Subject: [Ace] Container Use Case

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 04 Dec 2014 16:02:46 +0100

Hi all,

I read through the container use case and have a few questions.

The individual boxes (with bananas) are equipped with sensors and these
sensors communicate in a multi-hop fashion with each other to finally
reach a gateway (at the container level). This gateway then has access
to the Internet (sometimes, depending on where it is). Is this network
setup roughly correct?

You are saying that the boxes (+their sensors) may belong to different
owners. Since it is relevant for the use case I think it would be good
to have a list of the persons that seek access to different resources.
The container itself may belong to a party that is different from the
owner of the box. Does the ownership of the box change when it reaches
the supermarket? I guess the container will be sent back but I doubt
that this is true for the boxes?

It would be good to say whether you assume that the sensors upload their
data to different Internet servers or to the same and who wants to get
access to the data. I got a bit confused by the terminology you
introduced in Section 2.1.2 where you suddenly talk about "device owner"
whereas the terminology talks about resource owner and the actual text
refers to multiple owners (different owners for the different boxes, and
for the containers). Then, there is also the supermarket ordered the
goods and is supposed to own them afterwards.

Maybe there is also the possibility to be more specific about the
authorization challenges. For example, instead of saying "U1.1 The
device owner wants to grant different access rights to a resource to
different parties." you might want to state that "The owner of the
container grants read access the temperature information (?) to the
truck company." (I don't know if that makes sense but it's just an
example.) Since we talk about very specific use cases here we can also
be specific in the challenges.

Requirements U1.4 and U1.5 are not authorization requirements/challenges
but communication security requirements. Do you think that they are
essential for the work in ACE? I don't think so. I would leave them aside.

Regarding requirement U1.8: "Messages between client and resource server
might need to be forwarded over multiple hops." Where did you derive
this requirement from? Who is the client and who is the resource server
in this example?

Ciao
Hannes

---

From: Michael Richardson <[email-masked]>
Date: Thu, 04 Dec 2014 13:43:41 -0500

> to the Internet (sometimes, depending on where it is). Is this network

I think so.

    > to have a list of the persons that seek access to different resources.

I think that this is incorrect; I think that the bananas belong to different
owners.  The boxes started off owned by the producer, which is why the
producer was able to arrange for them to mesh together.  However, they
producer wants to delegate access to the sensors to different owners (of bananas).

    > that this is true for the boxes?

Does it matter if the boxes are recycled (firmware wiped/reset/etc.) or if
they are disposable?  As long as that process involves resetting things?

    > goods and is supposed to own them afterwards.

My understanding is that a key thing about this use case is that the
*container* needs access to the data, so that the *container* can make sure
the environment is correct.  (the truck, boat, train, etc. the container is
on)

There might not be connectivity for much of the voyage.

    > be specific in the challenges.

I agree with this change, let's be really clear.

    > essential for the work in ACE? I don't think so. I would leave them aside.

I would leave them there and say that they out of scope.

    > this requirement from? Who is the client and who is the resource server

and what layer are the multiple hops?
I think the point of this requirement is that we are assuming layer-3, IP
networking, not, for instance, Bluetooth, for which there would be no
authorization issues (because there is always only one owner in BT).

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 Dec 2014 14:11:21 +0100

Hi Michael,

thanks for sharing your views.

> producer wants to delegate access to the sensors to different owners (of bananas).

Ok. This might be good to state since I don't see that anywhere. I am
sure the producer may also keep track of the status while the shipments
travel to the different owners (customers, like supermarket).

> they are disposable?  As long as that process involves resetting things?

I think it is lifecycle issue. For example, if the boxes are indeed
change ownership to the supermarket then the producers should not have
access to the sensor data in the future. Right?

> the environment is correct.  (the truck, boat, train, etc. the container is

Interesting. I didn't understood that this is the main use case. I
thought that the main point was that you get the data to the Internet
and that access to the data is provided from there to the different
stakeholders (supermarket, producer, etc.)

> authorization issues (because there is always only one owner in BT).

Your understanding of Bluetooth is incorrect.

Ciao
Hannes

> 
> 
> 
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Stefanie Gerdes <[email-masked]>
Date: Fri, 05 Dec 2014 16:35:21 +0100

Hi Hannes,

thank you for your feedback.

On 12/04/2014 04:02 PM, Hannes Tschofenig wrote:
> The individual boxes (with bananas) are equipped with sensors and 
> these sensors communicate in a multi-hop fashion with each other
> to finally reach a gateway (at the container level). This gateway
> then has access to the Internet (sometimes, depending on where it
> is). Is this network setup roughly correct?

The boxes do not in every case want to access a server in the
Internet. An important part of the use case is the climate control
during shipments and in the ripening facilities. In this case, the
measurements of the sensors in the boxes (e.g. temperature or ethylene
sensors) are used to control the temperature of the goods.

It might not always be possible to reach servers in the Internet
during shipment. Therefore, recorded values might need to be stored
locally, at least until a connection is available. If a connection is
available there is not necessarily a need for anything other than an
IP router.

> 
> You are saying that the boxes (+their sensors) may belong to 
> different owners. Since it is relevant for the use case I think it 
> would be good to have a list of the persons that seek access to 
> different resources. The container itself may belong to a party 
> that is different from the owner of the box. Does the ownership of 
> the box change when it reaches the supermarket? I guess the 
> container will be sent back but I doubt that this is true for the 
> boxes?

I guess the ownership of the box will change. I will try to get more
information about this aspect.

> 
> It would be good to say whether you assume that the sensors upload 
> their data to different Internet servers or to the same and who 
> wants to get access to the data. I got a bit confused by the 
> terminology you introduced in Section 2.1.2 where you suddenly
> talk about "device owner" whereas the terminology talks about
> resource owner and the actual text refers to multiple owners
> (different owners for the different boxes, and for the containers).
> Then, there is also the supermarket ordered the goods and is
> supposed to own them afterwards.

For the climate control part of the use case, the banana box sensors
will communicate with the temperature regulation system, e.g. with the
fan next to them.

For locating goods of specific customers, the transloading personnel
will likely use devices which ask the sensors directly.

We used the term "device owner" instead of "resource owner" since
authorization might not only be needed to protect a resource but also
to protect a client. The owner of the client will want to decide if a
resource server is allowed to provide data and the owner of the
resource will want to make sure that only authorized entities are
allowed to request a resource.

>  device owner wants to grant different access rights to a resource 
> to different parties." you might want to state that "The owner of 
> the container grants read access the temperature information (?)
> to the truck company." (I don't know if that makes sense but it's
> just an example.) Since we talk about very specific use cases here
> we can also be specific in the challenges.

I am not sure if we want to go into this level of detail. I would
rather state the relevant problems and leave it to the implementers to
decide how exactly they want to solve them. Otherwise we might end up
with very specific solutions to a handful of use cases while slightly
different use cases cannot be addressed.

> 
> Requirements U1.4 and U1.5 are not authorization 
> requirements/challenges but communication security requirements.
> Do you think that they are essential for the work in ACE? I don't 
> think so. I would leave them aside.

The question is why we do authorization in the first place. Reasons
for authorization are to protect the integrity and confidentiality. If
we don't need either of these we won't need authorization.

> 
> Regarding requirement U1.8: "Messages between client and resource 
> server might need to be forwarded over multiple hops." Where did 
> you derive this requirement from? Who is the client and who is the 
> resource server in this example?

I am not sure if I understand that question. 2.1.1 states that because
of the high water content of the bananas, it might not be possible to
have a direct communication between two nodes. In this case, client
and resource server might also not be able to communicate directly.

Steffi

---

From: Stefanie Gerdes <[email-masked]>
Date: Fri, 05 Dec 2014 17:52:49 +0100

Hi all,

On 12/05/2014 02:11 PM, Hannes Tschofenig wrote:
>>> different owners. Since it is relevant for the use case I think
>>> it would be good to have a list of the persons that seek access
>>> to different resources.
>> 
>> I think that this is incorrect; I think that the bananas belong
>> to different owners.  The boxes started off owned by the
>> producer, which is why the producer was able to arrange for them
>> to mesh together.  However, they producer wants to delegate
>> access to the sensors to different owners (of bananas).
> 
> Ok. This might be good to state since I don't see that anywhere. I
> am sure the producer may also keep track of the status while the
> shipments travel to the different owners (customers, like
> supermarket).

I think the boxes in a container will likely belong to single
customer. During the shipment to the ripening facility, the owner of
the boxes will likely still be the fruit vendor.

Steffi

---

From: Michael Richardson <[email-masked]>
Date: Fri, 05 Dec 2014 12:12:57 -0500

> access to the sensor data in the future. Right?

I don't know if the ownership changes, or if the boxes are returned to the
producer.  I don't know, but I think that it doesn't matter.  
What I believe is that the bananas are removed from the boxes when they get
to the supermarket, and the boxes are "destroyed" 

Maybe I'm wrong here, and they sit in the supermarket in the boxes in the
aisles.  Maybe the producer gets access further access, or maybe they do
not....   So I guess your point is correct that there is an end-of-lifecycle
issue, and a possible transfer of ownership.  It could be that the box is
destroyed, and the sensors are returned to the sensor-owning-consortium.

    > stakeholders (supermarket, producer, etc.)

If the data could always go up to the Internet (live), then we could use
unconstrained OAUTH to provide access to the data.

    > Your understanding of Bluetooth is incorrect.

A BT can only pair with one other device.  You can not (sadly) mesh with it.
BTLE 4.1, can apparently, let you pair with multiple devices, but not
simultaneously.  I'm told that one can change in a matter of 10ms, so it
might be possible to do some kind of 6tisch-like scheduled mesh with BTLE.

Of course, we could run IP over BT, at which point, there could be multiple
hops involved, but that assumes we run a layer-3 protocol.  When I say using
BT and not doing "networking", I mean that the BT device would show up as a
straight rfcomm or microphone or something, and it would just spit data over
the virtual serial port/etc.

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 Dec 2014 20:56:25 +0100

Hi Michael,

thanks again for the quick feedback.

> destroyed, and the sensors are returned to the sensor-owning-consortium.

It would of course be nice to have (useful) examples where the ownership
of IoT devices changes. If this is not one of those cases that's fine as
well. Was just wondering because nothing was said about this topic.

> unconstrained OAUTH to provide access to the data.

Sure and that might be a good thing.

Another case would be that the data cannot always be sent to the
Internet and is instead cached in the meanwhile. Once Internet
connectivity is present then the data is uploaded.

I sort of read the use case in this way.

> the virtual serial port/etc.  

Let us discuss the features of Bluetooth Smart in a separate thread
since it is not essential for the use case document.

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 Dec 2014 21:04:02 +0100

Hi Stefanie,

thanks for your input.

> the boxes will likely still be the fruit vendor.

I read this paragraph:

"
   Due to the high water content of the fruits, the propagation of radio
   waves is hindered, thus often inhibiting direct communication between
   nodes [Jedermann14].  Instead, messages are forwarded over multiple
   hops.  Those relaying nodes might belong to different owners.  The
   sensors in the banana boxes cannot always reach the internet during
   the journey.
"

I got the impression that the relay nodes are essentially the sensors at
the different boxes. And from the statement that the relay nodes belong
to different owners I concluded that the boxes belong to different owners.

Regardless what the story is I think there is room for better describing
the stakeholders and the ownership a bit better to illustrate which
entity communicates with whom and who asks for access to what data.

Ciao
Hannes