idnits 2.17.1 draft-ietf-roll-applicability-home-building-09.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == It seems as if not all pages are separated by form feeds - found 0 form feeds but 31 pages Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 24, 2015) is 3321 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Downref: Normative reference to an Experimental RFC: RFC 4764 ** Obsolete normative reference: RFC 5246 (Obsoleted by RFC 8446) ** Downref: Normative reference to an Informational RFC: RFC 5548 ** Downref: Normative reference to an Informational RFC: RFC 5673 ** Downref: Normative reference to an Informational RFC: RFC 5826 ** Downref: Normative reference to an Informational RFC: RFC 5867 ** Obsolete normative reference: RFC 6347 (Obsoleted by RFC 9147) ** Downref: Normative reference to an Experimental RFC: RFC 6997 ** Downref: Normative reference to an Experimental RFC: RFC 6998 ** Downref: Normative reference to an Informational RFC: RFC 7102 ** Downref: Normative reference to an Informational RFC: RFC 7416 == Outdated reference: A later version (-12) exists of draft-ietf-roll-trickle-mcast-11 -- Possible downref: Non-RFC (?) normative reference: ref. 'IEEE802.15.4' -- Possible downref: Non-RFC (?) normative reference: ref. 'G.9959' == Outdated reference: A later version (-17) exists of draft-ietf-dice-profile-10 == Outdated reference: A later version (-05) exists of draft-richardson-6tisch--security-6top-04 Summary: 11 errors (**), 0 flaws (~~), 5 warnings (==), 3 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Roll A. Brandt 3 Internet-Draft Sigma Designs 4 Intended status: Standards Track E. Baccelli 5 Expires: September 25, 2015 INRIA 6 R. Cragie 7 ARM Ltd. 8 P. van der Stok 9 Consultant 10 March 24, 2015 12 Applicability Statement: The use of the RPL protocol suite in Home 13 Automation and Building Control 14 draft-ietf-roll-applicability-home-building-09 16 Abstract 18 The purpose of this document is to provide guidance in the selection 19 and use of protocols from the RPL protocol suite to implement the 20 features required for control in building and home environments. 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on September 25, 2015. 39 Copyright Notice 41 Copyright (c) 2015 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 57 1.1. Relationship to other documents . . . . . . . . . . . . . 4 58 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.3. Required Reading . . . . . . . . . . . . . . . . . . . . 4 60 1.4. Out of scope requirements . . . . . . . . . . . . . . . . 5 61 2. Deployment Scenario . . . . . . . . . . . . . . . . . . . . . 5 62 2.1. Network Topologies . . . . . . . . . . . . . . . . . . . 6 63 2.2. Traffic Characteristics . . . . . . . . . . . . . . . . . 7 64 2.2.1. General . . . . . . . . . . . . . . . . . . . . . . . 8 65 2.2.2. Source-sink (SS) communication paradigm . . . . . . . 8 66 2.2.3. Publish-subscribe (PS, or pub/sub)) communication 67 paradigm . . . . . . . . . . . . . . . . . . . . . . 9 68 2.2.4. Peer-to-peer (P2P) communication paradigm . . . . . . 9 69 2.2.5. Peer-to-multipeer (P2MP) communication paradigm . . . 9 70 2.2.6. Additional considerations: Duocast and N-cast . . . . 10 71 2.2.7. RPL applicability per communication paradigm . . . . 10 72 2.3. Layer-2 applicability . . . . . . . . . . . . . . . . . . 11 73 3. Using RPL to meet Functional Requirements . . . . . . . . . . 12 74 4. RPL Profile . . . . . . . . . . . . . . . . . . . . . . . . . 12 75 4.1. RPL Features . . . . . . . . . . . . . . . . . . . . . . 13 76 4.1.1. RPL Instances . . . . . . . . . . . . . . . . . . . . 13 77 4.1.2. Storing vs. Non-Storing Mode . . . . . . . . . . . . 13 78 4.1.3. DAO Policy . . . . . . . . . . . . . . . . . . . . . 14 79 4.1.4. Path Metrics . . . . . . . . . . . . . . . . . . . . 14 80 4.1.5. Objective Function . . . . . . . . . . . . . . . . . 14 81 4.1.6. DODAG Repair . . . . . . . . . . . . . . . . . . . . 14 82 4.1.7. Multicast . . . . . . . . . . . . . . . . . . . . . . 14 83 4.1.8. Security . . . . . . . . . . . . . . . . . . . . . . 15 84 4.1.9. P2P communications . . . . . . . . . . . . . . . . . 16 85 4.1.10. IPv6 address configuration . . . . . . . . . . . . . 16 86 4.2. Layer 2 features . . . . . . . . . . . . . . . . . . . . 16 87 4.2.1. Specifics about layer-2 . . . . . . . . . . . . . . . 16 88 4.2.2. Services provided at layer-2 . . . . . . . . . . . . 16 89 4.2.3. 6LowPAN options assumed . . . . . . . . . . . . . . . 16 90 4.2.4. Mesh Link Establishment (MLE) and other things . . . 16 91 4.3. Recommended Configuration Defaults and Ranges . . . . . . 16 92 4.3.1. Trickle parameters . . . . . . . . . . . . . . . . . 17 93 4.3.2. Other Parameters . . . . . . . . . . . . . . . . . . 17 94 5. MPL Profile . . . . . . . . . . . . . . . . . . . . . . . . . 18 95 5.1. Recommended configuration Defaults and Ranges . . . . . . 18 96 5.1.1. Real-Time optimizations . . . . . . . . . . . . . . . 18 97 5.1.2. Trickle parameters . . . . . . . . . . . . . . . . . 18 98 5.1.3. Other parameters . . . . . . . . . . . . . . . . . . 19 99 6. Manageability Considerations . . . . . . . . . . . . . . . . 19 100 7. Security Considerations . . . . . . . . . . . . . . . . . . . 20 101 7.1. Security considerations during initial deployment . . . . 20 102 7.2. Security Considerations during incremental deployment . . 21 103 7.3. Security Considerations for P2P uses . . . . . . . . . . 21 104 7.4. MPL routing . . . . . . . . . . . . . . . . . . . . . . . 22 105 7.5. RPL Security features . . . . . . . . . . . . . . . . . . 22 106 8. Other related protocols . . . . . . . . . . . . . . . . . . . 22 107 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23 108 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 23 109 11. Changelog . . . . . . . . . . . . . . . . . . . . . . . . . . 23 110 12. References . . . . . . . . . . . . . . . . . . . . . . . . . 24 111 12.1. Normative References . . . . . . . . . . . . . . . . . . 25 112 12.2. Informative References . . . . . . . . . . . . . . . . . 26 113 Appendix A. RPL shortcomings in home and building deployments . 28 114 A.1. Risk of undesired long P2P routes . . . . . . . . . . . . 28 115 A.1.1. Traffic concentration at the root . . . . . . . . . . 29 116 A.1.2. Excessive battery consumption in source nodes . . . . 29 117 A.2. Risk of delayed route repair . . . . . . . . . . . . . . 29 118 A.2.1. Broken service . . . . . . . . . . . . . . . . . . . 29 119 Appendix B. Communication failures . . . . . . . . . . . . . . . 30 120 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 31 122 1. Introduction 124 The primary purpose of this document is to give guidance in the use 125 of the Routing Protocol for Low power and lossy networks (RPL) 126 protocol suite in two application domains: 128 o Home automation 130 o Building automation 132 The guidance is based on the features required by the requirements 133 documents "Home Automation Routing Requirements in Low-Power and 134 Lossy Networks" [RFC5826] and "Building Automation Routing 135 Requirements in Low-Power and Lossy Networks" [RFC5867] respectively. 136 The Advanced Metering Infrastructure is also considered where 137 appropriate. The applicability domains distinguish themselves in the 138 way they are operated, their performance requirements, and the most 139 likely network structures. An abstract set of distinct communication 140 paradigms is then used to frame the applicability domains. 142 Home automation and building automation application domains share a 143 substantial number of properties: 145 o In both domains, the network can be disconnected from the ISP and 146 must still continue to provide control to the occupants of the 147 home/building. Routing needs to be possible independent of the 148 existence of a border router 150 o Both domains are subject to unreliable links but require instant 151 and very reliable reactions. This has impact on routing because 152 of timeliness and multipath routing. 154 The differences between the two application domains mostly appear in 155 commissioning, maintenance and the user interface, which do not 156 typically affect routing. Therefore, the focus of this applicability 157 document is on reliability, timeliness, and local routing. 159 1.1. Relationship to other documents 161 The Routing Over Low power and Lossy networks (ROLL) working group 162 has specified a set of routing protocols for Low-Power and Lossy 163 Networks (LLN) [RFC6550]. This applicability text describes a subset 164 of those protocols and the conditions under which the subset is 165 appropriate and provides recommendations and requirements for the 166 accompanying parameter value ranges. 168 In addition, an extension document has been produced specifically to 169 provide a solution for reactive discovery of point-to-point routes in 170 LLNs [RFC6997]. The present applicability document provides 171 recommendations and requirements for the accompanying parameter value 172 ranges. 174 A common set of security threats are described in [RFC7416]. The 175 applicability statements complement the security threats document by 176 describing preferred security settings and solutions within the 177 applicability statement conditions. This applicability statement 178 recommends more light weight security solutions and specify the 179 conditions under which these solutions are appropriate. 181 1.2. Terminology 183 This document uses terminology from [RFC6997], 184 [I-D.ietf-roll-trickle-mcast], [RFC7102], [IEEE802.15.4], and 185 [RFC6550]. 187 1.3. Required Reading 189 Applicable requirements are described in [RFC5826] and [RFC5867]. A 190 survey of the application field is described in [BCsurvey]. 192 1.4. Out of scope requirements 194 The considered network diameter is limited to a maximum diameter of 195 10 hops and a typical diameter of 5 hops, which captures the most 196 common cases in home automation and building control networks. 198 This document does not consider the applicability of Routing Protocol 199 for Low-Power and Lossy Networks (RPL)-related specifications for 200 urban and industrial applications [RFC5548], [RFC5673], which may 201 exhibit significantly larger network diameters. 203 2. Deployment Scenario 205 The use of communications networks in buildings is essential to 206 satisfy energy saving regulations. Environmental conditions of 207 buildings can be adapted to suit the comfort of the individuals 208 present inside. Consequently when no one is present, energy 209 consumption can be reduced. Cost is the main driving factor behind 210 deployment of wireless networking in buildings, especially in the 211 case of retrofitting, where wireless connectivity saves costs 212 incurred due to cabling and building modifications. 214 A typical home automation network is comprised of less than 100 215 nodes. Large building deployments may span 10,000 nodes but to 216 ensure uninterrupted service of light and air conditioning systems in 217 individual zones of the building, nodes are typically organized in 218 sub-networks. Each sub-network in a building automation deployment 219 typically contains tens to hundreds of nodes, and for critical 220 operations may operate independently from the other sub-networks. 222 The main purpose of the home or building automation network is to 223 provide control over light and heating/cooling resources. User 224 intervention via wall controllers is combined with movement, light 225 and temperature sensors to enable automatic adjustment of window 226 blinds, reduction of room temperature, etc. In general, the sensors 227 and actuators in a home or building typically have fixed physical 228 locations and will remain in the same home or building automation 229 network. 231 People expect an immediate and reliable response to their presence or 232 actions. For example, a light not switching on after entry into a 233 room may lead to confusion and a profound dissatisfaction with the 234 lighting product. 236 Monitoring of functional correctness is at least as important as 237 timely responses. Devices typically communicate their status 238 regularly and send alarm messages notifying a malfunction of 239 controlled equipment or network. 241 In building control, the infrastructure of the building management 242 network can be shared with the security/access, the Internet Protocol 243 (IP) telephony, and the fire/alarm networks. This approach has a 244 positive impact on the operation and cost of the network; however, 245 care should be taken to ensure that the availability of the building 246 management network does not become compromised beyond the ability for 247 critical functions to perform adequately. 249 In homes, the entertainment network for audio/video streaming and 250 gaming has different requirements, where the most important 251 requirement is the need for high bandwidth not typically needed for 252 home or building control. It is therefore expected that the 253 entertainment network in the home will mostly be separate from the 254 control network, which also lessens the impact on availability of the 255 control network 257 2.1. Network Topologies 259 In general, the home automation network or building control network 260 consists of wired and wireless sub-networks. In large buildings 261 especially, the wireless sub-networks can be connected to an IP 262 backbone network where all infrastructure services are located, such 263 as Domain Name System (DNS), automation servers, etc. 265 The wireless sub-network can be configured according to any of the 266 following topologies: 268 o A stand-alone network of 10-100 nodes without border router. This 269 typically occurs in the home with a stand-alone control network, 270 in low cost buildings, and during installation of high end control 271 systems in buildings. 273 o A connected network with one border router. This configuration 274 will happen in homes where home appliances are controlled from 275 outside the home, possibly via a smart phone, and in many building 276 control scenarios. 278 o A connected network with multiple border routers. This will 279 typically happen in installations of large buildings. 281 Many of the nodes are battery-powered and may be sleeping nodes which 282 wake up according to clock signals or external events. 284 In a building control network, for a large installation with multiple 285 border routers, sub-networks often overlap both geographically and 286 from a wireless coverage perspective. Due to two purposes of the 287 network, (i) direct control and (ii) monitoring, there may exist two 288 types of routing topologies in a given sub-network: (i) a tree-shaped 289 collection of routes spanning from a central building controller via 290 the border router, on to destination nodes in the sub-network; and/or 291 (ii) a flat, un-directed collection of intra-network routes between 292 functionally related nodes in the sub-network. 294 The majority of nodes in home and building automation networks are 295 typically class 0 devices [RFC7228], such as individual wall 296 switches. Only a few nodes (such as multi-purpose remote controls) 297 are more expensive Class 1 devices, which can afford more memory 298 capacity. 300 2.2. Traffic Characteristics 302 Traffic may enter the network originating from a central controller 303 or it may originate from an intra-network node. The majority of 304 traffic is light-weight point-to-point control style; e.g. Put-Ack 305 or Get-Response. There are however exceptions. Bulk data transfer 306 is used for firmware update and logging, where firmware updates enter 307 the network and logs leave the network. Group communication is used 308 for service discovery or to control groups of nodes, such as light 309 fixtures. 311 Often, there is a direct physical relation between a controlling 312 sensor and the controlled equipment. For example the temperature 313 sensor and room controller are located in the same room sharing the 314 same climate conditions. Consequently, the bulk of senders and 315 receivers are separated by a distance that allows one-hop direct path 316 communication. A graph of the communication will show several fully 317 connected subsets of nodes. However, due to interference, multipath 318 fading, reflection and other transmission mechanisms, the one-hop 319 direct path may be temporally disconnected. For reliability 320 purposes, it is therefore essential that alternative n-hop 321 communication routes exist for quick error recovery. (See Appendix B 322 for motivation.) 324 Looking over time periods of a day, the networks are very lightly 325 loaded. However, bursts of traffic can be generated by e.g. 326 incessant pushing of the button of a remote control, the occurrence 327 of a defect, and other unforeseen events. Under those conditions, 328 the timeliness must nevertheless be maintained. Therefore, measures 329 are necessary to remove any unnecessary traffic. Short routes are 330 preferred. Long multi-hop routes via the border router, should be 331 avoided whenever possible. 333 Group communication is essential for lighting control. For example, 334 once the presence of a person is detected in a given room, lighting 335 control applies to that room only and no other lights should be 336 dimmed, or switched on/off. In many cases, this means that a 337 multicast message with a 1-hop and 2-hop radius would suffice to 338 control the required lights. The same argument holds for Heating, 339 Ventilating, and Air Conditioning (HVAC) and other climate control 340 devices. To reduce network load, it is advisable that messages to 341 the lights in a room are not distributed any further in the mesh than 342 necessary based on intended receivers. 344 An example of an office surface is shown in [office-light], and the 345 current use of wireless lighting control products is shown in 346 [occuswitch]. 348 2.2.1. General 350 Whilst air conditioning and other environmental-control applications 351 may accept response delays of tens of seconds or longer, alarm and 352 light control applications may be regarded as soft real-time systems. 353 A slight delay is acceptable, but the perceived quality of service 354 degrades significantly if response times exceed 250 ms. If the light 355 does not turn on at short notice, a user may activate the controls 356 again, thus causing a sequence of commands such as 357 Light{on,off,on,off,..} or Volume{up,up,up,up,up,...}. In addition 358 the repetitive sending of commands creates an unnecessary loading of 359 the network, which in turn increases the bad responsiveness of the 360 network. 362 2.2.2. Source-sink (SS) communication paradigm 364 This paradigm translates to many sources sending messages to the same 365 sink, sometimes reachable via the border router. As such, source- 366 sink (SS) traffic can be present in home and building networks. The 367 traffic may be generated by environmental sensors (often present in a 368 wireless sub-network) which push periodic readings to a central 369 server. The readings may be used for pure logging, or more often, 370 processed to adjust light, heating and ventilation. Alarm sensors 371 may also generate SS style traffic. The central server in a home 372 automation network will be connected mostly to a wired network 373 segment of the home network, although it is likely that cloud 374 services will also be used. The central server in a building 375 automation network may be connected to a backbone or be placed 376 outside the building. 378 With regards to message latency, most SS transmissions can tolerate 379 worst-case delays measured in tens of seconds. Fire detectors, 380 however, represent an exception; For example, special provisions with 381 respect to the location of the Fire detectors and the smoke dampers 382 need to be put in place to meet the stringent delay requirements 383 measured in seconds. 385 2.2.3. Publish-subscribe (PS, or pub/sub)) communication paradigm 387 This paradigm translates to a number of devices expressing their 388 interest for a service provided by a server device. For example, a 389 server device can be a sensor delivering temperature readings on the 390 basis of delivery criteria, like changes in acquisition value or age 391 of the latest acquisition. In building automation networks, this 392 paradigm may be closely related to the SS paradigm given that 393 servers, which are connected to the backbone or outside the building, 394 can subscribe to data collectors that are present at strategic places 395 in the building automation network. The use of PS will probably 396 differ significantly from installation to installation. 398 2.2.4. Peer-to-peer (P2P) communication paradigm 400 This paradigm translates to a device transferring data to another 401 device often connected to the same sub-network. Peer-to-peer (P2P) 402 traffic is a common traffic type in home automation networks. Most 403 building automation networks rely on P2P traffic, described in the 404 next paragraph. Other building automation networks rely on P2P 405 control traffic between controls and a local controller box for 406 advanced group control. A local controller box can be further 407 connected to service control boxes, thus generating more SS or PS 408 traffic. 410 P2P traffic is typically generated by remote controls and wall 411 controllers which push control messages directly to light or heat 412 sources. P2P traffic has a stringent requirement for low latency 413 since P2P traffic often carries application messages that are invoked 414 by humans. As mentioned in Section 2.2.1 application messages should 415 be delivered within a few hundred milliseconds - even when 416 connections fail momentarily. 418 2.2.5. Peer-to-multipeer (P2MP) communication paradigm 420 This paradigm translates to a device sending a message as many times 421 as there are destination devices. Peer-to-multipeer (P2MP) traffic 422 is common in home and building automation networks. Often, a 423 thermostat in a living room responds to temperature changes by 424 sending temperature acquisitions to several fans and valves 425 consecutively. This paradigm is also closely related to the PS 426 paradigm in the case where a single server device has multiple 427 subscribers. 429 2.2.6. Additional considerations: Duocast and N-cast 431 This paradigm translates to a device sending a message to many 432 destinations in one network transfer invocation. Multicast is well 433 suited for lighting where a presence sensor sends a presence message 434 to a set of lighting devices. Multicast increases the probability 435 that the message is delivered within the strict time constraints. 436 The recommended multicast algorithm (e.g. 437 [I-D.ietf-roll-trickle-mcast]) assures that messages are delivered to 438 ALL intended destinations. 440 2.2.7. RPL applicability per communication paradigm 442 In the case of the SS paradigm applied to a wireless sub-network to a 443 server reachable via a border router, the use of RPL [RFC6550] in 444 non-storing mode is appropriate. Given the low resources of the 445 devices, source routing will be used from the border router to the 446 destination in the wireless sub-network for messages generated 447 outside the mesh network. No specific timing constraints are 448 associated with the SS type messages so network repair does not 449 violate the operational constraints. When no SS traffic takes place, 450 it is good practice to load only RPL code enabling P2P mode of 451 operation [RFC6997] to reduce the code size and satisfy memory 452 requirements. 454 P2P-RPL [RFC6997] is required for all P2P and P2MP traffic taking 455 place between nodes within a wireless sub-network (excluding the 456 border router) to assure responsiveness. Source and destination 457 devices are typically physically close based on room layout. 458 Consequently, most P2P and P2MP traffic is 1-hop or 2-hop traffic. 459 Appendix A explains why P2P-RPL is preferable to RPL for this type of 460 communication. Appendix B explains why reliability measures such as 461 multi-path routing are necessary even when 1-hop communication 462 dominates. 464 Additional advantages of P2P-RPL for home and building automation 465 networks are, for example: 467 o Individual wall switches are typically inexpensive class 0 devices 468 [RFC7228] with extremely low memory capacities. Multi-purpose 469 remote controls for use in a home environment typically have more 470 memory but such devices are asleep when there is no user activity. 471 P2P-RPL reactive discovery allows a node to wake up and find new 472 routes within a few seconds while memory constrained nodes only 473 have to keep routes to relevant targets. 475 o The reactive discovery features of P2P-RPL ensure that commands 476 are normally delivered within the 250 ms time window. When 477 connectivity needs to be restored, discovery is typically 478 completed within seconds. In most cases, an alternative (earlier 479 discovered) route will work and route rediscovery is not 480 necessary. 482 o Broadcast storms typically associated with route discovery for Ad 483 hoc On-Demand Distance Vector (AODV) [RFC3561] are less disruptive 484 for P2P-RPL. P2P-RPL has a "STOP" bit which is set by the target 485 of a route discovery to notify all other nodes that no more 486 Directed Acyclic Graph (DAG) Information Option (DIO) messages 487 should be forwarded for this temporary DAG. Something looking 488 like a broadcast storm may happen when no target is responding 489 however, in this case, the Trickle suppression mechanism kicks in, 490 limiting the number of DIO forwards in dense networks. 492 Due to the limited memory of the majority of devices, P2P-RPL is 493 preferably deployed with source routing in non-storing mode as 494 explained in Section 4.1.2. 496 Multicast with Multicast Protocol for Low power and Lossy Networks 497 (MPL) [I-D.ietf-roll-trickle-mcast] is preferably deployed for N-cast 498 over the wireless network. Configuration constraints that are 499 necessary to meet reliability and timeliness with MPL are discussed 500 in Section 4.1.7. 502 2.3. Layer-2 applicability 504 This document applies to [IEEE802.15.4] and [G.9959] which are 505 adapted to IPv6 by the adaption layers [RFC4944] and [RFC7428]. 506 Other layer-2 technologies, accompanied by an "IP over Foo" 507 specification, are also relevant provided there is no frame size 508 issue, and there are link layer acknowledgements. 510 The above mentioned adaptation layers leverage on the compression 511 capabilities of [RFC6554] and [RFC6282]. Header compression allows 512 small IP packets to fit into a single layer 2 frame even when source 513 routing is used. A network diameter limited to 5 hops helps to 514 achieve this even while using source routing. 516 Dropped packets are often experienced in the targeted environments. 517 Internet Control Message Protocol (ICMP), User Datagram Protocol 518 (UDP) and even Transmission Control Protocol (TCP) flows may benefit 519 from link layer unicast acknowledgments and retransmissions. Link 520 layer unicast acknowledgments are compulsory when [IEEE802.15.4] or 521 [G.9959] is used with RPL and P2P-RPL. 523 3. Using RPL to meet Functional Requirements 525 Several features required by [RFC5826], [RFC5867] challenge the P2P 526 paths provided by RPL. Appendix A reviews these challenges. In some 527 cases, a node may need to spontaneously initiate the discovery of a 528 path towards a desired destination that is neither the root of a DAG, 529 nor a destination originating Destination Advertisement Object (DAO) 530 signalling. Furthermore, P2P paths provided by RPL are not 531 satisfactory in all cases because they involve too many intermediate 532 nodes before reaching the destination. 534 P2P-RPL [RFC6997] is necessary in home automation and building 535 control networks, as point-to-point style traffic is substantial and 536 route repair needs to be completed within seconds. P2P-RPL provides 537 a reactive mechanism for quick, efficient and root-independent route 538 discovery/repair. The use of P2P-RPL furthermore allows data traffic 539 to avoid having to go through a central region around the root of the 540 tree, and drastically reduces path length [SOFT11] [INTEROP12]. 541 These characteristics are desirable in home and building automation 542 networks because they substantially decrease unnecessary network 543 congestion around the root of the tree. 545 When more reliability is required, P2P-RPL enables the establishment 546 of multiple independent paths. For 1-hop destinations this means 547 that one 1-hop communication and a second 2-hop communication take 548 place via a neighbouring node. Such a pair of redundant 549 communication paths can be achieved by using MPL where the source is 550 a MPL forwarder, while a second MPL forwarder is 1 hop away from both 551 the source and the destination node. When the source multicasts the 552 message, it may be received by both the destination and the 2nd 553 forwarder. The 2nd forwarder forwards the message to the 554 destination, thus providing two routes from sender to destination. 556 To provide more reliability with multiple paths, P2P-RPL can maintain 557 two independent P2P source routes per destination, at the source. 558 Good practice is to use the paths alternately to assess their 559 existence. When one P2P path has failed (possibly only temporarily), 560 as described in Appendix B, the alternative P2P path can be used 561 without discarding the failed path. The failed P2P path, unless 562 proven to work again, can be safely discarded after a timeout 563 (typically 15 minutes). A new route discovery is done when the 564 number of P2P paths is exhausted due to persistent link failures. 566 4. RPL Profile 568 P2P-RPL is necessary in home automation and building control 569 networks. Its reactive discovery allows for low application response 570 times even when on-the-fly route repair is needed. Non-storing mode 571 is preferable to reduce memory consumption in repeaters with 572 constrained memory when source routing is used. 574 4.1. RPL Features 576 An important constraint on the application of RPL is the presence of 577 sleeping nodes. 579 For example, in a stand-alone network, the master node (or 580 coordinator) providing the logical layer-2 identifier and unique node 581 identifiers to connected nodes may be a remote control which returns 582 to sleep once new nodes have been added. Due to the absence of the 583 border router, there may be no global routable prefixes at all. 584 Likewise, there may be no authoritative always-on root node since 585 there is no border router to host this function. 587 In a network with a border router and many sleeping nodes, there may 588 be battery powered sensors and wall controllers configured to contact 589 other nodes in response to events and then return to sleep. Such 590 nodes may never detect the announcement of new prefixes via 591 multicast. 593 In each of the above mentioned constrained deployments, a link layer 594 node (e.g. coordinator or master) assumes the role of authoritative 595 root node, transmitting unicast Router Advertisement (RA) messages 596 with a Unique Local Address (ULA) prefix information option to nodes 597 during the joining process to prepare the nodes for a later 598 operational phase, where a border router is added. 600 A border router is designed to be aware of sleeping nodes in order to 601 support the distribution of updated global prefixes to such sleeping 602 nodes. 604 4.1.1. RPL Instances 606 When operating P2P-RPL on a stand-alone basis, there is no 607 authoritative root node maintaining a permanent RPL Direction- 608 Oriented Directed Acyclic Graph (DODAG). A node necessarily joins at 609 least one RPL instance, as a new, temporary instance is created 610 during each P2P-RPL route discovery operation. A node can be 611 designed to join multiple RPL instances. 613 4.1.2. Storing vs. Non-Storing Mode 615 Non-storing mode is necessary to cope with the extremely constrained 616 memory of a majority of nodes in the network (such as individual 617 light switches). 619 4.1.3. DAO Policy 621 Nodes send DAO messages to establish downward paths from the root to 622 themselves. DAO messages are not acknowledged in networks composed 623 of battery operated field devices in order to minimize the power 624 consumption overhead associated with path discovery. The DAO 625 messages build up a source route because the nodes are recommended to 626 be in non-storing mode. 628 If devices in LLNs participate in multiple RPL instances and DODAGs, 629 it is highly recommended that both the RPLInstance ID and the DODAGID 630 be included in the DAO. 632 4.1.4. Path Metrics 634 Expected Transmission Count (ETX) is the recommended metric. 635 [RFC6551] provides other options. 637 It is recommended that packets from asymmetric and/or unstable 638 channels are deleted at layer 2. 640 4.1.5. Objective Function 642 Objective Function 0 (OF0) is the recommended Objective Function. 643 Other Objective Functions should be used only when dictated by 644 circumstances. 646 4.1.6. DODAG Repair 648 Since P2P-RPL only creates DODAGs on a temporary basis during route 649 repair or route discovery, there is no need to repair DODAGs. 651 For SS traffic, local repair is sufficient. The accompanying process 652 is known as poisoning and is described in Section 8.2.2.5 of 653 [RFC6550]. Given that the majority of nodes in the building do not 654 physically move around, creating new DODAGs should not happen 655 frequently. 657 4.1.7. Multicast 659 Commercial lighting deployments may have a need for multicast to 660 distribute commands to a group of lights in a timely fashion. 661 Several mechanisms exist for achieving such functionality; 662 [I-D.ietf-roll-trickle-mcast] is the generally accepted protocol for 663 home and building deployments. This section relies heavily on the 664 conclusions of [RT-MPL]. 666 At reception of a packet, the MPL forwarder starts a series of 667 consecutive trickle timer intervals, where the first interval has a 668 minimum size of Imin. Each consecutive interval is twice as long as 669 the former with a maximum value of Imax. There is a maximum number 670 of intervals given by max_expiration. For each interval of length I, 671 a time t is randomly chosen in the period [I/2, I]. For a given 672 packet, p, MPL counts the number of times it receives p during the 673 period [0, t] in a counter c. At time t, MPL re-broadcasts p when c 674 < k, where k is a predefined constant with a value k > 0. 676 The density of forwarders and the frequency of message generation are 677 important aspects to obtain timeliness during control operations. A 678 high frequency of message generation can be expected when a remote 679 control button is incessantly pressed, or when alarm situations 680 arise. 682 Guaranteeing timeliness is intimately related to the density of the 683 MPL routers. In ideal circumstances the message is propagated as a 684 single wave through the network, such that the maximum delay is 685 related to the number of hops times the smallest repetition interval 686 of MPL. Each forwarder that receives the message passes the message 687 on to the next hop by repeating the message. When several copies of 688 a message reach the forwarder, it is specified that the copy need not 689 be repeated. Repetition of the message can be inhibited by a small 690 value of k. To assure timeliness, the value of k should be chosen 691 high enough to make sure that messages are repeated at the first 692 arrival of the message in the forwarder. However, a network that is 693 too dense leads to a saturation of the medium that can only be 694 prevented by selecting a low value of k. Consequently, timeliness is 695 assured by choosing a relatively high value of k but assuring at the 696 same time a low enough density of forwarders to reduce the risk of 697 medium saturation. Depending on the reliability of the network 698 channels, it is advisable to choose the network such that at least 2 699 forwarders per hop repeat messages to the same set of destinations. 701 There are no rules about selecting forwarders for MPL. In buildings 702 with central management tools, the forwarders can be selected, but in 703 the home is not possible to automatically configure the forwarder 704 topology at the time of writing this document. 706 4.1.8. Security 708 In order to support low-cost devices and devices running on a 709 battery, RPL uses either unsecured messages or secured messages. If 710 RPL is used with unsecured messages, link layer security is a minimum 711 security requirement (see Section 7). If RPL is used with secured 712 messages, the following RPL security parameter values are 713 recommended: 715 o Counter Time Flag: T = '0': Do not use timestamp in the Counter 716 Field. 718 o Algorithm = '0': Use Counter with Cipher Block Chaining Message 719 Authentication Code (CBC-MAC Mode) (CCM) with Advanced Encryption 720 Standard (AES)-128 722 o Key Identifier Mode; KIM = '10': Use group key, Key Source 723 present, Key Index present 725 o Security Level; LVL = 0: Use MAC-32 727 4.1.9. P2P communications 729 [RFC6997] is recommended to accommodate P2P traffic, which is 730 typically substantial in home and building automation networks. 732 4.1.10. IPv6 address configuration 734 Assigned IP addresses follow IETF standards to be routable and unique 735 within the routing domain [RFC5889]. 737 4.2. Layer 2 features 739 No particular requirements exist for layer 2 but for the ones cited 740 in the IP over Foo RFCs. (See Section 2.3) 742 4.2.1. Specifics about layer-2 744 Not applicable 746 4.2.2. Services provided at layer-2 748 Not applicable 750 4.2.3. 6LowPAN options assumed 752 Not applicable 754 4.2.4. Mesh Link Establishment (MLE) and other things 756 Not applicable 758 4.3. Recommended Configuration Defaults and Ranges 760 The following sections describe the recommended parameter values for 761 P2P-RPL and Trickle. 763 4.3.1. Trickle parameters 765 Trickle is used to distribute network parameter values to all nodes 766 without stringent time restrictions. The recommended Trickle 767 parameter values are: 769 o DIOIntervalMin 4 = 16 ms 771 o DIOIntervalDoublings 14 773 o DIORedundancyConstant 1 775 When a node sends a changed DIO, this is an inconsistency and forces 776 the receiving node to respond within Imin. So when something happens 777 which affects the DIO, the change is ideally communicated to a node, 778 n hops away, within n times Imin. Often, dependent on the node 779 density, packets are lost, or not sent, leading to larger delays. 781 In general we can expect DIO changes to propagate within 1 to 3 782 seconds within the envisaged networks. 784 When nothing happens, the DIO sending interval increases to 4.37 785 minutes, thus drastically reducing the network load. When a node 786 does not receive DIO messages during more than 10 minutes it can 787 safely conclude the connection with other nodes has been lost. 789 4.3.2. Other Parameters 791 This section discusses the P2P-RPL parameters. 793 P2P-RPL [RFC6997] provides the features requested by [RFC5826] and 794 [RFC5867]. P2P-RPL uses a subset of the frame formats and features 795 defined for RPL [RFC6550] but may be combined with RPL frame flows in 796 advanced deployments. 798 The recommended parameter values for P2P-RPL are: 800 o MinHopRankIncrease 1 802 o MaxRankIncrease 0 804 o MaxRank 6 806 o Objective function: OF0 808 5. MPL Profile 810 MPL is used to distribute values to groups of devices. Using MPL, 811 based on the Trickle algorithm, timeliness should also be guaranteed. 812 A deadline of 200 ms needs to be met when human action is followed by 813 an immediately observable action such as switching on lights. The 814 deadline needs to be met in a building where the number of hops from 815 seed to destination varies between 1 and 10. 817 5.1. Recommended configuration Defaults and Ranges 819 5.1.1. Real-Time optimizations 821 When the network is heavily loaded, MAC delays contribute 822 significantly to the end to end delays when MPL intervals between 10 823 to 100 ms are used to meet the 200 ms deadline. It is possible to 824 set the number of buffers in the MAC to 1 and set the number of Back- 825 off repetitions to 1. The number of MPL repetitions compensates for 826 the reduced probability of transmission per MAC invocation [RT-MPL]. 828 In addition, end to end delays and message losses are reduced, by 829 adding a real-time layer between MPL and MAC to throw away the 830 earliest messages (exploiting the MPL message numbering) and favour 831 the most recent ones. 833 5.1.2. Trickle parameters 835 This section proposes values for the Trickle parameters used by MPL 836 for the distribution of packets that need to meet a 200 ms deadline. 837 The probability of meeting the deadline is increased by (1) choosing 838 a small Imin value,(2) reducing the number of MPL intervals thus 839 reducing the load, and (3) reducing the number of MPL forwarders to 840 also reduce the load. 842 The consequence of this approach is that the value of k can be larger 843 than 1 because network load reduction is already guaranteed by the 844 network configuration. 846 Under the condition that the density of MPL repeaters can be limited, 847 it is possible to choose low MPL repeat intervals (Imin) connected to 848 k values such that k>1. The minimum value of k is related to: 850 o Value of Imin. The length of Imin determines the number of 851 packets that can be received within the listening period of Imin. 853 o Number of repeaters receiving the broadcast message from the same 854 forwarder or seed. These repeaters repeat within the same Imin 855 interval, thus increasing the c counter. 857 Within the first MPL interval a limited number, q, of messages can be 858 transmitted. Assuming a 3 ms transmission interval, q is given by q 859 = Imin/3. Assuming that at most q message copies can reach a given 860 forwarder within the first repeat interval of length Imin, the 861 related MPL parameter values are suggested in the following sections. 863 5.1.2.1. Imin 865 The recommended value is Imin = 10 - 50 ms. 867 When Imin is chosen much smaller, the interference between the copies 868 leads to significant losses given that q is much smaller than the 869 number of repeated packets. With much larger intervals the 870 probability that the deadline will be met decreases with increasing 871 hop count. 873 5.1.2.2. Imax 875 The recommended value is Imax = 100 - 400 ms. 877 The value of Imax is less important than the value of max_expiration. 878 Given an Imin value of 10 ms, the 3rd MPL interval has a value of 879 10*2*2 = 40 ms. When Imin has a value of 40 ms, the 3rd interval has 880 a value of 160 ms. Given that more than 3 intervals are unnecessary, 881 the Imax does not contribute much to the performance. 883 5.1.3. Other parameters 885 Other parameters are the k parameter and the max_expiration 886 parameter. 888 k > q (see condition above). Under this condition and for small 889 Imin, a value of k=2 or k=3 is usually sufficient to minimize the 890 losses of packets in the first repeat interval. 892 max_expiration = 2 - 4. Higher values lead to more network load 893 while generating copies which will probably not meet their deadline. 895 6. Manageability Considerations 897 At this moment it is not clear how homenets will be managed. 898 Consequently it is not clear which tools will be used and which 899 parameters must be exposed for management. 901 In building control, management is mandatory. It is expected that 902 installations will be managed using the set of currently available 903 tools(including IETF tools like Management Information Base (MIB) 904 modules, NETCONF modules, Dynamic Host Configuration Protocol (DHCP) 905 and others) with large differences between the ways an installation 906 is managed. 908 7. Security Considerations 910 This section refers to the security considerations of [RFC6997], 911 [RFC6550], [I-D.ietf-roll-trickle-mcast], and the counter measures 912 discussed in sections 6 and 7 of [RFC7416]. 914 Communications network security is based on providing integrity 915 protection and encryption to messages. This can be applied at 916 various layers in the network protocol stack based on using various 917 credentials and a network identity. 919 The credentials which are relevant in the case of RPL are: (i) the 920 credential used at the link layer in the case where link layer 921 security is applied (see Section 7.1) or (ii) the credential used for 922 securing RPL messages. In both cases, the assumption is that the 923 credential is a shared key. Therefore, a mechanism is required which 924 allows secure distribution of a shared key and configuration of 925 network identity. Both can rely on: (i) pre-installation using an 926 out-of-band method, (ii) delivered securely when a device is 927 introduced into the network or (iii) delivered securely by a trusted 928 neighbouring device. The shared key is stored in a secure fashion 929 which makes it difficult to be read by an unauthorized party. 931 Securely delivering a key requires a delivery mechanism that has data 932 origin authentication, confidentiality and integrity protection. On 933 reception of the delivered key, freshness of the delivered key needs 934 to be ensured. Securely storing a key requires a storage mechanism 935 that has confidentiality and integrity protection and is only 936 accessible by an authorized party. 938 The network security domain is typically distinct from the 939 application security domains within the network, of which there may 940 be more than one. For this reason, end-to-end security between 941 applications is recommended by using Datagram Transport Layer 942 Security (DTLS) [RFC6347] or TLS [RFC5246]. 944 7.1. Security considerations during initial deployment 946 Wireless mesh networks are typically secured at the link layer in 947 order to prevent unauthorized parties from accessing the information 948 exchanged over the links. It is good practice to create a network of 949 nodes which share the same keys for link layer security and exclude 950 nodes sending unsecured messages. With per-message data origin 951 authentication, it is possible to prevent unauthorized nodes joining 952 the mesh. 954 At initial deployment the network is secured by consecutively 955 securing nodes at the link layer, thus building a network of secured 956 nodes. The Protocol for carrying Authentication for Network Access 957 (PANA) [RFC5191] with an Extensible Authentication Protocol (EAP) 958 provides a framework for network access and delivery of common link 959 keys. Several versions of EAP exist. ZigBee specifies the use of 960 EAP-TLS [RFC5216]. Wi-SUN HAN (Home Area Network) uses EAP-PSK 961 [RFC4764], which also looks promising for building control at this 962 moment. 964 New approaches to initial security deployment are being developed in 965 [I-D.kumar-dice-dtls-relay] and 966 [I-D.richardson-6tisch--security-6top]. They assume a partial 967 ordering of the nodes, such that unsecured nodes are added 968 sequentially with the restriction that a path between two secured 969 nodes exists which passes through secured nodes only. Other 970 initiatives are likely to emerge in the context of minimal 971 intervention configuration. 973 For building control an installer will probably use an installation 974 tool that establishes a secure communication path with the joining 975 node. In the home, nodes can be visually inspected by the home owner 976 and simple measures like pushing buttons simultaneously on joint and 977 joining devices is probably sufficient. 979 This recommendation is in line with the countermeasures described in 980 section 6.1.1 of [RFC7416] 982 7.2. Security Considerations during incremental deployment 984 When nodes are lost, no additional security measures are needed, the 985 network remains secure as before by not allowing the addition of new 986 nodes. New nodes can be added by using the same protocols used for 987 initial deployment. Some protocols may need a state change to a 988 subset of the secured nodes, other protocols only need the presence 989 of a "trusted" installation node [RFC6345], [RFC5191], or 990 [I-D.kumar-dice-dtls-relay]. 992 7.3. Security Considerations for P2P uses 994 Refer to the security considerations of [RFC6997]. Many initiatives 995 are under way to provide lighter weight security such as: 996 [I-D.ietf-dice-profile] and [I-D.keoh-dice-multicast-security] 998 7.4. MPL routing 1000 The routing of MPL is determined by the enabling of the interfaces 1001 for specified Multicast addresses. The specification of these 1002 addresses can be done via a Constrained Application Protocol (CoAP) 1003 application as specified in [RFC7390]. An alternative is the 1004 creation of a MPL MIB and use of Simple Network Management Protocol 1005 (SNMP)v3 [RFC3411] or equivalent techniques to specify the Multicast 1006 addresses in the MIB. The application of security measures for the 1007 specification of the multicast addresses assures that the routing of 1008 MPL packets is secured. 1010 7.5. RPL Security features 1012 This section follows the structure of section 7, "RPL security 1013 features" of [RFC7416], where a thorough analysis of security threats 1014 and proposed counter measures relevant to RPL and MPL are done. 1016 In accordance with section 7.1 of [RFC7416], "Confidentiality 1017 features", a secured RPL protocol implements payload protection, as 1018 explained in Section 7 of this document. The attributes key-length 1019 and life-time of the keys depend on operational conditions, 1020 maintenance and installation procedures. 1022 Section 7.1 and Section 7.2 of this document recommend link-layer 1023 measures to assure integrity in accordance with section 7.2 of 1024 [RFC7416], "Integrity features". 1026 The provision of multiple paths recommended in section 7.3 1027 "Availability features" of [RFC7416] is also recommended from a 1028 reliability point of view. Randomly choosing paths is a possibility. 1030 Key management discussed in section 7.4, "Key Management" of 1031 [RFC7416], is not standardized and discussions continue. 1033 Section 7.5, "Considerations on Matching Application Domain Needs" of 1034 [RFC7416] applies as such. 1036 8. Other related protocols 1038 Application and transport protocols used in home and building 1039 automation domains are expected to mostly consist in CoAP over UDP, 1040 or equivalents. Typically, UDP is used for IP transport to keep down 1041 the application response time and bandwidth overhead. CoAP is used 1042 at the application layer to reduce memory footprint and bandwidth 1043 requirements. 1045 9. IANA Considerations 1047 No considerations for IANA pertain to this document. 1049 10. Acknowledgements 1051 This document reflects discussions and remarks from several 1052 individuals including (in alphabetical order): Mukul Goyal, Sandeep 1053 Kumar, Jerry Martocci, Charles Perkins, Yvonne-Anne Pignolet, Yoshira 1054 Ohba, Michael Richardson, and Zach Shelby 1056 11. Changelog 1058 RFC editor, please delete this section before publication. 1060 Changes from version 0 to version 1. 1062 o Adapted section structure to template. 1064 o Standardized the reference syntax. 1066 o Section 2.2, moved everything concerning algorithms to section 1067 2.2.7, and adapted text in 2.2.1-2.2.6. 1069 o Added MPL parameter text to section 4.1.7 and section 4.3.1. 1071 o Replaced all TODO sections with text. 1073 o Consistent use of border router, monitoring, home- and building 1074 network. 1076 o Reformulated security aspects with references to other 1077 publications. 1079 o MPL and RPL parameter values introduced. 1081 Changes from version 1 to version 2. 1083 o Clarified common characteristics of control in home and building. 1085 o Clarified failure behaviour of point to point communication in 1086 appendix. 1088 o Changed examples, more hvac and less lighting. 1090 o Clarified network topologies. 1092 o replaced reference to smart_object paper by reference to I-D.roll- 1093 security-threats 1095 o Added a concise definition of secure delivery and secure storage 1097 o text about securing network with PANA 1099 Changes from version 2 to version 3. 1101 o Changed security section to follow the structure of security 1102 threats draft. 1104 o Added text to DODAG repair sub-section 1106 Changes from version 3 to version 4. 1108 o Renumbered sections and moved text to conform to applicability 1109 template 1111 o Extended MPL parameter value text 1113 o Added references to building control products 1115 Changes from version 4 to version 5. 1117 o Large editing effort to streamline text 1119 o Rearranged Normative and Informative references 1121 o Replaced RFC2119 terminology by non-normative terminology 1123 o Rearranged text of section 7, 7.1, and 7.2 to agree with the 1124 intention of section 7.2 1126 Changes from version 5 to version 6. 1128 o Issues #162 - #166 addressed 1130 Changes from version 6 to version 6. 1132 o Text of section 7.1 edited for better security coverage. 1134 12. References 1135 12.1. Normative References 1137 [RFC4764] Bersani, F. and H. Tschofenig, "The EAP-PSK Protocol: A 1138 Pre-Shared Key Extensible Authentication Protocol (EAP) 1139 Method", RFC 4764, January 2007. 1141 [RFC4944] Montenegro, G., Kushalnagar, N., Hui, J., and D. Culler, 1142 "Transmission of IPv6 Packets over IEEE 802.15.4 1143 Networks", RFC 4944, September 2007. 1145 [RFC5191] Forsberg, D., Ohba, Y., Patil, B., Tschofenig, H., and A. 1146 Yegin, "Protocol for Carrying Authentication for Network 1147 Access (PANA)", RFC 5191, May 2008. 1149 [RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS 1150 Authentication Protocol", RFC 5216, March 2008. 1152 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 1153 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 1155 [RFC5548] Dohler, M., Watteyne, T., Winter, T., and D. Barthel, 1156 "Routing Requirements for Urban Low-Power and Lossy 1157 Networks", RFC 5548, May 2009. 1159 [RFC5673] Pister, K., Thubert, P., Dwars, S., and T. Phinney, 1160 "Industrial Routing Requirements in Low-Power and Lossy 1161 Networks", RFC 5673, October 2009. 1163 [RFC5826] Brandt, A., Buron, J., and G. Porcu, "Home Automation 1164 Routing Requirements in Low-Power and Lossy Networks", RFC 1165 5826, April 2010. 1167 [RFC5867] Martocci, J., De Mil, P., Riou, N., and W. Vermeylen, 1168 "Building Automation Routing Requirements in Low-Power and 1169 Lossy Networks", RFC 5867, June 2010. 1171 [RFC6282] Hui, J. and P. Thubert, "Compression Format for IPv6 1172 Datagrams over IEEE 802.15.4-Based Networks", RFC 6282, 1173 September 2011. 1175 [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer 1176 Security Version 1.2", RFC 6347, January 2012. 1178 [RFC6550] Winter, T., Thubert, P., Brandt, A., Hui, J., Kelsey, R., 1179 Levis, P., Pister, K., Struik, R., Vasseur, JP., and R. 1180 Alexander, "RPL: IPv6 Routing Protocol for Low-Power and 1181 Lossy Networks", RFC 6550, March 2012. 1183 [RFC6551] Vasseur, JP., Kim, M., Pister, K., Dejean, N., and D. 1184 Barthel, "Routing Metrics Used for Path Calculation in 1185 Low-Power and Lossy Networks", RFC 6551, March 2012. 1187 [RFC6554] Hui, J., Vasseur, JP., Culler, D., and V. Manral, "An IPv6 1188 Routing Header for Source Routes with the Routing Protocol 1189 for Low-Power and Lossy Networks (RPL)", RFC 6554, March 1190 2012. 1192 [RFC6997] Goyal, M., Baccelli, E., Philipp, M., Brandt, A., and J. 1193 Martocci, "Reactive Discovery of Point-to-Point Routes in 1194 Low-Power and Lossy Networks", RFC 6997, August 2013. 1196 [RFC6998] Goyal, M., Baccelli, E., Brandt, A., and J. Martocci, "A 1197 Mechanism to Measure the Routing Metrics along a Point-to- 1198 Point Route in a Low-Power and Lossy Network", RFC 6998, 1199 August 2013. 1201 [RFC7102] Vasseur, JP., "Terms Used in Routing for Low-Power and 1202 Lossy Networks", RFC 7102, January 2014. 1204 [RFC7416] Tsao, T., Alexander, R., Dohler, M., Daza, V., Lozano, A., 1205 and M. Richardson, "A Security Threat Analysis for the 1206 Routing Protocol for Low-Power and Lossy Networks (RPLs)", 1207 RFC 7416, January 2015. 1209 [I-D.ietf-roll-trickle-mcast] 1210 Hui, J. and R. Kelsey, "Multicast Protocol for Low power 1211 and Lossy Networks (MPL)", draft-ietf-roll-trickle- 1212 mcast-11 (work in progress), November 2014. 1214 [IEEE802.15.4] 1215 "IEEE 802.15.4 - Standard for Local and metropolitan area 1216 networks -- Part 15.4: Low-Rate Wireless Personal Area 1217 Networks", . 1219 [G.9959] "ITU-T G.9959 Short range narrow-band digital 1220 radiocommunication transceivers - PHY and MAC layer 1221 specifications", . 1223 12.2. Informative References 1225 [RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An 1226 Architecture for Describing Simple Network Management 1227 Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, 1228 December 2002. 1230 [RFC3561] Perkins, C., Belding-Royer, E., and S. Das, "Ad hoc On- 1231 Demand Distance Vector (AODV) Routing", RFC 3561, July 1232 2003. 1234 [RFC5889] Baccelli, E. and M. Townsley, "IP Addressing Model in Ad 1235 Hoc Networks", RFC 5889, September 2010. 1237 [RFC6345] Duffy, P., Chakrabarti, S., Cragie, R., Ohba, Y., and A. 1238 Yegin, "Protocol for Carrying Authentication for Network 1239 Access (PANA) Relay Element", RFC 6345, August 2011. 1241 [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for 1242 Constrained-Node Networks", RFC 7228, May 2014. 1244 [RFC7390] Rahman, A. and E. Dijk, "Group Communication for the 1245 Constrained Application Protocol (CoAP)", RFC 7390, 1246 October 2014. 1248 [RFC7428] Brandt, A. and J. Buron, "Transmission of IPv6 Packets 1249 over ITU-T G.9959 Networks", RFC 7428, February 2015. 1251 [I-D.ietf-dice-profile] 1252 Tschofenig, H. and T. Fossati, "A TLS/DTLS Profile for the 1253 Internet of Things", draft-ietf-dice-profile-10 (work in 1254 progress), March 2015. 1256 [I-D.keoh-dice-multicast-security] 1257 Keoh, S., Kumar, S., Garcia-Morchon, O., Dijk, E., and A. 1258 Rahman, "DTLS-based Multicast Security in Constrained 1259 Environments", draft-keoh-dice-multicast-security-08 (work 1260 in progress), July 2014. 1262 [I-D.kumar-dice-dtls-relay] 1263 Kumar, S., Keoh, S., and O. Garcia-Morchon, "DTLS Relay 1264 for Constrained Environments", draft-kumar-dice-dtls- 1265 relay-02 (work in progress), October 2014. 1267 [I-D.richardson-6tisch--security-6top] 1268 Richardson, M., "6tisch secure join using 6top", draft- 1269 richardson-6tisch--security-6top-04 (work in progress), 1270 November 2014. 1272 [SOFT11] Baccelli, E., Phillip, M., and M. Goyal, "The P2P-RPL 1273 Routing Protocol for IPv6 Sensor Networks: Testbed 1274 Experiments", Proceedings of the Conference on Software 1275 Telecommunications and Computer Networks, Split, Croatia,, 1276 September 2011. 1278 [INTEROP12] 1279 Baccelli, E., Phillip, M., Brandt, A., Valev , H., and J. 1280 Buron , "Report on P2P-RPL Interoperability Testing", 1281 RR-7864 INRIA Research Report RR-7864, January 2012. 1283 [RT-MPL] van der Stok, P., "Real-Time multicast for wireless mesh 1284 networks using MPL", White paper, 1285 http://www.vanderstok.org/papers/Real-time-MPL.pdf, April 1286 2014. 1288 [occuswitch] 1289 Lighting, Philips., "OccuSwitch wireless", Brochure, http: 1290 //www.philipslightingcontrols.com/assets/cms/uploads/files 1291 /osw/MK_OSWNETBROC_5.pdf, May 2012. 1293 [office-light] 1294 Clanton and Associates, ., "A Life Cycle Cost Evaluation 1295 of Multiple Lighting Control Strategies", Wireless 1296 Lighting Control, http://www.daintree.net/wp- 1297 content/uploads/2014/02/ 1298 clanton_lighting_control_report_0411.pdf, February 2014. 1300 [RTN2011] Holtman, K. and P. van der Stok, "Real-time routing for 1301 low-latency 802.15.4 control networks", International 1302 Workshop on Real-Time Networks; Euromicro Conference on 1303 Real-Time Systems, July 2011. 1305 [MEAS] Holtman, K., "Connectivity loss in large scale IEEE 1306 802.15.4 network", Private Communication, November 2013. 1308 [BCsurvey] 1309 Kastner, W., Neugschwandtner, G., Soucek, S., and H. 1310 Newman, "Communication Systems for Building Automation and 1311 Control", Proceedings of the IEEE Vol 93, No 6, June 2005. 1313 Appendix A. RPL shortcomings in home and building deployments 1315 A.1. Risk of undesired long P2P routes 1317 The DAG, being a tree structure is formed from a root. If nodes 1318 residing in different branches have a need for communicating 1319 internally, DAG mechanisms provided in RPL [RFC6550] will propagate 1320 traffic towards the root, potentially all the way to the root, and 1321 down along another branch [RFC6998]. In a typical example two nodes 1322 could reach each other via just two router nodes but in unfortunate 1323 cases, RPL may send traffic three hops up and three hops down again. 1324 This leads to several undesired phenomena described in the following 1325 sections 1327 A.1.1. Traffic concentration at the root 1329 If many P2P data flows have to move up towards the root to get down 1330 again in another branch there is an increased risk of congestion the 1331 nearer to the root of the DAG the data flows. Due to the broadcast 1332 nature of RF systems any child node of the root is not just directing 1333 RF power downwards its sub-tree but just as much upwards towards the 1334 root; potentially jamming other MP2P traffic leaving the tree or 1335 preventing the root of the DAG from sending P2MP traffic into the DAG 1336 because the listen-before-talk link-layer protection kicks in. 1338 A.1.2. Excessive battery consumption in source nodes 1340 Battery-powered nodes originating P2P traffic depend on the route 1341 length. Long routes cause source nodes to stay awake for longer 1342 periods before returning to sleep. Thus, a longer route translates 1343 proportionally (more or less) into higher battery consumption. 1345 A.2. Risk of delayed route repair 1347 The RPL DAG mechanism uses DIO and DAO messages to monitor the health 1348 of the DAG. In rare occasions, changed radio conditions may render 1349 routes unusable just after a destination node has returned a DAO 1350 indicating that the destination is reachable. Given enough time, the 1351 next Trickle timer-controlled DIO/DAO update will eventually repair 1352 the broken routes, however this may not occur in a timely manner 1353 appropriate to the application. In an apparently stable DAG, 1354 Trickle-timer dynamics may reduce the update rate to a few times 1355 every hour. If a user issues an actuator command, e.g. light on in 1356 the time interval between the last DAO message was issued the 1357 destination module and the time one of the parents sends the next 1358 DIO, the destination cannot be reached. There is no mechanism in RPL 1359 to initiate restoration of connectivity in a reactive fashion. The 1360 consequence is a broken service in home and building applications. 1362 A.2.1. Broken service 1364 Experience from the telecom industry shows that if the voice delay 1365 exceeds 250ms, users start getting confused, frustrated and/or 1366 annoyed. In the same way, if the light does not turn on within the 1367 same period of time, a home control user will activate the controls 1368 again, causing a sequence of commands such as 1369 Light{on,off,off,on,off,..} or Volume{up,up,up,up,up,...}. Whether 1370 the outcome is nothing or some unintended response this is 1371 unacceptable. A controlling system must be able to restore 1372 connectivity to recover from the error situation. Waiting for an 1373 unknown period of time is not an option. While this issue was 1374 identified during the P2P analysis, it applies just as well to 1375 application scenarios where an IP application outside the LLN 1376 controls actuators, lights, etc. 1378 Appendix B. Communication failures 1380 Measurements on the connectivity between neighbouring nodes are 1381 discussed in [RTN2011] and [MEAS]. 1383 The work is motivated by the measurements in literature which affirm 1384 that the range of an antenna is not circle symmetric but that the 1385 signal strength of a given level follows an intricate pattern around 1386 the antenna, and there may be holes within the area delineated by an 1387 iso-strength line. It is reported that communication is not 1388 symmetric: reception of messages from node A by node B does not imply 1389 reception of messages from node B by node A. The quality of the 1390 signal fluctuates over time, and also the height of the antenna 1391 within a room can have consequences for the range. As function of 1392 the distance from the source, three regions are generally recognized: 1393 (1) a clear region with excellent signal quality, (2) a region with 1394 fluctuating signal quality, (3) a region without reception. In the 1395 text below it is shown that installation of meshes with neighbours in 1396 the clear region is not sufficient. 1398 [RTN2011] extends existing work by: 1400 o Observations over periods of at least a week, 1402 o Testing links that are in the clear region, 1404 o Observation in an office building during working hours, 1406 o Concentrating on one-hop and two-hop routes. 1408 Eight nodes were distributed over a surface of 30m2. All nodes are 1409 at one hop distance from each other and are situated in the clear 1410 region of each other. Each node sends messages to each of its 1411 neighbours, and repeats the message until it arrives. The latency of 1412 the message was measured over periods of at least a week. It is 1413 noticed that latencies longer than a second occurred without apparent 1414 reasons, but only during working days and never in the weekends. Bad 1415 periods could last for minutes. By sending messages via two paths: 1416 (1) one hop path directly, and (2) two hop path via a randomly chosen 1417 neighbour, the probability of delays larger than 100 ms decreased 1418 significantly. 1420 The conclusion is that even for 1-hop communication between not too 1421 distant "Line of Sight" nodes, there are periods of low reception in 1422 which communication deadlines of 200 ms are exceeded. It pays to 1423 send a second message over a 2-hop path to increase the reliability 1424 of timely message transfer. 1426 [MEAS] confirms that temporary bad reception by close neighbours can 1427 occur within other types of areas. Nodes were installed on the 1428 ceiling in a grid with a distance of 30-50 cm between nodes. 200 1429 nodes were distributed over an area of 10m x 5m. It clearly 1430 transpired that with increasing distance the probability of reception 1431 decreases. At the same time a few nodes furthest away from the 1432 sender had a high probability of message reception, while some close 1433 neighbours of the sender did not receive messages. The patterns of 1434 clear reception nodes evolved over time. 1436 The conclusion is that even for direct neighbours reception can 1437 temporarily be bad during periods of several minutes. For a reliable 1438 and timely communication it is imperative to have at least two 1439 communication paths available (e.g. two hop paths next to the 1-hop 1440 path for direct neighbours). 1442 Authors' Addresses 1444 Anders Brandt 1445 Sigma Designs 1447 Email: anders_Brandt@sigmadesigns.com 1449 Emmanuel Baccelli 1450 INRIA 1452 Email: Emmanuel.Baccelli@inria.fr 1454 Robert Cragie 1455 ARM Ltd. 1456 110 Fulbourn Road 1457 Cambridge CB1 9NJ 1458 UK 1460 Email: robert.cragie@gridmerge.com 1462 Peter van der Stok 1463 Consultant 1465 Email: consultancy@vanderstok.org