[T2TRG] Report from breakout on using application credentials to enable network access

[Mohit Sethi <[e-mail]>]

Topic: Use of application credentials for enabling network access (and 
vice-versa).

Participants (15 active): Erik Nordmark (note taker), Mohit Sethi 
(breakout leader), Thorsten Dahm, Donald Eastlake, Behcet Sarikaya, 
Demir Rakanovic, Phillip Hallam-Baker, Grace Lewis, Ludwig Seitz, 
Muhhamad Sajjad, Jari Arkko, Laurent Toutain, Hitoshi Asaeda, Francesca 
Palombini, Stephen Kraiman.

Summary and Conclusions from breakout:

1. It can be useful to enable network access for IoT devices using 
application credentials: This leads to less configuration work for the 
user of a new IoT device which is especially beneficial since the 
devices often have limited UI. Think of a new IoT toothbrush that you 
have just purchased. You bring it home and register it with the 
manufacturer (by reading a serial number/public key/scanning QR code 
etc.). It would be nice if the manufacturer can then tell the Access 
Point (AP) at the 
users home to enable limited Internet connectivity for the device.

2. Interesting to investigate if we can reverse the direction of 
enabling network-access: Instead of adding software and hardware 
complexity in the devices itself, it would make sense to simply put the 
dumb IoT devices at the desired location and then enable access from a 
server which is more resourceful.

3. Isolation: It would also be smart to put the IoT devices in separate 
VLANs. When the device is authenticated as an IoT device it should be 
put in its separate VLAN so that it has limited connectivity to only a 
couple of services (such as calling home for software update etc).

4. Scaling this to 1000s or 10k devices can be challenge. This also 
relates to the fact that enterprise scenarios are very different from 
the home scenarios. Enterprises may not want to delegate network access 
authentication to an external third party (such as the IoT device 
manufacturer).

5. Revoking network access should be secure and simple. For example, if 
one of the IoT devices is lost or sold, it shouldn't require you to 
change the network-access credentials for all the devices.


Possible Research work: Can we use existing protocols 
(802.1x/RADIUS/DIAMETER) for enabling such network access based on 
application credentials.

--Mohit

PS: Participants from the breakout are welcome to correct if there are 
errors or there is something I missed. Comments from the group are welcome.