Subject: [Ace] Request to form a WG on Authentication and Authorization for Constrained Environment (ACE)

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Apr 2014 09:53:10 +0200

Dear IESG, Dear Barry,

at IETF#89 in London many IETF participants met to discuss potential new
work on authentication and authorization for constrained environments
and we received lots of positive feedback during the BOF, see
http://www.ietf.org/mail-archive/web/ace/current/msg00309.html

Following the IETF meeting we continued the charter discussions to
address various questions that surfaced during the BOF and you can find
the discussions at:
http://www.ietf.org/mail-archive/web/ace/current/maillist.html

We have concluded our charter discussions and would like to present the
outcome to the IESG as input for forming a new working group.

------

Draft Charter - Authentication and Authorization for Constrained
Environment (ACE)

The IETF has recently developed protocols for use in constrained
environments, where network nodes are limited in CPU, memory and power.
It has been observed that Internet protocols can be applied to these
constrained environments, often only requiring minor tweaking and
profiling. In other cases, new protocols have been defined to address
the specific requirements of constrained environments. An example of
such a protocol is the Constrained Application Protocol (CoAP).

As in other environments, authentication and authorization questions
also arise in constrained environments. For example, a door lock has to
authorize the person seeking access using a "digital key". Where is the
authorization policy stored? How does the digital key communicate with
the lock? Does the lock interact with an authorization server to obtain
authorization information? How can access be temporarily granted to
other persons? How can access be revoked? These types of questions have
been answered by existing protocols for use cases outside constrained
environments, however in constrained environments, additional and
different requirements pose challenges for the use of various security
protocols. In particular, the need arises for a dynamic and fine grained
access control mechanism, where clients and/or resource servers are
constrained.

The IETF has a long history in developing three-party authentication and
authorization protocols for distributed environments. Examples include
Kerberos, the Public Key Infrastructure (PKI), the Authentication,
Authorization and Accounting (AAA) infrastructure, and the Web
Authorization Protocol (OAuth). All these protocols enjoy widespread
deployment on the Internet. Although they all aim to solve a similar
goal, at an abstract level, they offer quite different functions and
utilize different message exchanges. These differences result from the
main deployment use cases they were designed for respectively.

Requirements derived from use cases indicate the suitability of existing
work as a solution for constrained environments. These protocols,
however, were not optimized for constrained environments. Additional
requirements that need to be taken into account are the lack of a
suitable user-interface and the inability of embedded devices to contact
an authorization server in real-time with every resource access request
due to intermittent connectivity, etc.

This working group therefore aims to produce a standardized solution for
authentication and authorization to enable authorized access to
resources in constrained environments. As a starting point, the working
group will assume that access to resources at a resource server by a
client device takes place using CoAP and is protected by DTLS. Both
resource server and client may be constrained. This access will be
mediated by an authorization server, which is not considered to be
constrained.

Existing authentication and authorization protocols will be used and
re-applied for use in constrained environments where applicable. This
requires relevant specifications to be reviewed for suitability,
selecting a subset of them and restricting the options within each of
the specifications. Some functionality, however, may not be available in
existing protocols and thus new standardization efforts may be required.
Leveraging existing work means the working group benefits from available
security analysis, implementation, and deployment experience. Moreover,
a standardized solution for federated authentication and authorization
will help to stimulate the deployment of constrained devices that
provide increased security.

Once progress in identifying suitable candidate solutions has been made,
the working group will verify whether the same mechanisms are also
applicable beyond the use of CoAP and DTLS, which are the two main
protocols the group will focus on for access to resources. In
particular, the ability to use the developed solution over HTTP and TLS
will be investigated. Furthermore, to guarantee smooth transition, the
integration with existing deployments will be studied, particularly
concerning the use of protocol translation proxies.

This work does not make the assumption that the party offering
application layer services is always the same party offering network
access services.

The working group has the following tasks:

1) Produce use cases and requirements

2) Identify authentication and authorization mechanisms suitable for
resource access in constrained environments.

Milestones:

Jul 2014 Submit “Use cases and Requirements” as a WG item.
Dec 2014 Submit “Authentication and Authorization Solution” as a WG item.
Jul 2015 Submit “Use cases and Requirements” document to the IESG for
publication as an Informational RFC.
Jul 2016 Submit “Authentication and Authorization Solution”
specification to the IESG for publication as a Proposed Standard.

------

Ciao
Hannes & Kepeng

Ciao
Hannes

---

From: Barry Leiba <[email-masked]>
Date: Mon, 28 Apr 2014 09:10:56 -0400

I have begun the chartering process, and the charter is now in
"Informal Review" state, for comment by the IAB and IESG:
https://datatracker.ietf.org/doc/charter-ietf-ace/

Timeline:
The next formal IESG telechat is on 15 May, and I've put it on the
agenda for that telechat.  Its state will change to "Internal Review"
before then.  If it's approved for external review (the IETF and
broader SDO community) then, it will be back on the 29 May telechat
for possible final approval.

During the chartering process, we'll have to decide whether this
belongs in the App Area or the Sec Area, and I specifically ask the
IAB and IESG to comment on that during review.  For now, I'm holding
the token on it.

Barry