W3C

– DRAFT –
WoT Security

11 December 2023

Attendees

Present
Jan_Romann, Kaz_Ashimura, Mahda_Noura, Michael_McCool, Tomoaki_Mizushima
Regrets
-
Chair
McCool
Scribe
kaz, mahda-noura

Meeting minutes

Minutes

<kaz> Dec-4

McCool: approved minutes

Logistics

McCool: next week there will be no meeting due to the conflict with nordic cg meeting

McCool: we should find a solution for this to not require to cancel the meetings

Requirements and Use Cases

<kaz> security-categories.csv

McCool: We will continue on the use case document today and completing the table

McCool: for later we need to create a new column to split the private information column

https://w3c.github.io/wot-usecases/#UC-smartcity-geolocation-1

McCool: it's not really PII, safety critical - geo location might be safety critical in cases like an emergency, business critical- yes due to managing infrastructure

Kaz: I'm OK with working on Smart Cities use cases, but I'm not sure if it would be the best to use this existing use case from Singapore without having the original proposer or the other stakeholders from smart cities

McCool: we will do a draft and ask them, for now we are reading through what we have and try to extract requirements. But certaintly we haven't clarified what this geolocation device is and the use case is ambigious

Kaz: I would like to strongly suggest that we should focus on better template instead of putting content into it

McCool: we will be creating a link from the requirements to the category, so this table is a different form of these links

McCool: so, this is really us going through use cases and taking notes on what we think is true

Kaz: I can talk again with key stakeholders from smart cities and ask them about their possible collaboration for the use cases

McCool: we haven't commited any change on the document itself, and eventually we will contact the original contributors

https://w3c.github.io/wot-usecases/#UC-smartcity-dashboard-1

https://w3c.github.io/wot-usecases/#UC-interactive-public-spaces-1

McCool: it is a public service, in community service we may have different events and personalized information, a mixture of public and private information. maybe you want to rent a room and provide personalization
… also about a blind person walking to a map, and telling it that he/she is blind, this needs to be done secure

https://w3c.github.io/wot-usecases/#UC-meeting-room-event-assistance-1

McCool: it's not a public service and it's similar to the previous use case
… I walk into a meeting room and it doesn't load my preferences is not a big deal, but if I manage to mess around the settings than it is critical

Kaz: what we have been doing, the method might have been correct, at this stage of our charter we should try to get interesting analysis from other SDOs

McCool: I am not against that, but we have 73 use cases and we need to extract the information

Kaz: yes, how we extract the information is key, if there is a guideline it would be nicer

McCool: that is true, extracting useful information from that and turn it into requirements, there is multiple source of inputs for requirements, we have to look at each individually, this is essentially sumarizing the requirements that are required to do this.
… we could spend years looking at existing documents and extracting information out of them

Kaz: we could also ask people for help

McCool: sure, but that does not excuse us from our own existing use cases

Kaz: I am not objecting analyzing our own use cases, but regarding the methods we should and can consult

McCool: totally agree, but right now we have work items, for future we can also look at different use cases and link them to what we are currently doing

McCool: for retail use case we could invite the original contributors

McCool: the building use cases were done mainly by siemens

Kaz: as Ege mentioned during the main call and TD call, think about the coverage of existing specification

McCool: for the discovery spec we have requirements, thats related to coverage, full, partiall, or no coverage
… I think for security there are some things that are not adequately satsified
… only counting the number of satsified items are also not enough

Kaz: we can concentrate on what is missing, gap analysis

McCool: we won't know that until we don't finish our current task

Kaz: from your viewpoint, the current categorization could help us speed the coverage at the end, couldn't it?

McCool: for security we are linking through categories, and we only have 5 categories, however for discovery it is more difficult because we have a 1:1 mapping

McCool: is this activity something that we should all do, or some do it and review it

Kaz: we should clarify the gap analysis and what has been updated from which version how

McCool: we need to be concrete, we feel this use cases needs a mitigation of x, is this correct. I want to create a sumarry then ask for input to get more concrete input

McCool: I think we should do this task outside this meeting, I can do a PR
… we can merge the current ones we did together as a baseline

any obection to merging?
… updating the csv file

(none)

McCool: will do the rest offline and discuss it in a use case call

Mahda: I can provide help in some of the categories

McCool: Mahda is assigned 2.3, 2.4 and 2.7 use cases

w3c/wot-usecases#255

McCool: document requirements from use cases is really a use case, but I think we can still propose a table of requirements. We should only merge it after review
… in our next security we should have that table ready and than have a use call for review
… Kaz we need to schedule a use case call, how do we want to do that?

We can create a Doodle poll to get people's availability, but before that, we should make an announcement as part of the IG Charter discussion that we should look into the existing use cases as a starting point for gap analysis.

McCool: I think updating the use case document is not input but output of the current IG Charter

Kaz: We don't need to care about when the new IG Charter starts, because there is no gap between the current IG Charter and the next IG Charter as usual. Also clarifying use cases and requirements for WoT specs is already the task of the current WoT IG. What is important is clarifying the gaps between the existing WoT 1.1 standards and our use cases for WoT 2.0 standardization.

McCool: we don't need to wait for the new charter to start
… we can go ahead and schedule a meeting in January
… we announce it in the main call, and then send an email

Kaz: right
… that's why I've been suggesting we relaunch the IG's Use Cases TF asap.

[adjourned]

Minutes manually created (not a transcript), formatted by scribe.perl version 221 (Fri Jul 21 14:01:30 2023 UTC).