- iot-wg - mailman.ripe.net

Updated IoT WG agenda
by sandoche Balakrichenan 27 Oct '22

27 Oct '22

Dear all, Due to Visa issues, one of our presenters could not be here. Hence there is a modification in the Agenda. The current agenda looks as follows: * Introduction & House Keeping (5 mins) * Michael Richardson (Sandelman Software Works) – "Social and Technical metrics for Trust Anchor resilence in (IoT) devices" – (30 mins) * Nick Allott(Nquiringminds) - "Secure IOT gateways: highlighting the industry challenges, and identifying the collaborative innovation needed to address them“ – (30 mins) * Peter Steinhaeuser (embeDD) – "Restricting device's network access using MUD files and automatic MUD file creation using OpenWrt“ (25 min) -- Sandoche & Peter RIPE IoT WG Co-Chairs

1 0

RIPE-85 IoT WG Agenda
by Peter Steinhäuser 18 Oct '22

18 Oct '22

Dear all, as you all know, the IoT WG session @RIPE 85 will be on Thursday, October 27th 11:00 - 12:30 (UTC+2). The agenda looks as follows: Introduction & House Keeping (5 mins) Michael Richardson (Sandelman Software Works) – "Social and Technical metrics for Trust Anchor resilence in (IoT) devices" – (30 mins) Bahaa Al-Musawi (University of Kufa) - "A Novel Intrusion Detection Based on Using Non-linear Statistical Analysis and Features Selection Techniques“ – (30 mins) Peter Steinhaeuser (embeDD) – "Restricting device's network access using MUD files and automatic MUD file creation using OpenWrt“ (25 min) Looking forward to see you there! Thank you and kind regards, Peter & Sandoche. — RIPE IoT WG Co-Chairs

1 0

[IoT WG] RIPE-85 Call for Presentations
by Peter Steinhäuser 16 Oct '22

16 Oct '22

Dear collegues, in-person attendence for the RIPE-85 seems to be lower than usual. Although we have good candidates for doing presentations remotely we would like to ask the members of the WG attending RIPE-85 in person if someone has an interesting IoT related topic that could be presented during the WG session on Thursday. Best regards, Peter — RIPE IoT WG Co-Chair

1 0

International Workshop on Socio-technical Cybersecurity and Resilience in the IoT
by Vesna Manojlovic 31 Aug '22

31 Aug '22

https://petras-iot.org/update/star-iot/ STaR-IoT: 1st International Workshop on Socio-technical Cybersecurity and Resilience in the Internet of Things ((12th International Conference of the Internet of Things at the Faculty of Industrial Design Engineering (IDE), TU Delft)) 7 November, 2022 Submission link: https://easychair.org/cfp/stariot22 Submission deadline: Friday 2nd September, 2022 The adoption of IoT technologies and the harnessing of their economic value, represents a process that takes place continually at the intersection between developments in three major domains: social, technical, and economic.  This is because the IoT is much more than just products and services. ‘Things’ are the visible part of the IoT, however, what the IoT really represents, and how it works, goes way beyond devices. We call these interrelated collections of physical and digital objects (sensors, data stores, 3rd parties, business models, actuators, and so on) IoT constellations. As artificial intelligence, data science, and machine learning become more sophisticated, the power of these constellations will become increasingly apparent, and will impact on all aspects of our lives. Therefore, it is critical we fully understand the social and technical interdependencies, opportunities and challenges that exist now and in the future.  Being able to demonstrate that IoT and modern networks can increase security, safety, and resilience when used well, is essential. Bringing together socio-technical researchers to better understand safe and resilient IoT systems, in a way that is culturally appropriate and ethically acceptable and that breeds rather than subverts confidence, is the focus of this workshop. This workshop considers research that examines both social and technical issues relating to the resilience and cybersecurity of IoT devices, systems, and networks. To this end, we aim to bring together researchers to discuss socio-technical challenges and opportunities of IoT technologies, multi-scale deployments of embedded technologies in smart cities, Industry 4.0, logistics, etc. In doing so, it is important to compare local and international regulation, standardization and certification, and public trust in such technologies, and to examine the cybersecurity and resilience of dual-use technologies. This research informs cybersecurity of critical infrastructure, resilience and current geopolitical challenges, international alliances and collaboration, supply-chain security, and preparedness. The workshop will be hosted within the 12th International Conference of the Internet of Things, November 7–10, at the Faculty of Industrial Design Engineering (IDE), on the TU Delft campus (the Netherlands). (https://iot-conference.org/iot2022/). The workshop will be held on the 7th of November 2022. List of topics: We seek submissions that combine the understanding of socio and technical approaches to the resilience and security of IoT systems. Within this domain, particular topics of interest include, but are not limited to: Agile and Self-management architectures for IoT security and resilience Technical and Social emergent behaviours and IoT resilience to faults and threats Secure decentralised edge processing to mitigate faults and threats Law, Economics for security and resilience Public Value of IoT and Applications of IoT to bring Resilience Resilient Security IoT for the Long-term (physical decay, updates/maintenance, aging) IoT verification with the human-in-the-loop Security-by-Design; Privacy-by-Design, Resilience-by-Design Physical Layer Schemes for IoT/CPS key generation Ethics; Responsible and Resilient Innovation

1 0

Re: [iot-wg] iot-wg Digest, Vol 61, Issue 1
by Phil Stanhope 08 Jul '22

08 Jul '22

I think that Michaels' suggestion of an informal group, invite only, chatham house rules is excellent. Within the DNS community this existed for many years (I wasn't a direct participant). It was led by folks like Andrew Sullivan (now Internet Society CEO) and others. Inside Baseball what they termed it ... because they'd use IETF meeting or NANOG meetings to then get to the closest baseball game, have a series of meetings, etc. Always Chatham House rules. I know similar groups exist in the DDoS fighters space -- with some overlap to the DNS operators because of amplification attacks, etc. Always discussing sensitive matters, so Chatham House rules definitely apply. I'm certain that there are those at RIPE now (or previously) who could provide guidance on how comms were established, etc. I know I was in the room with folks who brokered contacts with other key players during the Oct 2016 Dyn attack as an example. -phil On Thu, Jul 7, 2022 at 6:00 AM <iot-wg-request(a)ripe.net> wrote: > Send iot-wg mailing list submissions to > iot-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-wg > or, via email, send a message with subject or body 'help' to > iot-wg-request(a)ripe.net > > You can reach the person managing the list at > iot-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-wg digest..." > > > Today's Topics: > > 1. Re: the vague IoT/RIPE-NCC training question (Michael Richardson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 06 Jul 2022 13:10:59 -0400 > From: Michael Richardson <mcr+ietf(a)sandelman.ca> > To: =?utf-8?Q?Peter_Steinh=C3=A4user?= <ps(a)embedd.com>, IoT WG RIPE > <iot-wg(a)ripe.net> > Subject: Re: [iot-wg] the vague IoT/RIPE-NCC training question > Message-ID: <27027.1657127459@localhost> > Content-Type: text/plain; charset="utf-8" > > > {did we sort out who are the new co-chairs?} > > Peter Steinh?user <ps(a)embedd.com> wrote: > > Regarding your initial topic about the NCC training offerings I tend > to stand on Jim?s > > side. Nevertheless I think this WG could: > > > 1) Identify IoT aspects that affect ISPs from the broad field of > topcis, as you already > > mentioned a bit further below. @Daniel: I salute your comment, I > think that?s we > > should focus on. > > > 2) Work on RIPE documents, i.e. like the BCOP document we were > working on. Such > > documents then could found a base for trainings, if done by the RIPE > NCC or third > > parties tends to be seen. > > Any other thoughts? > > > Getting engagement from the ISPs seems a tricky matter. Inside prpl > currently IoT is > > not a relevant topic, at least none of the major ISPs seems to have > brought it up, yet. > > Talking to IXPs as well could give us broader view. Although they > have not direct control > > about the end user?s CPEs they can get seriously affected by DDoS > attacks and > > should have a good interest in prevention. > > This concern is what originally motivated CIRA to engage in the SHG > project. > What we really have is a major, industry-wide, tragedy of the commons > https://en.wikipedia.org/wiki/Tragedy_of_the_commons situation. > The entities most affected by poor security and resulting DDoS attacks are > not the entities able to affect change. The ones who could affect change > do > not have the resources and/or motivation to do so. > > >> So, what would I like to see: > >> > >> 1) increase connection with RIPE NCC with organizations like > >> iotsecurityfoundation.org. IoTSF is among the few places I've > found which > >> are not about hype or marketing, who seem to have real connections > to both > >> places/people technical and people/places regulatory. Like the > IETF, though, > >> we need more participation of operators.... not just the airy-fairy > senior > >> security architects from various ISPs, but actual people in the > >> trenches. > > Let me ask a question here. > Is there a means by which the RIPE NCC can (or is already) be in the loop > for reports about DDoS > attacks on ISPs and critical (European) infrastructure? > I don't mean *me*, or the IOT-WG. I understand that this kind of thing is > often confidential. I am asking if the RIPE NCC can act as an air-gap > firewall, exfiltrating important aspects of the incidents. > We can only fix things that we can measure! > Also: _tell me how you will measure me, and I'll tell you how I will act_ > > >> Is there an opportunity to collect wisdom together? > >> Maybe some kind of symposium of operators and openwrt developers > could > >> happen. OpenWRT has had conferences, although often not that well > advertised > >> in advance. pprlFoundation sometimes has conferences I think. The > >> WBAlliance does stuff, but alas, 90% of what I see is total > marketing. > > One approach might be a small colloquium of operators/developers meeting > under Chatham House rules. I'm sure that I could get IoTSF to host such a > thing in London, but there may be better times/places at which the right > people are already there. Note that for the conversation to be genuine it > couldn't be open to the public, but a report would be generated. > > > > -- > Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 I?T consulting ) > Sandelman Software Works Inc, Ottawa and Worldwide > > > > >

2 1

the vague IoT/RIPE-NCC training question
by Michael Richardson 06 Jul '22

06 Jul '22

At RIPE84, recorded at https://ripe84.ripe.net/archives/video/782/ Jad El Cham asks about training from the RIPE NCC on "IoT". I watched this today from the archives. I wasn't able to be at the IOT-WG meeting in person (yes, you saw me there on Monday), because I was at the IoT Security Foundation's ManySecured WG meetings in London. Perhaps that makes me more qualified to answer the question? First, some nitpicks about this presentation. I couldn't hear Jad El Cham's name very well, and the lack of slides meant I had to watch the video three times to understand his question. https://ripe84.ripe.net/programme/meeting-plan/iot-wg/ has his name correctly, but: https://ripe84.ripe.net/archives/#wednesday does *NOT* If there were three slides with the questions and thoughts on them, then I could far better respond to the question. (Still not sure if the clapping for Marco leaving RIPE was ... "thanks for all the work", or "thank god you escaped with your sanity...) Second, while I share some of Jim's concern about scope creep, in fact there are many things that the RIPE NCC is uniquely positioned to help with that would benefit the community, and which probably *does* need a subsidy to get done correctly. Profit motives being forever next-quarter, 90% of the IoT security problems (as explained in the previous presentation, the slides at: https://ripe84.ripe.net/presentations/87-HVIKT-IoT-encounters-ripe.pdf include his missing slides...) are the result of next quarter thinking combined with very poor operational controls. If we are going to get a handle on the security issues with networks of devices (routers are the Internet of Internet things) then we need more data and more sharing of experiences. Back in RIPE79, (Rotterdam), I tried to start discussion about how ISPs can collaborate better on dealing with security issues, particularly DDoS caused by distributed malware. So, what would I like to see: 1) increase connection with RIPE NCC with organizations like iotsecurityfoundation.org. IoTSF is among the few places I've found which are not about hype or marketing, who seem to have real connections to both places/people technical and people/places regulatory. Like the IETF, though, we need more participation of operators.... not just the airy-fairy senior security architects from various ISPs, but actual people in the trenches. There are dozens of interesting bits of research being done via RIPE Atlas, telling more IoT types about the results would be a good thing. That could be in the form of some RIPE (NCC?) person talking about research, or perhaps for RIPE NCC sponsoring the researcher to present their stuff at a few conferences, such as the IoTSF conference in October, but also IETF meetings, RSA(*), Industrial Internet Consortium, The Thing Conference, ... btw: I did two training courses in 2020 for IoTSF on default passwords and software updates. *Manufacturers* are *really* hard to reach. Educating *operators* about what to *ask for*, and which regulation the supplier is not-complliant with when they fail, would also be very good. 2) RIPE NCC involvement with specifications like: https://datatracker.ietf.org/wg/mile/about/ ROLIE RFC 8322 good intro:https://www.redhat.com/en/blog/red-hat-adopts-rolie-protocol-automate… GOLIE https://github.com/rolieup/golie For instance, how many ISPs how how to set this up? I have no personal experience. Would I come to a day-long workshop (Saturday before or after RIPE?)... YES. This is training content that RIPE NCC could develop, and could provide in multiple venues for free or for low cost. This is much akin to MANRS, RPKI training, and I think there has been IX training occur as well. ROLIE is not loved by everyone, btw, and there are some alternatives which my slides from 79 went into, but actually I'm not, alas, qualified at this time to say much, because I know little myself. 3) RIPE (NCC) involvement with regulators on the topic of *privacy* and *liability* around vulnerability disclosures. Some operators, for instance, have told me that in order to avoid violating the privacy of their customers when it comes to detecting malware infestations on *their* networks, set up honeypots of (somewhat?) vulnerable devices and wait for them to get p0wned. That's an interesting training course on its own. 4) a RIPE reference secure CPE device...? I could probably go on for days here with things that could be done. Many medium-sized operators have decided they don't like what's available to them, and have went out to specify/build their own devices. Most bigger operators have been doing this for more than a decade, but my observation is that the bigger the operator, the less secure their default device is. (For instance, we know how many and how poorly some of these devices support IPv6) Is there an opportunity to collect wisdom together? Maybe some kind of symposium of operators and openwrt developers could happen. OpenWRT has had conferences, although often not that well advertised in advance. pprlFoundation sometimes has conferences I think. The WBAlliance does stuff, but alas, 90% of what I see is total marketing. 5) I could come with a fifth, but his email is already too long. :-) -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

4 5

IoT conference in Delft - call for workshops
by Aaron Ding 19 May '22

19 May '22

Hi all, a kind reminder for the workshop proposals at 12th International Conference on IoT https://iot-conference.org/iot2022/call-for-workshops/ Proposals can be submitted to workshops-iot2022-IDE(a)tudelft.nl<mailto:workshops-iot2022-IDE@tudelft.nl> Important Dates * Workshop proposal submission deadline: May 25th, 2022 * Notification of workshop acceptance: Rolling, typically within three weeks but no later than June 30 * Workshop papers Submission deadlines: Camera ready date no later than October 17, 2022 * Workshop dates: TBD within November 7-10, 2022 Workshop Program Chairs: Aaron Ding & Kimberly Garcia Aaron -- Associate Professor, TU Delft Associate Editor for ACM Transactions on IoT <https://homepage.tudelft.nl/8e79t/>https://homepage.tudelft.nl/8e79t/

1 0

LoRa Alliance's LoRaWAN World Expo conference
by Jim Reid 19 May '22

19 May '22

In case anyone's interested in this event... > Begin forwarded message: > > From: Olivier Beaujard <obeaujard(a)semtech.com> > Subject: [T20ALL] LoRa Alliance's LoRaWAN World Expo conference in Paris > Date: 19 May 2022 at 09:04:00 BST > To: "t22sg20all(a)lists.itu.int" <t22sg20all(a)lists.itu.int> > Cc: "tsbsg20(a)itu.int" <tsbsg20(a)itu.int> > Reply-To: Olivier Beaujard <obeaujard(a)semtech.com> > > The LoRa Alliance is organizing a two ways conference in Paris on July 6-7: the LoRaWAN World Expo. > > There will be an impressive line-up of ~50 speakers from our entire Global Ecosystem who will come and present about the Power of LoRaWAN in the IoT: Miscrosoft, AWS, Eutelsat, Echostar, Cisco, Tata,… and many others. > > You can see the latest version of the agenda: https://bit.ly/38d6rgk > and the latest list of speakers here: https://bit.ly/3kUaEs4 > > You can register for this important IoT event via this link: > https://cvent.me/EzK049 > > and you are welcome to use the 10% discount code: LWE-SAVE10 (valid through May 31). > > Let me know if you do have any question. > > > > With best regards, > > Olivier Beaujard > Senior Director, LoRa Ecosystem > Semtech > LoRa Alliance Board Member & > Chairman of the Regulatory Work Group > +33 667 027 641 > obeaujard(a)semtech.com >

1 0

Re: [iot-wg] iot-wg Digest, Vol 59, Issue 4
by Phil Stanhope 17 May '22

17 May '22

I just wanted to add my support for Peter. It was a pleasure to work with Peter and other members of the working group on the IoT Architectural Considerations paper we released in April 2021. Peter helped keep us organized and focused during the drafting and review process. -phil On Sun, May 15, 2022 at 6:00 AM <iot-wg-request(a)ripe.net> wrote: > Send iot-wg mailing list submissions to > iot-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-wg > or, via email, send a message with subject or body 'help' to > iot-wg-request(a)ripe.net > > You can reach the person managing the list at > iot-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-wg digest..." > > > Today's Topics: > > 1. [Peter Steinhaeuser] for co-chair (Peter Steinh?user) > 2. Re: [Peter Steinhaeuser] for co-chair (fwd) Michael > Richardson: Re: [Peter Steinhaeuser] for co-chair (Michael > Richardson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 14 May 2022 17:17:26 +0200 > From: Peter Steinh?user <ps(a)embedd.com> > To: IoT WG RIPE <iot-wg(a)ripe.net> > Subject: [iot-wg] [Peter Steinhaeuser] for co-chair > Message-ID: <6A271EB2-9384-477F-9237-632AA7FC4F8A(a)embedd.com> > Content-Type: text/plain; charset="us-ascii" > > Dear collegues, > > I put my hat (again) into the ring and ask you to support me as a candiate > for co-chairing this WG. > > I think that this WG is still trying to find it's place in the RIPE > community, the overall acitivity level has beend a bit low. Of course the > years of the pandemic and the lack of opportunities to meet in person were > not helpful. Nevertheless it seems that IoT is still something that is > often considered to live in the consumer space, and also many carriers > currently seem to have other priorities. > > With the expanding support of IP for IoT connectivity - i.e. the Thread > and Matter protcol - I think this WG can work more closely with the other > RIPE WGs and should working on linkinf with other RIPE WGs and > standardisation and industry entities to better understand what this RIPE > WG can contribute. > > There are already activities (IETF home gateway WG, Telcom Infra Project) > in this field and also carriers bit by bit seems to pay more attention to > IoT. Industrial IoT is also getting traction and new technologies like LiFi > are emerging. Such should also come this WG's attention and there's are > strong tendency to move toward IP (in my understanding). > > As a WG chair I would focus working on connecting the ongoing activities > to form technical standards and reference implementations for easy adoption > by the industry. I would also work on advocating those to industry players > (i.e. via Broadband Forum & prpl Foundation & Telcom Infrastructure Project > - TIP) to get broader support for these activities as well. In my role as > project manager for prplOS in the prpl Foundation I also propose > technologies for adoption & funding by the prpl Foundation and it's > members, as well as in the TIP project where we contribute technology and > solutions to the Open Coverged Wireless WG (and recently started working on > IoT integration as well). > > I would appreaciate your support for my standing for co-chair for this WG > and supporting it's activities. I still think that this WG can make > meaningful contributions - we had a good start with the BCOP document and > it was a pleasure for me to work with the participating WG members. > > Sincerly, > Peter Steinhaeuser >

1 0

Re: [iot-wg] iot-wg Digest, Vol 59, Issue 6
by Phil Stanhope 17 May '22

17 May '22

I just wanted to add my support for Peter. It was a pleasure to work with Peter and other members of the working group on the IoT Architectural Considerations paper we released in April 2021. Peter helped keep us organized and focused during the drafting and review process. -phil On Tue, May 17, 2022 at 6:00 AM <iot-wg-request(a)ripe.net> wrote: > Send iot-wg mailing list submissions to > iot-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-wg > or, via email, send a message with subject or body 'help' to > iot-wg-request(a)ripe.net > > You can reach the person managing the list at > iot-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-wg digest..." > > > Today's Topics: > > 1. Re: [Peter Steinhaeuser] for co-chair (T?ma Gavrichenkov) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 16 May 2022 20:01:19 +0200 > From: T?ma Gavrichenkov <ximaera(a)gmail.com> > To: Peter Steinh?user <ps(a)embedd.com> > Cc: IoT WG RIPE <iot-wg(a)ripe.net> > Subject: Re: [iot-wg] [Peter Steinhaeuser] for co-chair > Message-ID: > < > CALZ3u+aEXc5nLWGNcazAJAk15Zy6iDchj4c1YeTEMmNm6b+jJQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Peace, > > I, too, support Peter for the IoT WG Chair position. > > -- > T?ma > > On Sat, May 14, 2022, 5:17 PM Peter Steinh?user <ps(a)embedd.com> wrote: > > > Dear collegues, > > > > I put my hat (again) into the ring and ask you to support me as a > candiate > > for co-chairing this WG. > > > > I think that this WG is still trying to find it's place in the RIPE > > community, the overall acitivity level has beend a bit low. Of course the > > years of the pandemic and the lack of opportunities to meet in person > were > > not helpful. Nevertheless it seems that IoT is still something that is > > often considered to live in the consumer space, and also many carriers > > currently seem to have other priorities. > > > > With the expanding support of IP for IoT connectivity - i.e. the Thread > > and Matter protcol - I think this WG can work more closely with the other > > RIPE WGs and should working on linkinf with other RIPE WGs and > > standardisation and industry entities to better understand what this RIPE > > WG can contribute. > > > > There are already activities (IETF home gateway WG, Telcom Infra Project) > > in this field and also carriers bit by bit seems to pay more attention to > > IoT. Industrial IoT is also getting traction and new technologies like > LiFi > > are emerging. Such should also come this WG's attention and there's are > > strong tendency to move toward IP (in my understanding). > > > > As a WG chair I would focus working on connecting the ongoing activities > > to form technical standards and reference implementations for easy > adoption > > by the industry. I would also work on advocating those to industry > players > > (i.e. via Broadband Forum & prpl Foundation & Telcom Infrastructure > Project > > - TIP) to get broader support for these activities as well. In my role as > > project manager for prplOS in the prpl Foundation I also propose > > technologies for adoption & funding by the prpl Foundation and it's > > members, as well as in the TIP project where we contribute technology and > > solutions to the Open Coverged Wireless WG (and recently started working > on > > IoT integration as well). > > > > I would appreaciate your support for my standing for co-chair for this WG > > and supporting it's activities. I still think that this WG can make > > meaningful contributions - we had a good start with the BCOP document and > > it was a pleasure for me to work with the participating WG members. > > > > Sincerly, > > Peter Steinhaeuser_______________________________________________ > > iot-wg mailing list > > iot-wg(a)ripe.net > > https://lists.ripe.net/mailman/listinfo/iot-wg > > > > To unsubscribe from this mailing list, get a password reminder, or change > > your subscription options, please visit: > > https://lists.ripe.net/mailman/listinfo/iot-wg > > >

1 0