Subject: [Ace] ACE Charter Proposal v0.7

From: Likepeng <[email-masked]>
Date: Thu, 27 Mar 2014 02:48:38 +0000

Hello all,

Based on the recent discussions in the mailing list, Hannes and I have provided the ACE charter proposal v0.7:
http://tools.ietf.org/wg/core/trac/wiki/ACE_charter#

There is no change to the descriptive text.

We mainly change the task list and add milestones.

Do you think the charter is ready to go?

Please indicate your opinion, whether you like it or not, and also your comments/suggestions.

Thanks,

Kind Regards
Kepeng & Hannes

Draft Charter V0.7 - Authentication and Authorization for Constrained Environment (ACE)

The IETF has recently developed protocols for use in environments where network nodes are limited in CPU, memory, and power. It was observed that Internet protocols can be applied to these constrained environments, often only requiring minor tweaking and profiling. In other cases, new protocols have been defined to address the specific requirements of constrained devices and networks. An example of such a protocol is the Constrained Application Protocol (CoAP).

As in other environments, authentication and authorization question also arise in environments with constrained nodes and networks. For example, a door lock has to authorize the person seeking access using a "digital key". Where are the authorization decisions stored? How does the digital key communicate with the lock? Does the lock interact with an authorization server to obtain authorization information? How can access be granted to other persons temporarily? How can access be revoked? These types of questions have been answered by existing protocols for use cases outside the constrained environment. But in constrained environment, additional requirements pose challenges for the use of various security protocols. In particular, the need for a dynamic and fine grained access control mechanism whereby clients and/or resource servers suffer from constraints arises.

The IETF has a long history in developing three party authentication and authorization protocols for distributed environments. Examples include Kerberos, the Public Key Infrastructure (PKI), the Authentication, Authorization, and Accounting (AAA) infrastructure, and the Web Authorization Protocol (OAuth). All these protocols enjoy widespread deployment on the Internet. Although they all aim to solve a similar goal, at an abstract level, they offer quite different functions and utilize different message exchanges. These differences are motivated by the main deployment use cases they were designed for.

Requirements derived from use cases indicate the suitability of already existing work, such as OAuth, as a solution for constrained environments. These protocols were, however, not optimized for constrained environments. Additional requirements that need to be taken into account are the lack of a suitable user-interface for obtaining the consent of the user and the inability of embedded devices to contact an authorization server in real-time with every access request due to intermittent connectivity, etc.

This working group therefore aims for a standardized solution for authentication and authorization to enable authorized access to resources in constrained environments. As a starting point, the working group will assume that access to resources offered by a resource server by a client devices takes place using CoAP and is protected by DTLS. Both resource server and client may be resource constraint. This access will be mediated by an authorization server, which does not suffer from the same resource limitations.

Existing authentication and authorization protocols are used and re-applied for use with constrained devices, where applicable. This requires relevant specifications to be reviewed for suitability, selecting a subset of them, restricting the options within each of the specifications. Some functionalities may, however, not be available in existing protocols and for those cases new functionality has to be standardized. Thus, existing work can be leveraged and the group benefits from available security analysis, implementation, and deployment experience. Moreover, a standardized solution for federated authentication and authorization will help to stimulate the deployment of IoT devices offering increased security.

Once progress in identifying suitable candidate solutions has been made the working group will verify whether the same mechanism are also applicable beyond the use of CoAP and DTLS, which are the two main protocols the group will focus on for access to resources. In particular, the ability to use the developed solution over HTTP and TLS will be investigated. Furthermore, to guarantee smooth transition the integration with existing deployment will be studied. This particularly concerns the use of protocol translation proxies.

To be successful this working group requires expertise in security, privacy, and a good understanding of usability in the constrained environment space. This work does not make the assumption that the party offering application layer services is always the same party offering network access services.

The working group has the following tasks:

1) Use cases and requirements

2) Identification of authentication and authorization mechanisms suitable for resource access in constrained environments.

Milestones:

Jul 2014 Submit "Use cases and Requirements" as WG item.

Dec 2014 Submit "Authentication and Authorization Solution" as WG item.

Jul 2015 Submit "Use cases and Requirements" document to IESG for publication as informational RFC.

Jul 2016 Submit "Authentication and Authorization Solution" specification to IESG for publication as a Proposed Standard.