Re: [Mud] DPP + MUD onboarding

["M. Ranganathan" <[e-mail]>]

A few holes .. excuse the spam I need to think this through again.


On Fri, Jan 10, 2020 at 2:14 PM M. Ranganathan <[e-mail]> wrote:
>
> I am tinkering with ideas on onboarding devices using DPP and device
> certificates.
>
> In DPP a trusted configurator onboards a device.  I added (prototyped)
> piggy backing device certificates to DPP config requests so the device
> transmits its full device certificate (not just raw public key) as
> part of the DPP config request. This certificate is verified by the
> configurator which is a trusted application assumed to have the CA
> certifcate and can be assumed to reside on the same network  as the
> MUD-enabled device.( This certificate transmission is not part of the
> DPP spec but I am hoping somebody picks up on it.)
>
> The question is how to transmit the MUD URLin a non-spoofable way
> given that the configurator is trusted, has possession of the public
> key of the device and has already onboarded the device. I want to
> avoid defining new API for the MUD controller.
>
> Does the following make sense?
>
> - Configurator broadcasts the public key and MAC address of the device
> being onboarded (which is part of the DPP onboarding URL) on the local
> network using a reserved port.
> - MUD server picks up this information.
> - MUD-enabled device sends *signed* MUD URL as part of the DHCP
> request (using options 161).
> - MUD server verifies signature and installs rules / blocks device if
> signature fails.
>
> Thank you for reading.
>
> Thoughts?
>
> Best regards and best wishes for 2020.
>
> Ranga
> --
> M. Ranganathan



--
M. Ranganathan