Re: [hrpc] [Iotops] Authorization for IoT devices

[Hannes Tschofenig <[e-mail]>]

Have you tried to use ACE-OAuth, Michael?

The work in the ACE group had the goal to develop an authorization solution for IoT devices.

-----Original Message-----
From: Iotops <[e-mail]> On Behalf Of Michael Richardson
Sent: Tuesday, July 27, 2021 4:03 AM
To: [e-mail]; [e-mail]
Subject: [Iotops] Authorization for IoT devices


HRPC folks,

Today, I made a presentation at IOTOPS about
       https://datatracker.ietf.org/doc/draft-richardson-iotops-iot-iot/
I will send a youtube link as soon as it is published.

The short is that I see a need to standardize the encoding of authorization
control lists in IoT devices.   It should be possible to determine who can
open one's front door, (or furnace or stove or security cameras...), and also who can change the list.

I think that it should be possible to have a third party (person, device,
application) review the authorization list to see that, for instance, an ex-spouse does not have access.  Or to allow a less technical person to easily effect that new policy.

The access list might include a variety of other entities: banks with mortgages, sherrif, landlord, building manager.  Some of these might be
proclaimed by local law, convention, or contract.   My goal isn't to say
whether these are good or bad things, but rather to be able to clearly
document them.   I don't know if your furnace manufacturer should have remote
access, but if they do, it should be explicit rather than implicitely built-in to firmware.

I know that HRPC meets Tuesday, but I didn't ask for time because my week is already full.  I'm asking that the RG might review the document, look at the use cases, and ideally:
  1) suggest new ones
  2) tell me why some of mine are silly
  3) connect me with people who might be thinking about regulation in this area.

(The NYC key 2642/1620 situation begs for an auditable digital solution)

While I wrote the document about front door locks, one should think that it
applies to pretty much any major IoT device in the home.   While some systems
have a controller or commissioner or "home base" that collects the keys to all other devices, in that case, who has the keys to his key holder?

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide




IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.