RFC 7650

A Constrained Application Protocol (CoAP) Usage for REsource LOcation And Discovery (RELOAD)

πŸ“… published September 2015, from ietf

RFC 7650: A Constrained Application Protocol (CoAP) Usage for REsource LOcation And Discovery (RELOAD) πŸ¦‹

okay bestie, this one is a Standards Track document from the IETF, dated September 2015, and its ISSN is 2070-1721. The authors are J. Jimenez (Ericsson), J. Lopez-Vega (University of Granada), J. Maenpaa (Ericsson), and G. Camarillo (Ericsson). The header doesn't list anything it obsoletes or updates, so no other RFCs are being replaced or patched here. πŸ’…βœ¨

Abstract ✨

This document defines a Constrained Application Protocol (CoAP) Usage for REsource LOcation And Discovery (RELOAD). The CoAP Usage is how you federate Wireless Sensor Networks (WSNs) in a peer-to-peer way 🌸. It lets CoAP nodes store resources in a RELOAD peer-to-peer overlay, gives you a lookup service, and lets you use the RELOAD overlay as a cache for sensor data. All of this runs inside the RELOAD overlay itself, so there are no centralized servers involved πŸ™Œ. The RELOAD AppAttach method sets up a direct connection between nodes, and CoAP messages get exchanged over that connection.

Status of This Memo

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7650.

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents πŸŽ€

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   5
3.  Architecture  . . . . . . . . . . . . . . . . . . . . . . . .   5
4.  Registering CoAP URIs . . . . . . . . . . . . . . . . . . . .   7
5.  Lookup  . . . . . . . . . . . . . . . . . . . . . . . . . . .   8
6.  Forming a Direct Connection and Reading Data  . . . . . . . .   9
7.  Caching Mechanisms  . . . . . . . . . . . . . . . . . . . . .  11
  7.1.  ProxyCache  . . . . . . . . . . . . . . . . . . . . . . .  11
  7.2.  SensorCache . . . . . . . . . . . . . . . . . . . . . . .  13
8.  CoAP Usage Kinds Definition . . . . . . . . . . . . . . . . .  14
  8.1.  CoAP-REGISTRATION Kind  . . . . . . . . . . . . . . . . .  14
  8.2.  CoAP-CACHING Kind . . . . . . . . . . . . . . . . . . . .  15
9.  Access Control Rules  . . . . . . . . . . . . . . . . . . . .  15
10. Security Considerations . . . . . . . . . . . . . . . . . . .  16
11. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  17
  11.1.  CoAP-REGISTRATION Kind-ID  . . . . . . . . . . . . . . .  17
  11.2.  CoAP-CACHING Kind-ID . . . . . . . . . . . . . . . . . .  17
  11.3.  Access Control Policies  . . . . . . . . . . . . . . . .  17
12. References  . . . . . . . . . . . . . . . . . . . . . . . . .  18
  12.1.  Normative References . . . . . . . . . . . . . . . . . .  18
  12.2.  Informative References . . . . . . . . . . . . . . . . .  18
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  19

1. Introduction 🌈

okay so the Constrained Application Protocol (CoAP) Usage for REsource LOcation And Discovery (RELOAD) lets CoAP nodes store resources in a RELOAD peer-to-peer overlay, gives you a lookup service, and lets you use the RELOAD overlay as a cache for sensor data. The whole thing lives inside the RELOAD overlay, so no centralized servers needed. it's giving decentralized 😌

This usage is meant for devices that are connected across a wide geographic area. Picture a bunch of Wireless Sensor Networks (WSNs) that need to be federated over some bigger network. The WSNs connect to each other through nodes that have long range modules (like 2G, 3G, or 4G) as well as short range ones (like XBee, ZigBee, or Bluetooth LE) πŸ“‘.

Constrained devices are probably going to be all over the place when it comes to their radio layer, but they're expected to share one application-layer protocol, CoAP 🧚. CoAP is a specialized web transfer protocol [RFC7252]. It realizes the Representational State Transfer (REST) architecture for the most constrained nodes, like sensors and actuators. CoAP works not only between nodes on the same constrained network but also between constrained nodes and nodes on the Internet. That last part works because CoAP can be translated to Hypertext Transfer Protocol (HTTP) so it can plug into the web πŸ•ΈοΈ. CoAP shows up in all kinds of machine-to-machine (M2M) communication, such as home automation, construction, health care, or transportation. Basically, anywhere sensor and actuator devices are watching and interacting with the environment around them, CoAP is in the mix πŸ”₯.

As specified in [RFC6940], RELOAD is fundamentally an overlay network πŸ’œ. It gives you a layered architecture with pluggable application layers that can use the underlying forwarding, storage, and lookup functionalities. Figure 1 shows where the CoAP Usage fits inside the RELOAD architecture.

    Application

        +-------+
        | CoAP  |   ...
        | Usage |
        +-------+
    ------------------------------------ Messaging Service
    +------------------+     +---------+
    |     Message      |<--->| Storage |
    |    Transport     |     +---------+
    +------------------+           ^
           ^       ^               |
           |       v               v
           |     +-------------------+
           |     |    Topology       |
           |     |    Plug-in        |
           |     +-------------------+
           |         ^
           v         v
        +------------------+
        |  Forwarding &    |
        | Link Management  |
        +------------------+
    ------------------------------------ Overlay Link Service
         +-------+  +-------+
         |TLS    |  |DTLS   |  ...
         |Overlay|  |Overlay|
         |Link   |  |Link   |
         +-------+  +-------+

                       Figure 1: Architecture

The CoAP Usage has three basic functions:

  • Registration: CoAP nodes that can use the RELOAD data storage functionality can store a mapping from their CoAP URI to their Node-ID in the overlay. They can also look up the Node-IDs of other nodes. Nodes that aren't RELOAD aware can use other mechanisms, for example [CORERESDIR], in their local network πŸ™ˆ.
  • Lookup: Once a CoAP node has found the Node-ID for a URI it wants to retrieve, it can use the RELOAD message routing system to set up a connection for exchanging CoAP messages. Just like with registration, nodes that aren't RELOAD aware can send CoAP messages to a RELOAD Node (RN), which will do the lookup in the overlay for them 🫢.
  • Caching: Nodes can use the RELOAD overlay as a caching mechanism for information about which CoAP resources are available on the node. This is especially useful for power-constrained nodes, since they can make their data available in the overlay's cache while they're in sleep mode 😴.

For example, a CoAP proxy (see Section 3) could register its Node-ID (e.g., "9996172") and a list of sensors (e.g., "/sensors/temp-1; /sensors/temp-2; /sensors/light, /sensors/humidity") under its URI (e.g., "coap://overlay-1.com/proxy-1/") πŸ“.

When a node wants to find the values tied to that URI, it queries the overlay for "coap://overlay-1.com/proxy-1/" and gets back the proxy's Node-ID and the list of its sensors. The requesting node can then use the RELOAD overlay to set up a direct connection with the proxy and read sensor values ⭐.

The CoAP proxy can also store the sensor information in the overlay itself. That way, information can be retrieved straight from the overlay without making a direct connection to the proxy that stored it πŸ’–.

2. Terminology πŸ’…

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

We use the terminology and definitions from the RELOAD Base Protocol [RFC6940] a lot in this document. Some of those concepts are explained further in the "Concepts and Terminology for Peer to Peer SIP" [P2PSIP] document 🧠.

3. Architecture πŸ—οΈβœ¨

okay so the architecture bit is where it gets fun πŸ¦‹ we take RELOAD's existing nodes (Peer and Client) and extend them so sensor devices and other constrained devices can join the party. Figure 2 shows the overlay topology. Here's what each node type does:

Client As specified in [RFC6940], clients are nodes that do not have routing or storage responsibilities in the Overlay. πŸ’…

Peer As specified in [RFC6940], peers are nodes in the overlay that can route messages for nodes other than those to which it is directly connected. 🌸

Sensor Devices capable of measuring a physical quantity. Sensors usually acquire quantifiable information about their surrounding environment such as: temperature, humidity, electric current, moisture, radiation, and so on. 🌑️

Actuator Devices capable of interacting and affecting their environment such as: electrical motors, pneumatic actuators, electric switches, and so on. ⚑

Proxy Node Devices having sufficient resources to run RELOAD either as client or peer. These devices are located at the edge of the sensor network and, in case of Wireless Sensor Networks (WSN), act as coordinators of the network. πŸ‘‘

Physical devices can have one or several of the previous functional roles. Depending on which functionalities each node has, they can be:

Constrained Node A Constrained Node (CN) is a node with limited computational capabilities. CN devices belong to classes of at least C1 and C2 devices as defined in [RFC7228], their main constraint being the implementation of the CoAP protocol. If the CN is wireless, then it will be part of a Low-Rate Wireless Personal Area Network (LR-WPAN), also termed Low-Power and Lossy Network (LLN). Lastly, devices will usually be in sleep mode in order to prevent battery drain, and will not communicate during those periods. A CN is NOT part of the RELOAD overlay, therefore it cannot act as a client, peer, nor proxy. A CN is always either a Sensor or an Actuator. In the latter case, the node is often connected to a continuous energy power supply. πŸ”‹

RELOAD Node A RELOAD Node (RN) MUST implement the client functionality in the Overlay. Additionally, the node will often be a full RELOAD peer. An RN may also be sensor or actuator since it can have those devices connected to it. πŸŽ€

Proxy Node A Proxy Node (PN) MUST implement the RN functionality and act as a sink for the LR-WPAN network. The PN connects the short range Wireless Network to the Wide Area Network or the Internet. A Proxy Node fulfills the "Proxy Node" role as described previously in the Architecture. 🧚

                  +------+
                  |      |
         +--------+  RN  +---------+
         |        |      |         |
     +---+--+     +------+      +--+---+
     |      |                   |      |
     |  RN  |                   |  RN  |
     |      |                   |      |   +------------+
     +---+--+                   +--+---+   |        WSN |
         |         RELOAD          |       |     +----+ |
         |         OVERLAY         |       | +---+ CN | |
     +---+--+                   +--+---+   | |   +----+ |
     |      |                   |      +-----+          |
     |  RN  |                   |  PN  |   |            |
     |      |                   |      +-----+          |
     +---+--+     +------+      +--+---+   | |   +----+ |
         |        |      |         |       | +---+ CN | |
         +--------+  PN  +---------+       |     +----+ |
                  |      |                 +------------+
                  +-+--+-+
                    |  |
           +--------|--|--------+
           |     +--+  +--+     |
           |     |        |     |
           |  +--+-+    +-+--+  |
           |  | CN |    | CN |  |
           |  +----+    +----+  |
           |                WSN |
           +--------------------+

Figure 2: Overlay Topology


4. Registering CoAP URIs 🌈

so CoAP URIs are usually resolved with DNS πŸ™ƒ but when CoAP is needed inside a RELOAD environment, the overlay as a whole handles the URI resolution. No registering a URI the normal way! Instead, a peer stores a CoAPRegistration structure under a hash of its own URI. It uses the CoAP REGISTRATION Kind-ID, which is formally defined in Section 8.1 and uses a DICTIONARY data model. ✨

Let's look at an example. A CoAP proxy that lives in an overlay called overlay-1.com, using Node-ID 9996172, wants to register four different sensors to the URI coap://overlay-1.com/proxy-1/.well-known/. We'll use the link format from [RFC6690] to store the following mapping in the overlay:

 Resource-ID = h(coap://overlay-1.com/proxy-1/.well-known/)
 KEY =  9996172,

 VALUE = [
  </sensors/temp-1>;rt="temperature-c";if="sensor",
  </sensors/temp-2>;rt="temperature-c";if="sensor",
  </sensors/light>;rt="light-lux";if="sensor",
  </sensors/humidity>;rt="humidity-p";if="sensor"
     ]

Quick note: the Resource-ID stored in the overlay is calculated as a hash over the URI, that is, h(URI), which in RELOAD is usually SHA-1. πŸ”

So any other node that looks up coap://overlay-1.com/proxy-1/.well-known will learn that the Node-ID for proxy-1 is 9996172. On top of that, this mapping tells them how many sensors (CNs) there are and which URI paths to use to connect to them over CoAP. It's giving organised πŸ—‚οΈ


5. Lookup πŸ”

The RELOAD overlay supports a rendezvous system that can be used to look up other CoAP nodes. This happens by fetching mapping information between CoAP URIs and Node-IDs. πŸ¦‹

For example, say a node RN located in the overlay overlay-1.com wants to read which resources are served at an RN with URI coap://overlay-1.com/proxy-1/. It performs a fetch in the overlay. The Resource-ID used in this fetch is a SHA-1 hash over the URI coap://overlay-1.com/proxy-1/.well-known/. πŸ’–

After that fetch request, the overlay returns this result:

 Resource-ID = h(coap://overlay-1.com/proxy-1/.well-known/)
 KEY =  9996172,

 VALUE = [
  </sensors/temp-1>;rt="temperature-c";if="sensor",
  </sensors/temp-2>;rt="temperature-c";if="sensor",
  </sensors/light>;rt="light-lux";if="sensor",
  </sensors/humidity>;rt="humidity-p";if="sensor"
  ]

The KEY you get back is the Node-ID of the RN responsible for this KEY/VALUE pair. The VALUE is the set of URIs needed to read data from the CNs associated with that RN. 🫢

The RELOAD DICTIONARY model lets multiple nodes store to the same Resource-ID. This is handy for storing resources of the same type or with similar characteristics. After a lookup, this feature lets you fetch from all the RNs hosting CNs of the same class. Iconic behaviour πŸ‘‘

For instance, say the previous peer (9996172) and another peer (9996173) have both stored links to their temperature resources under the same Resource-ID (temperature). An RN (e.g., node-A) can do a fetch to the URI coap://overlay-1.com/temperature/.well-known/ and get these results:

 Resource-ID = h(coap://overlay-1.com/temperature/.well-known/)

 KEY =  9996172,
 VALUE = [
  </sensors/temp-1>;rt="temperature-c";if="sensor",
  </sensors/temp-2>;rt="temperature-c";if="sensor",
   ]

 KEY = 9996173,
 VALUE = [
  </sensors/temp-a>;rt="temperature-c";if="sensor",
        </sensors/temp-b>;rt="temperature-c";if="sensor"
   ]

6. Forming a Direct Connection and Reading Data πŸ§šβ€β™€οΈ

Once an RN (e.g., node-A) has the lookup info for a node in the overlay (e.g., proxy-1), it can connect to that node directly. It does this by sending an AppAttach request to the Node-ID it got during the lookup. πŸ“²

After the AppAttach negotiation, node-A can read the values of the CNs at proxy-1 using the info it got from the lookup. Following the example in Section 5, and according to [RFC6690], the requests for accessing the CNs at proxy-1 would be:

 REQ: GET /sensors/temp-1
 REQ: GET /sensors/temp-2

Figure 3 shows a sample of a node reading temperature data. 🌑️

+-----+     +---------+    +-----+          +---+
| PNA |     | OVERLAY |    | PNB |          |CNB|
+-----+     +---------+    +-----+          +---+
   |             |            |                |
   |             |            |                |
   | 1.RELOAD    |            |                |
   | FetchReq    |            |                |
   |+----------->|            |                |
   |             |            |                |
   | 2.RELOAD    |            |                |
   | FetchAns    |            |                |
   |<-----------+|            |                |
   |             |            |                |
   | 3.RELOAD    |            |                |
   |  AppAttach  |            |                |
   |+----------->|            |                |
   |             | 4.RELOAD   |                |
   |             | AppAttach  |                |
   |             |+---------->|                |
   |             |            |                |
   |             | 5.RELOAD   |                |
   | 6.RELOAD    |AppAttachAns|                |
   |AppAttachAns |<----------+|                |
   |<-----------+|            |                |
   |             |            |                |
   |                          |                |
   |   ---------------------  |                |
   | /        7.ICE          \|                |
   | \   connectivity checks /|                |
   |   ---------------------  |                |
   |                          |                |
   |      8.CoAP CON          |                |
   |    GET /sensors/temp-1   |                |
   |+------------------------>|                |
   |                          |  9.CoAP  GET   |
   |                          |/sensors/temp-1 |
   |                          |+-------------->|
   |                          | 10.CoAP        |
   |     11.CoAP              |    ACK 200     |
   |        ACK 200           |<--------------+|
   |<------------------------+|                |
   |                          |                |

Figure 3: An Example of a Message Sequence

7. Caching Mechanisms ✨

okay so CoAP already has caching built in 🧠 It's how a sensor's data gets reused for future requests, so you get faster responses and use less network bandwidth. The rules are in Section 5 of [RFC7252]. It works by reusing stored responses when new requests show up, and that storage lives in CoAP proxies 🫢

This CoAP usage for RELOAD adds a second caching trick πŸ¦‹ It stores sensor info right in the overlay itself. To pull that off, we have to define how the data gets stored. This caching is mainly meant for CNs with sensor capabilities, not RN sensors. Why? CNs have battery limits, so they spend long stretches in sleep mode 😴

Whenever a CN wakes up, it sends its newest sensor data to its proxy (PN). The PN then stores that data in the overlay using a RELOAD StoredData structure, which is defined in Section 6 of [RFC6940] πŸ’… We use the StoredDataValue structure from Section 6.2 of [RFC6940], specifically the SingleValue format type, to hold the cached values. The length, storage_time, lifetime, and Signature fields work exactly the same way there. The only thing that changes is DataValue, which can be either a ProxyCache or a SensorCache:

enum { reserved (0), proxy_cache(1), sensor_cache(2), (255) }
             CoAPCachingType;
struct {
 CoAPCachingType coap_caching_type;

 select(coap_caching_type) {
  case proxy_cache: ProxyCache proxy_cache_entry;
  case sensor_cache: SensorCache sensor_cache_entry;
  /* extensions */

 }
} CoAPCaching;

7.1. ProxyCache 🧁

ProxyCache is for storing values and sensor info (like inactivity time) for every sensor tied to one proxy, plus their CoAP URIs. SensorCache is different πŸ’– It only stores the info and cached value for a single sensor. It doesn't need a CoAP URI, because that URI is the same one used to generate the Resource-ID for that SensorCache entry.

ProxyCache holds the Node-ID, a length, and a bunch of SensorEntry types:

struct {
 Node-ID  Node_ID;
 uint32   length;
 SensorEntry sensors[count];
} ProxyCache;
  • Node-ID: The Node-ID of the Proxy Node (PN) that's responsible for different sensor devices.
  • length: The length of the rest of the structure.
  • Sensor-Entry: A list of sensors, written as SensorEntry types.

SensorEntry holds the coap_uri, sensor_info, and a bunch of SensorValue types:

struct {
 opaque  coap_uri;
 SensorInfo  sensor_info;
 uint32  length;
 SensorValue sensor_value[count];
} SensorEntry;
  • coap_uri: The CoAP name of the sensor device in question.
  • sensor_info: Contains relevant sensor information.
  • length: The length of the rest of the structure.
  • sensor_value: Contains a list of values stored by the sensor.

7.2. SensorCache 🌸

SensorCache is all about one sensor πŸ¦‹ It holds that sensor's info.

struct {
 Node-ID  Node_ID;
 SensorInfo sensor_info;
 uint32  length;
 SensorValue sensor_value[count];
} SensorCache;
  • Node_ID: Identifies the Node-ID of the Proxy Node responsible for the sensor.
  • sensor_info: Contains relevant sensor information.
  • length: The length of the rest of the structure.
  • sensor_value: Contains a list of values stored by the sensor.

SensorInfo holds relevant sensor info that depends on the use case. For example, the sensor manufacturer counts as relevant info here 🏭

struct {
 opaque  dev_info;

 /* extensions */

} SensorInfo;
  • dev_info: Contains specific device information as defined in [RFC6690], like temperature, luminosity, and so on. It can also represent other semantic info about the device.

SensorValue holds the measurement_time, lifetime, and value of a measurement πŸ“ˆ

struct {
 uint32  measurement_time;
 uint32  lifetime;
 opaque  value;

 /* extensions */

} SensorValue;
  • measurement_time: Shows the moment the measurement was taken. It's stored as the number of milliseconds since midnight Jan 1, 1970 UTC, not counting leap seconds ⏰
  • lifetime: Shows how long that measured value stays valid, in milliseconds since measurement_time.
  • value: The actual measured value. It can be different types (integer, long, string), so we used opaque for it πŸ”’

8. CoAP Usage Kinds Definition πŸ’œ

This section defines the CoAP-REGISTRATION and CoAP-CACHING Kinds. Let's get into it!

8.1. CoAP-REGISTRATION Kind πŸ’Œ

Kind-IDs

The Resource Name for the CoAP-REGISTRATION Kind-ID is the CoAP URI. The data stored here is a CoAPRegistration, which holds a set of CoAP URIs.

Data Model

The data model for the CoAP-REGISTRATION Kind-ID is dictionary. The dictionary key is the Node-ID of the storing RN, so each RN gets to store a single mapping πŸ—οΈ

Access Control

URI-NODE-MATCH. The "coap:" prefix has to be removed from the COAP URI before matching.

Data stored under the COAP-REGISTRATION Kind is of type CoAPRegistration, defined below:

struct {
 Node-ID Node_ID;
 uint16 coap_uris_length;
 opaque coap_uris (0..2^16-1);
} CoAPRegistration;

8.2. CoAP-CACHING Kind πŸŽ€

Kind-IDs

The Resource Name for the CoAP-CACHING Kind-ID is the CoAP URI. The data stored is a CoAPCaching, which holds a cached value.

Data Model

The data model for the CoAP-CACHING Kind-ID is single value.

Access Control

URI-MATCH. The "coap:" prefix needs to be removed from the COAP URI before matching.

Data stored under the CoAP-CACHING Kind is of type CoAPCaching, defined in Section 7.

9. Access Control Rules πŸ”

As specified in RELOAD Base [RFC6940], every Kind that is storable in an overlay must be associated with an access control policy. This policy decides whether a request from a given node to operate on a given value should succeed or fail. Usages can define whatever access control rules they want, including publicly writable values 🌈

CoAP Usage for RELOAD needs an access control policy that gives multiple nodes in the overlay read and write access. This access is for registering and caching info using CoAP URIs as identifiers. So none of the access control policies in RELOAD Base [RFC6940] are enough πŸ™…β€β™€οΈ

This document defines two access control policies, called URI-MATCH and URI-NODE-MATCH. Here's how URI-MATCH works πŸ’… A given value MUST be written and overwritten if and only if the signer's certificate has a uniformResourceIdentifier entry in the subjectAltName Extension [RFC5280] that, in canonicalized form, hashes to the Resource-ID for the resource. As explained in Section 6.3 of [RFC7252], the "coap" and "coaps" schemes conform to the generic URI, so they get normalized into the generic form as explained in Section 6 of [RFC3986]. The hash function is specified in Section 10.2 of [RFC6940]. The certificate can be generated as specified in Section 9 of [RFC7252], using Certificate mode.

URI-NODE-MATCH is the stricter one ⭐ A given value MUST be written and overwritten if and only if the URI-MATCH condition is met and, on top of that, the dictionary key equals the Node-ID in the certificate, and that Node-ID is the one indicated in the SignerIdentity value cert_hash.

These Access Control Policies are specified for IANA in Section 11.3.

10. Security Considerations 🚨

The security considerations of RELOAD [RFC6940] and CoAP [RFC7252] apply to this specification, so please pay attention πŸ‘€ RELOAD's security model is based on public key certificates, which get used for signing messages and stored objects. At the connection level, RELOAD can use either TLS or DTLS. For CoAP, several security modes have been defined. Implementations of this specification MUST follow all the security-related rules in the RELOAD [RFC6940] and CoAP [RFC7252] specifications. No skipping!

Also, in RELOAD, every Kind that is storable in an overlay must be associated with an access control policy. This document specifies two new access control policies, which are described in Section 9. They cover the most typical deployment scenarios πŸ’–

During registration and lookup, the security considerations relevant to RELOAD apply. A CoAP node that advertises its existence through this mechanism is more likely to get attacked than a node (especially a sleepy node) that doesn't advertise itself 😱 Section 11 of [RFC7252] and Section 13 of [RFC6940] have more info about the kinds of attacks and the mitigations possible.

The caching mechanism in this document is in addition to the caching CoAP already does. Access control is handled by the RELOAD overlay, and the peer storing the data is responsible for validating the signature on the data being stored πŸ›‘οΈ

11. IANA Considerations 🧾

11.1. CoAP-REGISTRATION Kind-ID πŸ¦„

This document introduces a data Kind-ID to the "RELOAD Data Kind-ID" registry:

    +-------------------+------------+----------+
    | Kind              |    Kind-ID |      RFC |
    +-------------------+------------+----------+
    | CoAP-REGISTRATION |      0x105 | RFC 7650 |
    +-------------------+------------+----------+

This Kind-ID was defined in Section 8.1.

11.2. CoAP-CACHING Kind-ID πŸͺ„

This document introduces another data Kind-ID to the "RELOAD Data Kind-ID" registry:

    +--------------+------------+----------+
    | Kind         |    Kind-ID |      RFC |
    +--------------+------------+----------+
    | CoAP-CACHING |      0x106 | RFC 7650 |
    +--------------+------------+----------+

This Kind-ID was defined in Section 8.2.

11.3. Access Control Policies πŸ—‚οΈ

IANA has created a "CoAP Usage for RELOAD Access Control Policy" registry. This registry has been added to the existing RELOAD registry. Entries in this registry are strings that denote access control policies, as described in Section 9. New entries are to be registered per the Specification Required policy in [RFC5226]. The initial contents of this registry are:

    +-----------------+----------+
    | Access Policy   |      RFC |
    +-----------------+----------+
    | URI-NODE-MATCH  | RFC 7650 |
    | URI-MATCH       | RFC 7650 |
    +-----------------+----------+

This access control policy was described in Section 9.

12. References πŸ“š

12.1. Normative References πŸ“šβœ¨

okay bestie, these are the must-read references 🫢 the spec basically can't be understood without them πŸ’…

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
           Resource Identifier (URI): Generic Syntax", STD 66,
           RFC 3986, DOI 10.17487/RFC3986, January 2005,
           <http://www.rfc-editor.org/info/rfc3986>.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
           <http://www.rfc-editor.org/info/rfc5280>.

[RFC6690]  Shelby, Z., "Constrained RESTful Environments (CoRE) Link
           Format", RFC 6690, DOI 10.17487/RFC6690, August 2012,
           <http://www.rfc-editor.org/info/rfc6690>.

[RFC6940]  Jennings, C., Lowekamp, B., Ed., Rescorla, E., Baset, S.,
           and H. Schulzrinne, "REsource LOcation And Discovery
           (RELOAD) Base Protocol", RFC 6940, DOI 10.17487/RFC6940,
           January 2014, <http://www.rfc-editor.org/info/rfc6940>.

[RFC7252]  Shelby, Z., Hartke, K., and C. Bormann, "The Constrained
           Application Protocol (CoAP)", RFC 7252,
           DOI 10.17487/RFC7252, June 2014,
           <http://www.rfc-editor.org/info/rfc7252>.

12.2. Informative References 🌸

these ones are extra reading, so not required to get the vibe 🧚 but they're super helpful if you wanna go deeper πŸ’œ

[CORERESDIR]
           Shelby, Z., Koster, M., Bormann, C., and P. Stok, "CoRE
           Resource Directory", Work in Progress, draft-ietf-core-
           resource-directory-04, July 2015.

[P2PSIP]   Bryan, D., Matthews, P., Shim, E., Willis, D., and S.
           Dawkins, "Concepts and Terminology for Peer to Peer SIP",
           Work in Progress, draft-ietf-p2psip-concepts-07, May 2015.

[RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
           IANA Considerations Section in RFCs", BCP 26, RFC 5226,
           DOI 10.17487/RFC5226, May 2008,
           <http://www.rfc-editor.org/info/rfc5226>.

[RFC7228]  Bormann, C., Ersue, M., and A. Keranen, "Terminology for
           Constrained-Node Networks", RFC 7228,
           DOI 10.17487/RFC7228, May 2014,
           <http://www.rfc-editor.org/info/rfc7228>.

Authors' Addresses πŸŽ€

and here's where you can find the authors, the real ones who made all of this happen πŸ«ΆπŸ¦‹

Jaime Jimenez
Ericsson
Hirsalantie 11
Jorvas  02420
Finland

Email: jaime.jimenez@ericsson.com


Jose M. Lopez-Vega
University of Granada
CITIC UGR Periodista Rafael Gomez Montero 2
Granada  18071
Spain

Email: jmlvega@ugr.es


Jouni Maenpaa
Ericsson
Hirsalantie 11
Jorvas  02420
Finland

Email: jouni.maenpaa@ericsson.com


Gonzalo Camarillo
Ericsson
Hirsalantie 11
Jorvas  02420
Finland

Email: gonzalo.camarillo@ericsson.com
πŸ“¦ where this page comes from