Subject: Is Device Control in the charter?

From: Steve Hanna <[email-masked]>
Date: Fri, 07 Apr 2000 12:13:11 -0400

I don't want to be a pain, but almost all of the discussion on the "home
network security" topic pertains to device control. And I don't think
that topic is in scope for this working group. Instead, I think that we
are chartered only to look at host configuration,
name-to-address translation, service discovery, and multicast address
allocation.

I can see a reasonable argument that we must consider device control
when designing (or identifying requirements for) our protocols.
Otherwise, we may design something that's incompatible with (or very
different from) the security used for device control protocols. If
that's the concern, it would be very useful to have some information
about *what kinds* of security is or will be included in popular device
control protocols.

* Could the working group chairs or area directors please comment on
  whether discussions of device control are in scope? If so, are we
  actually contemplating designing (or developing requirements for)
  device control protocols? Or are we simply looking to align our
  work with the work others are doing on device control protocols?

My personal opinion is that it would be useful and interesting to get
some real information about the security included in important device
control protocols. But I'm reluctant to expand the scope of the working
group to include the development of such protocols. We already have
*plenty* of work to do.

Thanks,

Steve

---

From: "Rose, William" <[email-masked]>
Date: Mon, 10 Apr 2000 15:31:02 -0400

>> The problem as I see it is the following:
>> -The "control" devices need to be able to be accessed from, and have
>>access to, outside the house to be truly useful to homeowners

>How do these devices get addresses which are addressable from outside
>the house? Zeroconf, by its nature, must automatically assign addresses.
>This appears incompatible with assignment of publicly routable
>addresses. Before we get into the questions of device control and
>security, let's decide if we're even in Zeroconf land.

>I think your concerns are all valid, but I believe these issues are all
>outside of this Working Group's realm. That said, they're also worthy of
>consideration separately.

I have contacted several people who can answer some of these questions and
will get the answers to you ASAA. I have asked them to forward the answers
to me, to keep them brief, and to do so within a few days.

This may be outside of zeroconfig but at least it might provide some
additional insight.

Bill Rose