RE: RE: NCS Signaling MIB SC Objects

Speaking as another MSO (and not wearing my co-chair hat)...

I am not personally fond of a "CMTS approving any SCN without
authorization"; that sounds like a great way to enable theft of service. :^(
But I don't think that is what CableLabs is advocating.

One case that seems to make sense is if the service flow is pre-authorized
in the CM configuration file (e.g. Provisioned but not Admitted/Active).
This might be used on an MTA that is initially disabled for telephone
service, to conserve on reserved bandwidth on DOCSIS. When the MTA is
enabled much later for telephony service (via SNMP Sets), the eCM would send
a DSC for the existing provisioned service flow. (Note that the language
that folks point to in the DQOS spec refers to rejecting both DSAs and DSCs
without authorization blocks.)

Another case that might potentially make sense is if the CMTS enforced that
all upstream traffic for a specific SCN be directed only towards the CMS. In
other words, if a CM sends a DSA for the NCS signaling SCN, then for the
resulting service flow, the CMTS would drop all upstream traffic not
directed to the CMS. I'm not sure I'm a big fan of this approach, but I
could see how other operators might use it.

I think in all cases, it should be much more clearly specified in the DQOS
specs that the CMTSs have to implement configuration parameters in order to
permit/deny these types of DSAs/DSCs. In other words, it should be an
operator decision to enable DSAs and DSCs without a PacketCable
authorization block -- not a vendor implementation decision.

-- Rich

-----Original Message-----
From: Thomas Anders [mailto:[email protected]]
Sent: Wednesday, April 07, 2004 9:17 AM
To: [email protected]
Subject: Re: [ipcdn] RE: NCS Signaling MIB SC Objects


Hi all,

since part of this discussion is related to MSOs, we'd like to speak up.

Wim>   It is clearly not the intention of the PacketCable
Wim>   specification that any DSA for a SCN will always succeed,
JFM>
JFM> That is a question of MSO policy authorization and is left for vendor 
differentiation.
[...]
Wim>   this would be a very easy theft-of-service scenario
JFM>
JFM> An operator would have to allow this.
[...]
Wim>   just stating that any SCN can be allowed without authorization
Wim>   opens up a security hole
JFM>
JFM> Operator decision.

We as an MSO clearly see more (security) problems than benefits with this
approach. We can hardly imagine "vendor differentiation" offering any
acceptable solution here. Even worse, much like Wim, we don't think it
fits with the current specs.


Best regards,
Thomas

-- 
Thomas Anders (thomas.anders at blue-cable.de)
Bosch Breitbandnetze GmbH, Berlin, Germany


_______________________________________________
IPCDN mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/ipcdn