Re: [Iotops] maintain ownership (was: can we create protocols that securely transfer ownership?)

[Michael Richardson <[e-mail]>]

Amyas Phillips, Ambotec <[e-mail]> wrote:
    > Most IoT devices are
    > now sold with EULAs, constraining any remaining legal concept of
    > ownership with contractual terms.

    > You can even find that a licence
    > to use it is the only thing you get when you buy a device, legal title
    > remaining with the vendor.

Yes.
Many people have problems with this, but ideally, this state of things would be more explicit.
I think that, if explained clearly, that many entities would refuse to
"license" the device.

    > I’d like to suggest that we set aside legal title and say “ownership”
    > for the purpose of this discussion means “logical control of a
    > device”. Transfer of logical control is an important and delicate event
    > in an IoT device’s lifecycle so this seems to fit within the aims of
    > the charter, even if it isn’t mentioned explicitly.

    > I’d like to further suggest that logical control ultimately means the
    > right to control what software is installed on a device. That is to
    > say, ownership == logical control == the right to set and (if transfer
    > of control is supported) replace the firmware update trust anchor. That
    > is what ownership means. Every other form of control is delegated from
    > that and is called something other than “ownership".

This definition works for me.

    > 1. What if an IC has an integrated secure element under logical control
    > of a third party and it is impossible even for a person with legal
    > title to seize control of that SE?

    > That’s fine, just acknowledge the SE as a separate domain of
    > control. Someone has physical title, possibly constrained by license
    > terms. Someone has logical control of the SE. Someone has logical
    > control of the ‘insecure’ computing environment. It would a similar
    > situation in a device with a main application processor and separate a
    > wireless module with its own firmware.

    > 2. Wouldn’t this mean that any device whose firmware has to be signed
    > by its OEM is still under the logical control of and “owned” by that
    > OEM?

    > Yes.

Agreed.

    > 3. But that’s not who I mean when I talk about the owner!

    > I get it, but this just means different and more specific terminology
    > is required. You might mean the entity trusted by the device to issue
    > application-layer commands (possibly including commands to set
    > application-layer trust anchors).

Agreed.

    > 6. What if the device ships without trust anchors, who owns it then?

    > It is in a first-to-claim state. That assumes that once “claimed” it
    > can’t be claimed by anyone else without the current claimant’s
    > authorisation.

Or, maybe it can't be updated, and it's first-malware-to-claim :-)

    > 8. Isn’t is possible to dream up IoT devices that don’t have logical
    > controllers?

    > I guess so - you could do without secure boot and expose
    > unauthenticated interfaces, or you could make a device that is always
    > claimable - but that doesn't invalidate the concept.

Are you, in "always claimable", including the case that the device
manufacturer will delegate software signing to the legal physical owner?
Apparently, many enterprises demand the right to control what and when
updates are deployed, and thus this has become a thing in SUIT.

    > 9. What does transfer of ownership mean then?

    > Setting someone else’s TA in the initial bootloader.

!yup.

    > 10. What if a hacker obtains arbitrary code execution?

    > They 0wn the device but they don’t own it - not unless they can make
    > their control permanent across reboots. They have application layer
    > logical control until a reboot.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide