Subject: [Anima] owner categories

From: "Hedanping (Ana)" <[email-masked]>
Date: Thu, 26 Mar 2015 23:09:06 +0000

I forward what has been discussed in 6lo.
I like this categorizing approach. I think in anima we need to clarify which owners do we care about during security bootstrapping

Regards,
Ana

From: 6tisch [mailto:[email-masked]] On Behalf Of Robert Moskowitz
Sent: Friday, March 27, 2015 6:37 AM
To: Rene Struik; Samita Chakrabarti; [email-masked]; [email-masked]
Subject: Re: [6tisch] [6lo] Tonight's 6lo informal security discussion

When we were doing IEEE 802.1AE, we said this very tightly:

MAC (layer 2) security addresses the risks and liablities of the network owner.
IP (layer 3) security addresses the risks and liablities of the system owner.
Transport/Session (layers 4/5) security addresses the risks and liablities of the application owner.
Data security addresses the risks and liablities of the data owner.

We WILL be doing more than one of the above.
On 03/26/2015 05:14 PM, Rene Struik wrote:
Dear colleagues:

I posted some material on difference in potential security objectives for infrastructure security and for application security to the Anima mailing list this morning (11.26am EDT) and that may be of interest to our 6l0 discussion tonight as well, esp. since Samita's email suggested focus on network access.

Weblink to this email:
http://www.ietf.org/mail-archive/web/anima/current/msg00864.html

Excerpt{
Security policy and trust model
The main objectives of network security are to provide for infrastructure security and application security. Infrastructure security deals with controlling admission to networks. The objective here is to restrict access to scarce network resources to authorized resources only, such as to ensure proper bandwidth allocation, protection of commands (such as those regulating network membership and exchange of status information), and, e.g., power drain savings. Application security deals with controlling access to actual information. The objective here is to restrict access to information shared between members of a group of network devices to precisely these group members, such as to prevent external parties from learning the contents of exchanged messages and from modifying message traffic or injecting their own messages in an undetected way.

Infrastructure security and application security have different underlying trust requirements. With infrastructure security, the network owner may have an interest in restricting access to his network to privileged devices only, based on specific criteria, such as device subscription to the network or charging for airtime/bandwidth, whereas network devices might not care who the actual network coordinator is, as long as access to bandwidth is satisfactory. With application security, devices that exchange information may have a vested interest in keeping their communications private, also from the network owner. Both types of security involve the management of groups of devices, either for controlling network membership (by a network coordinator) or for restricting access to information to specific groups (by a security manager).
}

Best regards, Rene

On 3/26/2015 5:53 PM, Samita Chakrabarti wrote:
Many folks were asking about the scope and content of the discussion.

Here are some thoughts and suggestions:

Scope:  Network level Access security and authentication
                                For 6lo Networks (multi-constrained L2 technologies)

Possible discussion items:

1.            L3 Solutions desirable for network access [ since we deal with multi-L2 Technologies]
2.            Dynamic Key/id distribution ? [ useful for L2-L3-APP layer SA?]
3.            Router Advertisement authentication?
4.            Join/Leave network
5.            Mobility across 6lowpan/6lo subnets or networks?
6.            Analysis of security work done in 6Tisch and how can we separate the Tsch-independent part for common usage on 6lo?

Time: 7p-8p Room: Pavillion (Terrace level)

See you there!

-Gabriel, Samita and James

_______________________________________________

6lo mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/6lo

--

email: [email-masked]<mailto:[email-masked]> | Skype: rstruik

cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

_______________________________________________

6tisch mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/6tisch