentiality protection.
+
+   o  The protocol solution SHOULD ensure that operations in default
+      configuration guarantees a low number of AN/NAS protocol
+      interactions.
+
+   o  The protocol solution SHOULD ensure the access control of the
+      management objects and possibly encrypt the values of these
+      objects when sending them over the networks.
+
+9.  Security Considerations
+
+   This document focuses on security threats, deriving a threat model
+   for ANCP and presenting the security requirements to be considered
+   for the design of ANCP.
+
+
+
+
+Moustafa, et al.             Informational                     [Page 16]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+10.  Acknowledgments
+
+   Many thanks go to Francois Le Faucher for reviewing this document and
+   for all his useful comments.  The authors would also like to thank
+   Philippe Niger, Curtis Sherbo, and Michael Busser for reviewing this
+   document.  Other thanks go to Bharat Joshi, Mark Townsley, Wojciech
+   Dec, and Kim Hylgaard who have had valuable comments during the
+   development of this work.
+
+11.  References
+
+11.1.  Normative References
+
+   [RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
+                 Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC3365]     Schiller, J., "Strong Security Requirements for
+                 Internet Engineering Task Force Standard Protocols",
+                 BCP 61, RFC 3365, August 2002.
+
+11.2.  Informative References
+
+   [ANCP-FRAME]  Ooghe, S., Voigt, N., Platnic, M., Haag, T., and S.
+                 Wadhwa, "Framework and Requirements for an Access Node
+                 Control Mechanism in Broadband  Multi-Service
+                 Networks", Work in Progress, October 2009.
+
+   [ANCP-MIB]    De Cnodder, S. and M. Morgenstern, "Access Node Control
+                 Protocol (ANCP) MIB module for Access Nodes", Work
+                 in Progress, July 2009.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                     [Page 17]
+
+RFC 5713                      ANCP Threats                  January 2010
+
+
+Authors' Addresses
+
+   Hassnaa Moustafa
+   France Telecom
+   38-40 rue du General Leclerc
+   Issy Les Moulineaux,   92794 Cedex 9
+   France
+
+   EMail: hassnaa.moustafa@orange-ftgroup.com
+
+
+   Hannes Tschofenig
+   Nokia Siemens Networks
+   Linnoitustie 6
+   Espoo  02600
+   Finland
+
+   Phone: +358 (50) 4871445
+   EMail: Hannes.Tschofenig@gmx.net
+   URI:   http://www.tschofenig.priv.at
+
+
+   Stefaan De Cnodder
+   Alcatel-Lucent
+   Copernicuslaan 50
+   B-2018 Antwerp,
+   Belgium
+
+   Phone: +32 3 240 85 15
+   EMail: stefaan.de_cnodder@alcatel-lucent.com
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Moustafa, et al.             Informational                     [Page 18]
+