[hrpc] Authorization for IoT devices

[Michael Richardson <[e-mail]>]

HRPC folks,

Today, I made a presentation at IOTOPS about
       https://datatracker.ietf.org/doc/draft-richardson-iotops-iot-iot/
I will send a youtube link as soon as it is published.

The short is that I see a need to standardize the encoding of authorization
control lists in IoT devices.   It should be possible to determine who can
open one's front door, (or furnace or stove or security cameras...), and
also who can change the list.

I think that it should be possible to have a third party (person, device,
application) review the authorization list to see that, for instance, an
ex-spouse does not have access.  Or to allow a less technical person to
easily effect that new policy.

The access list might include a variety of other entities: banks with
mortgages, sherrif, landlord, building manager.  Some of these might be
proclaimed by local law, convention, or contract.   My goal isn't to say
whether these are good or bad things, but rather to be able to clearly
document them.   I don't know if your furnace manufacturer should have remote
access, but if they do, it should be explicit rather than implicitely
built-in to firmware.

I know that HRPC meets Tuesday, but I didn't ask for time because my week is
already full.  I'm asking that the RG might review the document, look at the
use cases, and ideally:
  1) suggest new ones
  2) tell me why some of mine are silly
  3) connect me with people who might be thinking about regulation in this area.

(The NYC key 2642/1620 situation begs for an auditable digital solution)

While I wrote the document about front door locks, one should think that it
applies to pretty much any major IoT device in the home.   While some systems
have a controller or commissioner or "home base" that collects the keys to
all other devices, in that case, who has the keys to his key holder?

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide