Re: [Danish] Proposed WG Charter

[Paul Wouters <[e-mail]>]

On Mon, 14 Jun 2021, Ash Wilson wrote:

> Very often, mobile data used for IoT ends up going into a message broker or message queueing system, and the central application subscribes or otherwise
> consumes information from the messaging middleware. Without some sort of verifiable sender identity attached to the message itself, the identity of the
> sender and the integrity of the message is assumed based on the integrity of all middleware involved in passing messages. If we include the sender's DNS
> name in the message and protect it with a signature, then it may be verified by the central application, independent of the transport over which it
> arrives. Then, mobile data network authentication becomes more about protecting availability and performance than preventing impersonation in a
> message-oriented application. Use cases centering around mobile network identities are a little more nuanced, and the available mechanisms can vary based
> on the mobile operator's tech stack. That's probably a better conversation for 3GPP.

But the price of this method is revealing the DNS FQDN and IP of the IoT
device. I can't come up with a use case where an IoT device would gain
more than it loses from announcing to the world who it is and where it is.

Traditionally, this is all done using public/private CA's where the
client conveys it identity securely via TLS client authentication
using a certificate, or by not authenticating the TLS client and
forcint the client to do an authentication after the TLS connection
has estbalishes, eg via Basic Auth at the HTTP level.

> Consider that if a messaging middleware platform is trusted by multiple sophisticated smart cities applications, and none of those applications implement
> message authentication, the messaging middleware platform itself becomes an attractive target for a well-resourced adversary. Simply signing the messages
> passing through the system removes the pressure on the broker to ensure integrity, and reduces the value of a compromised broker.

But again, at a price of exposing the identity and the IP address /
locatin of the client. That makes it vulnerable to DoS attacks, eg
flood pings to its IP, or more subtle timing attacks - eg I ping it but
depending on the response time I can infer it is busy or not with its
actual job.

Paul