Subject: [Teep] Batch trust management support for OEM case

From: Mingliang Pei <[email-masked]>
Date: Fri, 24 Feb 2017 02:16:43 +0000

Hi All,

I received an inquiry from Xishun from Beanpod Technology whether we can support a batch mode case. The use case is that some OEM may want to provision TA into many devices they know with the same device key (for privacy and batch validation purpose). A TAM may issue one OTrP message to create SD and install the TA and send to many devices without requiring each device to submit their own device attestation. The batch support will reduce the load on the service side (TAM).

This looks to be an interesting case to me. We have baseline case for mutual trust establishment of one device at a time to a TAM, and use device information to ensure idempotency if multiple messages are delivered to the same device out of order from a TAM.

How do you think about the support of this?

Thanks,

Ming

---

From: Nick Cook <[email-masked]>
Date: Mon, 27 Feb 2017 12:54:10 +0000

Hi,

This seems to go against the principles of what OTrP was trying to achieve – that is building up trust in a device and then installing the apps once that is known. But if this is a use case that must be considered it would be good to get a clearer definition of what is needed:

1)      When we say device key, which exactly is that in the OTrP spec (just to be clear)?

2)      Is the primary reason just to limit TAM load?

3)      What is the issue around privacy? We have incorporated privacy measures into the protocol with the AIK. Clearly the first level check does contain uniqueness still. Is it that first level check that is causing a concern in this use case? We provided protection also here by having OTrP clients only respond to signed messages from trusted issuers so not just any server or app can check the device identifier.

Depending on the details this use case might already be possible with OTrP as it is today, but I would be concerned about class keys when considering the overall security model.

Keen to see more details,

Nick Cook
Chief Innovations Officer
Intercede
Digital trust    people ǀ devices ǀ apps
Office: +44 (0)1455 558 111 ǀ Mobile: +44 (0) 7780 954 442
www.intercede.com<http://www.intercede.com>
Legal Disclaimer <http://www.intercede.com/investors/privacy-policy/>
From: Mingliang Pei [mailto:[email-masked]]
Sent: 24 February 2017 02:17
To: [email-masked]
Subject: [Teep] Batch trust management support for OEM case

Hi All,

Thanks,

Ming