DOCSEARCHbyAlgolia
Submit Docs

W3C Web of Things

repository·main·Indexed 42 days ago

https://github.com/w3c/wot

A standardized framework for describing and interacting with physical devices (Things) using web-based technologies. It defines interoperability through Thing Descriptions (TDs), integration patterns (Direct, Gateway, and Cloud Connectivity), and a model for Actions, Events, and Properties to integrate devices into existing Web infrastructure.

Tokens
93.7K
Snippets
154
Records
436
Agent score
53%

What's inside WoT

  1. Overview of the Web of Things Standard Recommendation

    main
    The Web of Things (WoT) Standard Recommendation provides implementation and resource design guidelines to ensure interoperability across products, devices, services, and applications. The goal is to integrate 'Things' seamlessly into the existing Web infrastructure, leveraging existing Web standards rather than creating parallel non-Web protocols.

  2. Overview of the OCF/WoT Liaison Task Force

    main

    The OCF/WoT Liaison Task Force is a collaborative group between the W3C Web of Things (WoT) Working Group and the Open Connectivity Foundation (OCF). Its primary purpose is to enable the layering of systems designed according to W3C WoT recommendations with devices that conform to the OCF specification.

    Core Objectives

    • Interoperability: Ensuring W3C WoT recommendations can interoperate with and enable OCF devices.
    • Data Reconciliation: Reconciling the OCF data model with the information provided in W3C WoT Thing Descriptions.
    • Semantic Alignment: Defining common semantic vocabulary (ontologies), data, and interaction models.
    • Demonstration: Creating prototypes and Proof of Concepts (POCs) to demonstrate access to OCF resources via W3C WoT interfaces.

  3. Overview of the OPC UA W3C WoT Binding Proposal

    main

    The OPC UA W3C WoT Binding Proposal is a collaborative effort between the OPC Foundation and the W3C to create a standardized way to bind OPC UA systems to the W3C Web of Things (WoT). This binding enables cross-domain applications by allowing OPC UA industrial automation data to be represented within WoT Thing Descriptions (TDs).

    Key objectives of this binding include:

    • Transformation: Defining standardized methods to create a Thing Description from a UA NodesetFile and vice versa.
    • Endpoint Description: Defining how OPC UA-specific endpoints are described within TDs.
    • Security: Defining public UA security modes as metadata within TDs.
    • Ontology: Developing an 'OPC UA Binding Ontology' to cover UA-specific metadata (such as endpoint and security definitions).

  4. Overview of the Mozilla WebThings Demo

    main

    The Mozilla WebThings Demo showcases a mixture of virtual and physical devices that implement Mozilla's unofficial Web Thing API specification. It utilizes specific schemas from the Mozilla WoT Capability Schemas repository to define device capabilities.

    Compatibility Warning: Because Mozilla's Web Thing API specification has remaining differences with the latest W3C draft of the WoT Thing Description specification, these Thing Descriptions (TDs) will not currently validate using the ThingWeb Thing Description Playground.

  6. Overview of Web of Things Linked Data and Semantic Processing

    main

    The Linked Data and Semantic Processing Task Force focuses on integrating Linked Data principles into the Web of Things (WoT). The work is organized into three primary activity areas:

    1. Linked Data for Application and Platform Contracts: Developing vocabularies for describing contracts between applications and platforms.
    2. Thing Description Recipes: Creating patterns and recipes for expressing Thing Descriptions using Linked Data.
    3. Semantic Processing for Web of Things: Exploring methods for semantic processing within the WoT ecosystem.

  7. Current state of authentication and authorization standards

    main

    As of the current draft, there are no commonly accepted protocol standards for authenticating and authorizing things or devices.

    IETF ACE Working Group

    The IETF ACE working group is the leading initiative addressing this, but it currently lacks a finalized solution. It is in a stage of discussing various approaches for expressing and acquiring access tokens. Key unresolved areas include:

    • Automated creation and management of token issuance policies.
    • Performing and protecting component registration.
    • Managing the 'authorization to authorize'.
    • Authorization for things discovery.

    Transport and Application Level Security

    • Transport-level: DTLS and TLS are the accepted standards, though profiling for constrained devices is ongoing.
    • Application-level/Storage: Standards exist for representing encrypted and signed data in JSON (not suitable for highly constrained components). Work is ongoing for CBOR to support constrained components.

    Identity and Registration

    There are currently no commonly accepted standards for registering things/devices or supplying identity metadata and credentials.

  8. Access Security and Privacy resources for the Web of Things

    main

    The W3C Interest Group (IG) on the Web of Things - Security and Privacy provides several artifacts to understand the security and privacy landscape, requirements, and challenges for WoT.

    Key documentation available in this repository includes:

    • Challenges: Drivers behind adaptation and innovation needs for WoT security and privacy.
    • Requirements: Security and privacy requirements for WoT use cases.
    • Landscape: Assessment of existing and emerging security and privacy means for WoT.
    • Glossary: Definitions of terms used within this domain.
    • References: Supporting documentation and sources.

    For deeper technical surveys, refer to the W3C IG WoT Wiki for Design-Time Means, Runtime Means, and Advanced Concepts (such as authorization of things discovery).

  9. Review WoT Threat Model and Security Objectives

    main

    The Web of Things (WoT) threat model identifies several categories of security risks that developers and solution providers should consider when implementing WoT interfaces, protocol bindings, and Thing Descriptions (TDs).

    Identified Threat Categories

    Interface and Binding Threats

    • WoT Protocol Bindings: Malformed requests sent directly to the Protocol Bindings interface that could compromise the binding and allow arbitrary code execution with the binding's privileges.
    • WoT Interface - General Compromise: Malformed requests sent via the WoT interface that could compromise the Thing Instance and allow code execution with the instance's privileges.
    • WoT Interface - Unauthorized API access: Lack of proper authentication allowing unauthorized users on the same network to access sensitive resources (e.g., video streams) or execute actions (e.g., unlocking doors).
    • WoT DoS (Denial of Service): Flooding the Protocol Bindings or WoT interface with requests to exhaust processing bandwidth, potentially disabling communication or alarm systems.

    Communication and Data Threats

    • TD Authenticity: Intercepting and modifying a Thing Description (TD) to change authentication methods or authorities, or performing replay attacks with older, vulnerable TDs.
    • TD Confidentiality: Intercepting TDs to learn privacy-sensitive information about the host (e.g., presence of medical equipment).
    • Solution Data Authenticity: Modifying intercepted WoT interface requests (e.g., changing actuator settings) or replaying legitimate requests (e.g., replaying an 'unlock door' command).
    • Solution Data Confidentiality: Intercepting WoT interface exchanges to learn sensitive data (e.g., medical tracking data, user preferences, or camera streams).

    Privacy Threats

    • WoT TD Privacy: Monitoring publicly broadcasted TDs to build profiles of a user's installed devices and their purposes.

    Security Non-Objectives

    • Non-WoT End Points: The security of non-WoT endpoints and their external interfaces is outside the scope of WoT. Providers are recommended to follow industry best practices for these components.

  11. Expressing data types in a Thing Description

    main

    Thing Descriptions allow for the definition of types for input and output values (e.g., using valueType). The type system is designed to support both simple types and composed (complex) types.

    Key goals for the type system include:

    • Expressing how a JSON payload must look.
    • Enabling semantic annotation of type definitions.
    • Allowing mappings to formats other than JSON (e.g., XML).

    While original ideas involved basing simple types on XML Schema datatypes (like xsd:integer) and complex types on Schema.org, the current recommendation leans towards using JSON Schema for both simple and composed types due to its robust tool support and ability to define constraints and user-defined structures.

  12. Understand the core Web of Things (WoT) specifications

    main

    The Web of Things (WoT) provides a standardized way to integrate diverse IoT devices and services using web technologies. The core architecture relies on the following key specifications to harmonize access to heterogeneous IoT ecosystems:

    • WoT Architecture 1.1: Defines the high-level architectural framework.
    • WoT Thing Description 1.1: Provides a standardized format for descriptive information about a 'Thing', allowing for easy integration regardless of the underlying communication protocols.
    • WoT Discovery: Enables easy access to Thing Descriptions while managing privacy. It supports both local-area network (LAN) and internet-scale discovery, and can be used for both self-describing and externally described devices.
    • WoT Binding Templates (Note): Defines how to map Thing Descriptions to specific communication protocols.
    • WoT Scripting API (Note): Provides a way to interact with Things via scripts.