Re: [T2TRG] RESTful Design & Security

Yes, that sounds very reasonable. It does include changing the (end-)devices to support this new approach.

In the W3C Web of Things, we have the idea to retrofit information such as encoding and security aspects through interface descriptions that can be used across multiple IoT protocols (WoT Thing Description). Still it requires to upgrade what is accepted and served by the devices within the protocol used...

Ciao
Matthias

Sent from my phone, limitations might apply.

-----Original Message-----
From: Simpson, Robby (GE Energy Connections) [robby.simpson@ge.com]
Received: Tuesday, 07 Mar 2017, 20:47
To: Kovatsch, Matthias (CT RDA NEC EMB-DE) [matthias.kovatsch@siemens.com]; hannes.tschofenig@gmx.net [hannes.tschofenig@gmx.net]; mcr+ietf@sandelman.ca [mcr+ietf@sandelman.ca]
CC: T2TRG@irtf.org [T2TRG@irtf.org]
Subject: Re: [T2TRG] RESTful Design & Security

Personally, I’m a big fan of end-to-end and think that is the correct approach.

However, pragmatically, I realize this is not always possible.

I haven’t followed it for a while, but there was some activity in httpbis at one point for resource/object-level security (https://tools.ietf.org/wg/httpbis/draft-ietf-httpbis-encryption-encoding/).  If we limit the discussion to protocols that support content codings (e.g., HTTP and CoAP), then I would think defining a coding that specifies the resource-level security aspects would achieve quite a lot and would be able to preserve aspects through protocol conversion.

- Robby

Robby Simpson, PhD
System Architect
GE
Grid Solutions
M: +1 404 219 1851
Robby.Simpson@GE.com

From: T2TRG <t2trg-bounces@irtf.org> on behalf of "Kovatsch, Matthias" <matthias.kovatsch@siemens.com>
Date: Tuesday, March 7, 2017 at 2:36 PM
To: "hannes.tschofenig@gmx.net" <hannes.tschofenig@gmx.net>, "mcr+ietf@sandelman.ca" <mcr+ietf@sandelman.ca>
Cc: "T2TRG@irtf.org" <T2TRG@irtf.org>
Subject: EXT: Re: [T2TRG] RESTful Design & Security

Fair enough.

Yes, I am on this IoT Directorate. I would say a large fraction of the T2TRG participants has been arguing that the Internet of Gateways is not a good approach. Your security-related summary proves this point.

I personally don't see end-to-end security happening if we keep mixing application protocols, keep using black-magic middleboxes, and keep using proprietary interfaces at the device level. We need something end-to-end (or T2T) for end-to-end security.

Best wishes
Matthias

Sent from my phone, limitations might apply.

-----Original Message-----
From: Hannes Tschofenig [hannes.tschofenig@gmx.net]
Received: Tuesday, 07 Mar 2017, 20:10
To: Kovatsch, Matthias (CT RDA NEC EMB-DE) [matthias.kovatsch@siemens.com]; mcr+ietf@sandelman.ca [mcr+ietf@sandelman.ca]
CC: T2TRG@irtf.org [T2TRG@irtf.org]
Subject: Re: [T2TRG] RESTful Design & Security
Hi Matthias,

I know that this is a research group and everyone can create whatever
they want.

We briefly talked about security at the IoT directorate conference call
and I would be interesting to hear what works and what does not work for
others.

Ciao
Hannes

On 03/07/2017 07:45 PM, Kovatsch, Matthias wrote:
> On big propaganda tour? :P
>
> Regards
> Matthias
>
>
> Sent from my phone, limitations might apply.
>
> -----Original Message-----
> *From:* Hannes Tschofenig [hannes.tschofenig@gmx.net]
> *Received:* Tuesday, 07 Mar 2017, 19:39
> *To:* Michael Richardson [mcr+ietf@sandelman.ca]
> *CC:* t2trg@irtf.org [T2TRG@irtf.org]
> *Subject:* Re: [T2TRG] RESTful Design & Security
>
> OSCOAP does not work when
>
> * you mix protocols,
> * use a middlebox for some processing interactions (such as data
> aggregation), and
> * when one of the protocols is a non-RESTful protocol, such as BLE or MQTT.
>
> Unfortunately, these the use cases we are facing in current IoT
> deployments. For similar reasons we cannot use RFC 8075 either.
>
> Maybe you are seeing different deployment environments.
>
> Ciao
> Hannes
>
> On 03/07/2017 06:39 PM, Michael Richardson wrote:
>>
>> Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
>>     > Needless to say that these challenges have also been observed in other
>>     > protocols as well, such as HTTP and even SIP.
>>
>>     > What is the story for providing application layer security?
>>
>> OSCOAP seems to be end-to-end to me.
>>
>> --
>> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>>  -= IPv6 IoT consulting =-
>>
>>
>>
>
>
>
> _______________________________________________
> T2TRG mailing list
> T2TRG@irtf.org
> https://www.irtf.org/mailman/listinfo/t2trg<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_t2trg&d=DwMF-g&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=4w13vdCVEUj_vaCSQNdKRf25O0P4iaVn04ElXLrB_ak&m=k7IqC4lOSBeG5yZT3lwAYgfq7isPTJ1x7lhosU4sI0U&s=6FyGiDTW-U31FpvuMwpkVdhppH4XLcvlAPPiMqvTUIo&e=>
>