April 2019 - iot-wg - mailman.ripe.net

For information: ETSI releases IoT security standard
by Marco Hogewoning 17 Oct '19

17 Oct '19

Dear colleagues, The European Telecommunications Standardisation Institute (ETSI), earlier this week released their initial standard for securing IoT devices. The document is titled ‘Technical specification - Cyber Security for Consumer Internet of Things’ (ETSI TS 103 645), and states that its objective is, “...to support all parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.” While it remains a very high-level document, containing many recommendations our community probably takes for granted, it could be helpful in guiding newcomers towards a more secure implementation of their IoT services and devices. The recommendations include items like, for instance, using non-default passwords. Although this is not yet a European Standard (EN) level specification, it is likely that any European standard specification in this area would be developed based on guidance from this document. In this context, a specification like this might also be reflected in product conformity guidelines such as the Radio Equipment Directive, that I posted about last week. The specification is available at https://www.etsi.org/deliver/etsi_ts/103600_103699/103645/01.01.01_60/ts_10… Regards, Marco Hogewoning RIPE NCC

4 4

InnoITeam - a new Center of Excellence in IoT Science and Technology
by Artūras Serackis 01 Jul '19

01 Jul '19

Dear Colleagues, We are excited to introduce you a new initiative a Center of Excellence in IoT Science and Technology (InnoITeam). The CoE will leverage the knowledge, experience, and resources of three Lithuanian institutions – Kaunas University of Technology, Vilnius Gediminas Technical University and State Enterprise Centre of Registers of Lithuania - with the support of two advanced EU partners from Sweden – Linköping University and Interactive Institute Swedish ICT in Norrköping. During the first five years, the Consortium will focus on four R&D topics: 1. User interfacing and interaction design approaches for Smart Environments based on IoT. 2. Cybersecurity aspects of the Smart Environments based on IoT. 3. Data analysis and visualization approaches for data-intensive IoT environments. 4. Cognitive IoT technologies for Smart Home Environments. The InnoITeam project is funded by the European Union’s Horizon 2020 research and innovation programme and coordinated by the Kaunas University of Technology. The project has been already started in September (2017) and is finishing its first phase. During the second phase in a five-year period, the InnoITeam is planning to become a self-sustaining organization, integrating and supporting research excellence and innovation development in Lithuania, the Baltic Sea region, and Europe. Meet our team and recent news on our web page: https://www.innoiteam.com Follow us on social media: https://facebook.com/innoiteam https://www.linkedin.com/company/innoiteam/ https://twitter.com/innoiteam

8 9

draft agenda for RIPE78
by Jim Reid 29 Apr '19

29 Apr '19

Colleagues, here is v1.0 of the agenda for the WG meeting in Reykjavik. Please note this is subject to last-minute tweaking (running order, timings, etc). I don’t expect there will be substantial changes. Famous last words... 1. Administrivia 2. ITU Study Group 20 Update (5 mins) Patrik Faltstrom, Netnod 3. RIOT Summit Report (5 mins) Matthias Waehlisch, Freie Universitaet Berlin 4. Legal, security & ethical aspects of running an IoT network (20 mins) Mirjam Kühne, RIPE NCC RIPE Atlas is a global active measurement infrastructure, maintained by the RIPE NCC based on the voluntary contributions of thousands of probe hosts worldwide. In essence those RIPE Atlas probes are IoT devices that people place in their homes. In this presentation we will present the ethical, security and legal aspects that are put in place in order to support and protect this shared responsibility between the RIPE NCC as the provider or the platform and the users. 5. Building a smart house and you want to do it yourself? (20 mins) Jan Zorz Jan is building a house and since he wanted to build a smart one, he went through the process of testing and experimenting with different IOT devices communicating over different protocols wireless, as well as through hardware and software choices of open source home automation software. Alongside the process of connecting all the dots, privacy concerns also arise and it's time to have a proper discussion about these issues. 6. Spinning CPEs: collaborative work on CPE IoT protection (20 mins) Jelte Jansen, SIDN Labs Peter Steinhäuser, Embedd In this joint presentation, Peter Steinhäuser (Embedd) and Jelte Jansen (SIDN Labs) discuss their work on home network protection, including related standardization work, SPIN in OpenWRT, and an interactive SPIN demo. 7. A Residential IoT Unquarantine Playbook (20 mins) Michael Richardson, Sandelman Software Works Increased use of automated IoT security mechanisms such as the Manufacturer Usage Description means that devices will increasingly be "taken offline" for possible violations of stated security policy. Detection of a possible violations is just a first step. There are a number of additional steps necessary to return the device to correct operation. For residential IoT devices, agency, the only clear organization that the resident has a relationship with is the Internet (access) Service Provider (ISP). The ISP helpdesk will inevitably take the call and needs to pass the call off to a manufacturer or other entity, providing as much information as possible in an automated way. This presentation is about the process (the playbook) to be followed, and it attempts to identify which steps of the protocol can be automated with existing and/or up-coming protocols, and where there are gaps that could be automated. 8. AOB

1 0

Fwd: [IRTF-Announce] RFC 8576 on Internet of Things (IoT) Security: State of the Art and Challenges
by Gordon Lennox 27 Apr '19

27 Apr '19

Apologies to those who have already seen this but it ought still to be of interest to everyone in the WG. > Begin forwarded message: > > From: rfc-editor(a)rfc-editor.org > Subject: [IRTF-Announce] RFC 8576 on Internet of Things (IoT) Security: State of the Art and Challenges > Date: 27 April 2019 at 04:12:31 CEST > To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org, irtf-announce(a)irtf.org > Cc: drafts-update-ref(a)iana.org, t2trg(a)irtf.org, rfc-editor(a)rfc-editor.org > > A new Request for Comments is now available in online RFC libraries. > > > RFC 8576 > > Title: Internet of Things (IoT) Security: > State of the Art and Challenges > Author: O. Garcia-Morchon, > S. Kumar, > M. Sethi > Status: Informational > Stream: IRTF > Date: April 2019 > Mailbox: oscar.garcia-morchon(a)philips.com, > sandeep.kumar(a)signify.com, > mohit(a)piuha.net > Pages: 50 > Characters: 128372 > Updates/Obsoletes/SeeAlso: None > > I-D Tag: draft-irtf-t2trg-iot-seccons-16.txt > > URL: https://www.rfc-editor.org/info/rfc8576 > > DOI: 10.17487/RFC8576 > > The Internet of Things (IoT) concept refers to the usage of standard > Internet protocols to allow for human-to-thing and thing-to-thing > communication. The security needs for IoT systems are well > recognized, and many standardization steps to provide security have > been taken -- for example, the specification of the Constrained > Application Protocol (CoAP) secured with Datagram Transport Layer > Security (DTLS). However, security challenges still exist, not only > because there are some use cases that lack a suitable solution, but > also because many IoT devices and systems have been designed and > deployed with very limited security capabilities. In this document, > we first discuss the various stages in the lifecycle of a thing. > Next, we document the security threats to a thing and the challenges > that one might face to protect against these threats. Lastly, we > discuss the next steps needed to facilitate the deployment of secure > IoT systems. This document can be used by implementers and authors > of IoT specifications as a reference for details about security > considerations while documenting their specific security challenges, > threat models, and mitigations. > > This document is a product of the IRTF Thing-to-Thing Research Group > (T2TRG). > > This document is a product of the Thing-to-Thing of the IRTF. > > > INFORMATIONAL: This memo provides information for the Internet community. > It does not specify an Internet standard of any kind. Distribution of > this memo is unlimited. > > This announcement is sent to the IETF-Announce, rfc-dist and IRTF-Announce lists.To subscribe or unsubscribe, see > https://www.ietf.org/mailman/listinfo/ietf-announce > https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist > https://www.irtf.org/mailman/listinfo/irtf-announce > > For searching the RFC series, see https://www.rfc-editor.org/search > For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk > > Requests for special distribution should be addressed to either the > author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless > specifically noted otherwise on the RFC itself, all RFCs are for > unlimited distribution. > > > The RFC Editor Team > Association Management Solutions, LLC > >

1 0

extension of co-chair selection process
by Jim Reid 25 Apr '19

25 Apr '19

Colleagues, there still haven't been many expressions of support for the co-chair candidates. This is disappointing. I'm reluctant to make a consensus determination on the basis of only a handful of people supporting either candidate. It would clearly be much better for everyone if there were more statements of support. Unless there's a dramatic change in the next day or two, I will let the appointment process run for another week in the hope that gives extra time for more people speak up in favour of Sandoche or Peter. With that in mind, the final date for expressing your support for either candidate is May 3rd. I'll make a decision then based on the level of support that's been posted to that point. Could you please take a few moments to post on the appropriate threads to express your support for either Sandoche Balakrichenan or Peter Steinhauser? Thanks. Peter: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000395.html Sandoche: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000393.html

7 10

reminder on co-chair selection
by Jim Reid 15 Apr '19

15 Apr '19

Colleagues, there haven't been many expressions of support for the co-chair candidates. Could you please take a few moments to post on the appropriate threads for Peter Steinhauser or Sandoche Balakrichenan? Thanks. Sandoche: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000393.html Peter: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000395.html

2 1

Sandoche BALAKRICHENAN for co-chair
by sandoche Balakrichenan 15 Apr '19

15 Apr '19

** I am re-posting my candidature, since Jim wants a discrete thread for each candidate with his/her name in the Subject line, thus making the decision process easier ** Dear all, I would like to put my application for the co-chair role. I believe I could fit into Jim's criteria, not being among the usual suspects :-) _*About me *_ I have been working at the French domain registry (Afnic) for the last 10 years. Since the beginning, I have been carrying out multiple IoT-related initiatives and projects internally and/or with partners. My linked in profile: https://www.linkedin.com/in/sandoche-balakrichenan-2a44645/ 50% of my job profile is oriented towards technology watch, and thus involved in activities at the IETF, GS1 (RFID, Barcode standardization), AIOTI (The Alliance for the Internet of Things Innovation), RIPE, CENTR (Council for European Top Level Domains) and LoRa-Alliance. My interest in IoT includes identification, name resolution, service discovery and using DNS infrastructure as PKI for the IoT _*Some milestones in my IoT profile:*_ * I had participated for two years at the European Commission as an invited member of the IoT expert group. * Our IoT project WINGS (how DNS could be used for service discovery in the supply chain industry?) was awarded the CENTR R&D award for 2013 (https://www.inria.fr/en/centre/lille/news/anr-verso-wings-project-wins-cent…) * Principal contributor to the ONS standard (https://www.gs1.org/sites/default/files/docs/epc/ons_2_0_1-standard-2013013…) * Contributed to LoRa-alliance (lora-alliance.org) Backend interfaces specification on DNS usage for resolving LoRa devices in the Internet. _*What I could do in the Co-chair role?*_ * Will be able to participate in all RIPE physical sessions and other side meetings which a WG co-chair is supposed to attend. * Wil be able to allocate time to follow the policy proposal relevant to the WG; follow and respond to the mailing list discussion; ensure milestones and with the help of Jim, liaise with RIPE NCC. * Will be able to allocate time for administrative activities (like soliciting contents, preparing the agenda etc.) concerning the WG If you believe i can be of use, thanks for your support. Regards, Sandoche BALAKRICHENAN

6 6

appointing a co-chair
by Jim Reid 08 Apr '19

08 Apr '19

Ladies and gentlemen, boys and girls, start your engines! :-) Since the WG now has an appointment process in place, it's time to use it. Anyone interested in volunteering as a co-chair is encouraged to step forward. It would be helpful if potential candidates could post on the list what their vision is for the WG and what they would/wouldn't do if appointed. I would also urge volunteers to consult RIPE692: "RIPE Working Group Chair Job Description and Procedures" to get an appreciation for what this role entails. I'll also be happy to provide advice and guidance to anyone thinking about volunteering, either in private or on the list. The tentative schedule would be to finalise a list of potential candidates by early next year and run the selection process in March or theresabouts so the new co-chair can be in place in good time for RIPE78. Please speak up if you think this schedule is unreasonable or impractical. Although I have no say in who the WG chooses -- I just make the consensus determination -- I would very much like to see someone new in the role. It would be a pity if one of the usual suspects got the job. Not that I have any criticisms of them. A fresh face, new thinking and a break from the same old routine is both healthy and desirable IMO. However that will of course ultimately be a decision for the WG to make. Over to you...

5 5

co-chair selection is now under way
by Jim Reid 03 Apr '19

03 Apr '19

Colleagues, it’s high time the WG found another co-chair. Two candidates have come forward: Peter Steinhauser and Sandoche Balakrichenan. Thanks to both for volunteering. Please do not post statements of support for them on this thread. Use the appropriate thread(s): Sandoche: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000393.html Peter: https://www.ripe.net/ripe/mail/archives/iot-wg/2019-March/000395.html Vote early, vote often! :-) Well, OK we don’t vote but I’m sure you all get the general idea. I hope to make a consensus determination by April 26th - just after the Easter holiday. Over to you...

1 0

Agenda planning for Reykjavik
by Jim Reid 02 Apr '19

02 Apr '19

Colleages, RIPE78 is just over 6 weeks away. Yikes! Please send your suggestions for WG agenda items to iot-wg-chairs(a)ripe.net

1 0