Subject: [core] FW: New Version Notification for draft-zhu-core-groupauth-00.txt

From: 齐旻鹏 <[email-masked]>
Date: Mon, 24 Jun 2013 11:10:07 +0800

Hi everyone,

The authors have submit a new draft for the group authentication. We will appreciate if you have a look and give us any comment or suggestion. The link is as below.

Here is a problem that for group communication there is only uni-cast authentication instead of group authentication method can be used. This draft wants to analyze the problem, to summarize group authentication requirement and to provide a framework of solutions.

BRs,
Minpeng

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2013年6月24日 10:19
收件人: Ye Tian; Minpeng Qi; Judy Zhu
主题: New Version Notification for draft-zhu-core-groupauth-00.txt

A new version of I-D, draft-zhu-core-groupauth-00.txt
has been successfully submitted by Judy Zhu and posted to the
IETF repository.

Filename:	 draft-zhu-core-groupauth
Revision:	 00
Title:		 Group Authentication
Creation date:	 2013-06-24
Group:		 Individual Submission
Number of pages: 10
URL:             http://www.ietf.org/internet-drafts/draft-zhu-core-groupauth-00.txt
Status:          http://datatracker.ietf.org/doc/draft-zhu-core-groupauth
Htmlized:        http://tools.ietf.org/html/draft-zhu-core-groupauth-00

Abstract:
   The group communication is designed for the communication of Internet
   of Things. A threat is identified in [I-D.ietf-core-groupcomm] that
   current DTLS based approach is unicast oriented and there is no
   supporting on group authentication feature. Unicast oriented
   authentication will causing serious burden when a large number of
   terminal nodes will be involved inevitably. In another aspect, some
   terminals will own the same characteristics, such as owning same
   features, in the same place, working in the same time, etc. With this
   mechanism, all terminals can be authenticated together with little
   signaling and calculation at the same time. It will reduce the
   network burden and save time. This draft describes the security of
   group authentication and an group authentication implementation
   method for the Internet of things.

The IETF Secretariat

---

From: Bert Greevenbosch <[email-masked]>
Date: Wed, 26 Jun 2013 05:46:25 +0000

Hello Minpeng,

I have reviewed your draft on group authentication. I think it is good to consider this topic.

I also like the modular approach, i.e. define a special entity (group agent) that performs the authorisation for the other group members. In this way, not all group members need to talk directly to the network entity, and battery cost and network traffic are reduced.

I think the draft is a good start; although it will need thorough security analysis. Also we may need to consider the "transitive trust" nature of the draft and think of the feasibility for the network entity to verify the individual group member's credentials, with the group agent as an intermediary.

What do you think?

Best regards,
Bert

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of 齐旻鹏
Sent: 2013年6月24日 11:10
To: [email-masked]
Subject: [core] FW: New Version Notification for draft-zhu-core-groupauth-00.txt

Hi everyone,

BRs,
Minpeng

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2013年6月24日 10:19
收件人: Ye Tian; Minpeng Qi; Judy Zhu
主题: New Version Notification for draft-zhu-core-groupauth-00.txt

Abstract:

The IETF Secretariat

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core

---

From: 齐旻鹏 <[email-masked]>
Date: Wed, 26 Jun 2013 18:30:03 +0800

Hi Bert,
Thanks for your comments!

Our intention is to raise this issue and to call for attention on this topic. It is a start as you said. It should be revised with comments. 

For the feasibility for the network entity to verify the credentials, it is the key point of our intention. Without the credential, the server must authorize group agent to do authentication to the network entities and must trust whatever the group agent reports. It will lose control if the group agent becomes bad. So it is useful to include the some kind of credentials of the group members. But as what you said, we should think carefully about which kind of credential should be taken. If the credential is too big, then it will not be feasible to make such authentication.

BRs,
Minpeng

-----邮件原件-----
发件人: Bert Greevenbosch [mailto:[email-masked]] 
发送时间: 2013年6月26日 13:46
收件人: 齐旻鹏; [email-masked]
主题: RE: [core] FW: New Version Notification for draft-zhu-core-groupauth-00.txt

Hello Minpeng,

What do you think?

Best regards,
Bert

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of 齐旻鹏
Sent: 2013年6月24日 11:10
To: [email-masked]
Subject: [core] FW: New Version Notification for draft-zhu-core-groupauth-00.txt

Hi everyone,

BRs,
Minpeng

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2013年6月24日 10:19
收件人: Ye Tian; Minpeng Qi; Judy Zhu
主题: New Version Notification for draft-zhu-core-groupauth-00.txt

Abstract:

The IETF Secretariat