Re: [fun] WG Review: Home Networks (homenet)

[Keith Moore <[e-mail]>]

> 
> The purpose of this working group is to focus on this evolution, in
> particular as it addresses the introduction of IPv6, by developing an
> architecture addressing this full scope of requirements:
> 
> o  prefix configuration for routers
> o  managing routing
> o  name resolution
> o  service discovery
> o  network security

it seems like host/device security, as distinguished from network security, should also be in this list.

ease of configuration would appear to be paramount, and this touches on the interface between hosts/devices and the home network, particularly any perimeter based security mechanisms.  I'm thinking that when someone gets a new device, they might need to "pair" it with their network (similar to Bluetooth devices) so that the perimeter security devices know to allow traffic for it (and what kinds of traffic to allow).  similarly, hosts which have permission to access such devices from outside of the home network might also need to be "paired". 

one of the questions that I have is: to what extent is it reasonable to expect that network-accessible devices made for use in homes (and hosts that talk to them) are different than network-accessible devices used in other environments (and the hosts that talk to them)?  offhand I'm thinking that you want to be able to support ordinary hosts, devices, and applications on home networks, but it might take a bit more work to get their traffic through perimeter security.  similarly, you want to be able to enable ordinary hosts to talk to things on the home network, but doing so might be more cumbersome than for hosts with the appropriate support built-in.   there are multiple approaches for external access that could be considered: proxies, IPsec, tunnels, etc.  one thing that should be clear up front, is that using ip addresses for authentication tokens is a bad idea, no matter how widespread the practice is.

I guess I think that there's a real need to develop a standard means to arrange for secure external access to internal devices that are granted permission for such access.

> The task of the group is to produce an architecture document that
> outlines how to construct home networks involving multiple routers and
> subnets. This document is expected to apply the IPv6 addressing
> architecture, prefix delegation, global and ULA addresses, source
> address selection rules and other existing components of the IPv6
> architecture.

I don't think it should be presumed that ULA's are applicable.  Perhaps, but not certainly.  ULAs should be limited to devices for which there is never any need to be accessed from outside the network, or to access external hosts, and offhand I can't think of a situation that makes it reasonable to impose this limitation on every device on a network segment..  If ULAs can be doled out to only those devices that do not have permission for external access, independent of network segment, that might be fine. 

Keith