Subject: Re: [core] New Version Notification for draft-garcia-core-security-04.txt

From: Markus Wehner <[email-masked]>
Date: Fri, 08 Jun 2012 10:54:31 +0200

Dear Sye,

I like this document, it is written well and very clear.
Some comments from my side regarding the draft:

1. Difficulties with E2E security not only occur for protocol translation but also for aggregation (or in-network processing in general) of data.
Especially in industrial scenarios, aggregation of huge amounts of data may be performed at dedicated intermediate aggregating devices and sent to the application afterwards for efficiency reasons. Also in a home environment it is a privacy reason that for example not any single device can be monitored by a certain user (end user, power supplier) but aggregated information is needed.
Here, besides the solutions you mentioned for protocol translation, also homomorphic encryption may play a role which allows performing aggregation on encrypted payload on the cost of computational complexity.

2. Multi owner (resp. multi domain) use cases also raise security issues in the IoT world, i.e. data separation, resources sharing and in this scope trustworthiness, fairness, QoS restrictions... . Co-located networks that do not belong to the same domain which work in a cooperative way, i.e. for routing/energy efficiency, are part of that. Also, if a mobile node moves between different networks, besides reauthentication and so on, the trustworthiness is an important thing to consider here.

3. Especially in IoT world, nodes often know about their context which could enhance security. For example a network which knows locations of its nodes and is able to measure them could improve against physical replacement. The other way, only nodes within a certain area, i.e. an office room, could be allowed to have access to the rest of the network (automatically). Unfortunately this raises new security issues.

Best regards,
Markus

----- Original Message -----
From: Keoh, Sye Loong <[email-masked]>
Sent: Mon, 26 Mar 2012 22:08:38 +0000
To: [email-masked] <[email-masked]>
Cc:
Subject: [core] New Version Notification for draft-garcia-core-security-04.txt
--- Original Nachricht ---
Absender: Keoh, Sye Loong
Datum: 27.03.2012 00:08
> Dear all,
>
> In this new version, we have updated the conclusions section to reflect the status of current security technologies and the missing bits with regards to the security requirements we identified in the document.
>
> Since the WG advised that we should continue working on this draft  in Taipei, we are continuously improving the draft so that it serves its purpose to provide an overview of the security requirements for IoT. Therefore, we would greatly appreciate feedback and comments from WG members on this document.
>
> Many thanks
> Sye Loong
>
> -----Original Message-----
> From:[email-masked]  [mailto:[email-masked]]
> Sent: maandag 26 maart 2012 23:52
> To: Keoh, Sye Loong
> Cc:[email-masked]; Kumar, Sandeep;[email-masked]; Garcia Morchon, Oscar
> Subject: New Version Notification for draft-garcia-core-security-04.txt
>
> A new version of I-D, draft-garcia-core-security-04.txt has been successfully submitted by Sye Loong Keoh and posted to the IETF repository.
>
> Filename:        draft-garcia-core-security
> Revision:        04
> Title:           Security Considerations in the IP-based Internet of Things
> Creation date:   2012-03-26
> WG ID:           Individual Submission
> Number of pages: 45
>
> Abstract:
>     A direct interpretation of the Internet of Things concept refers to
>     the usage of standard Internet protocols to allow for human-to-thing
>     or thing-to-thing communication.  Although the security needs are
>     well-recognized, it is still not fully clear how existing IP-based
>     security protocols can be applied to this new setting.  This
>     Internet-Draft first provides an overview of security architecture,
>     its deployment model and general security needs in the context of the
>     lifecycle of a thing.  Then, it presents challenges and requirements
>     for the successful roll-out of new applications and usage of standard
>     IP-based security protocols when applied to get a functional Internet
>     of Things.
>
>
>
>
> The IETF Secretariat
>
> ________________________________
> The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>

-- 
---------------------------------------
Dipl.-Ing. Markus Wehner
on behalf of TWISNet project

University of Applied Sciences
Department of Electrical Engineering
Friedrich-List-Platz 1
D-01069 Dresden
Germany
http://www.htw-dresden.de

phone : +49 351 462 2465
email :[email-masked]
---------------------------------------

---

From: "Keoh, Sye Loong" <[email-masked]>
Date: Mon, 11 Jun 2012 16:12:32 +0000

Dear Markus,

Thank you very much for your comments.

Yes, you are absolutely right, that aggregation of data also breaks E2E security. Unfortunately, this is a very difficult problem in the area, and we have not seen any good solution that can address E2E security issues effectively. As you said, the use of homomorphic encryption scheme requires complex computation, and we think it may not be feasible on constrained devices, although it's worth mentioning and considering.

I have the impression that trustworthiness is something very difficult to quantify,  there are people who are skeptical about interaction between devices (running different applications) from multiple domains, and how trust can be established between them when they interact is typically unknown or unspecified. If you have some use cases that you think we should consider, we would be glad to hear them :)

Thanks and kind regards,
Sye Loong

-----Original Message-----
From: Markus Wehner [mailto:[email-masked]] 
Sent: vrijdag 8 juni 2012 10:55
To: Keoh, Sye Loong
Cc: [email-masked]
Subject: Re: [core] New Version Notification for draft-garcia-core-security-04.txt

Dear Sye,

Best regards,
Markus

----- Original Message -----
From: Keoh, Sye Loong <[email-masked]>
Sent: Mon, 26 Mar 2012 22:08:38 +0000
To: [email-masked] <[email-masked]>
Cc:
Subject: [core] New Version Notification for draft-garcia-core-security-04.txt
--- Original Nachricht ---
Absender: Keoh, Sye Loong
Datum: 27.03.2012 00:08

phone : +49 351 462 2465

---

From: Rene Struik <[email-masked]>
Date: Mon, 11 Jun 2012 12:29:32 -0400

Dear Sye Loong, Markus:

Secure aggregation is indeed a difficult problem. Even if one has a
secure "end to end" aggregation mechanism, this would usually relate to
the communication subsystems of devices and not necessarily to the
sensing applications themselves (imagine lighting a match next to a
temperature sensor, which is connected to a "perfectly secure"
end-to-end security system). In those cases, one has to do some more
analysis on the devices, e.g., regarding consistency of data over
time/location, etc. End-to-end security usually only deals with
communication security and not with security of the inputs (or outputs)
of this process. When adequately addressed, it does reduce the size of
remaining security/robustness/reliability issues.

I attached a paper by David Wagner (2004) that may be of interest here
(paper in Postscript format).

Best regards, Rene

-- 
email: [email-masked] 
Skype: rstruik
cell: +1 (647) 867-5658 
USA Google voice: +1 (415) 690-7363

---

From: Markus Wehner <[email-masked]>
Date: Fri, 15 Jun 2012 13:40:12 +0200

Dear Sye Loong, Rene,

I agree to your comments and also do not see a simple solution.
The scenario Rene described refers to what I mean with context awareness of the nodes but this is not only a problem of aggregation but of reliability/trustworthiness of sensed data in general. Of course using information from other nodes an aggregator could point on faulty measurements as described in the paper Rene sent. In case a single node or the aggregator is aware of its context (environmental model, location, ...) a priori it may be possible that this node is able to evaluate the data on its own based on these reliability models and inform the network of possible security attacks.

Yes, trustworthiness (of devices/services/users) is difficult to quantify, especially in multi-owner networks. Normally it is a binary service dependent decision based on authentication and authorization.
A simple use case covering mutliple domains is a household scenario including Smart Metering. Imagine to have several devices in the household which are connected to the IoT world. Not all devices need to be owned by the end user himself, i.e. a thermostat device offered by the heating supplier for monitoring and controling purposes, accessed by the end user and the supplier. There are several interested parties which may have access to the same devices for same or different purposes or integrate their own devices into the network. Services/Devices of the energy/heating/water suppliers (Smart Metering), communication provider, the user itself, other commercial services from third parties have to be trusted/authorized to obtain or share data. For example, the end user wants the air conditioner and thermostat communicating with each other, so they may be in the same PAN (as the rest of the IoT devices in one household), but the heating supplier is allowed to use monitored data 
of the thermostat only or maybe aggregated data from all thermostats of your household. In his domain, the supplier should see aggregates from different households (or repeatedly aggregated data according to his needs, i.e. of a city) only, that the end user is not allowed to see on the other side.
I do not know if this is a meaningful enough example to be considered but what I want to say is that this kind of multi-owner security is needed also in not too specialized use cases.

Best regards,
Markus

--- Original Nachricht ---
Absender: Rene Struik
Datum: 11.06.2012 18:29
>> Cc:[email-masked]
>> From: Keoh, Sye Loong<[email-masked]>
>> To:[email-masked]  <[email-masked]>
>> Cc:
>>> Cc:[email-masked]; Kumar,Sandeep;[email-masked]; Garcia Morchon, Oscar

phone : +49 351 462 2465