| draft-ietf-core-dev-urn-07.txt | draft-ietf-core-dev-urn.txt | |||
|---|---|---|---|---|
| Network Working Group J. Arkko | Network Working Group J. Arkko | |||
| Internet-Draft Ericsson | Internet-Draft Ericsson | |||
| Intended status: Informational C. Jennings | Intended status: Informational C. Jennings | |||
| Expires: January 3, 2021 Cisco | Expires: May 6, 2021 Cisco | |||
| Z. Shelby | Z. Shelby | |||
| ARM | ARM | |||
| July 2, 2020 | November 2, 2020 | |||
| Uniform Resource Names for Device Identifiers | Uniform Resource Names for Device Identifiers | |||
| draft-ietf-core-dev-urn-07 | draft-ietf-core-dev-urn-08 | |||
| Abstract | Abstract | |||
| This memo describes a new Uniform Resource Name (URN) namespace for | This document describes a new Uniform Resource Name (URN) namespace | |||
| hardware device identifiers. A general representation of device | for hardware device identifiers. A general representation of device | |||
| identity can be useful in many applications, such as in sensor data | identity can be useful in many applications, such as in sensor data | |||
| streams and storage, or equipment inventories. A URN-based | streams and storage, or equipment inventories. A URN-based | |||
| representation can be easily passed along in any application that | representation can be easily passed along in any application that | |||
| needs the information. | needs the information. | |||
| Status of This Memo | Status of This Memo | |||
| This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
| provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
| working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
| Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| This Internet-Draft will expire on January 3, 2021. | This Internet-Draft will expire on May 6, 2021. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (c) 2020 IETF Trust and the persons identified as the | Copyright (c) 2020 IETF Trust and the persons identified as the | |||
| document authors. All rights reserved. | document authors. All rights reserved. | |||
| This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
| Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
| (http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
| publication of this document. Please review these documents | publication of this document. Please review these documents | |||
| skipping to change at page 2, line 16 | skipping to change at page 2, line 16 | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
| 2. Requirements language . . . . . . . . . . . . . . . . . . . . 3 | 2. Requirements language . . . . . . . . . . . . . . . . . . . . 3 | |||
| 3. DEV URN Definition . . . . . . . . . . . . . . . . . . . . . 4 | 3. DEV URN Definition . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 3.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 3.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 3.2. Syntax . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 3.2. Syntax . . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 3.2.1. Character Case and URN-Equivalence . . . . . . . . . 6 | ||||
| 3.3. Assignment . . . . . . . . . . . . . . . . . . . . . . . 6 | 3.3. Assignment . . . . . . . . . . . . . . . . . . . . . . . 6 | |||
| 3.4. Security and Privacy . . . . . . . . . . . . . . . . . . 6 | 3.4. Security and Privacy . . . . . . . . . . . . . . . . . . 7 | |||
| 3.5. Interoperability . . . . . . . . . . . . . . . . . . . . 6 | 3.5. Interoperability . . . . . . . . . . . . . . . . . . . . 7 | |||
| 3.6. Resolution . . . . . . . . . . . . . . . . . . . . . . . 6 | 3.6. Resolution . . . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 3.7. Documentation . . . . . . . . . . . . . . . . . . . . . . 7 | 3.7. Documentation . . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 3.8. Additional Information . . . . . . . . . . . . . . . . . 7 | 3.8. Additional Information . . . . . . . . . . . . . . . . . 7 | |||
| 3.9. Revision Information . . . . . . . . . . . . . . . . . . 7 | 3.9. Revision Information . . . . . . . . . . . . . . . . . . 7 | |||
| 4. DEV URN Subtypes . . . . . . . . . . . . . . . . . . . . . . 7 | 4. DEV URN Subtypes . . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 4.1. MAC Addresses . . . . . . . . . . . . . . . . . . . . . . 7 | 4.1. MAC Addresses . . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 4.2. 1-Wire Device Identifiers . . . . . . . . . . . . . . . . 7 | 4.2. 1-Wire Device Identifiers . . . . . . . . . . . . . . . . 8 | |||
| 4.3. Organization-Defined Identifiers . . . . . . . . . . . . 8 | 4.3. Organization-Defined Identifiers . . . . . . . . . . . . 8 | |||
| 4.4. Organization Serial Numbers . . . . . . . . . . . . . . . 8 | 4.4. Organization Serial Numbers . . . . . . . . . . . . . . . 9 | |||
| 4.5. Organization Product and Serial Numbers . . . . . . . . . 9 | 4.5. Organization Product and Serial Numbers . . . . . . . . . 9 | |||
| 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 9 | 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 10 | |||
| 6. Security Considerations . . . . . . . . . . . . . . . . . . . 10 | 6. Security Considerations . . . . . . . . . . . . . . . . . . . 11 | |||
| 6.1. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . 11 | 6.1. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . 12 | |||
| 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 | 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 | |||
| 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 | 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 8.1. Normative References . . . . . . . . . . . . . . . . . . 11 | 8.1. Normative References . . . . . . . . . . . . . . . . . . 13 | |||
| 8.2. Informative References . . . . . . . . . . . . . . . . . 12 | 8.2. Informative References . . . . . . . . . . . . . . . . . 14 | |||
| Appendix A. Changes from Previous Version . . . . . . . . . . . 14 | Appendix A. Changes from Previous Version . . . . . . . . . . . 15 | |||
| Appendix B. Acknowledgments . . . . . . . . . . . . . . . . . . 16 | Appendix B. Acknowledgments . . . . . . . . . . . . . . . . . . 18 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18 | |||
| 1. Introduction | 1. Introduction | |||
| This memo describes a new Uniform Resource Name (URN) [RFC8141] | This document describes a new Uniform Resource Name (URN) [RFC8141] | |||
| namespace for hardware device identifiers. A general representation | namespace for hardware device identifiers. A general representation | |||
| of device identity can be useful in many applications, such as in | of device identity can be useful in many applications, such as in | |||
| sensor data streams and storage [RFC8428], or equipment inventories | sensor data streams and storage [RFC8428], or equipment inventories | |||
| [RFC7252], [I-D.ietf-core-resource-directory]. | [RFC7252], [I-D.ietf-core-resource-directory]. | |||
| A URN-based representation can be easily passed along in any | A URN-based representation can be easily passed along in any | |||
| application that needs the information, as it fits in protocols | application that needs the information, as it fits in protocols | |||
| mechanisms that are designed to carry URNs [RFC7230], [RFC7540], | mechanisms that are designed to carry URNs [RFC7230], [RFC7540], | |||
| [RFC3261], [RFC7252]. Finally, URNs can also be easily carried and | [RFC3261], [RFC7252]. Finally, URNs can also be easily carried and | |||
| stored in formats such as XML [W3C.REC-xml-19980210] or JSON | stored in formats such as XML [W3C.REC-xml-19980210] or JSON | |||
| [RFC8259] [RFC8428]. Using URNs in these formats is often preferable | [RFC8259] [RFC8428]. Using URNs in these formats is often preferable | |||
| as they are universally recognized, self-describing, and therefore | as they are universally recognized and self-describing, and therefore | |||
| avoid the need for agreeing to interpret an octet string as a | avoid the need for agreeing to interpret an octet string as a | |||
| specific form of a MAC address, for instance. | specific form of a MAC address, for instance. | |||
| This memo defines identity URN types for situations where no such | This document defines identity URN types for situations where no such | |||
| convenient type already exist. For instance, [RFC6920] defines | convenient type already exists. For instance, [RFC6920] defines | |||
| cryptographic identifiers, [RFC7254] defines International Mobile | cryptographic identifiers, [RFC7254] defines International Mobile | |||
| station Equipment Identity (IMEI) identifiers for use with 3GPP | station Equipment Identity (IMEI) identifiers for use with 3GPP | |||
| cellular systems, and [RFC8464] defines Mobile Equipment Identity | cellular systems, and [RFC8464] defines Mobile Equipment Identity | |||
| (MEID) identifiers for use with 3GPP2 cellular systems. Those URN | (MEID) identifiers for use with 3GPP2 cellular systems. Those URN | |||
| types should be employed when such identities are transported; this | types should be employed when such identities are transported; this | |||
| memo does not redefine these identifiers in any way. | document does not redefine these identifiers in any way. | |||
| Universally Unique IDentifier (UUID) URNs [RFC4122] are another | Universally Unique IDentifier (UUID) URNs [RFC4122] are another | |||
| alternative way for representing device identifiers, and already | alternative way for representing device identifiers, and already | |||
| support MAC addresses as one of type of an identifier. However, | support MAC addresses as one of type of an identifier. However, | |||
| UUIDs can be inconvenient in environments where it is important that | UUIDs can be inconvenient in environments where it is important that | |||
| the identifiers are as simple as possible and where additional | the identifiers are as simple as possible and where additional | |||
| requirements on stable storage, real-time clocks, and identifier | requirements on stable storage, real-time clocks, and identifier | |||
| length can be prohibitive. UUID-based identifiers are recommended | length can be prohibitive. UUID-based identifiers are recommended | |||
| for all general purpose uses when MAC addresses are available as | for all general purpose uses when MAC addresses are available as | |||
| identifiers. The device URN defined in this memo is recommended for | identifiers. The device URN defined in this document is recommended | |||
| constrained environments. | for constrained environments. | |||
| Future device identifier types can extend the device URN type defined | Future device identifier types can extend the device URN type defined | |||
| here, or define their own URNs. | here, or define their own URNs. | |||
| Note that long-term stable unique identifiers are problematic for | Note that long-term stable unique identifiers are problematic for | |||
| privacy reasons and should be used with care or avoided as described | privacy reasons and should be used with care or avoided as described | |||
| in [RFC7721]. | in [RFC7721]. | |||
| The rest of this memo is organized as follows. Section 3 defines the | The rest of this document is organized as follows. Section 3 defines | |||
| "DEV" URN type, and Section 4 defines subtypes for IEEE MAC-48, | the "DEV" URN type, and Section 4 defines subtypes for IEEE MAC-48, | |||
| EUI-48 and EUI-64 addresses and 1-wire device identifiers. Section 5 | EUI-48 and EUI-64 addresses and 1-wire device identifiers. Section 5 | |||
| gives examples. Section 6 discusses the security and privacy | gives examples. Section 6 discusses the security and privacy | |||
| considerations of the new URN type. Finally, Section 7 specifies the | considerations of the new URN type. Finally, Section 7 specifies the | |||
| IANA registration for the new URN type and sets requirements for | IANA registration for the new URN type and sets requirements for | |||
| subtype allocations within this type. | subtype allocations within this type. | |||
| 2. Requirements language | 2. Requirements language | |||
| The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
| "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | |||
| skipping to change at page 5, line 25 | skipping to change at page 5, line 25 | |||
| identifiernodash = 1*unreservednodash | identifiernodash = 1*unreservednodash | |||
| product = identifiernodash | product = identifiernodash | |||
| serial = identifier | serial = identifier | |||
| componentpart = *( "_" identifier ) | componentpart = *( "_" identifier ) | |||
| unreservednodash = ALPHA / DIGIT / "." | unreservednodash = ALPHA / DIGIT / "." | |||
| unreserved = unreservednodash / "-" | unreserved = unreservednodash / "-" | |||
| hexstring = 1*(hexdigit hexdigit) | hexstring = 1*(hexdigit hexdigit) | |||
| hexdigit = DIGIT / "a" / "b" / "c" / "d" / "e" / "f" | hexdigit = DIGIT / "a" / "b" / "c" / "d" / "e" / "f" | |||
| number = 1*DIGIT | number = 1*DIGIT | |||
| ALPHA = %x41-5A / %x61-7A | ALPHA = %x41-5A / %x61-7A | |||
| DIGIT = %x30-39 | DIGIT = %x30-39 | |||
| The above Augmented Backus-Naur Form (ABNF) copies the DIGIT and | The above Augmented Backus-Naur Form (ABNF) copies the DIGIT and | |||
| ALPHA rules originally defined in [RFC5234], exactly as defined | ALPHA rules originally defined in [RFC5234], exactly as defined | |||
| there. | there. | |||
| The device identity namespace includes three subtypes (see Section 4, | The device identity namespace includes three subtypes (see Section 4, | |||
| and more may be defined in the future as specified in Section 7. | and more may be defined in the future as specified in Section 7. | |||
| The optional underscore-separated components following the hexstring | The optional underscore-separated components following the hexstring | |||
| are strings depicting individual aspects of a device. The specific | are strings depicting individual aspects of a device. The specific | |||
| strings and their semantics are up to the designers of the device, | strings and their semantics are up to the designers of the device, | |||
| but could be used to refer to specific interfaces or functions within | but could be used to refer to specific interfaces or functions within | |||
| the device. | the device. | |||
| With the exception of the MAC-address and 1-Wire DEV URNs, each DEV | With the exception of the MAC-address and 1-Wire DEV URNs, each DEV | |||
| URN may also contain optional colon-separated identifiers. These are | URN may also contain optional colon-separated identifiers. These are | |||
| provided for extensibility. | provided for extensibility. | |||
| There are no special character encoding rules or considerations for | There are no special character encoding rules or considerations for | |||
| comforming with the URN syntax, beyond those applicable for URNs in | conforming with the URN syntax, beyond those applicable for URNs in | |||
| general [RFC8141], or the context where these URNs are carried (e.g., | general [RFC8141], or the context where these URNs are carried (e.g., | |||
| inside JSON [RFC8259] or SenML [RFC8428]). | inside JSON [RFC8259] or SenML [RFC8428]). | |||
| The DEV URN syntax allows both upper and lower case characters. The | ||||
| lexical equivalence of the DEV URNs is defined as an exact and case | ||||
| sensitive string match. Character case is not otherwise significant | ||||
| for the DEV URN subtypes defined in this document. Future subtypes | ||||
| might use identifiers that require other encodings that require a | ||||
| more full-blown character set (such as BASE64). To facilitate | ||||
| equivalence checks, it is RECOMMENDED that implementations always use | ||||
| lower case letters where they have a choice in case, unless there is | ||||
| a reason otherwise. (Such a reason might be, for instance, the use | ||||
| of a subtype that requires the use of both upper case and lower case | ||||
| letters.) | ||||
| DEV URNs do not use r-, q-, or f-components. | DEV URNs do not use r-, q-, or f-components. | |||
| Specific subtypes of DEV URNs may be validated through mechanisms | Specific subtypes of DEV URNs may be validated through mechanisms | |||
| discussed in Section 4. | discussed in Section 4. | |||
| Finally, the string representation of the device identity URN and of | The string representation of the device identity URN and of the MEID | |||
| the MEID sub namespace is fully compatible with the URN syntax. | sub namespace is fully compatible with the URN syntax. | |||
| 3.2.1. Character Case and URN-Equivalence | ||||
| The DEV URN syntax allows both upper and lower case characters. The | ||||
| URN-equivalence of the DEV URNs is defined per [RFC8141] Section 3.1, | ||||
| i.e,. two URNs are URN-equivalent if their assigned-name portions are | ||||
| octet-by-octet equal after applying case normalization to the URI | ||||
| scheme ("urn"), namespace identifier ("dev"), and any percent-encoded | ||||
| characters. The rest of the DEV URN is compared in a case sensitive | ||||
| manner. It should be noted that URN-equivalence matching merely | ||||
| quickly shows that two URNs are definitely the same for the purposes | ||||
| of caching and other similar uses. Two DEV URNs may still refer to | ||||
| the same entity, and not be found URN-equivalent according to the RFC | ||||
| 8141 definition. For instance, in the ABNF syntax strings are case- | ||||
| insensitive, and a MAC address could be represented either with | ||||
| uppercase or lowercase hexadecimal digits. | ||||
| Character case is not otherwise significant for the DEV URN subtypes | ||||
| defined in this document. However, future subtypes might include | ||||
| identifiers that use encodings such as BASE64, which encode strings | ||||
| in a larger variety of characters, and might even encode binary data. | ||||
| To facilitate equivalence checks, it is RECOMMENDED that | ||||
| implementations always use lower case letters where they have a | ||||
| choice in case, unless there is a reason otherwise. (Such a reason | ||||
| might be, for instance, the use of a subtype that requires the use of | ||||
| both upper case and lower case letters.) | ||||
| 3.3. Assignment | 3.3. Assignment | |||
| Assignment: The process for identifier assignment is dependent on the | Assignment: The process for identifier assignment is dependent on the | |||
| used subtype, and documented in the specific subsection under | used subtype, and documented in the specific subsection under | |||
| Section 4. | Section 4. | |||
| Device identifiers are generally expected to be unique, barring the | Device identifiers are generally expected to be unique, barring the | |||
| accidental issue of multiple devices with the same identifiers. | accidental issue of multiple devices with the same identifiers. In | |||
| many cases, device identifiers can also be changed by users, or | ||||
| sometimes assigned in an algorithmic fashion. Any potential | ||||
| conflicts arising from such assignments are not something that the | ||||
| DEV URNs as such manage; they simply are there to refer to a | ||||
| particular identifier. | ||||
| This URN type SHOULD only be used for persistent identifiers, such as | The DEV URN type SHOULD only be used for persistent identifiers, such | |||
| hardware-based identifiers or cryptographic identifiers based on keys | as hardware-based identifiers or cryptographic identifiers based on | |||
| intended for long-term usage. | keys intended for long-term usage. | |||
| 3.4. Security and Privacy | 3.4. Security and Privacy | |||
| Security and Privacy: As discussed in Section 6, care must be taken | Security and Privacy: As discussed in Section 6, care must be taken | |||
| to use device identifier-based identifiers due to their nature as a | in the use of device-identifier-based identifiers due to their nature | |||
| long-term identifier that is often not changeable. Leakage of these | as long-term identifiers that are not normally changeable. Leakage | |||
| identifiers outside systems where their use is justified should be | of these identifiers outside systems where their use is justified | |||
| controlled. | should be controlled. | |||
| 3.5. Interoperability | 3.5. Interoperability | |||
| Interoperability: There are no specific interoperability concerns. | Interoperability: There are no specific interoperability concerns. | |||
| 3.6. Resolution | 3.6. Resolution | |||
| Resolution: The device identities are not expected to be globally | Resolution: The device identities are not expected to be globally | |||
| resolvable. No identity resolution system is expected. Systems may | resolvable. No identity resolution system is expected. Systems may | |||
| perform local matching of identities to previously seen identities or | perform local matching of identities to previously seen identities or | |||
| skipping to change at page 8, line 48 | skipping to change at page 9, line 23 | |||
| Editor's Note (Please remove before publication): The DEV URN "os" | Editor's Note (Please remove before publication): The DEV URN "os" | |||
| subtype has originally been defined in the LwM2M standard, but has | subtype has originally been defined in the LwM2M standard, but has | |||
| been incorporated here to collect all syntax associated with DEV | been incorporated here to collect all syntax associated with DEV | |||
| URNs in one place. At the same time, the syntax of this subtype | URNs in one place. At the same time, the syntax of this subtype | |||
| was changed to avoid the possibility of characters that are not | was changed to avoid the possibility of characters that are not | |||
| allowed in SenML Name field (see [RFC8428] Section 4.5.1). | allowed in SenML Name field (see [RFC8428] Section 4.5.1). | |||
| When included in an "os" DEV URN, the PEN number MUST NOT be | When included in an "os" DEV URN, the PEN number MUST NOT be | |||
| padded with extra leading zeroes. Organizations are also | padded with extra leading zeroes. Organizations are also | |||
| encouraged to select serial number formats that avoid possibility | encouraged to select serial number formats that avoid possibility | |||
| for ambiquity, in the form of leading zeroes or otherwise. | for ambiguity, in the form of leading zeroes or otherwise. | |||
| Organization serial number DEV URNs consist of the PEN number and the | Organization serial number DEV URNs consist of the PEN number and the | |||
| serial number. As with other DEV URNs, for carrying additional | serial number. As with other DEV URNs, for carrying additional | |||
| information and extensibility, optional colon-separated identifiers | information and extensibility, optional colon-separated identifiers | |||
| and underscore-separated components may also be included. The serial | and underscore-separated components may also be included. The serial | |||
| numbers themselves are defined by the organization, and this | numbers themselves are defined by the organization, and this | |||
| specification does not specify how they are allocated. | specification does not specify how they are allocated. | |||
| 4.5. Organization Product and Serial Numbers | 4.5. Organization Product and Serial Numbers | |||
| skipping to change at page 9, line 33 | skipping to change at page 10, line 8 | |||
| number, product class, and the serial number. As with other DEV | number, product class, and the serial number. As with other DEV | |||
| URNs, for carrying additional information and extensibility, optional | URNs, for carrying additional information and extensibility, optional | |||
| colon-separated identifiers and underscore-separated components may | colon-separated identifiers and underscore-separated components may | |||
| also be included. Both the product class and serial numbers | also be included. Both the product class and serial numbers | |||
| themselves are defined by the organization, and this specification | themselves are defined by the organization, and this specification | |||
| does not specify how thy are allocated. | does not specify how thy are allocated. | |||
| When included in an "ops" DEV URN, the PEN number MUST NOT be padded | When included in an "ops" DEV URN, the PEN number MUST NOT be padded | |||
| with extra leading zeroes. Organizations are also encouraged to | with extra leading zeroes. Organizations are also encouraged to | |||
| select product and serial number formats that avoid possibility for | select product and serial number formats that avoid possibility for | |||
| ambiquity. | ambiguity. | |||
| 5. Examples | 5. Examples | |||
| The following three examples provide examples of MAC-based, 1-Wire, | The following three examples provide examples of MAC-based, 1-Wire, | |||
| and Cryptographic identifiers: | and Cryptographic identifiers: | |||
| urn:dev:mac:0024beffff804ff1 # The MAC-48 address of | urn:dev:mac:0024beffff804ff1 # The MAC-48 address of | |||
| # 0024be804ff1, converted | # 0024be804ff1, converted | |||
| # to EUI-64 format | # to EUI-64 format | |||
| skipping to change at page 11, line 5 | skipping to change at page 12, line 5 | |||
| # subtype | # subtype | |||
| 6. Security Considerations | 6. Security Considerations | |||
| On most devices, the user can display device identifiers. Depending | On most devices, the user can display device identifiers. Depending | |||
| on circumstances, device identifiers may or may not be modified or | on circumstances, device identifiers may or may not be modified or | |||
| tampered with by the user. An implementation of the DEV URN MUST NOT | tampered with by the user. An implementation of the DEV URN MUST NOT | |||
| change these properties from what they were intended. In particular, | change these properties from what they were intended. In particular, | |||
| a device identifier that is intended to be immutable should not | a device identifier that is intended to be immutable should not | |||
| become mutable as a part of implementing the DEV URN type. More | become mutable as a part of implementing the DEV URN type. More | |||
| generally, nothing in this memo should be construed to override what | generally, nothing in this document should be construed to override | |||
| the relevant device specifications have already said about the | what the relevant device specifications have already said about the | |||
| identifiers. | identifiers. | |||
| 6.1. Privacy | 6.1. Privacy | |||
| Other devices in the same network may or may not be able to identify | Other devices in the same network may or may not be able to identify | |||
| the device. For instance, on Ethernet network, the MAC address of a | the device. For instance, on an Ethernet network, the MAC address of | |||
| device is visible to all other devices. | a device is visible to all other devices. | |||
| The URNs generated according to the rules defined in this document | The URNs generated according to the rules defined in this document | |||
| result in long-term stable unique identifiers for the devices. Such | result in long-term stable unique identifiers for the devices. Such | |||
| identifiers may have privacy and security implications because they | identifiers may have privacy and security implications because they | |||
| may enable correlating information about a specific device over a | may enable correlating information about a specific device over a | |||
| long period of time, location tracking, and device specific | long period of time, location tracking, and device specific | |||
| vulnerability exploitation [RFC7721]. Also, usually there is no easy | vulnerability exploitation [RFC7721]. Also, usually there is no easy | |||
| way to change the identifier. Therefore these identifiers need to be | way to change the identifier. Therefore these identifiers need to be | |||
| used with care and especially care should be taken to avoid leaking | used with care and especially care should be taken to avoid leaking | |||
| them outside of the system that is intended to use the identifiers. | them outside of the system that is intended to use the identifiers. | |||
| 7. IANA Considerations | 7. IANA Considerations | |||
| This document requests the registration of a new URN namespace for | This document requests the registration of a new URN namespace for | |||
| "DEV", as described in Section 3. | "DEV", as described in Section 3. | |||
| Additional subtypes for DEV URNs can be defined through Specification | IANA is asked to create a "DEV URN Subtypes" registry. The initial | |||
| Required or IESG Approval [RFC8126]. | values in this registry are as follows: | |||
| Such allocations are appropriate when there is a new namespace of | Subtype Description Reference | |||
| some type of device identifiers, defined in stable fashion and with a | ------------------------------------------------------------------------ | |||
| publicly available specification that can be pointed to. | mac MAC Addresses (THIS RFC) Section 4.1 | |||
| ow 1-Wire Device Identifiers (THIS RFC) Section 4.2 | ||||
| org Organization-Defined Identifiers (THIS RFC) Section 4.3 | ||||
| os Organization Serial Numbers (THIS RFC) Section 4.4 | ||||
| ops Organization Product and Serial Numbers (THIS RFC) Section 4.5 | ||||
| Additional subtypes for DEV URNs can be defined through Specification | ||||
| Required or IESG Approval [RFC8126]. These allocations are | ||||
| appropriate when there is a new namespace of some type of device | ||||
| identifiers, defined in stable fashion and with a publicly available | ||||
| specification that can be pointed to. | ||||
| Note that the organisation (Section 4.3) device identifiers can also | Note that the organisation (Section 4.3) device identifiers can also | |||
| be used in some cases, at least as a temporary measure. It is | be used in some cases, at least as a temporary measure. It is | |||
| preferable, however, that long-term usage of a broadly employed | preferable, however, that long-term usage of a broadly employed | |||
| device identifier be registered with IETF rather than used through | device identifier be registered with IETF rather than used through | |||
| the organisation device identifier type. | the organisation device identifier type. | |||
| 8. References | 8. References | |||
| 8.1. Normative References | 8.1. Normative References | |||
| skipping to change at page 14, line 20 | skipping to change at page 15, line 35 | |||
| <https://www.rfc-editor.org/info/rfc7254>. | <https://www.rfc-editor.org/info/rfc7254>. | |||
| [RFC8464] Atarius, R., "A URN Namespace for Device Identity and | [RFC8464] Atarius, R., "A URN Namespace for Device Identity and | |||
| Mobile Equipment Identity (MEID)", RFC 8464, | Mobile Equipment Identity (MEID)", RFC 8464, | |||
| DOI 10.17487/RFC8464, September 2018, <https://www.rfc- | DOI 10.17487/RFC8464, September 2018, <https://www.rfc- | |||
| editor.org/info/rfc8464>. | editor.org/info/rfc8464>. | |||
| [I-D.ietf-core-resource-directory] | [I-D.ietf-core-resource-directory] | |||
| Shelby, Z., Koster, M., Bormann, C., Stok, P., and C. | Shelby, Z., Koster, M., Bormann, C., Stok, P., and C. | |||
| Amsuess, "CoRE Resource Directory", draft-ietf-core- | Amsuess, "CoRE Resource Directory", draft-ietf-core- | |||
| resource-directory-24 (work in progress), March 2020. | resource-directory-25 (work in progress), July 2020. | |||
| Appendix A. Changes from Previous Version | Appendix A. Changes from Previous Version | |||
| Version -08 of the WG draft took into account Barry Leiba's AD review | ||||
| comments. To address these comments, changes were made in | ||||
| o Further updates of the upper/lower case rules for the DEV URNs. | ||||
| o Further updates to the ABNF. | ||||
| o The use of HEXDIG from RFC 5234. | ||||
| o IANA considerations for the creation of separate registry for the | ||||
| own parameters of DEV URNs. | ||||
| o Editorial improvements. | ||||
| Version -07 of the WG draft took into account Carsten Bormann's | Version -07 of the WG draft took into account Carsten Bormann's | |||
| feedback, primarily on character case issues and editorials. | feedback, primarily on character case issues and editorials. | |||
| Version -06 of the WG draft took into account Marco Tiloca's feedback | Version -06 of the WG draft took into account Marco Tiloca's feedback | |||
| before a second WGLC, primarily on further cleanup of references and | before a second WGLC, primarily on further cleanup of references and | |||
| editorial issues. | editorial issues. | |||
| Version -05 of the WG draft made some updates based on WGLC input: | Version -05 of the WG draft made some updates based on WGLC input: | |||
| examples for MAC-48 and EUI-48, clarification with regards to leading | examples for MAC-48 and EUI-48, clarification with regards to leading | |||
| zeroes, new recommendation with the use of lower-case letters to | zeroes, new recommendation with the use of lower-case letters to | |||
| skipping to change at page 15, line 21 | skipping to change at page 16, line 49 | |||
| numbers and the use of product classes and serial numbers was better | numbers and the use of product classes and serial numbers was better | |||
| explained. | explained. | |||
| Version -03 of the WG draft removed some unnecessary references, | Version -03 of the WG draft removed some unnecessary references, | |||
| updated some other references, removed pct-encoding to ensure the DEV | updated some other references, removed pct-encoding to ensure the DEV | |||
| URNs fit [RFC8428] Section 4.5.1 rules, and clarified that the | URNs fit [RFC8428] Section 4.5.1 rules, and clarified that the | |||
| original source of the "os" and "ops" subtypes. | original source of the "os" and "ops" subtypes. | |||
| Version -02 of the WG draft folded in the "ops" and "os" branches of | Version -02 of the WG draft folded in the "ops" and "os" branches of | |||
| the dev:urn syntax from LwM2M, as they seemed to match well what | the dev:urn syntax from LwM2M, as they seemed to match well what | |||
| already existed in this memo under the "org" branch. However, as a | already existed in this document under the "org" branch. However, as | |||
| part of this three changes were incorporated: | a part of this three changes were incorporated: | |||
| o The syntax for the "org:" changes to use "-" rather than ":" | o The syntax for the "org:" changes to use "-" rather than ":" | |||
| between the OUI and the rest of the URN. | between the OUI and the rest of the URN. | |||
| o The organizations for the "ops" and "os" branches have been | o The organizations for the "ops" and "os" branches have been | |||
| changed to use PEN numbers rather than OUI numbers [OUI]. The | changed to use PEN numbers rather than OUI numbers [OUI]. The | |||
| reason for this is that PEN numbers are allocated through a | reason for this is that PEN numbers are allocated through a | |||
| simpler and less costly process. However, this is a significant | simpler and less costly process. However, this is a significant | |||
| change to how LwM2M identifiers were specified before. | change to how LwM2M identifiers were specified before. | |||
| skipping to change at page 16, line 46 | skipping to change at page 18, line 27 | |||
| rest of the URN can employ the unreserved characters [RFC3986]. | rest of the URN can employ the unreserved characters [RFC3986]. | |||
| Version -03 made several minor corrections to the ABNF as well as | Version -03 made several minor corrections to the ABNF as well as | |||
| some editorial corrections. | some editorial corrections. | |||
| Appendix B. Acknowledgments | Appendix B. Acknowledgments | |||
| The authors would like to thank Ari Keranen, Stephen Farrell, | The authors would like to thank Ari Keranen, Stephen Farrell, | |||
| Christer Holmberg, Peter Saint-Andre, Wouter Cloetens, Jaime Jimenez, | Christer Holmberg, Peter Saint-Andre, Wouter Cloetens, Jaime Jimenez, | |||
| Joseph Knapp, Padmakumar Subramani, Mert Ocak, Hannes Tschofenig, Jim | Joseph Knapp, Padmakumar Subramani, Mert Ocak, Hannes Tschofenig, Jim | |||
| Schaad, Thomas Fossati, Carsten Bormann, Marco Tiloca, and Ahmad | Schaad, Thomas Fossati, Carsten Bormann, Marco Tiloca, Barry Leiba, | |||
| Muhanna for interesting discussions in this problem space. We would | and Ahmad Muhanna for feedback and interesting discussions in this | |||
| also like to note prior documents that focused on specific device | problem space. We would also like to note prior documents that | |||
| identifiers, such as [RFC7254] or [RFC8464]. | focused on specific device identifiers, such as [RFC7254] or | |||
| [RFC8464]. | ||||
| Authors' Addresses | Authors' Addresses | |||
| Jari Arkko | Jari Arkko | |||
| Ericsson | Ericsson | |||
| Jorvas 02420 | Jorvas 02420 | |||
| Finland | Finland | |||
| Email: jari.arkko@piuha.net | Email: jari.arkko@piuha.net | |||
| End of changes. 34 change blocks. | ||||
| 72 lines changed or deleted | 119 lines changed or added | |||
This html diff was produced by rfcdiff 1.42. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||