October 24, 2005 Network Firewall Configuration and Control Concerns Brent Hirschman

1 Major Concerns for Security Greatest concern for security is impact on RF Resources Handset viruses becoming significant concern Intrusion Detection system needs to be included Need to “Shut Down” Rogues Security Architecture Concerns Parallel architectures for QoS, Security, AAA Introduction of new Protocols Intrusion Detection System Impact

2 Architecture Concerns Basic NFCC Architecture Session Mgr Profile Mgr Ntwk Pres. Agent Traffic Filters RAN IP Ntwk User Profile DB NNI NLSP or PFCP

3 Intrusion Detection and Prevention Systems VAAAHAAA HA Access Router PDSN RAN IP Ntwk RAD or DIA NNI IP Ntwk Intrusion Detection and Prevention System Intrusion Detection System

4 Architecture Concerns Additional Capability of Intrusion Detection Session Mgr Profile Mgr Ntwk Pres. Agent Traffic Filters RAN IP Ntwk User Profile DB NNI NLSP or PFCP Intrusion Detection System Change Filters and tell PM of change and cause.

5 Architecture Concerns - Basic AAA Picture VAAAHAAA HA Access Router PDSN RAN IP Ntwk User Profile DB RAD or DIA NNI

6 Architecture Concerns Basic NFCC Architecture Session Mgr Profile Mgr Ntwk Pres. Agent Traffic Filters RAN IP Ntwk User Profile DB NNI NLSP or PFCP

7 Architecture Concerns Basic QoS Architecture Visited PDP Home PDP PEP RAN IP Ntwk User Profile DB NNI COPS-PR

8 Architecture Concerns Overlay Architecture – Why so many protocols? AAA/SM/ PDP AAA/PM/ PDP HA/NPA/ PEP PDSN/TF/ PEP RAN IP Ntwk User Profile DB NNI RAD/DIA NSLP/PFCP COPS-PR

9 Protocol Changes needed RADIUS/DIAMETER – Need Peering and negotiation – only DIAMETER COPS-PR – Need Visited and Home PDP – needed in world of Remote HAs. NSLP/PFCP – Need for new protocol? Can we put it in another protocol? Can we design a single protocol to do all this?