IoTScape service definition signing/authorization

[gsteinLTU]

Potential Issues:

• A malicious user could submit services with offensive names/contents
• A malicious user could flood the device services list (or the RPCs on an existing service) as a DoS attack

Options:

• Profanity filter would prevent most (not all but likely enough) offensive names, but would not allow blocking a user who manages to circumvent it
• One user account "owns" the service and new versions must somehow be submitted as an authenticated request before being publicly usable
• Possibly as a "code signing" feature where service definitions must be sent with a signature verifying their contents and associated user, with the ability to block services/users if they are acting maliciously

However, IoTScape services need to run on devices with no direct input method (e.g. an Arduino) and as virtual devices that need to be easy to distribute and create arbitrarily/quickly to unknown users.

Once the service definition is established on the server, maybe we can assume all devices using that version are fine. Then devices won't need to authenticate, so it only needs to be done once.

[gsteinLTU]

@brollb I think the solution is actually much simpler than we were talking about.

We can add the profanity filter just in case, and have a way to send the service definition authenticated at "compile time". The server would store hashes (so if the service is unloaded it can recognize it as valid again even if another user attempts to recreate it), names, versions, and owners for services in the database. A new version can only be pushed by the same user who pushed the earlier versions.

A blocking feature would have to come later (if we ever need it), but it shouldn't be too hard, and services could be manually blocked (erase the hash and change the owner) in the meantime.

This doesn't fix the case of someone creating many device services to fill the list, but we might just have to reorganize the list to be by user if that becomes an issue (this is how ServiceCreation is supposed to prevent that, right?).

[gsteinLTU]

Basic profanity filter is in ebae507fad32a29c78a43d244041e0f15bcddfba