Light                        Network
Light-1   Light-2    Light-3     Switch    Rtr-1      Rtr-2  Backbone
 |          |          |          |          |          |          |
 |          |          |          |          |          |          |
 |          |          |          |          |          |          |
 | MLD Report: Join    |          |          |          |          |
 | Group (Room-A-Lights)          |          |          |          |
 |---LL------------------------------------->|          |          |
 |          |          |          |          |MLD Report: Join     |
 |          |          |          |          |Group (Room-A-Lights)|
 |          |          |          |          |---LL---->----LL---->|
 |          |          |          |          |          |          |
 |          | MLD Report: Join    |          |          |          |
 |          | Group (Room-A-Lights)          |          |          |
 |          |---LL------------------------------------->|          |
 |          |          |          |          |          |          |
 |          |          | MLD Report: Join    |          |          |
 |          |          | Group (Room-A-Lights)          |          |
 |          |          |---LL-------------------------->|          |
 |          |          |          |          |          |          |
 |          |          |          |          |MLD Report: Join     |
 |          |          |          |          |Group (Room-A-Lights)|
 |          |          |          |          |<--LL-----+---LL---->|
 |          |          |          |          |          |          |
 |          |          |          |          |          |          |
          
        

Figure 6: Joining Lighting Groups Using MLD

3.6. Commissioning the Network Based On Resource Directory

This section outlines how devices in the lighting use case (both Switches and Lights) can be commissioned, making use of Resource Directory [I-D.ietf-core-resource-directory] and its group configuration feature.

Once the Resource Directory (RD) is discovered, the Switches and Lights need to be discovered and their groups need to be defined. For the commissioning of these devices, a commissioning tool can be used that defines the entries in the RD. The commissioning tool has the authority to change the contents of the RD and the Light/Switch nodes. DTLS-based unicast security is used by the commissioning tool to modify operational data in RD, Switches and Lights.

In our particular use case, a group of three lights is defined with one IP multicast address and hostname:

• "Room-A-Lights.floor1.west.bldg6.example.com"

The commissioning tool has a list of the three lights and the associated IP multicast address. For each light in the list the tool learns the IP address of the light and instructs the RD with three (unicast) POST commands to store the endpoints associated with the three lights as prescribed by the RD specification [I-D.ietf-core-resource-directory]. Finally the commissioning tool defines the group in the RD to contain these three endpoints. Also the commissioning tool writes the IP multicast address in the Light endpoints with, for example, the (unicast) POST command discussed in Section 2.6.2.2.

The light switch can discover the group in RD and thus learn the IP multicast address of the group. The light switch will use this address to send CoAP group communication requests to the members of the group. When the message arrives the Lights should recognize the IP multicast address and accept the message.

4. Deployment Guidelines

This section provides guidelines how IP multicast based CoAP group communication can be deployed in various network configurations.

4.1. Target Network Topologies

CoAP group communication can be deployed in various network topologies. First, the target network may be a traditional IP network, or a LLN such as a 6LoWPAN network, or consist of mixed traditional/constrained network segments. Second, it may be a single subnet only or multi-subnet; e.g., multiple 6LoWPAN networks joined by a single backbone LAN. Third, a wireless network segment may have all its nodes reachable in a single IP hop (fully connected), or it may require multiple IP hops for some pairs of nodes to reach each other.

Each topology may pose different requirements on the configuration of routers and protocol(s), in order to enable efficient CoAP group communication. To enable all the above target network topologies, an implementation of CoAP group communication needs to allow:

1. Routing/forwarding of IP multicast packets over multiple hops
2. Routing/forwarding of IP multicast packets over subnet boundaries between traditional and constrained (e.g., LLN) networks.

The remainder of this section discusses solutions to enable both features.

4.2. Networks Using the MLD Protocol

CoAP nodes that are IP hosts (i.e., not IP routers) are generally unaware of the specific IP multicast routing/forwarding protocol being used. When such a host needs to join a specific (CoAP) multicast group, it requires a way to signal to IP multicast routers which IP multicast traffic it wants to receive.

The Multicast Listener Discovery (MLD) protocol [RFC3810] (see Appendix A) is the standard IPv6 method to achieve this; therefore this approach should be used on traditional IP networks. CoAP server nodes would then act in the role of MLD Multicast Address Listener.

The guidelines from [RFC6636] on tuning of MLD for mobile and wireless networks may be useful when implementing MLD in LLNs. However, on LLNs and 6LoWPAN networks the use of MLD may not be feasible at all due to constraints on code size, memory, or network capacity.

4.3. Networks Using RPL Multicast Without MLD

It is assumed in this section that the MLD protocol is not implemented in a network, for example, due to resource constraints. The RPL routing protocol (see Section 12 of [RFC6550]) defines the advertisement of IP multicast destinations using Destination Advertisement Object (DAO) messages and routing of multicast IPv6 packets based on this. It requires the RPL Mode of Operation to be 3 (Storing Mode with multicast support).

Hence, RPL DAO can be used by CoAP nodes that are RPL Routers, or are RPL Leaf Nodes, to advertise IP multicast group membership to parent routers. Then, the RPL protocol is used to route IP multicast CoAP requests over multiple hops to the correct CoAP servers.

The same DAO mechanism can be used to convey IP multicast group membership information to an edge router (e.g., 6LBR), in case the edge router is also the root of the RPL DODAG. This is useful because the edge router then learns which IP multicast traffic it needs to pass through from the backbone network into the LLN subnet. In 6LoWPAN networks, such selective "filtering" helps to avoid congestion of a 6LoWPAN subnet by IP multicast traffic from the traditional backbone IP network.

4.4. Networks Using MPL Forwarding Without MLD

The MPL forwarding protocol [I-D.ietf-roll-trickle-mcast] can be used for propagation of IPv6 multicast packets to all MPL Forwarders within a predefined network domain, over multiple hops. MPL is designed to work in LLNs. In this section it is again assumed that Multicast Listener Discovery (MLD) is not implemented in the network, for example, due to resource limitations in an LLN.

The purpose of MPL is to let a predefined group of Forwarders collectively work towards the goal of distributing an IPv6 multicast packet throughout an MPL Domain. (A Forwarder node may be associated to multiple MPL Domains at the same time.) So it would appear there is no need for CoAP servers to advertise their multicast group membership, since any IP multicast packet that enters the MPL Domain is distributed to all MPL Forwarders without regard to what multicast addresses the individual nodes are listening to.

However, if an IP multicast request originates just outside the MPL Domain, the request will not be propagated by MPL. An example of such a case is the network topology of Figure 1 where the Subnets are 6LoWPAN subnets and per 6LoWPAN subnet one Realm-Local ([I-D.droms-6man-multicast-scopes]) MPL Domain is defined. The backbone network in this case is not part of any MPL Domain.

This situation can become a problem in building control use cases. For example, when the Controller Client needs to send a single IP multicast request to the group Room-A-Lights. By default, the request would be blocked by Rtr-1 and by Rtr-2, and not enter the Realm-Local MPL Domains associated to Subnet-1 and Subnet-2. The reason is that Rtr-1 and Rtr-2 do not have the knowledge that devices in Subnet-1/2 want to listen for IP packets destined to IP multicast group Room-A-Lights.

To solve the above issue, the following solutions could be applied:

1. Extend the MPL Domain. E.g. in above example, include the Network Backbone to be part of each of the two MPL Domains. Or in above example, create just a single MPL Domain that includes both 6LoWPAN subnets plus the backbone link, which is possible since MPL is not tied to a single link-layer technology.
2. Manual configuration of edge router(s) as MPL Seed(s) for specific IP multicast traffic. In the above example, this could be done through the following three steps: First, configure Rtr-1 and Rtr-2 to act as MLD Address Listeners for the Room-A-Lights IP multicast group. This step allows any (other) routers on the backbone to learn that at least one node on the backbone link is interested to receive any IP multicast traffic to Room-A-Lights. Second, configure both routers to "inject" any IP multicast packets destined to group Room-A-Lights into the (Realm-Local) MPL Domain that is associated to that router. Third, configure both routers to propagate any IPv6 multicast packets originating from within their associated MPL Domain to the backbone, if at least one node on the backbone has indicated interest to receive such IPv6 packets (for which MLD is used on the backbone).
3. Use an additional protocol/mechanism for injection of IP multicast traffic from outside an MPL Domain into that MPL Domain, based on IP multicast group subscriptions of Forwarders within the MPL Domain. Such protocol is currently not defined in [I-D.ietf-roll-trickle-mcast].

Concluding, MPL can be used directly in case all sources of IP multicast CoAP requests (CoAP clients) and also all the destinations (CoAP servers) are inside a single MPL Domain. Then, each source node acts as an MPL Seed. In all other cases, MPL can only be used with additional protocols and/or configuration on how IP multicast packets can be injected from outside into an MPL Domain.

4.5. 6LoWPAN Specific Guidelines for the 6LBR

To support multi-subnet scenarios for CoAP group communication, it is recommended that a 6LoWPAN Border Router (6LBR) will act in an MLD Router role on the backbone link. If this is not possible then the 6LBR should be configured to act as an MLD Multicast Address Listener (see Appendix A) on the backbone link.

5. Security Considerations

This section describes the relevant security configuration for CoAP group communication using IP multicast. The threats to CoAP group communication are also identified and various approaches to mitigate these threats are summarized.

5.1. Security Configuration

As defined in Sections 8.1 and 9.1 of [RFC7252], CoAP group communication based on IP multicast:

• Will operate in CoAP NoSec (No Security) mode, until a future group security solution is developed (see also Section 5.3.3).
• Will use the "coap" scheme. The "coaps" scheme should only be used when a future group security solution is developed (see also Section 5.3.3).

Essentially the above configuration means that there is currently no security at the CoAP layer for group communication. Therefore, for sensitive and mission critical applications (e.g., health monitoring systems, alarm monitoring systems) it is currently recommended to deploy CoAP group communication with an application-layer security mechanism (e.g, data object security) for improved security.

Application level security has many desirable properties including maintaining security properties while forwarding traffic through intermediaries (proxies). Application level security also tends to more cleanly separate security from the dynamics of group membership (e.g., the problem of distributing security keys across large groups with many members that come and go).

Without application-layer security, CoAP group communication should only be currently deployed in non-critical applications (e.g., read-only temperature sensors). Only when security solutions at the CoAP layer are mature enough (see Section 5.3.3) should CoAP group communication without application-layer security be considered for sensitive and mission-critical applications.

5.2. Threats

As noted above, there is currently no security at the CoAP layer for group communication. This is due to the fact that the current DTLS-based approach for CoAP is exclusively unicast oriented and does not support group security features such as group key exchange and group authentication. As a direct consequence of this, CoAP group communication is vulnerable to all attacks mentioned in Section 11 of [RFC7252] for IP multicast.

5.3. Threat Mitigation

Section 11 of [RFC7252] identifies various threat mitigation techniques for CoAP group communication. In addition to those guidelines, it is recommended that for sensitive data or safety-critical control, a combination of appropriate link-layer security and administrative control of IP multicast boundaries should be used. Some examples are given below.

5.3.1. WiFi Scenario

In a home automation scenario (using WiFi), the WiFi encryption should be enabled to prevent rogue nodes from joining. The Customer Premise Equipment (CPE) that enables access to the Internet should also have its IP multicast filters set so that it enforces multicast scope boundaries to isolate local multicast groups from the rest of the Internet (e.g., as per [RFC6092]). In addition, the scope of the IP multicast should be set to be site-local or smaller scope. For site-local scope, the CPE will be an appropriate multicast scope boundary point.

5.3.2. 6LoWPAN Scenario

In a building automation scenario, a particular room may have a single 6LoWPAN network with a single Edge Router (6LBR). Nodes on the subnet can use link-layer encryption to prevent rogue nodes from joining. The 6LBR can be configured so that it blocks any incoming (6LoWPAN-bound) IP multicast traffic. Another example topology could be a multi-subnet 6LoWPAN in a large conference room. In this case, the backbone can implement port authentication (IEEE 802.1X) to ensure only authorized devices can join the Ethernet backbone. The access router to this secured network segment can also be configured to block incoming IP multicast traffic.

5.3.3. Future Evolution

In the future, to further mitigate the threats, security enhancements need to be developed at IETF for group communications. This will allow introduction of a secure mode of CoAP group communication, and use of the "coaps" scheme for that purpose.

At the time of writing of this specification, there are various approaches being considered for security enhancements for group communications. Specifically, a lot of the current effort at IETF is geared towards developing a DTLS-based group communication. This is primarily motivated by the fact that the unicast CoAP security is DTLS-based (Section 9.1 of [RFC7252]. For example, [I-D.keoh-dice-multicast-security] proposes a DTLS-based IP multicast security. However, it is too early to conclude if this is the best approach. Alternatively, [I-D.mglt-dice-ipsec-for-application-payload] proposes an IPSec-based IP multicast security. This approach also needs further investigation and validation.

5.4. Monitoring Considerations

5.4.1. General Monitoring

CoAP group communication is meant to be used to control a set of related devices (e.g., simultaneously turn on all the lights in a room). This intrinsically exposes the group to some unique monitoring risks that solitary devices (i.e., devices not in a group) are not as vulnerable to. For example, assume an attacker is able to physically see a set of lights turn on in a room. Then the attacker can correlate a CoAP group communication message to that easily observable coordinated group action even if the contents of the message are encrypted by a future security solution (see Section 5.3.3). This will give the attacker side channel information to plan further attacks (e.g. by determining the members of the group then some network topology information may be deduced).

One mitigation to group communication monitoring risks that should be explored in the future is methods to de-correlate coordinated group actions. For example, if a CoAP group communication GET is sent to all the alarm sensors in a house, then their (unicast) responses should be as de-correlated as possible. This will introduce greater entropy into the system and will make it harder for an attacker to monitor and gather side channel information.

5.4.2. Pervasive Monitoring

A key additional threat consideration for group communication is pointed to by [RFC7258] which warns of the dangers of pervasive monitoring. CoAP group communication solutions which are built on top of IP multicast need to pay particular heed to these dangers. This is because IP multicast is easier to intercept (e.g., and to secretly record) compared to unicast traffic. Also, CoAP traffic is meant for the Internet of Things. This means that CoAP traffic (once future security solutions are developed as in Section 5.3.3) may be used for the control and monitoring of critical infrastructure (e.g., lights, alarms, etc.) which may be prime targets for attack.

For example, an attacker may attempt to record all the CoAP traffic going over the smart grid (i.e., networked electrical utility) of a country and try to determine critical nodes for further attacks. For example, the source node (controller) sending out the CoAP group communication messages. CoAP multicast traffic is inherently more vulnerable (compared to a unicast packet) as the same packet may be replicated over many links so there is a much higher probability of it getting captured by a pervasive monitoring system.

One useful mitigation to pervasive monitoring is to restrict the scope of the IP multicast to the minimal scope that fulfills the application need. Thus, for example, site-local IP multicast scope is always preferred over global scope IP multicast if this fulfills the application needs. This approach has the added advantage that it coincides with the guidelines for minimizing congestion control (see Section 2.8.

In the future, even if all the CoAP multicast traffic is encrypted, an attacker may still attempt to capture the traffic and perform an off-line attack. Though of course having the multicast traffic protected is always desirable as it significantly raises the cost to an attacker (e.g., to break the encryption) versus unprotected multicast traffic.

6. IANA Considerations

6.1. New 'core.gp' Resource Type

This memo registers a new resource type (rt) from the CoRE Parameters Registry called 'core.gp'.

(Note to IANA/RFC Editor: This registration follows the process described in section 7.4 of [RFC6690]).

Attribute Value: core.gp

Description: Group Configuration resource. This resource is used to query/manage the group membership of a CoAP server.

Reference: See Section 2.6.2.

6.2. New 'coap-group+json' Internet Media Type

This memo registers a new Internet Media Type for CoAP group configuration resource called 'application/coap-group+json'.

(Note to IANA/RFC Editor: This registration follows the guidance from [RFC6838], and (last paragraph) of Section 12.3 of [RFC7252].

Type name: application

Subtype name: coap-group+json

Required parameters: None

Optional parameters: None

Encoding considerations: 8bit UTF-8.

JSON to be represented using UTF-8 which is 8bit compatible (and most efficient for resource constrained implementations).

Security considerations:

Denial of Service attacks could be performed by constantly (re-)setting the group configuration resource of a CoAP endpoint to different values. This will cause the endpoint to register (or de-register) from the related IP multicast group. To prevent this it is recommended that a form of authorization (making use of unicast DTLS-secured CoAP) be used such that only authorized controllers are allowed by an endpoint to configure its group membership.

Interoperability considerations: None

Published specification: (This I-D when it becomes an RFC)

Applications that use this media type:

CoAP client and server implementations that wish to set/read the group configuration resource via 'application/coap-group+json' payload as described in Section 2.6.2.

Fragment identifier considerations: N/A

Additional Information:

Deprecated alias names for this type: None

Magic number(s): None

File extension(s): *.json

Macintosh file type code(s): TEXT

Person and email address to contact for further information: Esko Dijk ("Esko.Dijk@Philips.com")

Intended usage: COMMON

Restrictions on usage: None

Author: CoRE WG

Change controller: IETF

Provisional registration? (standards tree only): N/A

7. Acknowledgements

Thanks to Jari Arkko, Peter Bigot, Anders Brandt, Ben Campbell, Angelo Castellani, Alissa Cooper, Spencer Dawkins, Adrian Farrel, Stephen Farrell, Thomas Fossati, Brian Haberman, Bjoern Hoehrmann, Matthias Kovatsch, Guang Lu, Salvatore Loreto, Kerry Lynn, Andrew McGregor, Kathleen Moriarty, Pete Resnick, Dale Seed, Martin Stiemerling, Zach Shelby, Peter van der Stok, Gengyu Wei, and Juan Carlos Zuniga for their helpful comments and discussions that have helped shape this document.

Special thanks to Carsten Bormann and Barry Leiba for their extensive and thoughtful Chair and AD reviews of the document. Their reviews helped to immeasurably improve the document quality.

8. References

8.1. Normative References

[RFC2119]	Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3376]	Cain, B., Deering, S., Kouvelas, I., Fenner, B. and A. Thyagarajan, "Internet Group Management Protocol, Version 3", RFC 3376, October 2002.
[RFC3433]	Bierman, A., Romascanu, D. and K. Norseth, "Entity Sensor Management Information Base", RFC 3433, December 2002.
[RFC3542]	Stevens, W., Thomas, M., Nordmark, E. and T. Jinmei, "Advanced Sockets Application Program Interface (API) for IPv6", RFC 3542, May 2003.
[RFC3810]	Vida, R. and L. Costa, "Multicast Listener Discovery Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
[RFC3986]	Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005.
[RFC4291]	Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, February 2006.
[RFC4601]	Fenner, B., Handley, M., Holbrook, H. and I. Kouvelas, "Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)", RFC 4601, August 2006.
[RFC4919]	Kushalnagar, N., Montenegro, G. and C. Schumacher, "IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs): Overview, Assumptions, Problem Statement, and Goals", RFC 4919, August 2007.
[RFC4944]	Montenegro, G., Kushalnagar, N., Hui, J. and D. Culler, "Transmission of IPv6 Packets over IEEE 802.15.4 Networks", RFC 4944, September 2007.
[RFC5110]	Savola, P., "Overview of the Internet Multicast Routing Architecture", RFC 5110, January 2008.
[RFC5771]	Cotton, M., Vegoda, L. and D. Meyer, "IANA Guidelines for IPv4 Multicast Address Assignments", BCP 51, RFC 5771, March 2010.
[RFC5952]	Kawamura, S. and M. Kawashima, "A Recommendation for IPv6 Address Text Representation", RFC 5952, August 2010.
[RFC6092]	Woodyatt, J., "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service", RFC 6092, January 2011.
[RFC6550]	Winter, T., Thubert, P., Brandt, A., Hui, J., Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur, JP. and R. Alexander, "RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks", RFC 6550, March 2012.
[RFC6636]	Asaeda, H., Liu, H. and Q. Wu, "Tuning the Behavior of the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) for Routers in Mobile and Wireless Networks", RFC 6636, May 2012.
[RFC6690]	Shelby, Z., "Constrained RESTful Environments (CoRE) Link Format", RFC 6690, August 2012.
[RFC6775]	Shelby, Z., Chakrabarti, S., Nordmark, E. and C. Bormann, "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)", RFC 6775, November 2012.
[RFC6838]	Freed, N., Klensin, J. and T. Hansen, "Media Type Specifications and Registration Procedures", BCP 13, RFC 6838, January 2013.
[RFC7159]	Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 7159, March 2014.
[RFC7230]	Fielding, R. and J. Reschke, "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", RFC 7230, June 2014.
[RFC7252]	Shelby, Z., Hartke, K. and C. Bormann, "The Constrained Application Protocol (CoAP)", RFC 7252, June 2014.
[RFC7258]	Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an Attack", BCP 188, RFC 7258, May 2014.
[RFC7320]	Nottingham, M., "URI Design and Ownership", BCP 190, RFC 7320, July 2014.

8.2. Informative References

[RFC1033]	Lottor, M., "Domain administrators operations guide", RFC 1033, November 1987.
[RFC4605]	Fenner, B., He, H., Haberman, B. and H. Sandick, "Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD)-Based Multicast Forwarding ("IGMP/MLD Proxying")", RFC 4605, August 2006.
[RFC5740]	Adamson, B., Bormann, C., Handley, M. and J. Macker, "NACK-Oriented Reliable Multicast (NORM) Transport Protocol", RFC 5740, November 2009.
[I-D.ietf-core-block]	Bormann, C. and Z. Shelby, "Blockwise transfers in CoAP", Internet-Draft draft-ietf-core-block-11, March 2013.
[I-D.ietf-core-resource-directory]	Shelby, Z., Krco, S. and C. Bormann, "CoRE Resource Directory", Internet-Draft draft-ietf-core-resource-directory-00, June 2013.
[I-D.ietf-core-observe]	Hartke, K., "Observing Resources in CoAP", Internet-Draft draft-ietf-core-observe-08, February 2013.
[I-D.ietf-roll-trickle-mcast]	Hui, J. and R. Kelsey, "Multicast Protocol for Low power and Lossy Networks (MPL)", Internet-Draft draft-ietf-roll-trickle-mcast-04, February 2013.
[I-D.keoh-dice-multicast-security]	Keoh, S., Kumar, S., Garcia-Morchon, O., Dijk, E. and A. Rahman, "DTLS-based Multicast Security for Low-Power and Lossy Networks (LLNs)", Internet-Draft draft-keoh-dice-multicast-security-04, February 2014.
[I-D.droms-6man-multicast-scopes]	Droms, R., "IPv6 Multicast Address Scopes", Internet-Draft draft-droms-6man-multicast-scopes-02, July 2013.
[I-D.mglt-dice-ipsec-for-application-payload]	Migault, D. and C. Bormann, "IPsec/ESP for Application Payload", Internet-Draft draft-mglt-dice-ipsec-for-application-payload-00, July 2014.

Appendix A. Multicast Listener Discovery (MLD)

In order to extend the scope of IP multicast beyond link-local scope, an IP multicast routing or forwarding protocol has to be active in routers on an LLN. To achieve efficient IP multicast routing (i.e., avoid always flooding IP multicast packets), routers have to learn which hosts need to receive packets addressed to specific IP multicast destinations.

The Multicast Listener Discovery (MLD) protocol [RFC3810] (or its IPv4 equivalent IGMP [RFC3376]) is today the method of choice used by an (IP multicast enabled) router to discover the presence of IP multicast listeners on directly attached links, and to discover which IP multicast addresses are of interest to those listening nodes. MLD was specifically designed to cope with fairly dynamic situations in which IP multicast listeners may join and leave at any time.

[RFC6636] discusses optimal tuning of the parameters of MLD/IGMP for routers for mobile and wireless networks. These guidelines may be useful when implementing MLD in LLNs.

Appendix B. Change Log

[Note to RFC Editor: Please remove this section before publication.]

Changes from ietf-23 to ietf-24:

• Clarified in section 2.6.1.2 (Configuring Members) that ABNF rules from Section 3.2.2 of [RFC 3986] should be used for the IP address parsing.
• Minor editorial updates.

Changes from ietf-22 to ietf-23:

• Updated requirements language (RFC 2119) to follow Barry Leiba's suggestions #1, #2b, and #2.1 as per "http://www.ietf.org/mail-archive/web/core/current/msg05593.html".
• Clarified that [RFC 7320] implies that also other specifications cannot pre-define URI structure.
• Added MUST to Token re-use time as it is additional specification to CoAP [RFC 7252].
• Clarified use of multicast POSTing in Section 2.4, in response to Jari Arkko's COMMENTs in "http://www.ietf.org/mail-archive/web/core/current/msg05572.html".
• Added to Section 5.1 (Security Configuration) the possibility to use application-layer (data object) security, which enables to use CoAP group communication also for critical applications, pointed out by Jari Arkko's COMMENTs in "http://www.ietf.org/mail-archive/web/core/current/msg05572.html".
• Fixed subtle error in hex string "c00l" to "c001".
• Clarified in Section 2.11 (Exceptions) that CoAP Observe feature does not support group communication as per Jari's Arkko's comment in "http://www.ietf.org/mail-archive/web/core/current/msg05592.html".
• Moved section 2.6 (Member Discovery) into a new subsection as part of 2.7.1 (Membership Configuration – Background).
• Minor editorial updates.

Changes from ietf-21 to ietf-22:

• Updated with comments from IESG review as follows:
  1. Changed Status from Informational to Experimental.
  2. Addressed Brian Haberman's DISCUSS (to put in reference to ASM) in section 1.2 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05547.html".
  3. Addressed Brian Haberman's DISCUSS (to put in reference to multicast forwarding proxies) in section 2.1 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05547.html".
  4. Addressed Brian Haberman's DISCUSS (to put in reference to getting port numbers from URIs) in section 2.3 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05563.html".
  5. Addressed Brian Haberman's DISCUSS (to put in reference to IGMP/MLD API) in section 2.7.2.1, 2.7.2.2, 2.7.2.6 and 2.7.2.7 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05547.html".
  6. Addressed Brian Haberman's COMMENT (to put in reference to reliable multicast RFC) in section 1.3 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05545.html".
  7. Addressed Kathleen Moriarty's DISCUSS (to broaden to cover general monitoring) in section 5.4 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05566.html".
  8. Addressed Martin Stiemerling's DISCUSS (to clearly indicate that the draft introduces new CoAP protocol functionality) in the Abstract and section 1.2 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05542.html".
  9. Addressed Martin Stiemerling's DISCUSS (to clarify selected requirements language) in section 2.7.2 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05542.html". (Note that the other sections are not impacted as they truly are new requirements and not repetition of the CoAP RFC 7252)
  10. Addressed Spencer Dawkins' COMMENT as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05557.html".
  11. Addressed Alissa Cooper's COMMENT as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05567.html".
  12. Addressed selected Stephen Farrell's COMMENTs as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05576.html".
  13. Addressed selected Pete Resnick's COMMENTs as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05568.html".
  14. Addressed selected Adrian Farrel's COMMENTs as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05565.html".
  15. Addressed selected Jari Arkko's COMMENTs as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05572.html".

• Updated with comments from GEN-ART review as follows:
  1. Addressed major issue #1 from Ben Campbell's GEN-ART review (about introducing new functionality beyond CoAP RFC 7252) by changing the status of document to Experimental, and updating Abstract and section 2.1 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05551.html".
  2. Addressed major issue #2 from Ben Campbell's GEN-ART review (about giving a stronger recommendation not to use CoAP group communication in many scenarios until stronger security solutions are available) in section 5.1 and section 5.4 as called out in "http://www.ietf.org/mail-archive/web/core/current/msg05551.html".
  3. Addressed selected minor issues and nits from Ben Campbell's GEN-ART review comments from "http://www.ietf.org/mail-archive/web/core/current/msg05535.html".

• Various minor editorial updates.

Changes from ietf-20 to ietf-21:

• Updated with comments from AD review by Barry Leiba. The details of the updates can be seen by looking at the WG mailing list from July 26-31, 2014.
• Various minor editorial updates.

Changes from ietf-19 to ietf-20:

• Replaced obsolete reference [RFC 2616] by [RFC 7230].
• Replaced outdated reference draft-ietf-appsawg-uri-get-off-my-lawn by [RFC 7320] and moved to Normative reference.
• Replaced outdated reference draft-ietf-core-coap by [RFC 7252].
• Moved [RFC 1033] to Informative reference.
• Updated to latest revision numbers for informative draft references by regenerating file through xml2rfc tool.
• Re-ran IETF spell check tool and corrected some minor spelling errors.
• Various minor editorial updates.

Changes from ietf-18 to ietf-19:

• Added guideline on Token value re-use in section 2.5.
• Updated section 5.1 (Security Configuration) and 5.3.3 (Future Security Evolution) to point to latest security developments happening in DICE WG for support of group security.
• Added Pervasive Monitoring considerations in section 5.4.
• Various editorial updates for improved readability.

Changes from ietf-17 to ietf-18:

• Extensive editorial updates based on WGLC comments by Thomas Fossati and Gengyu Wei.
• Addressed ticket #361: Added text for single membership PUT section 2.7.2.7 (Updating a single group membership (PUT)).
• Addressed ticket #360: Added text for server duties upon all-at-once PUT section 2.7.2.6 (Creating/updating all group memberships at once (PUT)).
• Addressed ticket #359: Fixed requirements text for Section 2.7.2.2 (Creating a new multicast group membership (POST)).
• Addressed ticket #358: Fixed requirements text for Section 2.7.2.1 (CoAP-Group Resource Type and Media Type).
• Addressed ticket #357: Added that "IPv6 addresses of other scopes MAY be enabled" in section 2.2 (Group Definition and Naming).
• Various editorial updates for improved readability.

Changes from ietf-16 to ietf-17:

• Added guidelines on joining of IPv6/IPv4 "All CoAP Nodes" multicast addresses (#356).
• Added MUST support default port in case multicast discovery is available.
• In section 2.1 (IP Multicast Background), clarified that IP multicast is not guaranteed and referenced a definition of Reliable Group Communication (#355).
• Added section 2.5 (Messages and Responses) to clarify how responses are identified and how Token/MID are used in multicast CoAP.
• In section 2.6.2 (RESTful Interface for Configuring Group Memberships), clarified that group management interface is an optional approach for dynamic commissioning and that other approaches can also be used if desired.
• Updated section 2.6.2 (RESTful Interface for Configuring Group Memberships) to allow deletion of individual group memberships (#354).
• Various editorial updates based on comments by Peter van der Stok. Removed reference to expired draft-vanderstok-core-dna at request of its author.
• Various editorial updates for improved readability.

Changes from ietf-15 to ietf-16:

• In section 2.6.2, changed DELETE in group management interface to a PUT with empty JSON array to clear the list (#345).
• In section 2.6.2, aligned the syntax for IP addresses to follow RFC 3986 URI syntax, which is also used by coap-18. This allows re-use of the parsing code for CoAP URIs for this purpose (#342).
• Addressed some more editorial comments provided by Carsten Bormann in preparation for WGLC.
• Various editorial updates for improved readability.

Changes from ietf-14 to ietf-15:

• In section 2.2, provided guidance on how implementers should parse URIs for group communication (#339).
• In section 2.6.2.1, specified that for group membership configuration interface the "ip" (i.e., "a" parameter) key/value is not required when it is unknown (#338).
• In section 2.6.2.1, specified that for group membership configuration interface the port configuration be defaulted to standard CoAP port 5683, and if not default then should follow standard notation (#340).
• In section 2.6.2.1, specified that notation of IP address in group membership configuration interface should follow standard notation (#342).
• In section 6.2, "coap-group+json" Media Type encoding simplified to just support UTF-8 (and not UTF-16 and UTF-32) (#344).
• Various editorial updates for improved readability.

Changes from ietf-13 to ietf-14:

• Update to address final editorial comments from the Chair's review (by Carsten Bormann) of the draft. This included restructuring of Section 2.6 (Configuring Group Memberships) and Section 4 (Deployment Guidelines) to make it easier to read. Also various other editorial changes.
• Changed "ip" field to "a" in Section 2.6 (#337)

Changes from ietf-12 to ietf-13:

• Extensive editorial updates due to comments from the Chair's review (by Carsten Bormann) of the draft. The best way to see the changes will be to do a -Diff with Rev. 12.
• The technical comments from the Chair's review will be addressed in a future revision after tickets are generated and the solutions are agreed to on the WG E-mail list.

Changes from ietf-11 to ietf-12:

• Removed reference to "CoAP Ping" in Section 3.5 (Group Member Discovery) and replaced it with the more efficient support of discovery of groups and group members via the CORE RD as suggested by Zach Shelby.
• Various editorial updates for improved readability.

Changes from ietf-10 to ietf-11:

• Added text to section 3.8 (Congestion Control) to clarify that a "CoAP client sending a multicast CoAP request to /.well-known/core SHOULD support core-block" (#332).
• Various editorial updates for improved readability.

Changes from ietf-09 to ietf-10:

• Various editorial updates including:
• Added a fourth option in section 3.3 on ways to obtain the URI path for a group request.
• Clarified use of content format in GET/PUT requests for Configuring Group Membership in Endpoints (in section 3.6).
• Changed reference "draft-shelby-core-resource-directory" to "draft-ietf-core-resource-directory".
• Clarified (in section 3.7) that ACKs are never used for a multicast request (from #296).
• Clarified (in section 5.2/5.2.3) that MPL does not support group membership advertisement.
• Adding introductory paragraph to Scope (section 2.2).
• Wrote out fully the URIs in table section 3.2.
• Reworded security text in section 7.2 (New Internet Media Type) to make it consistent with section 3.6 (Configuring Group Membership).
• Fixed formatting of hyperlinks in sections 6.3 and 7.2.

Changes from ietf-08 to ietf-09:

• Cleaned up requirements language in general. Also, requirements language are now only used in section 3 (Protocol Considerations) and section 6 (Security Considerations). Requirements language has been removed from other sections to keep them to a minimum (#271).
• Addressed final comment from Peter van der Stok to define what "IP stack" meant (#296). Following the lead of CoAP-17, we know refer instead to "APIs such as IPV6_RECVPKTINFO [RFC 3542]".
• Changed text in section 3.4 (Group Methods) to allow multicast POST under specific conditions and highlighting the risks with using it (#328).
• Various editorial updates for improved readability.

Changes from ietf-07 to ietf-08:

• Updated text in section 3.6 (Configuring Group Membership in Endpoints) to make it more explicit that the Internet Media Type is used in the processing rules (#299).
• Addressed various comments from Peter van der Stok (#296).
• Various editorial updates for improved readability including defining all acronyms.

Changes from ietf-06 to ietf-07:

• Added an IANA request (in section 7.2) for a dedicated content-format (Internet Media type) for the group management JSON format called 'application/coap-group+json' (#299).
• Clarified semantics (in section 3.6) of group management JSON format (#300).
• Added details of IANA request (in section 7.1) for a new CORE Resource Type called 'core.gp'.
• Clarified that DELETE method (in section 3.6) is also a valid group management operation.
• Various editorial updates for improved readability.

Changes from ietf-05 to ietf-06:

• Added a new section on commissioning flow when using discovery services when end devices discover in which multicast group they are allocated (#295).
• Added a new section on CoAP Proxy Operation (section 3.9) that outlines the potential issues and limitations of doing CoAP multicast requests via a CoAP Proxy (#274).
• Added use case of multicasting controller on the backbone (#279).
• Use cases were updated to show only a single CoAP RD (to replace the previous multiple RDs with one in each subnet). This is a more efficient deployment and also avoids RD specific issues such as synchronization of RD information between serves (#280).
• Added text to section 3.6 (Configuring Group Membership in Endpoints) that clarified that any (unicast) operation to change an endpoint's group membership must use DTLS-secured CoAP.
• Clarified relationship of this document to draft-ietf-core-coap in section 2.2 (Scope).
• Removed IPSec related requirement, as IPSec is not part of draft-ietf-core-coap anymore.
• Editorial reordering of subsections in section 3 to have a better flow of topics. Also renamed some of the (sub)sections to better reflect their content. Finally, moved the URI Configuration text to the same section as the Port Configuration section as it was a more natural grouping (now in section 3.3) .
• Editorial rewording of section 3.7 (Multicast Request Acceptance and Response Suppression) to make the logic easier to comprehend (parse).
• Various editorial updates for improved readability.

Changes from ietf-04 to ietf-05:

• Added a new section 3.9 (Exceptions) that highlights that IP multicast (and hence group communication) is not always available (#187).
• Updated text on the use of [RFC2119] language (#271) in Section 1.
• Included guidelines on when (not) to use CoAP responses to multicast requests and when (not) to accept multicast requests (#273).
• Added guideline on use of core-block for minimizing response size (#275).
• Restructured section 6 (Security Considerations) to more fully describe threats and threat mitigation (#277).
• Clearly indicated that DNS resolution and reverse DNS lookup are optional.
• Removed confusing text about a single group having multiple IP addresses. If multiple IP addresses are required then multiple groups (with the same members) should be created.
• Removed repetitive text about the fact that group communication is not guaranteed.
• Merged previous section 5.2 (Multicast Routing) into 3.1 (IP Multicast Routing Background) and added link to section 5.2 (Advertising Membership of Multicast Groups).
• Clarified text in section 3.8 (Congestion Control) regarding precedence of use of IP multicast domains (i.e., first try to use link-local scope, then site-local scope, and only use global IP multicast as a last resort).
• Extended group resource manipulation guidelines with use of pre-configured ports/paths for the multicast group.
• Consolidated all text relating to ports in a new section 3.3 (Port Configuration).
• Clarified that all methods (GET/PUT/POST) for configuring group membership in endpoints should be unicast (and not multicast) in section 3.7 (Configuring Group Membership In Endpoints).
• Various editorial updates for improved readability, including editorial comments by Peter van der Stok to WG list of December 18th, 2012.

Changes from ietf-03 to ietf-04:

• Removed section 2.3 (Potential Solutions for Group Communication) as it is purely background information and moved section to draft-dijk-core-groupcomm-misc (#266).
• Added reference to draft-keoh-tls-multicast-security to section 6 (Security Considerations).
• Removed Appendix B (CoAP-Observe Alternative to Group Communications) as it is as an alternative to IP Multicast that the WG has not adopted and moved section to draft-dijk-core-groupcomm-misc (#267).
• Deleted section 8 (Conclusions) as it is redundant (#268).
• Simplified light switch use case (#269) by splitting into basic operations and additional functions (#269).
• Moved section 3.7 (CoAP Multicast and HTTP Unicast Interworking) to draft-dijk-core-groupcomm-misc (#270).
• Moved section 3.3.1 (DNS-SD) and 3.3.2 (CoRE Resource Directory) to draft-dijk-core-groupcomm-misc as these sections essentially just repeated text from other drafts regarding DNS based features. Clarified remaining text in this draft relating to DNS based features to clearly indicate that these features are optional (#272).
• Focus section 3.5 (Configuring Group Membership) on a single proposed solution.
• Scope of section 5.3 (Use of MLD) widened to multicast destination advertisement methods in general.
• Rewrote section 2.2 (Scope) for improved readability.
• Moved use cases that are not addressed to draft-dijk-core-groupcomm-misc.
• Various editorial updates for improved readability.

Changes from ietf-02 to ietf-03:

• Clarified that a group resource manipulation may return back a mixture of successful and unsuccessful responses (section 3.4 and Figure 6) (#251).
• Clarified that security option for group communication must be NoSec mode (section 6) (#250).
• Added mechanism for group membership configuration (#249).
• Removed IANA request for multicast addresses (section 7) and replaced with a note indicating that the request is being made in draft-ietf-core-coap (#248).
• Made the definition of 'group' more specific to group of CoAP endpoints and included text on UDP port selection (#186).
• Added explanatory text in section 3.4 regarding why not to use group communication for non-idempotent messages (i.e., CoAP POST) (#186).
• Changed link-local RD discovery to site-local in RD discovery use case to make it more realistic.
• Fixed lighting control use case CoAP proxying; now returns individual CoAP responses as in coap-12.
• Replaced link format I-D with RFC6690 reference.
• Various editorial updates for improved readability

Changes from ietf-01 to ietf-02:

• Rewrote congestion control section based on latest CoAP text including Leisure concept (#188)
• Updated the CoAP/HTTP interworking section and example use case with more details and use of MLD for multicast group joining
• Key use cases added (#185)
• References to draft-vanderstok-core-dna and draft-castellani-core-advanced-http-mapping added
• Moved background sections on "MLD" and "CoAP-Observe" to Appendices
• Removed requirements section (and moved it to draft-dijk-core-groupcomm-misc)
• Added details for IANA request for group communication multicast addresses
• Clarified text to distinguish between "link local" and general multicast cases
• Moved lengthy background section 5 to draft-dijk-core-groupcomm-misc and replaced with a summary
• Various editorial updates for improved readability
• Change log added

Changes from ietf-00 to ietf-01:

• Moved CoAP-observe solution section to section 2
• Editorial changes
• Moved security requirements into requirements section
• Changed multicast POST to PUT in example use case
• Added CoAP responses in example use case

Changes from rahman-07 to ietf-00:

• Editorial changes
• Use cases section added
• CoRE Resource Directory section added
• Removed section 3.3.5. IP Multicast Transmission Methods
• Removed section 3.4 Overlay Multicast
• Removed section 3.5 CoAP Application Layer Group Management
• Clarified section 4.3.1.3 RPL Routers with Non-RPL Hosts case
• References added and some normative/informative status changes

Authors' Addresses