Re: [dhcwg] DHCP and DHCPv6 options for LWM2M services

[Srinivasa Rao Nalluri <[e-mail]>]

Hi,

To add more on certificate validation....

Idea is to trust your DHCP server to give valid certificate. Otherwise we have risk.
In TLS/PKI frame work there is no way to validate root certificate. That remains same with our proposal.

In TLS root certificates are generally not exchanged using any protocol. So risk is less.

Our proposal is trade-off between flexibility and risk

With regards
Srinivasa Rao Nalluri


From: Srinivasa Rao Nalluri
Sent: Tuesday, January 10, 2017 9:28 AM
To: 'Ted Lemon'
Cc: [e-mail]; Ari Keränen; Jan Melen; Jaime Jiménez; Amit Gupta X
Subject: RE: [dhcwg] DHCP and DHCPv6 options for LWM2M services

Hello Ted Lemon,

If I understand correct, you are asking how certificate supplied through DHCP option is validated.

The certificate supplied through DHCP option is not validated but it can be used to validate certificate offered by LWM2M server during LWM2M bootstrapping phase.

Instead of hardcoding root certificate in device by manufacturer, we are proposing to obtain same through DHCP option.

In case I misunderstood your question, please elaborate same.

With Regards
Srinivas

From: Ted Lemon [mailto:[e-mail]]
Sent: Monday, January 09, 2017 7:51 PM
To: Srinivasa Rao Nalluri
Cc: [e-mail]<mailto:[e-mail]>; Ari Keränen; Jan Melen; Jaime Jiménez; Amit Gupta X
Subject: Re: [dhcwg] DHCP and DHCPv6 options for LWM2M services

How would this be validated?

On Jan 9, 2017, at 2:00 AM, Srinivasa Rao Nalluri <[e-mail]<mailto:[e-mail]>> wrote:

Hi,

Considering growing popularity of Internet of Things and relevant protocols like LWM2M/CoAP/MQTT, we in Ericsson see need for new DHCP options to make LWM2M service deployment easy and flexible.

Light weight machine to machine (LWM2M) protocol is used to manage end device life cycle in machine to machine communication scenarios.
LWM2M device bootstrap is an optional life cycle phase for devices to  get needed information when starting up for first time.  Information
gathered during bootstrapping might include management server details  and security certificates required to establish connectivity with
management server.  Information required to connect with bootstrap  server might be hard coded during device manufacturing phase.

Hard coding configuration by device manufacturer forces device  operator to use same configuration as hard coded.  It is possible
that reachability information of bootstrap server that is hard coded may be outdated and boot strap server reachability might fail during
first use of device.  In such cases connectivity with bootstrap server is possible only through device software upgrade.

So, we see need to introduce two options to support LWM2M server URL and LWM2M server certificate that validates public key provided by LWM2M server. Thus bootstrap related information can be gathered by LWM2M client during DHCP/DHCPv6 negotiation phase. Draft available at below link describes details.

https://www.ietf.org/internet-drafts/draft-nalluri-dhc-dhcpv6-lwm2m-bootstrap-options-01.txt

This draft considers options for both DHCP and DHCPv6.

I would like this draft to be considered by DHC working group as work item. Please contact me for any further details.


With Regards
Srinivasa Rao Nalluri
Ericssion
India
_______________________________________________
dhcwg mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/dhcwg