Re: [Iot-onboarding] Thinking through onboarding

[Mohit Sethi M <[e-mail]>]

Hi Scott,

Welcome to the list. It is always nice to get new perspective. :)

I agree with your comment about configuration vs. fleet management. And I strongly agree with your comment that manufacturer installed certs make the system very fragile. We have taken an eternity for manufacturers to not put default passwords. I am sure some manufacturers are better than others. And I am happy if devices could provide certificates to prove that they are authentic. But that would still not solve all our problems. Besides, active involvement of the manufacturer to track devices between owners is something that most privacy conscious people would frown upon.

I recommend you to have a look at EAP-NOOB slides here: https://datatracker.ietf.org/meeting/103/materials/slides-103-secdispatch-nimble-out-of-band-authentication-for-eap-eap-noob-draft-aura-eap-noob-04-01

It's security relies on an OOB channel. Whether that OOB channel is a QR code, NFC, blinking lights, or audio, it doesn't matter for EAP-NOOB. And it supports both directions. So if you are configuring a new TV, you can scan a QR code. On the other hand, if you are configuring a new home camera, you can show it a QR code. And it does not require yet another app. The OOB message is a URL. Therefore, any standard camera application or NFC enabled phone would do the job without requiring custom applications for each device.

Configuration of the Wi-Fi network is only a secondary bonus. The main use-case is to register a new device on the server and associate it with a user account. I know it uses EAP and a server. But I also think that it is time for us to move away from network-wide shared secrets.

--Mohit

PS: The spec is here: https://tools.ietf.org/html/draft-aura-eap-noob-06. Open source implementation (with formal security proofs) is here: https://github.com/tuomaura/eap-noob


On 9/11/19 7:55 PM, Scott Jenson wrote:
Michael Richardson introduced me to this mailing list. I'm working through the onboarding issue from and UX point of view, trying to make it 'just work' and my (likely naive) starting point is that when you turn on a device (or 20...) in your home they should 'just work' and auto connect.
Clearly there are a lot of reasons this is hard and I've been working through specificis of how to safely onboard a large number of devices (e.g. light switches and electrical sockets) . However, as I've worked through the entire customer journey, it's clear this is a very deep problem:

  1.  Correct Installation
Is each device correctly installed, especially for deployments with multiple people involved for industrial deployments. Are all devices powered up and ready to be onboarded? How do can you confirm? If you've installed X devices and only see X-1 devices, how do you find the missing one?

  2.  Mapping
What room is this in? What does it control?

  3.  Maintenance
Why isn't switch#27 responding? Where is switch #27? Can I replace switch#27?

It's the realization that it is more than just 'configuration' but really more 'fleet management'. I've come to the conclusion that to solve *just* the onboarding problem, isn't enough. The fleet management issue isn't something to put into the 'app layer' and not worry about it. It's something important for the onboarding issue as well.

What started my towards this list are my concerns with BRSKI. While having a company installed cert to connect to your specific WiFi can be fairly automatic and even magical, that seems like a very fragile system.. Most devices are bought through resellers so a bespoke cert is out of the question. Less urgent but still important are changes to your WiFi and reselling. All of these solutions point to the likely friction of a factory cert.

The only solution I've found so far is the Nest solution (I know, I'm from Google but I'm not selling it, I promise...) which has a QRcode on the device and an app. It's a pain to have an app in the loop but it allows: generic purchase (e.g. home depot) so anyone can setup anything (or move to a new Wifi AP)

I don't this this solution is good enough but it works and it's fairly secure. My goal in posting this to this list is to kick start a better solution.

To summarize: I feel that if we really believe in the potential of smart devices, we need to onboard dozens of devices at once. But doing so feels incredibly hard. One way forward would be to work on additional protocols, likely involving a location service (e.g. Wifi RTT) and a heartbeat service to kickstart some rudimentary fleet management to help troubleshoot any onboarding issues.. This may be longer term thinking but I assume this crowd is the one that would appreciate this issue.

Scott