mmccool
commented
3 years ago Thank you for your comments. We also looked at the similar issues you posted and linked above, and acknowledge your concerns. We have been discussing your input in our Security meeting and while we don't yet have a complete response, here are some points of discussion which came up:
- WoT is descriptive. It does not mandate particular security mechanisms or mitigations, although we do provide best practices guidance for "new" implementations
- There will always be a tradeoff between centralization and decentralization. Centralizing in a gateway may be good if the gateway is secure, but it also becomes a single point of failure. Co-tenancy of services also carries its own risks.
- There is no "perfect" security configuration. However it is true that a gateway will have more resources (memory, processor power, connectivity) which may make it easier to implement stronger security.
- Many existing IoT implementations use the "device is a server" approach (eg OCF, which is in turn based on CoAP). Since WoT is descriptive, it needs to be able to describe such architectures. Note that it still supports client-based architectures, but ultimately to be compatible with RESTful web services (eg to support mashups) there needs to be a "server" that provides a network API to access the device.
- A WoT "Thing" is actually an abstraction for a service that provides access to a device... it does not need to run on the device itself, and often does not. In fact, in the Mozilla implementation, all Things run on the gateway, and the devices are (typically) clients... exactly like what you propose.
- There are other reasons why it makes sense to structure IoT devices as clients, in particular they may only be active periodically to save battery. This also motivates an architecture where a service running somewhere else (e.g. a gateway) shadows the device (as a server), and the device itself is not actually running a server. For similar reasons a device may not host its own Thing Description.
We can certainly discuss updates to the WoT Architecture and WoT Security and Privacy Guidelines documents to better capture and discuss the above points. We could, for example, point out in the security documents that implementing devices as clients and running the Thing services in a gateway may allow for more centralized security implementations.
hspaay
Note: this issue might be somewhat strongly worded but considering what is at stake it is best to be clear.
The architecture sections on common patterns describe many cases as if the gateways and edge device need to connect to the appliance. This means the IoT device (appliance) acts as a server. Libraries such as webthing-node create a server that the gateway discovers and connects to.
There are a few drawbacks to this approach, but by far the worst is that it increases the attack footprint to never seen before proportions. Imagine that the majority of IoT devices can be connected to. Who wants to be responsible to ensure that every single manufacturer creates bomb proof security on their servers? Most likely the same thing will happen as what happened to cameras. One day someone finds a vulnerability and the next day the internet burns down, or your identity gets stolen. Point in case are the DDOS reflection attacks facilitated by the CoAP protocol. This is not imaginary as explained in this article on IoT vulnerabilities
There are two steps that the WoT specification can do to mitigate this potential disaster (and hopefully more):
The most secure server is the one that doesn't exist. Rather than including a server in every IoT device, define that gateways or edge devices receive connections from IoT devices and aggregate the data. There are far fewer edge devices/gateways than IoT devices so this approach significantly reduces the footprint. The moment an appliance 'joins a gateway' its server must be off.
Second, provide a secure reference implementation of this gateway that has had thorough reviews of its security aspects and receives regular updates.
If you put out a specification like WoT you also bear responsibility for its weaknesses. Yes it requires some rethinking of the data flow and security best practices, but the high level abstract architecture does not have to change much. WoT already has gateways and edge devices, which is fine, but it just need to be clear that the role of the thing is to connect to a gateway or edge device, not the other way around. Ignoring this problem is simply irresponsible.
It is not my intention to offend anyone. It is clear that a lot of hard work went into the WoT specification and I sincerely hope it will be a massive success. But please reconsider the servers aspect of it and don't create the proverbial skynet.