OWASP TASC Framework Project
TASC Framework Project
Things Authentication and Secure Communications (for Resource Constrained Systems)
Makers, professionally or as hobbyists, are creating "Internet of Things" (IoT) devices using low power systems such as Arduino. Security is often an afterthought or not considered at all. This project will make it easy to secure communications between devices.
This project will put a communications protocol and medium agnostic encryption and authentication layer onto resource constrained devices such as the Arduino.
The use of this framework will require no specialist security knowledge.
The TASC Framework (Things Authentication and Secure Communications) provides a lightweight abstracted security framework and supporting libraries to provide authentication and secure communications on resource constrained systems. For example developers creating "Internet of Things" (IoT) devices using low power systems such as Arduino who are not security experts.
The libraries and source code / examples associated with this project are licenced under Apache 2.0 Licence in order to encourage the broadest possible use in embedded systems where dynamic linking may not be practical.
The documentation and guidelines are licenced under Creative Commons Attribution ShareAlike 3.0 Licence.
What is OWASP TASC Framework Project?
Low powered devices such as those found in IoT developments will often be placed on people's home networks or within range of other's wireless communications devices. This leaves them vulnerable to compromises - particularly with regards to integrity and confidentiality.
The OWASP TASC Framework looks to address these issues in a way that makes no assumptions about the mechanism of the transmission of the data or commands - whether it be visible light, infra-red, 433MHz, 1-wire, serial, I2C, Bluetooth, WiFi etc. This is done by providing the capability to secure the payload and allowing the device developer the freedom to choose the communication medium.
Using an AES library such as: http://forum.arduino.cc/index.php?topic=88890.0 symmetric key encryption of the message payloads to ensure the authentication, integrity, and confidentiality of messages.
The framework consists of a coordinator, a key manager, and one or more pairing mechanisms.
Not yet...but watch this space...
Please let us know of any relevant related projects.
Nothing yet but we should have some deliverables ready soon.
News and Events
How can I participate in your project?
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. Please see the getting involved tab.
If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. See the getting involved tab for some of the ways you might be able to contribute.
What platforms are supported by the framework?
The framework itself is platform agnostic and can be readily ported to any platform. Initially the Arduino platform will be targeted as a reference implementation due to it's broad adoption, starting point for budding developers, and strong community.
The key milestones are:
- Use cases
- API and data structures
- Documented lightweight security framework and API
- Reference implementation for Arduino platform
- Client libraries and ports to other platforms
The key deliverables are
- Formal documentation
- Arduino reference implementation and documentation
- Additional platform ports for both clients and servers
Here is an outline of the modules that will be specified in the documentation and delivered in the reference Arduino implementation:
Involvement in the development and promotion of the OWASP TASC Framework Project is actively encouraged! You do not have to be a security expert in order to contribute.
Some of the ways you can help:
- Core framework developer
- Framework functional testing
- Framework penetration testing
- Helping alpha and beta testing the framework on different hardware:
- Sharing example code
- Creating "How to" articles and videos
- Providing feedback
- Project administration support.
- Publicity and awareness / advocacy
A minimum viable product would meet all requirements of the reference implementation and all previous milestones (see Road Map). The reference implementation includes the foundation of the system, the interface layer and example implementations of the interfaces that can be used as a basis for customization by the end user to meet the specific requirements of their system or environment.