Re: [Teep] IETF 101 agenda requests

[Dave Thaler <[e-mail]>]

On slide 6 of the "Problem Statement" slides there were three use cases for Trusted Applications
(as opposed to use cases for OTrP or TEEP per se), of which one was IoT. 

The Mirai botnet attack used the REE (not a TEE) of devices to conduct attacks against an external entity.  Since
TEEP is about TEE provisioning, not REE provisioning, TEEP is not directly applicable to controlling how/whether
malware can be installed in the REE.

I think what David's saying is that a provisioned TEE application could have functionality to detect/mitigate something
malicious that it detects an REE app is doing.  That's true, just like the TEE application could do anything else
(compute pi, etc.) but we shouldn't try to enumerate every operation that a TEE application might try to do, just 
things that introduce requirements on OTrP.

In the "TEEP Use Cases" slides for IETF 101, these are use cases for OTrP (as opposed to use cases for Trusted Apps in general).
In the discussion around slide 6, we agreed that Rich Apps are largely orthogonal because they don't introduce
new requirements on the OTrP protocol.   I think Ben's saying this is similarly orthogonal.

For it to not be orthogonal, one would have to argue how/why it affects the OTrP protocol itself.  If there is such
an argument, that would be a good way to continue this discussion.  If not, or if we don't know if there is,
then it's orthogonal until such an argument is provided.

Dave

-----Original Message-----
From: Wheeler, David M <[e-mail]> 
Sent: Tuesday, March 27, 2018 8:44 AM
To: Benjamin Kaduk <[e-mail]>; faibish, sorin <[e-mail]>
Cc: teep <[e-mail]>; Dave Thaler <[e-mail]>; [e-mail]
Subject: RE: [Teep] IETF 101 agenda requests

Ben,
I agree with you regarding the question of charter, however, I think (please correct if I misunderstand) what Sorin is proposing is to use the DDoS example as a use case to evaluate if OTrP has considered the appropriate relationships and entities within the protocol that would allow the proposed DDoS solution to be implemented.

Our charter does state that "the solution approach must take a wide range of TEE and relevant technologies" and the architecture document includes "relevant use cases." Since the DDoS proposal includes an implementation where a TEE application implements a set of filtering policies, I believe it is relevant.

I think it is a very interesting use case, since it expands beyond a simple Device-User to Service-Provider situation, and creates a more complex interaction for the application - especially the interaction of the trusted application to aspects of the device itself (i.e. filtering outgoing packets). Is our policy for accepting TEE applications rich enough (or at least extensible enough) to enable a device/user to implement controls on what applications are allowed to do, perhaps even based on the service provider installing those applications.

I believe it is in our best interest to evaluate it, and the implications of such TEE applications. We can still come to the conclusion that some aspects of supporting such a use case may be out-of-scope, but it will give us concrete information to point to regarding what is exactly out-of-scope, why it breeches our scope, and perhaps direct future additions/expansions to the protocol.

Thanks,
Dave Wheeler


-----Original Message-----
From: TEEP [mailto:[e-mail]] On Behalf Of Benjamin Kaduk
Sent: Monday, March 26, 2018 6:33 PM
To: faibish, sorin <[e-mail]>
Cc: teep <[e-mail]>; Dave Thaler <[e-mail]>; [e-mail]
Subject: Re: [Teep] IETF 101 agenda requests

On Mon, Mar 26, 2018 at 11:12:37PM +0000, faibish, sorin wrote:
> We discussed the DDoS in Singapore and we had a presentation on the DDoS:
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fmeeting%2F100%2Fmaterials%2Fslides-100-saag-int&data
> =02%7C01%7Cdthaler%40microsoft.com%7C105f96f6b0744e2a276408d593f98cc2%
> 7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636577622384270342&sdata=
> 32qt5mT4aXYjJ9gZW%2BFRegXm4GbM%2FWlOpwh6XmnJ84I%3D&reserved=0
> er-domain-ddos-mitigations-potentials-challenges-and-solutions-min-suk
> -kang/
> 
> So, I would like to include this usecase as a target for the WG. I 
> will write a draft related to this usecase. Thanks

Wanting it to be a target and writing a draft are both orthogonal to the question of whether the work is in-charter.  (Rechartering to include it would of course be possible, through the normal
procedure...)

-Ben

> ../Sorin
> 
> -----Original Message-----
> From: Benjamin Kaduk [mailto:[e-mail]]
> Sent: Friday, March 23, 2018 8:39 AM
> To: faibish, sorin <[e-mail]>
> Cc: Dave Thaler <[e-mail]>; teep <[e-mail]>; 
> [e-mail]
> Subject: Re: [Teep] IETF 101 agenda requests
> 
> Hi Sorin,
> 
> On Thu, Mar 22, 2018 at 09:26:22AM +0000, faibish, sorin wrote:
> > New proposed usecase for TEEP WG.
> > 
> > Most recently the frequency and intensity of DDoS attacks from IoT devices increased with attacks almost every day. The reason of the proliferation of DDoS attacks from IoT devices is a result of the lower and maybe inexistent security protection of cheap IoT devices that have no security features implemented as this would increase the cost of such devices using any security HW. In the current charter of TEEP there sre 3 usecases and I would like to add the protectioin against DDoS of IoT as a new usecase:
> 
> On a quick read of the charter, I don't see how this topic would be in scope -- am I missing something that would allow it?
> 
> Thanks,
> 
> Ben
> 
> _______________________________________________
> TEEP mailing list
> [e-mail]
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsoft
> .com%7C105f96f6b0744e2a276408d593f98cc2%7C72f988bf86f141af91ab2d7cd011
> db47%7C1%7C0%7C636577622384270342&sdata=1F4dZBFAumiRdEl7G4FYn0bO9VSzFy
> k%2BSkxW6cCfesw%3D&reserved=0

_______________________________________________
TEEP mailing list
[e-mail]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&data=02%7C01%7Cdthaler%40microsoft.com%7C105f96f6b0744e2a276408d593f98cc2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636577622384270342&sdata=1F4dZBFAumiRdEl7G4FYn0bO9VSzFyk%2BSkxW6cCfesw%3D&reserved=0