Re: [Iotops] [Rats] 802.1AR device identity

[Guy Fedorkow <[e-mail]>]

Hi Laurence,

  I agree that onboarding is the most-obvious use-case.  Security-related configuration that should be applied only to specific identified devices is another use.

  I think of IDevID as the serial number plate the manufacturer etches into a laptop, while LDevID is the asset tag the corporate IT department or its outsourced supplier sticks on the laptop.

  If you’re using the laptop in the same corporate context, the asset tag number is the uniform identifier across the org, and that’s likely to be the right thing to use.  If you bought it on ebay, use the IDevID!

  But it seems clear 802.1AR wasn’t designed with the intent of tracking devices through a chain of owners.  For that you might want something like the TCG Platform Certificate.

  /guy

 

 

From: Eliot Lear <[e-mail]> 
Sent: Sunday, April 18, 2021 9:52 AM
To: Guy Fedorkow <[e-mail]>
Cc: Laurence Lundblade <[e-mail]>; Ira McDonald <[e-mail]>; [e-mail]; Smith, Ned <[e-mail]>; [e-mail]; Henk Birkholz <[e-mail]>
Subject: Re: [Rats] 802.1AR device identity

 

Sorry for the delayed response:





	On 2 Apr 2021, at 19:05, Guy Fedorkow <[e-mail] <mailto:[e-mail]> > wrote:

	 

	Hi Laurence,

	  I agree that IDevID is intended to persist through the device’s lifetime, while LDevID is meant to represent the current owner.

 

Yes, that was the original intent, and even the current intent.  And while that is necessary, it may not be sufficient for long supply chains where ownership passes from one to another.  The LDevID is an owner-assigned name, and so the question is this: when an owner goes to transfer, does it need to use the IDevID again or should it use the LDevID?  There are benefits and drawbacks to both, but if the LDevID is used, then it is used as the IDevID would have been as part of that transfer.  The nice thing about FDO is that it keeps an entire record of these sorts of transfers.

 

Eliot