Rocket CWMP

Remote governance and configuration for internet equipment

• The project's own website: https://www.sartura.hr/blog/sartura-collaborates-with-vodafone-and-further-extends-rocket-cwmp/

Why does this actually matter to end users?

Somewhere in your house, office or library, there is a modest little box that connects you to the internet. Every connection a laptop, tablet or phone makes using your wifi goes through that box. The box is directly connected to the internet via your internet provider. If someone is able to control it, they can see all your traffic. And even worse - in subtle way manipulate it without you seeing it. When was the last time you think that box was updated? Do you know this for a fact? Who is even responsible for doing that? Do you suppose it is maintained remotely by someone? How do they do that? And can you trust that everything happens securely and is implemented flawlessly?

As a user, you may be rightly concerned about keeping the devices in your house secure and up to date. The fact that this box is typically hidden away in the proverbial broom closet, doesn't make it less of a critical point of failure for your day-to-day security. But at the same time, handling 24/7 internet threats is a heavy responsibility for normal consumers to bear - even technically inclined ones. You really want to be able to let professionals service and maintain your device. Your internet service provider (that typically provides you with such a box these days) will very much agree, because when devices in your household are captured by a botnet due to bad maintenance it causes a lot of work and headache on their part.

As a scoiety we really want such core technology components to use up-to-date code you can trust. Device manufacturers do not always act as responsible as they should, nor do they all have the same level of security skills and quality assurance and aftersales support. So as the device that keeps you connected to the internet ages, it becomes less and less secure over time. And in some cases, the manufacturer may have an unhealthy interest in your data - or is tempted in some other way by business models or political motivations that you may not agree on.

Luckily, one can in most cases replace the so called firmware that makes the device do everything it can do. Devices mostly reuse standard components, so you can download a community vetted open source solution on it instead. But if you install something different from what the supplier put on, that actually impacts the ability to remotely maintain. There are international standards for this, but the firmware needs to implement these for standard updates to work. So far this was not something that the community had created, and so it was hard to deploy at scale.

Rocket is a very welcome open source project led by a small Croatian company that offers the solution to exactly this problem. It is targeted to implement all the relevant industry standards service providers need to support users. This will allow them to switch their customers over from aged and closed vendor firmware, to something they and others can study and add new functionality to - and still perform the maintenance remotely as customers expect. Such updatability is extremely important both for security as well as for the Next Generation Internet initiative. The devices involved tend to have a very long life span, sometimes well over a decade. If old devices cannot be taught new tricks, such as adding new and more secure internet standards, progress is significantly slowed down. And of course technically inadequate devices currently operating in our homes and offices will continue to age, and make today's internet less safe for all.