Subject: [T2TRG] draft-garciamorchon-t2trg-automated-iot-security-00

From: "Garcia-Morchon O, Oscar" <[email-masked]>
Date: Tue, 3 Jul 2018 07:13:03 +0000

Dear all,

Thorsten and I have submitted a draft  https://datatracker.ietf.org/doc/draft-garciamorchon-t2trg-automated-iot-security/ with initial ideas to automate IoT security.

The basic problem that this draft tries to solve is the mismatch between the security capabilities and settings with which IoT devices are designed/manufactured/deployed and the actual security requirements of the IoT devices in different environments over time.

Examples of this mismatch are as follows:

a)       An IoT device is designed and manufactured with certain security capabilities. When deployed, it is deployed in a different environment requiring different security settings. Thus, this device poses a security risk.
b)      An IoT device is designed and manufactured with certain security capabilities. When initially deployed, these security capabilities match the security requirements in the IoT deployment. However, over time new threats appear. Thus, this device poses a security risk.

The draft proposes the definition of two protocols to automate security configuration and vulnerability assessment of IoT devices. It gives some first ideas for such protocols. The draft illustrates how these protocols can be used to deploy different security profiles, concept that we had in the first versions of the seccons document (https://datatracker.ietf.org/doc/draft-irtf-t2trg-iot-seccons/).

The new document is very early work, thus, do not expect it to be complete/perfect.

We would like to get feedback from the group to know whether:
-          it is worth working on this problem space
-          the proposed direction makes sense to try to solve this problem

Regards, Oscar.

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.