QoS support can be made based on several mechanisms and protocols such as control admission and traffic grooming as well as contention resolution. However, security issue can decrease the QoS provision over optical networks including optical label and packet switched networks. For this reason, an advanced authentication scheme can help to assure the traffic transfer from the ingress edge node to egress edge node, in case of unicast and to several egress edge node, in case of multicast. Several authentication approaches can be used to guarantee the suitable QoS support.
Dear Khlifi Yassine,
to set up connections with QoS support via WDM-based optical networks, the RSVP-TE (RFC 2747) is used as a GMPLS signaling protocol. My figure illustrates this. Here are two main Security Problems (SP):
· SP1: Security guarantee of RSVP-TE Signaling Protocol, that is the guarantee of security during the construction of an end-to-end connection with QoS support in the form of an LSP.
· SP2: Guarantee the security of communication via the established end-to-end connection with QoS support, that is the communication via LSP.
SP2 is a classic security issue - namely: the problem of security during communication between two computers. The following security protocols can be used to solve this problem:
· IPsec for the security guarantee of point-to-point communication between two IP instances, in fact between two IP addresses.
· TLS (Transport Layer Security) for the security of the connection-oriented Point-to-point communication between two TCP sockets.
· DTLS (Datagram TLS) for the security of the connectionless
Point-to-point communication between two UDP sockets.
SP1 is not a classic security problem, but the problem of the security guarantee of signaling according to RSVP-TE, i.e. the problem of securing RSVP-TE signaling when setting up LSPs. Some suggestions for solving the SP1 are already found mainly in several IETF documents, in particular in the documents of the working group KARP (Keying and Authentication for Routing Protocols). It should be noted that RSVP-TE (as well as RSVP) is located on layer 4 and RSVP has IP Protocol No = 46. For this reason, the Securing RSVP-TE Signaling Protocol solutions are based on IPsec, and IKEv2 (RFC 5996) is used as the Key Management Protocol. Some ideas for solving SP1 can be found in:
· RFC 5920: Security Framework for MPLS and GMPLS Networks
· RFC 6518: KARP Design Guidelines
· RFC 6862: KARP Overview, Threats, and Requirements
· RFC 6952: Analysis of BGP, LDP, PCEP, and MSDP Issues According to the KARP Design Guide
· draft-mahesh-karp-rsvp-te-analysis-01.txt
· Negotiation for Keying Pairwise Routing Protocols in IKEv2
draft-mahesh-karp-rkmp-05; See: 6.3.1. Transforms Substructures for RSVP-TE Authentication; the proposed mechanism secures RSVP-TE associations using the IKEv2
https://tools.ietf.org/html/draft-mahesh-karp-rkmp-05
· Jing Zhi, Chung-Horng Lung, Xia Xu (Carleton University, Ottawa) and Srinivasan, Yi Lei (EION Inc): Securing RSVP and RSVP-TE Signaling Protocols and Their Performance Study
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.533.5590&rep=rep1&type=pdf
Good luck and best regards
Anatol Badach
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.396.595&rep=rep1&type=pdf
Optical network security can be implemented over the physical layer or switching layer. Using physical layer, one can use the optical signal behavior. However, using switching layer it depends on the technology-enabled to assure the traffic transfer. The important question is how to implement, for example, the authentication process in the signaling and switching phases through the use of the set of labels. the implementation process must take advantage of labels which guarantee the transfer of information related to network and the traffic and its requirements.