Re: [6tisch] [6tisch-security] proposed security text for architecture draft

[Michael Richardson <[e-mail]>]

<[e-mail]> wrote:
    > I mentioned EAP because it does not require to change AAA
    > infrastructure to interwork with, and AAA is needed where a huge number
    > of nodes have to be managed.  In smart meter use case, the number can
    > be tens of millions of smart meters with hundreds of thousands of PCE
    > for a single utility company.

I agree with your concern about the need for a scalable backend when there
are millions of smart meters.

Can you tell me a bit about the legacy AAA infrastructure whose existence 
you want to leverage: I'm all for resuing existing, fully paid-up infrastructure.

What does it do now (before smart meters are installed).  
Will this AAA infrastructure already have the capacity for these tens of
millions of smart meters?

If an interface to an AAA infrastructure was desired, I would add that as a
northbound interface on the JCE.  For millions of smart meters, I would
imagine deploying JCEs for groups of maybe ~10^3 to ~10^5 meters, and the the
JCE would speak radius to the AAA. It would use the joining node's IDevID to
discovery the right policy for this meter. It could also take this from LDAP,
From a RESTful interface, or via database interface directly.  
It doesn't really matter... I don't think meters need roaming support, but
maybe there is a use case I don't know about.

Also, I do not claim that any of the 6tisch industrial zero-touch system is
appropriate for non-industrial uses.  It probably a non-starter in the
home that lacks any kind of professional manager, and also lacks someone to
run the authorization authority.

-- 
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-