[smartpowerdir] report on the EC IOT experts group meeting in April

[Jari Arkko <[e-mail]>]

I was in my second EC IOT experts group meeting in April. As you may remember, this is a small group of experts and stakeholders who should guide EU's role in promoting IOT technology and setting governance directions. Zach Shelby and me alternate as the IETF representative in this group. The rest of the participants come from diverse backgrounds: Internet Governance people, industry group representatives, academia, etc.

This time their meeting focused on cellular networks and their role in the Internet of Things, the group continued the work on their governance paper, and we a presentation about ETSI's machine-to-machine standardization work.

Liberalization of mobile networks number spaces for IOT

Rudolf van den Berg from OECD argued that we need market liberalization (number spaces, SIM cards, etc) so that the "one million device users" (utility companies etc) can unlock themselves from providers. Currently, a utility company that acquires cellular network service from a particular operator gets SIM cards, phone numbers, IMSI, etc. from that operator, and changing the operator currently involves having to change those million SIM cards in the devices that in the field. This is limiting the growth of some IOT applications, particularly when a very large number of devices has to stay in use for a decade or longer. As a practical example, government organizations have a legal obligation to allow their service contracts opened up in periodic competitive bidding process, which basically forces them to plan for an eventual operator change in their IOT-based applications. In general, the requirements from these new types of users are the following:

- switch operator without switching SIM cards
- employ national roaming to avoid dark spots
- allow the user to negotiate roaming prices in different countries
- guarantees on life time of networks

There are technical solutions (network-reprogrammable SIM cards and so on) but they have not been standardized and they may not be flexible enough (I'm personally not sure that's true). Rudolf proposes opening up the IMSI space for non-operators, so that a large user could have their own number space, own SIM cards, and simply contract on a yearly basis with operators for running the authentication infrastructure and roaming.

Rudolf also had a nice classification of IOT applications into mobile/fixed vs. concentrated/dispersed, and showed how different types of network solutions are appropriate for different applications. Traffic applications are dispersed and mobile, for instance, and cellular network solutions fit very well here. Whereas home networking may be best covered by wireless local area networks. There is no clear single winner, both types of technology are needed. The "just turn it on" model of cellular devices and their SIM cards is very appealing, however. There are limited examples of other deployment models where no user interaction is required but the system can still run in secure manner.

Governance aspects

The group is working on a paper that defines the governance directions regarding IOT for the EU. This paper is not making as much progress as they had initially hoped, and several more meeting rounds will be needed. The most interesting part of the governance discussion was about the level of required human control. EU might set some basic principles on what IOT systems must follow with regards to human safety, control, privacy, etc. These principles would be very similar to those that have been already specified for privacy in EU, for instance. In the question of human control, the group was divided about whether there could be situations where human involvement cannot be allowed. The example that started this discussion was smart grid control of your air conditioning, should you be allowed to turn air conditioning on, even at times of high load? This topic provokes a lot of opinions, mostly about having to leave consumers and users a choice. That being said, there are already systems such as ABS brakes in cars that run autonomously and cannot be disabled. So maybe the example application was bad. The group had lot of discussion about the principles, and the room generally seemed to think that there has to be a baseline set of rules and principles -- allowing (some) control, privacy, fair access to information, and so on.

ETSI M2M

ETSI's work on M2M was presented. 70 organizations participate the work in ETSI M2M working group, mainly working on an architecture for M2M services. Their primary model is IP(v6) connectivity from sensors over some access network to a server platform that can serve the needs of multiple M2M applications. The work is primarily not about designing new protocols, existing protocols (HTTP etc) are reused where possible.

Given the wide interest to ETSI's work, there is a plan to move the work from a regional entity (ETSI) to a 3GPP-like partnership entity.

Other

The group also talked about privacy impact assessment (PIA) and got a presentation from a Dutch foundation Qiy and their unified view model into online resources. Next meetings are in June 30th, September 28-29th, and November 15-16th.