[AXS-39] CClient Wallet

[bernardoaraujor]

Summary This issue is particularly crucial because this is what actually turns FROST into IOTA Access, and this integration is the backbone of the project.

Description Code under iota/token-store is all TypeScript. It performs the role of Token Store on the Cloud with IOTA Hub.

On the Embedded side, embedded/bc/bc_daemon.c communicates with this service. It does it mainly via cURL.

If the IOTA Token/Seed/PrivKey is the main piece of information that identifies each device, it is important that it is embedded in the device itself (ideally on a secure, tamper-proof storage).

Communcation with the node must be done via CClient calls.

JIRA: AXS-39

[vlad-ns]

Description: Alice (device owner) delegates access to Bob for certain amount of IOTA tokens which are transferred from Bob wallet to the device.

Steps:

1. Alice creates new policy with references to:
   • Subject Bob_ID
   • Object Device_ID
   • Action
   • Cost (and currency?)
   • request.isPayed flag
   • Optional constrains: Time, location..
2. Policy is placed on Tangle policy store and synchronised with the device automatically though policy updater mechanism.
3. Bob connects to the device and polls all actions that are delegated to him using Access Secure Networking API. Some actions will be locked and require payment transaction to unlock. API also provides wallet ID of the device.
4. Bob creates transaction that contains address of the Bob wallet, device wallet and amount of tokens. Transaction is stored on IOTA Tangle.
5. Bob notifies device about transaction
6. Upon notification from Bob, device verifies transaction on IOTA. Verification is stored in data acquisition plugin.
7. PIP contains reference to the payment verification content (request.isPayed) which is used by PDP to calculate policy.
8. Each time access request occurs, PDP will check whether policy is payed by checking PIP locally.

[bernardoaraujor]

@vlad-ns + @oopsmonk I have a question:

should Bob transfer tokens to the Device wallet, or to Alice's wallet? 🤔

[oopsmonk]

@vlad-ns + @oopsmonk I have a question:

should Bob transfer tokens to the Device wallet, or to Alice's wallet? 🤔

IMO, Bob sends tokens to device wallet then gives the hash (could be transaction or bundle hash) to the device. PDP will validate the policy when the transaction is confirmed. @vlad-ns But I don't know how PDP check the policy payment from PIP.

[bernardoaraujor]

@oopsmonk how does Alice collects her token later? Assuming device's seed is stored in Secure Element, so Alice doesn't know the device's seed.

[bernardoaraujor]

Bob sends tokens to device wallet then gives the hash (could be transaction or bundle hash) to the device.

I agree with this. I see it as step 5 on @vlad-ns list.

But my question above is still challenging me. I can think of two alternatives:

• Multisig Transaction. To collect tokens from device, Alice and Device seed must sign the tx. Then, multisig tx would need to be a functionality during Wallet implementation.
• Token Collection Policy. To allow Alice (or others, like Carol) to remove tokens from device. We would need to integrate an Action Resolver Plugin with the Wallet functionality.

Last alternative would be making Bob send transaction to Alice and make Policy for device access behave accordingly.

[oopsmonk]

Token collection is not covered in the scenario above. as the owner, he/she doesn't need to receive tokens on each deal but issues a policy for token collection to the device at anytime as preference.

[vlad-ns]

@vlad-ns + @oopsmonk I have a question: should Bob transfer tokens to the Device wallet, or to Alice's wallet? 🤔

IMO, Bob sends tokens to device wallet then gives the hash (could be transaction or bundle hash) to the device. PDP will validate the policy when the transaction is confirmed. @vlad-ns But I don't know how PDP check the policy payment from PIP.

This is related to step number 6. If possible wallet should provide callback to PIP when transaction is confirmed. PDP will calculate the decision based on the request.isPayed information from PIP: Policy should contain:

"operation": "eq", "attribute_list": [ { "type": "request.isPayed.type", "value": "request.isPayed.value" }, { "type": "boolean", "value": "true" } ]

[vlad-ns]

@vlad-ns + @oopsmonk I have a question:

should Bob transfer tokens to the Device wallet, or to Alice's wallet? 🤔

Both ideas are valid @bernardoaraujor. Device owner is also owner of the device wallet. Having a wallet on the device is interesting for solving autonomous vehicles problems like paying for fuel or toll.