Re: [Spud] Crypto-security of SPUD Properties?

[🔓Dan Wing <[e-mail]>]

On 24-Nov-2015 01:46 pm, Dave Dolson <[e-mail]> wrote: 
> I was just reading the property binding section of 
> https://tools.ietf.org/html/draft-trammell-spud-req-01.html#section-7.2 <https://tools.ietf.org/html/draft-trammell-spud-req-01.html#section-7.2>
>  
> (Sorry, if this has been discussed)
>  
> Is it intended that properties could be used to authoritatively indicate things to the network?
>  
> E.g., could network elements know with crypto-grade confidence that the server is an example.com <http://example.com/> server?
>  
> I’m thinking of a use-case in which an server (at example.com <http://example.com/>) wants to pay for a mobile user to receive content. The idea is that the user does not pay for the bits; the server pays.
> There are several reasons why the server might want to do so:
> - the price of purchased digital content (music, book, video) includes “free delivery”
> - reversed-charges communication (along the lines of North American  1-800 phone numbers)
> - delivery of advertising and promotional content.
>  
> Obviously the mobile operator’s charging device in the network wants to be sure this property cannot be spoofed by other servers.
>  
> I have some ideas about how the crypto would work. I don’t know if those details matter to SPUD, provided a property can crypto-sign a packet or tunnel, something like an AH header.
>  
> I think it might be possible to attach a property that is meaningless to any network device that a key hasn’t been shared with.
>  
> Does this seem like a reasonable thing to pursue in the context of SPUD? Is there interest in adding this to the list of use-cases?

This can be done with oauth, where the oauth "resource" is the network resource such as bandwidth (to download a file) or performance (low jitter or low delay for a game).  Typically oauth is used when the "resource" is your pictures stored on cloud service A and being made accessible to cloud service B.

-d