This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP TASC Framework Project"
Andy Boura (talk | contribs) (→What is OWASP Security Principles Project?) |
Andy Boura (talk | contribs) (→TASC Framework Project) |
||
| Line 13: | Line 13: | ||
Makers, professionally or as hobbyists, are creating "Internet of Things" (IoT) devices using low power systems such as Arduino. Security is often an afterthought or not considered at all. This project will make it easy to secure communications between devices. | Makers, professionally or as hobbyists, are creating "Internet of Things" (IoT) devices using low power systems such as Arduino. Security is often an afterthought or not considered at all. This project will make it easy to secure communications between devices. | ||
| − | + | This project will put a communications protocol and medium agnostic encryption and authentication layer onto resource constrained devices such as the Arduino. It will do this via symmetric key encryption of the message payloads to ensure the authentication, integrity, and confidentiality of messages. | |
The use of this framework will require no specialist security knowledge. | The use of this framework will require no specialist security knowledge. | ||
Revision as of 15:30, 23 July 2015
TASC Framework ProjectThings Authentication and Secure Communications (for Resource Constrained Systems) Makers, professionally or as hobbyists, are creating "Internet of Things" (IoT) devices using low power systems such as Arduino. Security is often an afterthought or not considered at all. This project will make it easy to secure communications between devices. This project will put a communications protocol and medium agnostic encryption and authentication layer onto resource constrained devices such as the Arduino. It will do this via symmetric key encryption of the message payloads to ensure the authentication, integrity, and confidentiality of messages. The use of this framework will require no specialist security knowledge. DescriptionThe TASC Framework (Things Authentication and Secure Communications) provides a lightweight abstracted security framework and supporting libraries to provide authentication and secure communications on resource constrained systems. For example developers creating "Internet of Things" (IoT) devices using low power or resource constrained systems such as Arduino who are not security experts. LicensingThe libraries and source code / examples associated with this project are licenced under Apache 2.0 Licence in order to encourage the broadest possible use in embedded systems where dynamic linking may not be practical. The documentation and guidelines are licenced under Creative Commons Attribution ShareAlike 3.0 Licence. |
What is OWASP TASC Framework Project?Low powered devices such as those found in IoT developments will often be placed on people's home networks or within range of other's wireless communications devices. This leaves them vulnerable to compromises - particularly with regards to integrity and confidentiality. The OWASP TASC Framework looks to address these issues in a way that makes no assumptions about the mechanism of the transmission of the data or commands - whether it be visible light, infra-red, 433MHz, 1-wire, serial, I2C, Bluetooth, WiFi etc. This is done by providing the capability to secure the payload and allowing the device developer the freedom to choose the communication medium. The framework consists of a coordinator, a key manager, and one or more pairing mechanisms. PresentationNot yet...but watch this space... Project LeaderRelated ProjectsPlease let us know of any relevant related projects. Openhub |
Quick DownloadNothing yet but we should have some deliverables ready soon. News and Events
Classifications
| |||||||
How can I participate in your project?
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. Please see the getting involved tab.
If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.
What platforms are supported by the framework?
The framework itself is platform agnostic and can be readily ported to any platform. Initially the Arduino platform will be targeted as a reference implementation due to it's broad adoption, starting point for budding developers, and strong community.
Contributors
The OWASP Security Principles project is developed by a worldwide team of volunteers.
The first contributors to the project were:
- Andy Boura
- Pete Ikusz
- Malcolm Boura
- YOUR NAME BELONGS HERE
The key milestones are:
- Use cases
- Requirements
- API and data structures
- Documented lightweight security framework and API
- Reference implementation for Arduino platform
- Client libraries and ports to other platforms
The key deliverables are
- Formal documentation
- Arduino reference implementation and documentation
- Additional platform ports for both clients and servers
Getting Involved
Involvement in the development and promotion of the OWASP TASC Framework Project is actively encouraged! You do not have to be a security expert in order to contribute.
Some of the ways you can help:
- Core framework developer
- Framework functional testing
- Framework penetration testing
- Helping alpha and beta testing the framework on different hardware:
- Sharing example code
- Creating "How to" articles and videos
- Providing feedback
- Project administration support.
- Publicity and awareness / advocacy
