Re: [T2TRG] Report from breakout on using application credentials to enable network access

Dear all: 

Regarding the topic of  network access for IoT devices.
We are currently working on that, using RADIUS and EAP. Concretely, we are using CoAP to transport EAP messages. The proposal is in draft-marin-ace-wg-coap-eap. 

We have a functional prototype of the protocol for Contiki O.S. and we have performed some tests comparing the performance to PANATIKI's implementation of the PANA protocol for Contiki O.S shown in this article. http://www.mdpi.com/1424-8220/16/3/358

We are currently working on the concept of CoAP relay and proxy for network access authentication. 

Questions are welcome.
Best Regards,
Dan.

>> De: Mohit Sethi <mohit.m.sethi@ericsson.com <mailto:mohit.m.sethi@ericsson.com>>
>> Fecha: 13 de abril de 2017, 10:41:16 CEST
>> Para: "t2trg@irtf.org <mailto:t2trg@irtf.org>" <T2TRG@irtf.org <mailto:T2TRG@irtf.org>>
>> Asunto: [T2TRG] Report from breakout on using application credentials to enable network access
>> 
>> Topic: Use of application credentials for enabling network access (and vice-versa).
>> 
>> Participants (15 active): Erik Nordmark (note taker), Mohit Sethi (breakout leader), Thorsten Dahm, Donald Eastlake, Behcet Sarikaya, Demir Rakanovic, Phillip Hallam-Baker, Grace Lewis, Ludwig Seitz, Muhhamad Sajjad, Jari Arkko, Laurent Toutain, Hitoshi Asaeda, Francesca Palombini, Stephen Kraiman.
>> 
>> Summary and Conclusions from breakout:
>> 
>> 1. It can be useful to enable network access for IoT devices using application credentials: This leads to less configuration work for the user of a new IoT device which is especially beneficial since the devices often have limited UI. Think of a new IoT toothbrush that you have just purchased. You bring it home and register it with the manufacturer (by reading a serial number/public key/scanning QR code etc.). It would be nice if the manufacturer can then tell the Access Point (AP) at the users home to enable limited Internet connectivity for the device.
>> 
>> 2. Interesting to investigate if we can reverse the direction of enabling network-access: Instead of adding software and hardware complexity in the devices itself, it would make sense to simply put the dumb IoT devices at the desired location and then enable access from a server which is more resourceful.
>> 
>> 3. Isolation: It would also be smart to put the IoT devices in separate VLANs. When the device is authenticated as an IoT device it should be put in its separate VLAN so that it has limited connectivity to only a couple of services (such as calling home for software update etc).
>> 
>> 4. Scaling this to 1000s or 10k devices can be challenge. This also relates to the fact that enterprise scenarios are very different from the home scenarios. Enterprises may not want to delegate network access authentication to an external third party (such as the IoT device manufacturer).
>> 
>> 5. Revoking network access should be secure and simple. For example, if one of the IoT devices is lost or sold, it shouldn't require you to change the network-access credentials for all the devices.
>> 
>> 
>> Possible Research work: Can we use existing protocols (802.1x/RADIUS/DIAMETER) for enabling such network access based on application credentials.
>> 
>> --Mohit
>> 
>> PS: Participants from the breakout are welcome to correct if there are errors or there is something I missed. Comments from the group are welcome.
>> 
>> _______________________________________________
>> T2TRG mailing list
>> T2TRG@irtf.org <mailto:T2TRG@irtf.org>
>> https://www.irtf.org/mailman/listinfo/t2trg <https://www.irtf.org/mailman/listinfo/t2trg>