Subject: Re: [T2TRG] I-D Action: draft-bormann-t2trg-sworn-05.txt

From: Carsten Bormann <[email-masked]>
Date: Mon, 7 Feb 2022 03:32:52 +0100

We have now submitted a new version of the SWORN (Secure Wake on Radio Nudging) draft, now with more general considerations on token-based in-network authorization.  I believe in-network authorization can be a useful way to protect energy-limited IoT devices from unwanted traffic (it is not intended to replace application-layer authentication/authorization).  One interesting aspect, as always, is what players are active in this protocol and how they contribute to the ultimate security objective (availability of the IoT devices to legitimate uses).

I hope we can discuss this work in the context of the security activities of this RG.  There of course also is a “Computing in the network” aspect: This design calls for routers to check MACs (message authentication codes) before forwarding packets, and this will generally be needed to be done in the “fast path”.  But maybe fine-tuning of the design can be done once we like its security properties.

The protocol sketches included in the drafts are not intended for standardization (at least not yet), but serve as Gedankenexperiments to obtain the right security and operational properties.

Grüße, Carsten

> On 2022-02-07, at 03:24, [email-masked] wrote:
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>        Title           : SWORN: Secure Wake on Radio Nudging
>        Authors         : Carsten Bormann
>                          Yizhou Li
> 	Filename        : draft-bormann-t2trg-sworn-05.txt
> 	Pages           : 18
> 	Date            : 2022-02-06
> 
> Abstract:
>   Normally off devices (RFC7228) would need to expend considerable
>   energy resources to be reachable at all times.  Instead, MAC layer
>   mechanisms are often employed that allow the last hop router of the
>   device to "wake" the device via radio when needed.  Activating these
>   devices even for a short time still does expend energy and thus
>   should be available to authorized correspondents only.
>   Traditionally, this has been achieved by heavy firewalling, allowing
>   only authorized hosts to reach the device at all.  This may be too
>   inflexible for an Internet of Things.
> 
>   The present report describes how to use a combination of currently
>   standardized technologies to securely effect this authorization.
> 
>   We also discuss how the general approach of the original SWORN
>   protocol can be extended to cover additional use cases and
>   implementation environments.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-bormann-t2trg-sworn/
> 
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-bormann-t2trg-sworn-05.html
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-bormann-t2trg-sworn-05
> 
> 
> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt