[Ace] New doc: draft-maler-ace-oauth-uma-00

[Eve Maler <[e-mail]>]

Hi all,

Hannes, Erik, Samuel, and I worked on a new discussion document that gives insight into the ways in which OAuth and UMA could be used towards IoT requirements for authentication and authorization:

http://tools.ietf.org/html/draft-maler-ace-oauth-uma-00

Quoting the abstract:

   Authentication and authorization are fundamental security features
   used in Internet and Web applications.  Providing the same level of
   security functionality to the Internet of Things (IoT) environment as
   well is a logical enhancement and reduces the risk of unauthorized
   access to personal data.

   IoT devices, however, have limitations in terms of processing power,
   memory, user interface, Internet connectivity, etc.  Since many use
   cases span Web and IoT environments and the question of "Web" vs.
   "IoT" can in some cases be considered a continuum, it is required to
   find security solutions that can accommodate the capabilities and
   constraints of both environments without significant compromises.

   Thus, an approach of adapting already standardized and deployed
   authentication and authorization technologies is worth examining.
   This document describes how the Web Authorization Protocol (OAuth) in
   combination with User-Managed Access (UMA) can be used for an IoT
   environment to bring Web-scale authorization services to the IoT
   world.

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl