[Ace] Draft ACE Charter V0.1

Likepeng <likepeng@huawei.com> Thu, 12 December 2013 03:49 UTC

From: Likepeng <likepeng@huawei.com>
To: "ace@ietf.org" <ace@ietf.org>
Thread-Topic: Draft ACE Charter V0.1
Thread-Index: Ac727SJkqYhxD//mT5GYmRIeXquOcw==
Date: Thu, 12 Dec 2013 03:49:19 +0000
Message-ID: <34966E97BE8AD64EAE9D3D6E4DEE36F252AD2DF8@SZXEMA501-MBS.china.huawei.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
Content-Type: multipart/alternative; boundary="_000_34966E97BE8AD64EAE9D3D6E4DEE36F252AD2DF8SZXEMA501MBSchi_"
MIME-Version: 1.0
Subject: [Ace] Draft ACE Charter V0.1
Precedence: list

Hello all,

Thanks for your feedback, and they are very helpful.

We made a quick update for the charter (1), and hope it captures some of your comments.

I created a wiki page for the charter, so that people can log in the wiki page to improve it:

http://trac.tools.ietf.org/wg/core/trac/wiki/ACE_charter#

Feel free to provide your further comments/suggestions.

Thanks
Kind Regards
Kepeng & Stefanie

(1) Draft Charter V0.1 - Authentication and Authorization for Constrained Environment (ACE)

The CoAP (Constrained Application Protocol) is a light-weight application layer protocol, especially suitable for applications such as smart energy, smart home, building automation, remote patient monitoring etc. Due to the nature of these applications, including a critical, unattended infrastructure and usage in the personal sphere, security and privacy protection are critical components.

Currently, a problem with constrained devices is the realization of such secure operation. Constrained devices are unable to include many sophisticated features, such as user interfaces and configuration files, but nevertheless need to perform authentication and authorization operations. While authentication is well understood, at least for communication security, there are only insufficient means for authorization. Authentication is considered in this context as it is needed as a prerequisite to performing authorization, including the authorization to change the authorization state.

The ACE WG focuses on providing constrained devices with the necessary prerequisites to use REST operations in a secure way such as authorization information and the related keying material. Constrained devices will thus be enabled to authenticate operations from other (constrained or less-constrained) devices, to communicate securely with them and to verify their individual authorization to access specific resources. To achieve this, ACE will be able to employ additional less-constrained devices in order to relieve the constrained nodes from complex security related tasks (e.g. managing authorization policies and a large number of keys). ACE will use CoAP and employ security properties of DTLS whenever possible.

The ACE WG has the following tasks:

- Document the use cases and high-level requirements for secured communication between constrained devices. (This task is pursued as a means to the other ends, not as an end in itself.)

- Flesh out profiles for the certificates that already are part of CoAP's security architecture as well as possibly for any ACE-specific use of certificates.

- Define a mechanism for authenticated and protected transfer of authorization information suitable for constrained device to constrained device communication.

- Define an access token and authorization information format suitable for constrained devices.

- Define bootstrapping for authorization information using the Resource Directory (see http://tools.ietf.org/html/draft-ietf-core-resource-directory).

[Ace] Draft ACE Charter V0.1 Likepeng