Vorlage 3b

2. Direct peering with the FOITT (direct peering agreement between the CSP’s AS and the FOITT’s AS)

8.2.1.3 Threat analysis of the IP DN Variant A: OpenVPN

The bilateral connection agreements shall define specific protective measures for the following points:

 Confidentiality (including data protection)

 Authentication

 Authorised access availability (i.e. no refusal of authorised access to network

elements, saved information, information flows, services and applications but not in terms of general availability)

 Data integrity

 Non-repudiation (incontestability of receipt of the data, similar to a registered letter with acknowledgment of receipt)

8.2.1.4 Scalability of the IP DN Variant A: OpenVPN

The scalability of the DN is restricted by the overall capacity of the FOITT transport network (backhauling) to the LEMF and by the capacity of the CSP’s peering partner or Internet access. The OpenVPN variant thus offers a limited available bandwidth.

The FOITT peering interface can be expanded up to a certain maximum bandwidth. There is also a maximum bandwidth for the FOITT transport network (backhauling) and the FOITT-PTSS interface. However, on account of the redundancy, the maximum individual bandwidth available per CSP is lower than the overall bandwidth.

The throughput within an OpenVPN tunnel is also limited. This capacity can be increased by using more powerful processors (vertical scaling). Also, additional OpenVPN tunnels may be added (horizontal scaling). The details are addressed in the bilateral connection agreements between the PTSS and the CSPs.

8.2.2 IP DN Variant B: Direct connection of a CSP to the PTSS

The CSP’s handover point (DN-HP) resides on the premises of the PTSS, near the LEMF system. The PTSS provides on its premises a shared co-location for a limited number of CSPs. Each CSP is responsible for the installation, operation and maintenance of its network termination equipment within the co-location. The interception data is handed over at the DN-HP non-encrypted. The CSP is responsible for the data delivery up to the handover points (DN-HP) on the premises of the PTSS.