Re: [Secauth] Review request- secauth - authentication and authorization - second draft

[Hannes Tschofenig <[e-mail]>]

Hi Hosnieh,

I just took a quick look at the scenarios. Comments are inline:

----


3.  Use cases

   The following subsections explain different use case scenarios.


3.1.  Verification of a User to an Application Over the Network

Alice turned on the wash machine at home and then went to work. Alice
can check the status of this wash machine using an application on her
Smartphone remotely at company x. Wash machine doesn?t support any
certificates signed by a CA. Alice needs to be authenticated in the
wash machine and wash machine needs to trust Alice to allow her
control it.


[hannes] Take a look at the ACE use case document. This use case sounds
very similar to what we are trying to address. Here is the pointer to
the use case document:
http://tools.ietf.org/html/draft-seitz-ace-usecases-01



3.2.  Home User Behind Firewall or a Proxy Server

Alice?s device is behind a firewall or a proxy server. Alice wants to
use an application that uses SIP protocol to contact Bob. Bob rejects
any unknown calls to avoid advertisements/spam. Proxy server needs to
verify Alice and send the information to Bob?s device

[hannes] Hasn't this been solved already with the work on SIP?


3.3.  Home Gateway/Device with an Static IP Address (Valid IP)

Scenario 1: Alice needs to control its home gateway and add new rules
so that she can access a device inside her home network. Alice
remotely connects to this device. This device doesn?t support any
valid CA. The device needs to authenticate Alice before lets it
control this device and add/modify any new rule to this device.

[hannes] Today this issue is solved by either connecting to the device
in a special way (when you install it) and then provision your
username/password or you use some other pairing procedure (such as
entering info that is printed on the bottom of the device).

These pairing procedures are interesting but they often relate to the
radio technology that is being used (compare Bluetooth vs. WiFi) and
then there are various technologies that have been explored (and
standardized already).


Scenario 2: Alice?s wash machine technically has a problem. Its
application was configured by the vendors? in a way to report this
problem automatically to a technical service (repair place). Both the
technical service application and wash machine need to authenticate
each other so that they can trust and exchange information.

[hannes] This is not a common use today but what is common is that
devices get provisioned with long-term keys during the manufacturing /
provisioning process and then they talk to the websites of the
manufacturer. In fact, this is the most common deployment model of IoT
appliances today.


3.4.  Verification of an App. to an App. Over the Network

[hannes] I don't know a lot about these use cases since I did not follow
the OpenFlow work. So, I will skip those.

----

Ciao
Hannes


On 09/15/2014 05:22 PM, Hosnieh Rafiee wrote:
> Hello,
> 
> I have revised the secauth requirement and use case draft. I would appreciate your inputs on this new version.
> 
> I am going to upload after receiving more feedback
> The current pre-upload version can be found here:
> 
> < http://editor.rozanak.com/show.aspx?u=AZ6AA4BFD809BB71B2544CTAM >
> 
> @Paul, Viktor: would you please check to see whether the document is clear and satisfy the changes you have asked.
> 
> @folks: I welcome more comments before uploading new version. Please share your inputs on editorial, document organization or technical.
> 
> Thanks,
> Best,
> Hosnieh
> 
> 
> _______________________________________________
> Secauth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secauth
>