Subject: Re: [Apn] why it is necessary to differentiate the security concern for 5G Vertical Networks from the grand Internet ( was RE: Application-Aware Networking (APN) focused interim

From: Michael Richardson <[email-masked]>
Date: Fri, 4 Jun 2021 12:32:04 -0400

On 2021-05-27 6:51 p.m., Linda Dunbar wrote:
> Michael,
> 
> Since you have "mostly ignored 5G", here are some real money making business enabled by 5G.
> 
> https://www.youtube.com/watch?v=herCDIhWUnM

_New 5G technology 'transforms virtual sport and entertainment viewing'
Was pretty much content-free.  I learnt that I might be able to order 
hotdogs while at the game

> https://youtu.be/Gtu11EuCSXw

5G for Sport	- a bunch of not yet here user interface technologies from 
BT... Google Glasses redux... "Every seat will be the best seat in the 
house"... just pure fantasy for the UI side of things in my opinion. 
But, I'll accept this technological McGuffin for the moment.

> https://www.youtube.com/watch?v=ZNQ4c4xeKEg

Verizon 5G Edge and AWS Wavelength: Changing the experience of 
basketball | Verizon

All about shot-tracker.  They compared 5G to "4G", but not, to for 
instance, wifi6.

> 
> The business model is no longer the traditional monthly subscribers, but more of the Services oriented business model, enabled by dedicated closed-looped or Non-Public Networks (called by 3GPP).
> 
> Those Closed-Looped networks or Non-Public Networks, where APN is more likely to be valuable, have different security concern than the public Internet. It is not Netflix sending traffic across the public Internet and requiring subscribers to pay a premium, which has net neutrality and privacy issues.
> 
> In the Closed Looped Service Network, there is always a Service controller dictating various policies. There are many things that the Network needs to interact with the Service Controller, which is out of the scope of IETF APN. From IETF APN perspective, it needs to achieve optimized forwarding based on the Application characteristics managed by the Application/Service Controller.

Videos 1 and 2 were all about subscribers getting access to content, 
exactly as with netflix, but now all multi-feed, live and in 3D plus 
replays.   I saw nothing about a services oriented business model.
I see that the applications need to very clearly articulate which 
streams they care about, and this needs to go into the network.
(I don't really care if "Netflix" is across the Internet or via private 
peering.  It crosses an AS, and in the virtual interim this fact was 
re-iterated)

The shot-tracker situation sounds like some kind of local 5G deployment 
at the basketball team training facility replacing, I guess, wifi. I'm 
unclear why there is any data going offsite ("edge computing" is 
mentioned a lot).... but maybe there is some AWS connection.  But, given 
that the whole facility is wired, I don't see why fiber can't provide.

So all my points remain: if end-user devices are involved (up to the 
application in order to know which QUIC streams are which), then we need 
a trust model between the devices and the Service Controller.  The lack 
of this trust model is why all the previous efforts have failed. 
Rejigging the L2 encoding won't change this.

Getting that trust model in place would be truly revolutionary.
Not only could I pay for better bandwidth when I need it, but I could 
also "unpay" for nuissance traffic and have it blocked upstream.
DOTS has gotten a lot way towards this, but it depends somewhat upon the 
home routers being provisioned by the ISP, and does not include end 
devices as yet.

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 4 Jun 2021 17:42:12 +0000

Michael, 

WIFI is collision based transmission, and it doesn't support radio side differentiated services as good as 5G Radio does. 
Therefore, WIFI can't support specialized ultra-low latency services as 5G does. 

There is no point convincing you of the 5G value. But one thing for sure, there are a lot of 5G enabled vertical services powered by specialized closed loop networks. Netflex is not one of them. 

Linda

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Michael Richardson
Sent: Friday, June 4, 2021 11:32 AM
To: [email-masked]; [email-masked]
Subject: Re: [Apn] why it is necessary to differentiate the security concern for 5G Vertical Networks from the grand Internet ( was RE: Application-Aware Networking (APN) focused interim

On 2021-05-27 6:51 p.m., Linda Dunbar wrote:
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> youtube.com%2Fwatch%3Fv%3DherCDIhWUnM&amp;data=04%7C01%7Cldunbar%40fut
> urewei.com%7C183a263cffab4b8988c508d92776529e%7C0fee8ff2a3b240189c753a
> 1d5591fedc%7C1%7C1%7C637584211419748943%7CUnknown%7CTWFpbGZsb3d8eyJWIj
> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&am
> p;sdata=0%2FxH6V157DXKpaOAtDxZT1kjNC3kFV4FL78q99iUpF4%3D&amp;reserved=
> 0

_New 5G technology 'transforms virtual sport and entertainment viewing'
Was pretty much content-free.  I learnt that I might be able to order hotdogs while at the game

> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyout
> u.be%2FGtu11EuCSXw&amp;data=04%7C01%7Cldunbar%40futurewei.com%7C183a26
> 3cffab4b8988c508d92776529e%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%
> 7C637584211419748943%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQI
> joiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=oVl1wFM23Gt
> FkvXHF4cOFpSbPpRo36FLVTkCtlemO4E%3D&amp;reserved=0

5G for Sport	- a bunch of not yet here user interface technologies from 
BT... Google Glasses redux... "Every seat will be the best seat in the house"... just pure fantasy for the UI side of things in my opinion. 
But, I'll accept this technological McGuffin for the moment.

> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> youtube.com%2Fwatch%3Fv%3DZNQ4c4xeKEg&amp;data=04%7C01%7Cldunbar%40fut
> urewei.com%7C183a263cffab4b8988c508d92776529e%7C0fee8ff2a3b240189c753a
> 1d5591fedc%7C1%7C1%7C637584211419748943%7CUnknown%7CTWFpbGZsb3d8eyJWIj
> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&am
> p;sdata=gtR%2Fbp8Y47j45e4OfuPNARVLdpib337vjQSYzRLNwCM%3D&amp;reserved=
> 0

Verizon 5G Edge and AWS Wavelength: Changing the experience of basketball | Verizon

All about shot-tracker.  They compared 5G to "4G", but not, to for instance, wifi6.

> In the Closed Looped Service Network, there is always a Service controller dictating various policies. There are many things that the Network needs to interact with the Service Controller, which is…

Videos 1 and 2 were all about subscribers getting access to content, exactly as with netflix, but now all multi-feed, live and in 3D plus 
replays.   I saw nothing about a services oriented business model.
I see that the applications need to very clearly articulate which streams they care about, and this needs to go into the network.
(I don't really care if "Netflix" is across the Internet or via private peering.  It crosses an AS, and in the virtual interim this fact was
re-iterated)

The shot-tracker situation sounds like some kind of local 5G deployment at the basketball team training facility replacing, I guess, wifi. I'm unclear why there is any data going offsite ("edge computing" is mentioned a lot).... but maybe there is some AWS connection.  But, given that the whole facility is wired, I don't see why fiber can't provide.

So all my points remain: if end-user devices are involved (up to the application in order to know which QUIC streams are which), then we need a trust model between the devices and the Service Controller.  The lack of this trust model is why all the previous efforts have failed. 
Rejigging the L2 encoding won't change this.

Getting that trust model in place would be truly revolutionary.
Not only could I pay for better bandwidth when I need it, but I could also "unpay" for nuissance traffic and have it blocked upstream.
DOTS has gotten a lot way towards this, but it depends somewhat upon the home routers being provisioned by the ISP, and does not include end devices as yet.

--
Apn mailing list
[email-masked]
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fapn&amp;data=04%7C01%7Cldunbar%40futurewei.com%7C183a263cffab4b8988c508d92776529e%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637584211419748943%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=wYgoIqsfHsLoNXE%2BUV8Hq5z7CP0TK2F6LzKgJ6%2F4Wv8%3D&amp;reserved=0

---

From: Michael Richardson <[email-masked]>
Date: Fri, 04 Jun 2021 14:55:41 -0400

Linda Dunbar <[email-masked]> wrote:
    > There is no point convincing you of the 5G value. But one thing for
    > sure, there are a lot of 5G enabled vertical services powered by
    > specialized closed loop networks. Netflex is not one of them.

You've missed the point.
This wasn't about whether 5G was good or bad.
It was about use cases for APN.

(ps: I learnt nothing about 5G from the videos. I actually know a great deal
about it.  I don't believe even the moderate claims will come true, for the
reasons I wrote about: lack of a trust model between end user and operator.
I think that operators will be seriously disappointed)

Two of the examples you gave me for *APN* (+ 5G) involve the public, using
devices they own, accessing high-end sports across a public network.
You've told me that this isn't the use case for APN, so why did I watch these videos?

One example you gave me compared *4G* (3GPP) against 5G for shot-tracking stuff.
Not being a basketball coach, I have really no idea what the effect of
latency is on that.  But, again, I don't know how APN fits into this.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 4 Jun 2021 19:30:50 +0000

Michael, 

I meant to say that APN is useful in those "Closed Loop Networks", which are becoming more common for the 5G enabled special services. 

The "end user" or services that need APN are the one who have special contracts with the operators. Not all services. 

Linda Dunbar

-----Original Message-----
From: Apn <[email-masked]> On Behalf Of Michael Richardson
Sent: Friday, June 4, 2021 1:56 PM
To: [email-masked]; [email-masked]
Subject: Re: [Apn] why it is necessary to differentiate the security concern for 5G Vertical Networks from the grand Internet ( was RE: Application-Aware Networking (APN) focused interim

You've missed the point.

(ps: I learnt nothing about 5G from the videos. I actually know a great deal about it.  I don't believe even the moderate claims will come true, for the reasons I wrote about: lack of a trust model between end user and operator.
I think that operators will be seriously disappointed)

Two of the examples you gave me for *APN* (+ 5G) involve the public, using devices they own, accessing high-end sports across a public network.
You've told me that this isn't the use case for APN, so why did I watch these videos?

One example you gave me compared *4G* (3GPP) against 5G for shot-tracking stuff.
Not being a basketball coach, I have really no idea what the effect of latency is on that.  But, again, I don't know how APN fits into this.

---

From: Michael Richardson <[email-masked]>
Date: Sat, 05 Jun 2021 13:40:56 -0400

Linda Dunbar <[email-masked]> wrote:
    > I meant to say that APN is useful in those "Closed Loop Networks",
    > which are becoming more common for the 5G enabled special services.

So what parts of the Close Loop Network needs standards work?

    > The "end user" or services that need APN are the one who have special
    > contracts with the operators. Not all services.

I'm rather convinced that you could use RSVP+Diffserv (aka "diffedge") to do
this then.  diffedge did not, AFAIK, ever make it out of ID.
     https://www.ietf.org/archive/id/draft-bernet-diffedge-01.txt

While Joel mentioned many things that made "Intserv" (just RSVP) undeployable
in the Internet, it was deployable within Enterprises, and there are now 20+
years of improvements to forwarding plane and control plane CPUs.
Given that you have a closed environment, it seems like diffedge + SDN ought
to do what you want.

---

From: "Pengshuping (Peng Shuping)" <[email-masked]>
Date: Mon, 7 Jun 2021 01:50:26 +0000

Hi Michael, 

Many thanks for your interests and the discussions. 

A few clarifications to your points regarding APN.

1. The end-user devices are NOT involved.
2. The "Cloud Loop Networks" should mean about a service operator's controlled network or an enterprise's network, i.e. a limited domain. Although it is a limited domain, still the network is generally built using the devices from multiple vendors, and that is why the standards is needed. 
3. RSVP+Diffserv should have been able to provide differentiated services to some level. However, RSVP replies on end-to-end signaling and it is stateful, while APN relies on the attribute carried in the packet indicating the traffic classification and service provisioning which allows a much better scalability. 

Some logics behind APN is like the followings. 

The traditional services does not have too much differentiated service requirements, so COS/DSCP may be enough. But now we have 5G, the eMBB, uRLLC, and mMTC as well as the various verticals (e.g. Smart City, Smart Grid, V2X, Industry IoT, etc.) have very diverse service requirements, which caused the granularity provided by even DSCP not enough. Meanwhile the network capabilities enabling differentiated services, such as SR policies and network slicing (hundreds to thousands), have been evolving. So there is a mismatch between such 5G differentiated service requirements and the advanced network capabilities, wherein APN fits in the gap. The APN attribute could be used to express the fine granularity service requirements of the 5G or vertical services. It makes the traffic as an object to be served in the network, and it can be used for policy enforcements in the various nodes along the path such as traffic steering at the headend, performance measurement at the midpoint, and so on. 

Best regards, 
Shuping 

-----Original Message-----
From: rtgwg [mailto:[email-masked]] On Behalf Of Michael Richardson
Sent: Sunday, June 6, 2021 1:41 AM
To: linda 73504 <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [Apn] why it is necessary to differentiate the security concern for 5G Vertical Networks from the grand Internet ( was RE: Application-Aware Networking (APN) focused interim

    > contracts with the operators. Not all services.

I'm rather convinced that you could use RSVP+Diffserv (aka "diffedge") to do this then.  diffedge did not, AFAIK, ever make it out of ID.
     https://www.ietf.org/archive/id/draft-bernet-diffedge-01.txt

While Joel mentioned many things that made "Intserv" (just RSVP) undeployable in the Internet, it was deployable within Enterprises, and there are now 20+ years of improvements to forwarding plane and control plane CPUs.
Given that you have a closed environment, it seems like diffedge + SDN ought to do what you want.

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 7 Jun 2021 14:56:15 +0000

Michael, 

Closed Loop Networks still have nodes from different vendors, like UPFs can be from vendor A and B, routers connecting the edge servers to UPFs can be from Vendor X/Y/Z. 
Therefore,  Closed Loop Networks still need standardization. E.g. IETF DETNET is used for closed loop networks. 

If using RSVP+Diffserv, extension is needed to represent finer grade of services. I assume that APN is meant to address those extensions. 
The draft-peng-apn-scope-gap-analysis has more detailed analysis. 

Linda Dunbar

---

From: Michael Richardson <[email-masked]>
Date: Fri, 11 Jun 2021 12:43:48 -0400

Pengshuping (Peng Shuping) <[email-masked]> wrote:
    > 3. RSVP+Diffserv should have been able to provide differentiated
    > services to some level. However, RSVP replies on end-to-end signaling
    > and it is stateful, while APN relies on the attribute carried in the
    > packet indicating the traffic classification and service provisioning
    > which allows a much better scalability.

*diffedge* is RSVP signaling from the end station (or encapsulating
 node) to the *edge* of that network, at which point there is a device which
 translates the RSVP into diffserv.
 This means that the core of the network does not need to scale, nor keep  state.
 This also means that the diffserv marks are applied by a device which is
 trusted by the core to mark correctly.

    > The traditional services does not have too much differentiated service
    > requirements, so COS/DSCP may be enough. But now we have 5G, the eMBB,
    > uRLLC, and mMTC as well as the various verticals (e.g. Smart City,
    > Smart Grid, V2X, Industry IoT, etc.) have very diverse service
    > requirements, which caused the granularity provided by even DSCP not
    > enough.

This is an assertion which I still haven't seen explained in the use cases.
While many networks use like four diffserv code points, and use them for the
default value, the 64 diffserv code points are intended to be a palette.

    > Meanwhile the network capabilities enabling differentiated
    > services, such as SR policies and network slicing (hundreds to
    > thousands), have been evolving.

okay, but I still don't understand how network slicing matters, except that
it creates a lot more queues to put things into.

    > So there is a mismatch between such 5G
    > differentiated service requirements and the advanced network
    > capabilities, wherein APN fits in the gap. The APN attribute could be
    > used to express the fine granularity service requirements of the 5G or
    > vertical services.

How fine?  you said that end stations are not involved.
How how is the classication done in order to find this fine structure?
In the meeting last week, the classication was to occur on destination
address only.

    > It makes the traffic as an object to be served in
    > the network, and it can be used for policy enforcements in the various
    > nodes along the path such as traffic steering at the headend,
    > performance measurement at the midpoint, and so on.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Michael Richardson <[email-masked]>
Date: Fri, 11 Jun 2021 12:53:11 -0400

Linda Dunbar <[email-masked]> wrote:
    > Closed Loop Networks still have nodes from different vendors, like UPFs
    > can be from vendor A and B, routers connecting the edge servers to UPFs
    > can be from Vendor X/Y/Z.  Therefore, Closed Loop Networks still need
    > standardization. E.g. IETF DETNET is used for closed loop networks.

I never argued that there shouldn't be standardization.
I'd sure like you to go far beyond where you are proposing.
I'm asking for something more specific in the requirements.

    > If using RSVP+Diffserv, extension is needed to represent finer grade of
    > services. I assume that APN is meant to address those extensions.  The
    > draft-peng-apn-scope-gap-analysis has more detailed analysis.

}   Application-aware Networking (APN) is introduced in
}   [I-D.li-apn-framework] and [I-D.li-apn-problem-statement-usecases].
}   APN conveys an attribute along with data packets into network and
}   make the network aware of fine-grain user group-level and application
}   group-level requirements.

how is the "user" or "application" identified by the classifier, if end
stations are not involved?  Destination address can sometimes identify the
application, but it can't identify the user.

But the document says that the CPE is going to look at 5-tuple:
}5.  Basic Solution and Benefits
}
}   With APN, at the edge node, i.e. CPE, of the SD-WAN (see Figure 2),
}   the 5-tuple, plus information related to user or application group-
}   level requirements is constructed into a structured value, called as
}   APN attribute.

section 6.1 explains why you can't use flow-label, but a stack of MPLS labels
seems to work just fine, and it's got many more bits than DSCP.