<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi Poonam</p>
    <p>Thanks.  The concern here is that the device could choose to
      identify as something else through a set of false communications. 
      It is indeed an interesting area of research.  I am not saying
      there is nothing to be done, but it is something that requires
      careful consideration as we aim toward automating policy.  I fear
      in particular that the cloud makes this quite a bit harder, and
      IOT manufacturer use of their own DNS infrastructure will make it
      yet more difficult, because we are all using the same cloud infra.</p>
    <p>Eliot<br>
    </p>
    <p><br>
    </p>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 19.03.20 15:42, Poonam Yadav wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CABGSL4WL8qgdGVAVg=TuiRcMFAvgjdr26eC1-GgJgrksv-_qOg@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt"><span
style="background:transparent;margin-top:0pt;margin-bottom:0pt">Dear
            Elliot,</span></p>
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt"><span
style="background:transparent;margin-top:0pt;margin-bottom:0pt">Thank
            you for your very important question. In the current
            setting, our router verifies packets using devices' MAC
            addresses; it means the router has a list of mac addresses
            of all IoT devices. For another work, we used
            certificate-based authentication between the router and
            device MUD server, something similar: </span><span
style="background:transparent;margin-top:0pt;margin-bottom:0pt;color:rgb(74,110,224)"><a
style="background:transparent;margin-top:0pt;margin-bottom:0pt;color:rgb(74,110,224)"
              target="_blank"
href="https://docs.microsoft.com/en-us/azure/iot-edge/how-to-authenticate-downstream-device"
              class="gmail-_e75a791d-denali-editor-page-rtfLink"
              moz-do-not-send="true">https://docs.microsoft.com/en-us/azure/iot-edge/how-to-authenticate-downstream-device</a></span></p>
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt">We
          used off-the-self IoT devices so its not easy to integrate
          many TEE based solutions. </p>
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt">Best
          regards,</p>
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt">Poonam</p>
        <p
style="color:rgb(14,16,26);background:transparent;margin-top:0pt;margin-bottom:0pt"><br>
        </p>
      </div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">On Thu, Mar 19, 2020 at 12:47
          PM Eliot Lear <<a href="mailto:lear@ofcourseimright.com"
            moz-do-not-send="true">lear@ofcourseimright.com</a>>
          wrote:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0px 0px 0px
          0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
          <div>
            <p>Very interesting work!<br>
            </p>
            <p>A cautionary question:</p>
            <p>If I wanted to pretend to be one of these devices on your
              network, how hard would it be?</p>
            <p>Eliot<br>
            </p>
            <div>On 19.03.20 12:56, Poonam Yadav wrote:<br>
            </div>
            <blockquote type="cite">
              <div dir="ltr">Thanks for sharing! 
                <div><br>
                </div>
                <div>We have analysed similar pattern in many IoT
                  devices and presented periodicity in IoT traffic as
                  FFT  (fig 4 - of IoTDI paper attached for reference) 
                  and some initial results here in this report:</div>
                <div><a
                    href="https://www.repository.cam.ac.uk/handle/1810/284092"
                    target="_blank" moz-do-not-send="true">https://www.repository.cam.ac.uk/handle/1810/284092</a><br>
                </div>
                <div>and full paper is here:</div>
                <div><a
                    href="https://dl.acm.org/doi/10.1145/3302505.3310082"
                    target="_blank" moz-do-not-send="true">https://dl.acm.org/doi/10.1145/3302505.3310082</a><br>
                </div>
                <div><br>
                </div>
                <div>Best regards,</div>
              </div>
              <br>
              <div class="gmail_quote">
                <div dir="ltr" class="gmail_attr">On Thu, Mar 19, 2020
                  at 10:31 AM Mirjam Kuehne <<a
                    href="mailto:mir@ripe.net" target="_blank"
                    moz-do-not-send="true">mir@ripe.net</a>> wrote:<br>
                </div>
                <blockquote class="gmail_quote" style="margin:0px 0px
                  0px 0.8ex;border-left:1px solid
                  rgb(204,204,204);padding-left:1ex">Dear colleagues,<br>
                  <br>
                  IoT devices often perform activities on a periodic
                  basis. Thymen Wabeke<br>
                  of SIDN Labs shares his analysis of periodic network
                  traffic from IoT<br>
                  lightbulbs. Read it on RIPE Labs at:<br>
                  <br>
                  <a
href="https://labs.ripe.net/Members/thymen_wabeke/visualisations-of-periodic-iot-traffic"
                    rel="noreferrer" target="_blank"
                    moz-do-not-send="true">https://labs.ripe.net/Members/thymen_wabeke/visualisations-of-periodic-iot-traffic</a><br>
                  <br>
                  Kind regards,<br>
                  Mirjam Kühne<br>
                  RIPE NCC<br>
                  <br>
                  _______________________________________________<br>
                  iot-wg mailing list<br>
                  <a href="mailto:iot-wg@ripe.net" target="_blank"
                    moz-do-not-send="true">iot-wg@ripe.net</a><br>
                  <a
                    href="https://lists.ripe.net/mailman/listinfo/iot-wg"
                    rel="noreferrer" target="_blank"
                    moz-do-not-send="true">https://lists.ripe.net/mailman/listinfo/iot-wg</a><br>
                </blockquote>
              </div>
              <br>
              <fieldset></fieldset>
              <pre>_______________________________________________
iot-wg mailing list
<a href="mailto:iot-wg@ripe.net" target="_blank" moz-do-not-send="true">iot-wg@ripe.net</a>
<a href="https://lists.ripe.net/mailman/listinfo/iot-wg" target="_blank" moz-do-not-send="true">https://lists.ripe.net/mailman/listinfo/iot-wg</a>
</pre>
            </blockquote>
          </div>
        </blockquote>
      </div>
    </blockquote>
  </body>
</html>