Re: Access control for IoT
Tim Coote <[email protected]> Sat, 16 Jan 2016 15:51:24 +0000
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <[email protected]> |
--===============0870832143898032600== Content-Type: multipart/alternative; boundary="Apple-Mail=_C3F9251B-69FF-4CB8-B719-94D35F7E7841" --Apple-Mail=_C3F9251B-69FF-4CB8-B719-94D35F7E7841 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Good to see some other points of view on IoT security. This is one of = the specific issues that triggered my joining this list! I=E2=80=99ve been struggling to get the point over about authorisation = transfer to various groups and found that they generally agree = intellectually, but still seem to think in terms of authentication = creating authorisation. Naming is another related issue. I=E2=80=99d = concluded that Things in IoT shouldn=E2=80=99t be identified just with = individual hardware objects, even though the model has value from a = usability point of view (esp. when things go wrong). In fact, most = current IoT devices are much too clever to easily compose and get useful = compound behaviours out of. The issue seems to be a tension between = makers of Things and service providers who are more interested in the = Internet aspects. The different interests create different motivations = over features vs control (inc. security). I=E2=80=99d be intrigued on points of view on privacy issues to do with = aggregated data. All providers that I=E2=80=99ve worked encountered are = salivating at mining behavioural and other data. So the question is, = will general users get so spooked that they will only use well = controlled systems or will they covet the functionality more. I=E2=80=99m = pitching the former, but can see an argument for the latter. If the = former is true, then I=E2=80=99ve concluded that the provider of the IoT = service needs an opt-in policy for retaining any data. = (Datensparsamkeit, as I=E2=80=99ve seen the approach described). tc > On 15 Jan 2016, at 23:13, Alan Karp <[email protected] = <mailto:[email protected]>> wrote: >=20 > For reasons that I don't understand, I got a slot at an invitation = only IEEE workshop on security and privacy for IoT. (Maybe not enough = people are willing to go to Washington, DC, in February.) Invitees can = submit papers, and 15 will be selected for presentation. Mine is at = http://alankarp.parseapp.com/Access-Control-for-IoT.pdf = <http://alankarp.parseapp.com/Access-Control-for-IoT.pdf>. >=20 > The submission deadline has passed, so it's too late for me to fix any = errors. However, if you find things that need changing, I can address = them in the presentation should I get one of the slots. >=20 > -------------- > Alan Karp > _______________________________________________ > cap-talk mailing list > [email protected] <mailto:[email protected]> > http://www.eros-os.org/mailman/listinfo/cap-talk --Apple-Mail=_C3F9251B-69FF-4CB8-B719-94D35F7E7841 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">Good to see some other points of view on IoT security. This = is one of the specific issues that triggered my joining this list!<div = class=3D""><br class=3D""></div><div class=3D"">I=E2=80=99ve been = struggling to get the point over about authorisation transfer to various = groups and found that they generally agree intellectually, but still = seem to think in terms of authentication creating authorisation. Naming = is another related issue. I=E2=80=99d concluded that Things in IoT = shouldn=E2=80=99t be identified just with individual hardware objects, = even though the model has value from a usability point of view (esp. = when things go wrong). In fact, most current IoT devices are much too = clever to easily compose and get useful compound behaviours out of. = The issue seems to be a tension between makers of Things and = service providers who are more interested in the Internet aspects. The = different interests create different motivations over features vs = control (inc. security).<div class=3D""><br class=3D""></div><div = class=3D"">I=E2=80=99d be intrigued on points of view on privacy issues = to do with aggregated data. All providers that I=E2=80=99ve worked = encountered are salivating at mining behavioural and other data. So the = question is, will general users get so spooked that they will only use = well controlled systems or will they covet the functionality more. I=E2=80= =99m pitching the former, but can see an argument for the latter. If the = former is true, then I=E2=80=99ve concluded that the provider of the IoT = service needs an opt-in policy for retaining any data. = (Datensparsamkeit, as I=E2=80=99ve seen the approach = described).</div><div class=3D""><br class=3D""></div><div = class=3D"">tc</div><div class=3D""><div class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 15 Jan 2016, at 23:13, Alan = Karp <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">For reasons that I don't understand, I got a slot at an = invitation only IEEE workshop on security and privacy for IoT. = (Maybe not enough people are willing to go to Washington, DC, in = February.) Invitees can submit papers, and 15 will be selected for = presentation. Mine is at <a = href=3D"http://alankarp.parseapp.com/Access-Control-for-IoT.pdf" = class=3D"">http://alankarp.parseapp.com/Access-Control-for-IoT.pdf</a>.<di= v class=3D""><br class=3D""></div><div class=3D"">The submission = deadline has passed, so it's too late for me to fix any errors. = However, if you find things that need changing, I can address them in = the presentation should I get one of the slots.<br clear=3D"all" = class=3D""><div class=3D""><div class=3D"gmail_signature"><br = class=3D"">--------------<br class=3D"">Alan Karp</div></div> </div></div> _______________________________________________<br class=3D"">cap-talk = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br class=3D""><a = href=3D"http://www.eros-os.org/mailman/listinfo/cap-talk" = class=3D"">http://www.eros-os.org/mailman/listinfo/cap-talk</a><br = class=3D""></div></blockquote></div><br = class=3D""></div></div></body></html>= --Apple-Mail=_C3F9251B-69FF-4CB8-B719-94D35F7E7841-- --===============0870832143898032600== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk --===============0870832143898032600==--