Subject: [Ace] Home-PDS use case --- RE: Review of ACE Uses Cases draft (draft-ietf-ace-usecases-03)

From: Thomas Hardjono <[email-masked]>
Date: Sun, 31 May 2015 19:29:48 +0000

> -----Original Message-----
> From: Carsten Bormann [mailto:[email-masked]]
> Sent: Friday, May 29, 2015 5:10 PM
> To: Thomas Hardjono
> Cc: [email-masked]; [email-masked];
> [email-masked];
> [email-masked]
> Subject: Re: [Ace] Review of ACE Uses Cases
> draft (draft-ietf-ace-usecases-03)
> 
> Thomas Hardjono wrote:
> > PS. If the ACE WG is open, I can write a
> short use-case on the Home-PDS.
> 
> Yes, please: This would be very useful.
> 
> Grüße, Carsten

Thanks Carsten,

Attached is a use-case for the Home-PDS.

Please let me know if there are typos or corrections/clarifications needed.

cheers,

/thomas/

---- begin ACE use case ------

2.8 Home Personal Data Store

As the future home automation or "smart home" becomes a reality, users (home owners, residents, tenants and other occupants) have become increasingly concerned about the control over data being gathered by the various home automation devices. As such, many users today consider that they are the legal owners of data being generated by home automation devices and sensors within the boundaries of their property. Thus, many users seek to use a home server device (analogous to common NAS servers or home audio servers) that acts as the collection-point for all data reported to by the smart-home devices/sensors. Such a device is referred to generally as the Home Personal Data Store (Home-PDS).

Using a Home-PDS the home-owner then has an owner-centric control over their data sets collected in their Home-PDS, and can provide explicit permission for these data-sets to be accessed by entities, systems or person from outside the home.

2.8.1 Home Sensor Data Collection

Alice who is a home owner has just deployed a number of smart-home devices and sensors. After she has on-boarded these devices into the home automation system, she configures these devices/sensors to communicate and report their respective raw data-sets into her Home-PDS. After verifying that all her smart home devices are operable and reporting data, she uses the authorization manager tool on the Home-PDS to set permissions for external entities to read relevant data-sets from the Home-PDS.

Alice provides permission for the local electricity company to access power consumption data-sets pertaining to all her home appliances, in the hope that the electricity company can advise her on how to use power more efficiently. 

Alice has also signed-up to a new service called "Lighting As a Service" (LaaS) where all the home's lighting needs are monitored and serviced by the LaaS company. Alice then uses the authorization manager tool on the Home-PDS to provide the company with on-going access to the data-sets in her Home-PDS that are related to lighting in her house (e.g. light-bulb data, socket data, burn-rate data, etc). The LaaS company uses these lighting data-sets to monitor in real-time the status of all her home's lighting. The company then sends Alice new light-bulbs just in time to replace some light bulbs that are burning out.

2.8.2 Home-based healthcare Data

Bob, who is Alice's spouse, has decided to configure the Home-PDS to collect and store data from his Wi-Fi enabled weight-scale as Bob is under medical care and monitoring. He has also configured his smart-watch to report sleep data, heart rate data and movement data to their Home-PDS. 

Bob then uses the authorization manager tool on the Home-PDS to set permission for his doctor and physiotherapist to read his health related data-sets from the Home-PDS.

2.8.3 Authorization Problems Summary

U8.1 Home-owners must have full control over the data being generated by the devices and sensors within their home.

U8.2 Home-owners need the ability to set the Home-PDS as the default data collection point for all devices and sensors they introduce into their home.

U8.3 Data from devices and sensors in the home must not leave the home premises without clear explicit permission from the home-owner.

U8.4 Home-owners need the ability to set fine grained access control rules for other users or entities (inside and outside the home) to access to data-sets in the Home-PDS.

U8.5 Home-owners need the ability to set access control rules in a meaningful manner, using a friendly and coherent user interface.

U8.6 Home-owners need the ability to modify or revoke previously granted access to users or entities.

U8.7 Home-owners need the option to obtain hosted services implementing the Home-PDS function, while retaining the same degree of owner-centric control over the data from the devices and sensors within their home.

---- end ACE use case ------

____________________________________________

---

From: Carsten Bormann <[email-masked]>
Date: Sun, 31 May 2015 21:37:34 +0200

Thomas,

thank you for the description of this really important use case. Two
quick comments come to mind:

2.8.2 adds Bob as a stake holder, but 2.8.3 then only seems to mention
the home owner as the controlling entity.

"Leave the home premises" is a concept that is hard to map into
authorization.  In particular, enforcing it would require assurance from
all on-premise devices that are granted authorization to some data,
assuring that they are not a channel that can be used to exfiltrate data.

Grüße, Carsten

---

From: Thomas Hardjono <[email-masked]>
Date: Sun, 31 May 2015 20:13:27 +0000

> Sent: Sunday, May 31, 2015 3:38 PM
> To: Thomas Hardjono
> Subject: Re: Home-PDS use case --- RE: [Ace]
> Review of ACE Uses Cases draft (draft-ietf-
> ace-usecases-03)
> 
> Thomas,
> 
> thank you for the description of this really
> important use case. Two quick comments come to
> mind:
> 
> 2.8.2 adds Bob as a stake holder, but 2.8.3
> then only seems to mention the home owner as
> the controlling entity.

Yes, I didn't want to repeat the same authorization use-cases that was already in the draft-03. We could (i) make Bob a co-owner, (ii) have Alice provide Bob with full access, or (iii) have Alice delegate to Bon some powers over the Home-PDS.

> "Leave the home premises" is a concept that is
> hard to map into authorization.  In
> particular, enforcing it would require
> assurance from all on-premise devices that are
> granted authorization to some data, assuring
> that they are not a channel that can be used
> to exfiltrate data.

I didn't mention one important aspect related to the IoT/Constrained space, namely that in order for IoT-related services to scale and be accepted socially there will need to be a "Legal Trust Framework for Data Sharing" (what I call LTF-DS).  This is equivalent to (and broader than) the current Legal Trust Frameworks for Identity Federation (like InCommon, OIX, Kantara trust framework efforts).

Basically, the LTF-DS is a legal contract that calls-out the rights and obligations of all the stakeholders the ecosystem. This covers the home-owners, the device/sensor vendors, the service providers (that want to read data from the device/vendors), etc. etc.

The LTF-DS will legally prevent device/sensor vendors and providers from building-in backdoors into devices/sensors where they quietly upload data from a person's home without the home-owner's clear consent.

BTW the whole point of the Home-PDS is to create a distributed architecture in order to prevent surveillance (and data theft) at a massive scale. It's much harder to hack into a million homes than into a single service provider. I'm sure folks in Europe have been seeing news about the recent hacks into various US companies :-)

/thomas/