Subject: [Ace] Possible Proxy use cases for ACE

From: "Rahman, Akbar" <[email-masked]>
Date: Thu, 23 Jan 2014 12:05:38 -0500

(Note: Changing the subject line to a more descriptive one for the topic)

Hi Ludwig/Olaf,

Thanks for your feedback.  It is good that the use case already makes mention of Proxies.  What I was interested in was the following use cases (and associated questions).  Please tell me if it is already in the scope of the current use case draft or if it should be added.

1) Proxy Unicast Use Case
--------------------------------
A building automation case requires that low cost light fixtures supporting CoAP be purchased off the shelf.   Before they are installed, the light fixtures are configured to send all their CoAP requests through a CoAP Forward Proxy located in the building.  From experience the building owner sees that the great majority of light fixtures are safe, but that some small percentage occasionally  have malware installed on them.

References:
- Forward-Proxies: http://tools.ietf.org/html/draft-ietf-core-coap-18#section-5.7.2
- Security for Proxying: http://tools.ietf.org/html/draft-ietf-core-coap-18#section-11.2 

Q1 -Should the Resource Server authentication and access control model require it to know anything about the light fixtures, or should it just consider that all requests as originating from just the Proxy?    
Q2 -Can the Proxy enforce authentication and access control model on behalf of the Resource Server?

2) Proxy Multicast Use Case
----------------------------------
As in (1) but with the extra complication that the Proxy may IP multicast (i.e. fan out) the single CoAP request from the light fixture to multiple Resource Servers.

Reference:
- Multicast Proxying: http://tools.ietf.org/html/draft-ietf-core-groupcomm-18#section-2.10 

Q1 & Q2 as in (1)
Q3 - Should the multiple Resource Servers have coordinated authentication and access control models to handle the single multicast request?

Best Regards,

Akbar

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Ludwig Seitz
Sent: Thursday, January 23, 2014 7:36 AM
To: [email-masked]
Subject: Re: [Ace] New Version of Proposed Charter

On 01/23/2014 01:21 PM, Olaf Bergmann wrote:
> "Rahman, Akbar" <[email-masked]> writes:
>
>> - Will ACE cover the transfer of authorization info to a CoAP forward 
>> proxy to send unicast/multicast DTLS messages on behalf of a Client?
>>
>>   (Reference:
>> http://tools.ietf.org/html/draft-ietf-core-coap-18#section-11.2 )
>
> The current discussions did not address this issue, and I think that 
> this will not be a hot topic in the starting phase of a to-be-WG.
>
> But I agree that this kind of authorization transfer should be taken 
> into consideration for solution design in the current drafts. Do you 
> have a description of a usage scenario that could be incorporated with 
> the use cases draft?
>

Proxies are already mentioned in the use cases draft (section 2.5.1 and requirement U5.3). Rahman, do you think that should be more specific?
If so I'm happy to hear your suggestions.

/Ludwig

--
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 24 Jan 2014 10:08:14 +0100

On 01/23/2014 06:05 PM, Rahman, Akbar wrote:
> Thanks for your feedback.  It is good that the use case already makes mention of Proxies.
 > What I was interested in was the following use cases (and associated 
questions).  Please
 > tell me if it is already in the scope of the current use case draft 
or if it should be added.
> A building automation case requires that low cost light fixtures supporting CoAP be purchased
 > off the shelf. Before they are installed, the light fixtures are 
configured to send all their
 > CoAP requests through a CoAP Forward Proxy located in the building. 
 From experience the
 > building owner sees that the great majority of light fixtures are 
safe, but that some small
 > percentage occasionally  have malware installed on them.
>
> References:

The use case document does not go into that level of detail. If you'd 
like to write up a compelling use case for this, I'd be happy to 
integrate it into the draft.

You will also find some consideration on this question in 
draft-selander-core-access-control ( 
http://tools.ietf.org/html/draft-selander-core-access-control#section-5.1).

> Q1 -Should the Resource Server authentication and access control model require it to know
 > anything about the light fixtures, or should it just consider that 
all requests as originating
 > from just the Proxy?

In the general case it depends on the severity of the threat (in your 
specific use case I think it's not worth the extra effort for the latter 
option). I'd say that both options must be possible to support with a 
standardized solution.

> Q2 -Can the Proxy enforce authentication and access control model on behalf of the Resource

In your case the proxy belongs to the same resource owner as the 
servers, so obviously the answer is yes. Otherwise there is a trust 
establishment issue that needs to be solved.

> As in (1) but with the extra complication that the Proxy may IP multicast (i.e. fan out)
 > the single CoAP request from the light fixture to multiple Resource
 > Servers.
>
>
> Reference:

Again this depends on who the resource owner(s) is/are. If all servers 
belong to a single owner, obviously you'd want some coordination.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Rahman, Akbar" <[email-masked]>
Date: Fri, 24 Jan 2014 14:11:10 -0500

Thanks, Ludwig.  It sounds like you are saying my concerns will be naturally covered during the ACE requirements and protocol development.  So I will just keep an eye out as the ACE effort progresses and contribute as required.

Akbar

-----Original Message-----
From: Ludwig Seitz [mailto:[email-masked]] 
Sent: Friday, January 24, 2014 4:08 AM
To: Rahman, Akbar; Olaf Bergmann
Cc: [email-masked]
Subject: Re: Possible Proxy use cases for ACE

questions).  Please
 From experience the

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se