Re: [Ace] Offline operation of Resource Server

[Ludwig Seitz <[e-mail]>]

On 07/15/2014 10:25 AM, Likepeng wrote:
> Hi Ludwig,
>
>> It means exactly the kind of offline validation that Michael described above.
>>
>> 1. You need some initial enrollment of AS <-> RS (that could be online or offline
>> & manual such as by reading off some QR code with the RSs initial key material
>> and feeding that to the AS).
>>
>> 2. Then you need some online authorization decision step between C and AS.
>>
>> 3. Then (possibly later) there is some interaction between C and RS, that could
>> be offline. Here RS needs to be able to do offline validation of the
>> authorization decision from step 2.
>
> This seems to be the normal flow.
>
> If I check the draft section 4.3.4, in the normal flow, the RS also does not need to contact the AS for the online validation of the access token.
> http://tools.ietf.org/html/draft-selander-core-access-control-02
>
> Do you mean Client is also offline, and can't contact with AS?
>

I haven't really considered that, but it might be the case that in step 
3. even the client is offline. Think about the example Göran gave:

>
> One example of offline operations is for field technicians to physical
> access radio base station sites:
> If the base station is malfunctioning, there may be no cellular coverage
> at the site, and the field technician need to access the site to repair
> the base station (which then may become a catch 22).


-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone [phone]
http://www.sics.se