Re: [Rats] Dynamic Systems in IETF RATS (was Re: 3 Use cases)

["Oliver, Ian (Nokia - FI/Espoo)" <[e-mail]>]

Hello Michael,

If think you got both cases perfect there...actually they are the two use cases we are working on, so...


But in both cases, regardless of the network, there is a requirement for some dynamicity in the "pre known" devices. So for a rail environment the set of devices (eg: wagons) is known and combinations of those could be precalculated. For a medical system it becomes much more difficult in that the set of devices will potentially change rapidly.

Thinking about these cases suggests to me that we would need t concentrate more on the introduction protocols between attestable device and attestor - more work to be done here

And yes, the nightmare scenario is one where Scotty has to wait for the attestation server

Ian



--

Dr. Ian Oliver

Cybersecurity Research

Distinguished Member of Technical Staff

Nokia Bell Labs

[phone]

________________________________
From: Michael Richardson
Sent: Monday, 07 October 2019 15:32
To: Oliver, Ian (Nokia - FI/Espoo)
Cc: [e-mail]
Subject: Dynamic Systems in IETF RATS (was Re: [Rats] 3 Use cases)


Oliver, Ian (Nokia - FI/Espoo) <[e-mail]> wrote:
    > Dynamic Systems

    > All current integrity mechanism assume a certain degree of fixed
    > properties, eg: TPM's CRTM/SRTM, and known configurations. A case
    > exists where a set of, say, IoT devices each with integrity
    > measurements are attested by some Edge node. The Edge node may combine
    > the IoT device measurements into a single measurement (eg: Merkel
    > Tree). If the configuration of IoT device changes, particuarly in
    > relation to availability of device, then this combined measurement will
    > change. This changed measurement however may be a valid configuration.

    > For example, in a medical case, the set of measurement devices may be
    > rapidly changing due to necessity of network provisioning, device
    > availabiltiy etc, but the permutations of devices may still be valid.

So you are describing a system where there is an assembly of devices.
I have a few questions and want to offer a two categories:
1) the network's view of the devices is transparent.  That is, each device
   in the assembly is reachable by the network either through L2-bridging,
   L3-routing (facilited maybe by DHCPv6-PD), or because all devices are
   just connected to the same "wifi" or LLN.

2) the network's view of the devices is opaque: the network only sees some
   gateway device and perhaps all interaction is via an application layer gateway.

Case (2) seems that the layer of indirection means the assembly
gateway/controller should probably be a relying party for the devices,
and should communicate it's configuration to an attester in order to validate
it's configuration.  The network would see the resulting attestion of the
aggregate.  I don't see anything surprising or new here. Just a recursive
application of RATS.

Case (1) is therefore the more interesting case, I think.
I imagine, yes, some health care situation where the assembly is the hospital
room, and the devices are the individual monitors.  The room needs to attest
to it's ability to deal/collect the correct/complete set of information, and
one can see that the failure (or the deplection) of some device leads to the
room being "unviable", and requiring attention.

I also was thinking about an assembly that is a passenger-rail coach arranged
in a set.  Each has a series of safety sensors that the engine must
interrogate directly. But, it's not necessary for every sensor in every coach
to be functional, as there is some redundancy, not just within each vehicle,
but also because there are multiple vehicles.

===

In thinking about this, I also thought of some sf movie (Expanse, Star Trek,
Star Wars), where sensors and sub-systems get blown up/overloaded, and need
to be patched.  Chewbacca is waiting for the attestation system to agree that
all parts are installed correctly, and Han and R2D2 are effecting repairs... A
very dynamical system; but you don't get to lightspeed until is sure it won't
just kill everyone onboard.  ...
Scotty: "Captain! I canna give you warp speed until the wee attestations settle."

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [