Subject: Re: [Mud] [Iot-onboarding] administrative control of devices --- thinking again about an IoT security WG

From: Qin Wu <[email-masked]>
Date: Thu, 24 Sep 2020 10:51:46 +0000

Have we considered to manage multiple devices on boarding at one time?
These devices might be placed behind the same gateway device. In some cases, there is no DNS infrastructure or DHCP.

-Qin
-----邮件原件-----
发件人: Iot-onboarding [mailto:[email-masked]] 代表 Michael Richardson
发送时间: 2020年9月19日 5:58
收件人: [email-masked]; [email-masked]
主题: [Iot-onboarding] administrative control of devices --- thinking again about an IoT security WG

Michael Richardson <[email-masked]> wrote:
    > This includes:
    > * administrative control of devices

Some have asked how big this effort would be.
I think that it might rather small, and it does not have to a single solution either.  90% of the challenge in building administrative interfaces is the authorization side.  This is something that can be handled during onboarding.

A RESTCONF interface might be enough.
  1) https://datatracker.ietf.org/doc/draft-ietf-netconf-keystore/ provides
     a way to update a WPA-PSK key for network access.

  2) https://datatracker.ietf.org/doc/rfc8341/ and/or
     https://datatracker.ietf.org/doc/draft-ietf-netconf-trust-anchors/
     provides a way to update who can manage the device.  

  3) I looked for a way to statically configure DNS server IPs into a device,
     should one not be willing to use the Do53 ones from DHCP.  There isn't
     such a thing, but I'll bet ADD WG would comment on such a document.
     I was actually looking for some network configuration ("MIB") YANG module, which
     I'm sure exists, but I'm not YANG expert.
     
  4) https://datatracker.ietf.org/doc/draft-kwatsen-netconf-sztp-csr/
     can be used to renew management interface certificates.  Or the
     onboarding system might have an LDevID renewal process.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Michael Richardson <[email-masked]>
Date: Thu, 24 Sep 2020 13:43:54 -0400

Qin Wu <[email-masked]> wrote:
    > These devices might be placed behind the same gateway device. In some
    > cases, there is no DNS infrastructure or DHCP.

BRSKI and the 802.1X EAP methods (EAP-NOOB, BRSKI-TEAP) do not need DHCP or
DNS in order to onboard devices.
Multiple devices is not more difficult than a single device.

I had some contact with some Google IoT people who were considering how
a home owner might onboard dozens to hundreds of devices.
Consider a person who has just moved into a new apartment, or installers
setting up an office building.

The issue primarily about be sure that the device in your "hand" is actually
the device being controlled.  Given a mess of boxes on the floor, even NFC
could see many devices.

There is an advantage to having an integrated API, because one can make the
device "do" something to confirm it's the right device.  That's a bit of
slippery slope of APIs, but "identify self" is a reasonable administrative
API that could be in common.

(Some 1U servers have a blue LED with a button just so that you match the
front/back of a given 1U server in a cabinet full of ~48 of them...  Some
versions could also turn this on via software, or can query the state of the
button via software)

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide