Draft: draft-ietf-detnet-ip

Commentary: Sorry , now it is uploaded to the right folder . Simple accept pull request . Thx Bala'zs
Paragraph (version A):
Security considerations for DetNet are described in detail in I-
D.ietf-detnet-security.  This section considers exclusively security
considerations which are specific to the DetNet data plane.
Paragraph (version B):
Security considerations for DetNet are described in detail in I-
D.ietf-detnet-security.  General security considerations are
described in I-D.ietf-detnet-architecture.  This section considers
exclusively security considerations which are specific to the DetNet
IP data plane.
Paragraph (version A):
The primary considerations for the data plane is to maintain
confidentiality of data traversing the DetNet network, application
flows can be protected through whatever means is provided by the
underlying technology.  For example, encryption may be used, such as
that provided by IPSec RFC4301 for IP flows and by MACSec
IEEE802.1AE-2018 for Ethernet (Layer-2) flows.
Paragraph (version A):
DetNet flows are identified on a per-flow basis, which may provide
attackers with additional information about the data flows (when
compared to networks that do not include per-flow identification).
This is an inherent property of DetNet which has security
implications that should be considered when determining if DetNet is
a suitable technology for any given use case.
Paragraph (version A):
To provide uninterrupted availability of the DetNet quality of
service, provisions can be made against DOS attacks and delay
attacks.  To protect against DOS attacks, excess traffic due to
malicious or malfunctioning devices can be prevented or mitigated,
for example through the use of traffic admission control applied at
the input of a DetNet domain.  To prevent DetNet packets from being
delayed by an entityexternal to a DetNet domain, DetNet technology
definition can allow for the mitigation of Man-In-The-Middle attacks,
for example through use of authentication and authorization of
devices within the DetNet domain.
Paragraph (version A):
Because DetNet mechanisms or applications that rely on DetNet can
make heavy use of methods that require precise time synchronization,
the accuracy, availability, and integrity of time synchronization is
of critical importance.  Extensive discussion of this topic can be
found in RFC7384.
Paragraph (version B):
The primary considerations for the data plane is to maintain
integrity of data and delivery of the associated DetNet service
traversing the DetNet network.  Application flows can be protected
through whatever means is provided by the underlying technology.  For
example, encryption may be used, such as that provided by IPSec
RFC4301 for IP flows and/or by an underlying sub-net using MACSec
IEEE802.1AE-2018 for IP over Ethernet (Layer-2) flows.
Paragraph (version B):
From a data plane perspective this document does not add or modify
any header information.
Paragraph (version B):
At the management and control level DetNet flows are identified on a
per-flow basis, which may provide controller plane attackers with
additional information about the data flows (when compared to
controller planes that do not include per-flow identification).  This
is an inherent property of DetNet which has security implications
that should be considered when determining if DetNet is a suitable
technology for any given use case.
Paragraph (version B):
To provide uninterrupted availability of the DetNet service,
provisions can be made against DOS attacks and delay attacks.  To
protect against DOS attacks, excess traffic due to malicious or
malfunctioning devices can be prevented or mitigated, for example
through the use of existing mechanism such as policing and shaping
applied at the input of a DetNet domain.  To prevent DetNet packets
from being delayed by an entity external to a DetNet domain, DetNet
technology definition can allow for the mitigation of Man-In-The-
Middle attacks, for example through use of authentication and
authorization of devices within the DetNet domain.