Subject: Re: [Secdispatch] OMA SpecWorks - E2E Security

From: Göran Selander <[email-masked]>
Date: Wed, 6 Mar 2019 14:34:58 +0000

Hi Hannes,

You are wrong. The figures in my part of the presentation were all from an approved OMA SpecWorks White Paper published October 2018:

Lightweight M2M 1.1: Managing Non-IP Devices in Cellular IoT Networks (October 2018).
https://www.omaspecworks.org/white-paper-lightweight-m2m-1-1/

Figure 1 in section 3.1 of the white paper (used in slide 4 of my presentation)
Figure without number in section 2.3 (used in slide 7)
Figure 4 in section 4 (using in slide 7)

As should be clear from this official white paper, these are scenarios which are considered to be useful with LwM2M version 1.1, which is the version of LwM2M released in July 2018.

There is an internal discussion within OMA on the applicability of the LwM2M specification for different scenarios. I personally find the idea that a specification which does not explicitly describe a particular use case forbids its use quite extraordinary.

Göran

From: Secdispatch <[email-masked]> on behalf of Hannes Tschofenig <[email-masked]>
Date: Wednesday, 6 March 2019 at 13:42
To: "[email-masked]" <[email-masked]>
Subject: [Secdispatch] OMA SpecWorks - E2E Security

Hi all,

I thought it would be useful to clarify the presentation Goeran made yesterday about the e2e security features in LwM2M. I didn’t want to use the valuable meeting time for such purpose.

Goeran referred to a whitepaper and showed a picture that illustrated an end-to-end security use case in an NB IoT scenarios using various proxies/gateways.

The mentioned whitepaper has not been approved in OMA SpecWorks and has not been published yet.

More importantly though the LwM2M specifications do not contain any proxy/gateway support. The work was planned but due to lack of interest did not process. Additionally, the LwM2M architecture does not describe how end-to-end communication happens, i.e. the communication is only described between the a LwM2M-enabled IoT device and the device management server. The interaction with an application server is outside the scope of LwM2M.

Members in OMA have offered end-to-end security solutions on top of LwM2M. If you care to hear what we did, drop me an email.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 6 Mar 2019 14:58:29 +0000

Hi Goeran

Thanks for pointing to another Ericsson whitepaper.

  *   I personally find the idea that a specification which does not explicitly describe a particular use case forbids its use quite extraordinary.

The LwM2M specification is a profile of various IETF specifications and considers certain aspects in scope and other aspects outside the scope. This is not unusual and a feature (not a bug).

Ciao
Hannes

From: Göran Selander <[email-masked]>
Sent: Mittwoch, 6. März 2019 15:35
To: Hannes Tschofenig <[email-masked]>; [email-masked]
Subject: Re: [Secdispatch] OMA SpecWorks - E2E Security

Hi Hannes,

Göran

From: Secdispatch <[email-masked]<mailto:[email-masked]>> on behalf of Hannes Tschofenig <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, 6 March 2019 at 13:42
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [Secdispatch] OMA SpecWorks - E2E Security

Hi all,

Ciao
Hannes

---

From: Göran Selander <[email-masked]>
Date: Wed, 6 Mar 2019 15:55:05 +0000

Hi Hannes,

From: Hannes Tschofenig <[email-masked]>
Date: Wednesday, 6 March 2019 at 15:59
To: Göran Selander <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: [Secdispatch] OMA SpecWorks - E2E Security

Hi Goeran

Wrong again. This is an OMA SpecWorks official white paper with authors from T-Mobile and Ericsson. This is the place where others would say: “sorry folks, I made some wrong claims in the SecDispatch Interim Webex chat yesterday”.

Ø  I personally find the idea that a specification which does not explicitly describe a particular use case forbids its use quite extraordinary.

Leaving the general and OMA internal discussion aside, for the case of relevance here there is a public reference.

Göran

Hi Hannes,

Göran

Hi all,

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 6 Mar 2019 16:09:17 +0000

*   Wrong again. This is an OMA SpecWorks official white paper with authors from T-Mobile and Ericsson. This is the place where others would say: “sorry folks, I made some wrong claims in the SecDispatch Interim Webex chat yesterday”.

I made no claims about this topic at the SecDispatch meeting yesterday. As you know, the OMA allows promotional material to be published as whitepapers and blog posts. I point this out since others on this list may not know about the OMA process and may then believe that these whitepapers represent the views of the other members, which they don’t.

  *   Leaving the general and OMA internal discussion aside, for the case of relevance here there is a public reference.

Here is the relevant spec:
http://www.openmobilealliance.org/release/LightweightM2M/V1_1-20180710-A/

If you look at it then you will release that there is neither an application server in that architecture nor gateways.

Ciao
Hannes

---

From: Göran Selander <[email-masked]>
Date: Wed, 6 Mar 2019 17:22:21 +0000

Hi Hannes,

From: Hannes Tschofenig <[email-masked]>
Date: Wednesday, 6 March 2019 at 17:09
To: Göran Selander <[email-masked]>, ”[email-masked]” <[email-masked]>
Subject: RE: [Secdispatch] OMA SpecWorks – E2E Security

Ø  Wrong again. This is an OMA SpecWorks official white paper with authors from T-Mobile and Ericsson. This is the place where others would say: “sorry folks, I made some wrong claims in the SecDispatch Interim Webex chat yesterday”.

You are actually right here, this is not an official white paper but a T-Mobile and Ericsson promotional material. This was news to me, I sincerely apologize. Nevertheless, as the white paper indicates this how Ericsson and a customer plan to deploy LwM2M v1.1.

Ø  Leaving the general and OMA internal discussion aside, for the case of relevance here there is a public reference.

The architecture we are deploying is having a LwM2M client in the UE and a LwM2M server behind the MME and SCEF nodes, i.e. that the CoAP messages have to traverse these nodes going from LwM2M client to LwM2M server. What the term “application server” means in the context of this figure is less important.

Göran

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 6 Mar 2019 17:30:25 +0000

Thanks for the clarification, Goeran.

Great to see that you are making use of CoAP over TCP.

From: Göran Selander <[email-masked]>
Sent: Mittwoch, 6. März 2019 18:22
To: Hannes Tschofenig <[email-masked]>; [email-masked]
Subject: Re: [Secdispatch] OMA SpecWorks - E2E Security

Hi Hannes,

From: Hannes Tschofenig <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, 6 March 2019 at 17:09
To: Göran Selander <[email-masked]<mailto:[email-masked]>>, ”[email-masked]<mailto:[email-masked]>” <[email-masked]<mailto:[email-masked]>>
Subject: RE: [Secdispatch] OMA SpecWorks – E2E Security

Göran