[core] Invitation to New Non-WG Mailing List: Authentication and Authorization for Constrained Environments (ace)

Hi everybody,

As a result of discussions in the CoRE WG in Berlin and Vancouver the
new non-WG mailing list Authentication and Authorization for Constrained
Environments (ace) was created.

The purpose of this list is to organize interest in a group to define
the charter for work on Authentication and Authorization for Constrained
Environments.

Our mailing list can be found at (1), existing work can be found at (2),
and the draft charter can be found at (3).

Please feel welcome to join the list and provide your feedback!

Thanks,

Kind Regards
Kepeng & Stefanie

(1)Mailing List

https://www.ietf.org/mailman/listinfo/ace

(2)Existing work:

Use Cases:
http://tools.ietf.org/id/draft-garcia-core-security
http://tools.ietf.org/id/draft-greevenbosch-core-authreq
http://tools.ietf.org/id/draft-seitz-core-sec-usecases

Solutions
http://tools.ietf.org/id/draft-gerdes-core-dcaf-authorize
http://tools.ietf.org/id/draft-kang-core-secure-reconfiguration
http://tools.ietf.org/id/draft-selander-core-access-control
http://tools.ietf.org/id/draft-zhu-core-groupauth
http://tools.ietf.org/id/draft-pporamba-dtls-certkey
http://tools.ietf.org/id/draft-schmitt-two-way-authentication-for-iot
http://tools.ietf.org/id/draft-seitz-core-security-modes

(3)Draft Charter - Authentication and Authorization for Constrained
Environment (ACE)

The CoAP (Constrained Application Protocol) is a light-weight
application layer protocol, especially suitable for applications such as
smart energy, smart home, building automation, remote patient monitoring
etc. Due to the nature of these applications, including a critical,
unattended infrastructure and usage in the personal sphere, security and
privacy protection are critical components.

Currently, a problem with constrained devices is the realization of such
secure communication. The devices only have limited resources such as
memory, storage and transmission capacity. These constraints severely
limit the security functions and communications the device can perform.
Missing functionality includes authentication, which provides trust and
ensures an entity is who it says it is, and authorization, which defines
and enforces access rights for different clients.

The ACE WG focuses on providing constrained devices with the necessary
prerequisites to use REST operations in a secure way. Constrained
devices will thus be enabled to authenticate communications from other
(constrained or less-constrained) devices, to communicate securely with
them and to verify their individual authorization to access specific
resources. To achieve this, ACE will be able to employ an architecture
with one or more trusted less-constrained devices which will relieve the
constrained nodes from complex security related tasks (e.g. managing
authorization policies and a large number of keys). ACE will use CoAP
and employ security properties of DTLS whenever possible.

The ACE WG has the following tasks:
- Document the use cases and high-level requirements for secured
communication between constrained devices.
- Define certificate profiling (what kinds of certificates and which
attributes are to be used).
- Define a mechanism for authenticated and protected transfer of
authorization information suitable for constrained device to constrained
device communication.
- Define an access ticket and authorization information format suitable
for constrained devices.
- Define bootstrapping for authorization information using the Resource
Directory.