[Ace] Fw: [core] Invitation to New Non-WG Mailing List: Authentication and Authorization for Constrained Environments (ace)

[Likepeng <[e-mail]>]

I forward this email to ace mailing list.

It will be better to discuss it in ace.

@Rene, please join ace mailing list.

Thanks,
Kind Regards
Kepeng

-----邮件原件-----
发件人: core [mailto:[e-mail]] 代表 Rene Struik
发送时间: 2013年12月11日 22:45
收件人: Stefanie Gerdes; [e-mail]
抄送: [e-mail]; [e-mail]; [e-mail]; [e-mail]
主题: Re: [core] Invitation to New Non-WG Mailing List: Authentication and Authorization for Constrained Environments (ace)

[apologies for replying to all the IETF lists in the original cc]

Dear colleagues:

I have some initial feedback on the potential draft charter.

I believe it is really premature to write potential point solutions into a draft charter, in casu definition of a less constrained device that can be used to outsource computational, storage, or management functionality to. (Does this imply one envisions to have to buy a separate box/single point of failure to take on this task?) It would make much more sense to look into this problem space in terms of requirements first, with an eye towards scalability towards billion+ devices. This does not preclude this potential solution direction, but questions as to what this entails in terms of usability, scalability, and communications impact need to be clear first. This is an ambitious undertaking and many efforts in the past have been far less successful than initially thought. There is also an undercurrent in the draft charter text that there is a need for different "device types", which is not a priori clear. To realize the full potential of constrained networks, one should refle!
ct upon "
 trust" endowed upon single nodes, of whatever type, and consider limiting the impact of violation of this trust, should this occur, as an explicit design criterium.

In the end, this may be an undertaking that would be suitable as an IAB work item, considering potential scope.

Best regards, Rene

==

To achieve this, ACE will be able to employ an architecture with one or more trusted less-constrained devices which will relieve the constrained nodes from complex security related tasks (e.g. managing authorization policies and a large number of keys). ACE will use CoAP and employ security properties of DTLS whenever possible.




On 12/11/2013 8:46 AM, Stefanie Gerdes wrote:
> Hi everybody,
>
> As a result of discussions in the CoRE WG in Berlin and Vancouver the 
> new non-WG mailing list Authentication and Authorization for 
> Constrained Environments (ace) was created.
>
> The purpose of this list is to organize interest in a group to define 
> the charter for work on Authentication and Authorization for 
> Constrained Environments.
>
> Our mailing list can be found at (1), existing work can be found at 
> (2), and the draft charter can be found at (3).
>
> Please feel welcome to join the list and provide your feedback!
>
> Thanks,
>
> Kind Regards
> Kepeng & Stefanie
>
>
> (1)Mailing List
>
> https://www.ietf.org/mailman/listinfo/ace
>
> (2)Existing work:
>
> Use Cases:
> http://tools.ietf.org/id/draft-garcia-core-security
> http://tools.ietf.org/id/draft-greevenbosch-core-authreq
> http://tools.ietf.org/id/draft-seitz-core-sec-usecases
>
> Solutions
> http://tools.ietf.org/id/draft-gerdes-core-dcaf-authorize
> http://tools.ietf.org/id/draft-kang-core-secure-reconfiguration
> http://tools.ietf.org/id/draft-selander-core-access-control
> http://tools.ietf.org/id/draft-zhu-core-groupauth
> http://tools.ietf.org/id/draft-pporamba-dtls-certkey
> http://tools.ietf.org/id/draft-schmitt-two-way-authentication-for-iot
> http://tools.ietf.org/id/draft-seitz-core-security-modes
>
> (3)Draft Charter - Authentication and Authorization for Constrained 
> Environment (ACE)
>
> The CoAP (Constrained Application Protocol) is a light-weight 
> application layer protocol, especially suitable for applications such 
> as smart energy, smart home, building automation, remote patient 
> monitoring etc. Due to the nature of these applications, including a 
> critical, unattended infrastructure and usage in the personal sphere, 
> security and privacy protection are critical components.
>
> Currently, a problem with constrained devices is the realization of 
> such secure communication. The devices only have limited resources 
> such as memory, storage and transmission capacity. These constraints 
> severely limit the security functions and communications the device can perform.
> Missing functionality includes authentication, which provides trust 
> and ensures an entity is who it says it is, and authorization, which 
> defines and enforces access rights for different clients.
>
> The ACE WG focuses on providing constrained devices with the necessary 
> prerequisites to use REST operations in a secure way. Constrained 
> devices will thus be enabled to authenticate communications from other 
> (constrained or less-constrained) devices, to communicate securely 
> with them and to verify their individual authorization to access 
> specific resources. To achieve this, ACE will be able to employ an 
> architecture with one or more trusted less-constrained devices which 
> will relieve the constrained nodes from complex security related tasks 
> (e.g. managing authorization policies and a large number of keys). ACE 
> will use CoAP and employ security properties of DTLS whenever possible.
>
> The ACE WG has the following tasks:
> - Document the use cases and high-level requirements for secured 
> communication between constrained devices.
> - Define certificate profiling (what kinds of certificates and which 
> attributes are to be used).
> - Define a mechanism for authenticated and protected transfer of 
> authorization information suitable for constrained device to 
> constrained device communication.
> - Define an access ticket and authorization information format 
> suitable for constrained devices.
> - Define bootstrapping for authorization information using the 
> Resource Directory.


--
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]


_______________________________________________
core mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/core