Subject: Re: [Secauth] secauth - version 2 authentication and authorization requirement draft

From: Hosnieh Rafiee <[email-masked]>
Date: Thu, 25 Sep 2014 12:30:58 +0000

Hi Will,

Thanks for your deep review and your suggestions and supports.

> 
> 1. I think SECAUTH intends to provide a authentication mechanism using 
> existing network layer secure tech. In network layer, we must consider 
> NAT issue.
> e.g., in section 4.2 Verification of a User to an Application Over the
> Network，wash machine may supposed to be behind NAT，how does Alice get 
> private IP address of wash machine to authenticate?

Yes that is true. However, I thought that I covered it in other use cases but if I need to explicitly mention this, I would add it. My reasons are that if Alice wants to connect to its home device and control it and if the device is behind a NAT or has no valid IP address, then either Alice needs to first connect to the intermediate device that has a valid IP address and then try to access this device (something like VPN) or Alice should have a valid IP address and introduce it to the device so that the device initiate the communication. In former case, it falls into category of proxy servers or intermediate device authentication. In the latter case, it would be similar to a home user who is behind NAT and wants to communicate to a server and be authenticated to it.  

Furthermore, I presume that the networks which supports IPv6 and in case the devices supports IPv6, fortunately/unfortunately the devices are accessible via their IPv6 address since it is global. (My printer has an IPv6 address and it set it up by default via my home router). 

Nevertheless, there are two solutions for NAT, either secauth uses the security of network layer and then use those parameters to generate a secure value for the authentication as it happened in the example document in the draft. Then it generates the messages that is not dependent to IP address of the node so that NAT would not make an issue.

The second solution is that, the NAT device has a one to one mapping for devices that needs to be accessible outside. Something like what is explained in the following article http://www.nimlabs.org/dirtynat.html

> 2. In IOT，one smart device could control another smart device，so
> there might be a case of verification of a device to a device over 
> constrain network.

Ok I will add it

> 3. section 4.5 seems to be describing SDN security. What's the 
> relationship with Verification of an App. To an App. Over Network in 
> the title?

It is really difficult to categorize SDN related mechanisms. Since at the beginning its impact was on layer2/3 but now it also have impact on all above layers. Therefore, some of them can fall in the category of software to software (app to app). One possibility is to just remove the main title and make the subtitle as a main title to avoid any misinterpretation.

Thanks again,
Best,
Hosnieh