Re: [T2TRG] Report from breakout on using application credentials to enable network access

[Hannes Tschofenig <[e-mail]>]

Hi Mohit,

thanks for the writeup.

A few remarks inline:

On 04/13/2017 10:41 AM, Mohit Sethi wrote:
> Topic: Use of application credentials for enabling network access (and
> vice-versa).
> 
> Participants (15 active): Erik Nordmark (note taker), Mohit Sethi
> (breakout leader), Thorsten Dahm, Donald Eastlake, Behcet Sarikaya,
> Demir Rakanovic, Phillip Hallam-Baker, Grace Lewis, Ludwig Seitz,
> Muhhamad Sajjad, Jari Arkko, Laurent Toutain, Hitoshi Asaeda, Francesca
> Palombini, Stephen Kraiman.
> 
> Summary and Conclusions from breakout:
> 
> 1. It can be useful to enable network access for IoT devices using
> application credentials: This leads to less configuration work for the
> user of a new IoT device which is especially beneficial since the
> devices often have limited UI. Think of a new IoT toothbrush that you
> have just purchased. You bring it home and register it with the
> manufacturer (by reading a serial number/public key/scanning QR code
> etc.). It would be nice if the manufacturer can then tell the Access
> Point (AP) at the users home to enable limited Internet connectivity for
> the device.

While this would be nice it is almost impossible to deploy.
Since OEMs, device vendors nor network operators have to do their
deployment at the same time to make this happen it is an uphill battle.

Furthermore, neither home users, enterprises, nor industrial IoT
deployments will allow external parties to configure their network.

> 
> 2. Interesting to investigate if we can reverse the direction of
> enabling network-access: Instead of adding software and hardware
> complexity in the devices itself, it would make sense to simply put the
> dumb IoT devices at the desired location and then enable access from a
> server which is more resourceful.

Where would this server be?

Note that the story for network access varies hugely between different
connectivity technologies.

> 
> 3. Isolation: It would also be smart to put the IoT devices in separate
> VLANs. When the device is authenticated as an IoT device it should be
> put in its separate VLAN so that it has limited connectivity to only a
> couple of services (such as calling home for software update etc).

Sounds useful but would require some management overhead, which is most
likely only justified in an enterprise network. I can hardly imagine how
home users configure such an isolation nor what benefits it would give
them (since their networks are rather small).

> 
> 4. Scaling this to 1000s or 10k devices can be challenge. This also
> relates to the fact that enterprise scenarios are very different from
> the home scenarios. Enterprises may not want to delegate network access
> authentication to an external third party (such as the IoT device
> manufacturer).

When you say "this" what do you refer to?

> 
> 5. Revoking network access should be secure and simple. For example, if
> one of the IoT devices is lost or sold, it shouldn't require you to
> change the network-access credentials for all the devices.

This is not necessarily a technology challenge since we have all the
necessary mechanisms in place. Unfortunately, many home networks use a
somewhat simplistic credential configuration mechanism with class keys.

> 
> 
> Possible Research work: Can we use existing protocols
> (802.1x/RADIUS/DIAMETER) for enabling such network access based on
> application credentials.
I am sure we could work it out but I am less sure there is interest to
deploy it (from an incentive, business model, security, etc. point of
view).

Ciao
Hannes

> 
> --Mohit
> 
> PS: Participants from the breakout are welcome to correct if there are
> errors or there is something I missed. Comments from the group are welcome.
> 
> _______________________________________________
> T2TRG mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/t2trg