Re: [T2TRG] Report from breakout on using application credentials to enable network access

Hi, 

> El 14 abr 2017, a las 19:31, Michael Richardson <mcr+ietf@sandelman.ca> escribió:
> 
> 
> Dan García Carrillo <dan.garcia@um.es> wrote:
>> Regarding the topic of network access for IoT devices.  We are
>> currently working on that, using RADIUS and EAP. Concretely, we are
>> using CoAP to transport EAP messages. The proposal is in
>> draft-marin-ace-wg-coap-eap.
> 
>> We have a functional prototype of the protocol for Contiki O.S. and we
>> have performed some tests comparing the performance to PANATIKI's
>> implementation of the PANA protocol for Contiki O.S shown in this
>> article. http://www.mdpi.com/1424-8220/16/3/358
> 
> What node provides the authenticator function?
> Do you have that part in Contiki?  Your document says you run that on a Linux
> system using hostapd.
> 
In the prototype implementation the Authenticator currently is outside the 6LowPAN. We connect to it with the border router in Contiki.  

> How do you establish the radius shared secret for node A or B,
> so that it can help enroll some future node E.  Or must it always go through
> pre-established controller C?
> 
> If that's an intended limitation, then it can't work for enrolling nodes
> in a route-over mesh, only for single-hop networks.
> 

Are you asking if we support the joining through an intermediary? If that is the case, we are currently working on that with a CoAP relay and CoAP proxy. The authentication is always with the Controller, through the intermediary (that is previously authenticated and shares key material with the Controller), and it would be no problem in a multi-hop network.

> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
> -= IPv6 IoT consulting =-
> 
> 

Regards,
Dan

> 
> _______________________________________________
> T2TRG mailing list
> T2TRG@irtf.org
> https://www.irtf.org/mailman/listinfo/t2trg