Re: [Anima] Homogeneous vs. heterogeneous trust domains (Re: What elements of IETF ANIMA can be used for I2NSF?)

[Michael Richardson <[e-mail]>]

Michael Behringer (mbehring) <[e-mail]> wrote:
    > Toerless summed it up nicely.

    > Inside a domain (for example, an enterprise network), you want a single
    > trust domain. The owner of that enterprise network wants all those
    > devices under one trust anchor. (Of course he can create sub-domains,
    > or several domains).

I think that we are all agreed on this.

    > Before they form part of a single domain, devices come from various
    > vendors, or are imprinted in various ways. In that part there are many
    > trust domains. As Brian points out, some domains will accept a call
    > home functions, others will not.

So, irrespective of whether there is a call-home part of the imprinting,
Brian's point was that some domains expect to the imprinting in the field,
and some prefer to do this in a virtual faraday cage.

I claim that there is doesn't matter where the initial imprinting occurs;
I think it's the same process.  All nodes should expect the potential for
their role to change after a power cycle/deep sleep.

    > Bottom line: We need a process which gets devices from various origins
    > and trust domains, and various ways to initialise them to a single
    > trust domain, for example an enterprise
    > network. draft-pritikin-bootstrapping-keyinfrastructures tries to
    > explain what this process could look like.

In other emails over the I've tried to fill in some details on such a
process, is it the time to recap that here?

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-