Hello Michael, Thank you for your suggestion. I prefer not to include [I-D.ietf-anima-bootstrapping-keyinfra], since it is not as directly related to PLC as [I-D.ietf-6tisch-dtsecurity-zerotouch-join]. How about make a very brief explanation just like you made for [I-D.ietf-6tisch-minimal-security]?
I post the second paragraph of the security considerations below. Please tell me your opinion. Thank you. Malicious PLC devices could paralyze the whole network via DOS attacks, e.g., keep joining and leaving the network frequently, or multicast routing messages containing fake metrics. A device may also join a wrong or even malicious network, exposing its data to illegal users. Mutual authentication of network and new device can be conducted during the onboarding process of the new device. Methods include protocols such as [RFC7925] (exchanging pre-installed certificates over DTLS), [I-D.ietf-6tisch-minimal-security] (which uses pre-shared keys), and [I-D.ietf-6tisch-dtsecurity-zerotouch-join] (which uses IDevID and MASA service). It is also possible to use EAP methods such as [I-D.ietf-emu-eap-noob] via transports like PANA [RFC5191]. No specific mechanism is specified by this document as an appropriate mechanism will depend upon deployment circumstances. The network encryption key appropriate for the layer-2 can also be acquired during the onboarding process. Best regards, Remy -----邮件原件----- 发件人: Michael Richardson [mailto:[email protected]] 发送时间: 2020年5月22日 23:20 收件人: Liubing (Remy) <[email protected]> 抄送: [email protected]; Carles Gomez Montenegro <[email protected]> 主题: Re: 答复: [6lo] FW: I-D Action: draft-ietf-6lo-plc-03.txt Liubing (Remy) <[email protected]> wrote: > It is highly recommended to conduct a mutual authentication between the > network and the device tending to join in it. The authentication can be > accomplished with the help of certificates or pre-shared keys > [I-D.ietf-6tisch-minimal-security] provisioned by the operator at the > deployment site. Alternatively, the certificates could be provisioned > by the manufacturer or the vendor before the shipment, and in this case > the authentication can be accomplished with the help of a MASA service > on the Internet [dtsecurity-zerotouch-join]. I suggest: An onboarding process is required to enabled a new PLC node to join the network. This is required in order for the new node to acquire the network encryption key appropriate for the layer-2. Automated processes perform a mutual authentication of network and new node. Methods include protocols such as [I-D.ietf-6tisch-minimal-security] (which uses pre-shared keys), and constrained variations of [I-D.ietf-anima-bootstrapping-keyinfra] such [I-D.ietf-6tisch-dtsecurity-zerotouch-join]. It is also possible to use EAP methods such as [I-D.ietf-emu-eap-noob] via transports like PANA [RFC5191]. No specific mechanism is specified by this document as an appropriate mechanism will depend upon deployment circumstances. -- Michael Richardson <[email protected]>, Sandelman Software Works -= IPv6 IoT consulting =- _______________________________________________ 6lo mailing list [email protected] https://www.ietf.org/mailman/listinfo/6lo
