Hi Jeff,
Totally agree! For me is UMA a good candidate for solving certain issues in the IoT. But in fact it is not really our job to decide yet about protocols in our DG (regarding our charter). Maybe later in a WG.
Before we can do this we have to identify/analyze/sort out/discuss open issues and answer many other questions .
Ingo
From: j stollman [mailto:stollman.j@gmail.com]
Sent: Samstag, 24. August 2013 15:26
To: Friese, Ingo
Cc: Colin Wallis; emaler@forrester.com; dg-idot@kantarainitiative.org
Subject: Re: [DG-IDoT] IDoT use-case collection "rental car mobility" scenario by Ingo
The discussion of UMA gives me a bit of pause. I think UMA is a great concept and I am pleased and impressed with how it has developed from concept to early reality. But without derogating UMA, I wonder if the discussion of UMA is yet ripe in the IoT DG.
The topic of the Internet of Things is quite broad. Under this single rubrick fall such issues as the following:
1. What devices will become internet enabled?
2. What new capabilities will arise from devices becoming internet enabled?
3. What are the concerns about using internet-enabled devices?
* security
* privacy
* identity
* legal
1. What are the mitigations for the above concerns?
2. How can this new ecosystem be managed?
* at the individual level
* at the ecosystem level
1. What technology/protocol solutions can be used to accommodate the management and mitigations?
As a discussion group without deliverables, we are free to cover any and all of the topics above (plus those I overlooked). But I fear that if our small group tries to address all of them at once, we will fritter away our motivation.
I support the idea of developing use cases, because they will likely inform all of issues above. But I am fearful of the discussion migrating too soon to the solution end of the spectrum before we have explored the depth and breadth of the issues that will evolve from our futurecasting which will lead eventually to defining requirements . As technologists jumping to solutions before we have fully articulated requirements is frequently our tendency. I am not arguing that UMA is not be applicable to IoT. But I am not certain that trying to devise solutions at this early stage won't cause us to create solution silos. If we articulate the first several requirements of IoT, stop developing requirements, and then determine that UMA solves the puzzle for this small segment of the market we defined, we create a narrow "standard" that may not address the other requirements which we later recognize. We can't wait forever to have the :"complete" list of requirements. But at this early state, I am wary of putting too much focus on any solution before we have invested significant energy into imagining the potential of this fascinating area of innovation and, by doing so, developing a more comprehensive set of its requirements.
Thank you.
Jeff
On Fri, Aug 23, 2013 at 8:36 AM,
From the identity point of view we have several aspects here:
Bob is crossing domains of different companies. All these companies may have chosen different solutions, protocols and address and authentication schemes to manage their items. Addressing/Discovery The gate of "Berlin Parking" has to communicate with Bob's car. At least in order to recognize "ok this car has a special contract so it's good to go". For communication we need communication endpoints/addresses for the gate and for the car. The endpoint for the gate could be: 10.0.0.78.88.9876.berlincenter.berlinparking.dehttp://10.0.0.78.88.9876.berlincenter.berlinparking.de/ (mixed address...public & "Berlin Parking" specific address URL) The endpoint for the car is in fact an IMEI (International Mobile Station Equipment Identity) of a mobile build in GSM unit e.g. #490154203237518#. Other rental car companies use the car-id taken from the CAN-BUS System (widely used system in car industry). Both companies have their special address scheme. How to address items across different domains, namespaces and formats? (Extensible Resource Identifier OASIS XRI might be an approach....needs further discussion) Authentication Bob is able to load the battery of his car or he can get gasoline without direct payment. It is really important that only cars of "Green&blue car" company get their fuel or energy without extra payment. So the car has to authenticate itself against the energy station. How to provide authentication without Bob's interaction? May be its possible to find a special solution for "Green&blue car" but what if tomorrow other rental car companies want to join? Is there something like a general authentication scheme for things? Authorization "Green&blue car" is only allowed for gas up to a certain amount of money. How to authorize things? (OAuth for Things?...) Policies The rental car company "Green&blue car" is allowed to check the status, location and certain statistics at any time. "Berlin Green Energy" is allowed to check the location of Bobs car in order to direct him to the nearest Energy station. There has to be a policy management deciding who is allowed for what? I have the feeling we need an authorization framework here. (kind of UMA/OAuth thing?) _______________________________________________ DG-IDoT mailing list DG-IDoT@kantarainitiative.orgmailto:DG-IDoT@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/dg-idot Eve Maler http://www.xmlgrrl.com/blog +1 425 345 6756tel:%2B1%20425%20345%206756 http://www.twitter.com/xmlgrrl _______________________________________________ DG-IDoT mailing list DG-IDoT@kantarainitiative.orgmailto:DG-IDoT@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/dg-idot -- Jeff Stollman stollman.j@gmail.commailto:stollman.j@gmail.com 1 202.683.8699 Truth never triumphs - its opponents just die out. Science advances one funeral at a time. Max Planck