Eat-out, put-together or cook Web standards for IoT Security Bhuvana Ramkumar Staff Software Engineer, Application Security Team, Predix, GE Digital 11:18 AM

11:18 AM

Intent Take a look at web security standards Take a look at the IoT land Compare and contrast security concerns across these two worlds Reinvent ? Reengineer ? Recombine ? 11:18 AM

11:18 AM

What to expect from the session ? Gain an overall perspective of security protocols Explore unique security requirements of IoT landscape Focus on Layer 7 protocols with details of Layer 6 and 5 i.e : Application, Presentation and Session layers 11:18 AM

Focus SASL : MQTT : AMQP : Brief overview Security considerations Brokers Workarounds Benefits 11:18 AM

What is SASL ? Authentication mechanism/framework Independent of Application protocols Inbuilt support for integrity (message digest) Inbuilt support for confidentiality (SCRAM, hashing, encryption) Support for proxy authorization Users can assume authentication credentials Can work complementary to TLS 11:18 AM

Benefits of SASL Abstracts away security implementation details Inbuilt support for network encryption No hard requirement for choice of protocols Simple handshake mechanism between parties Support for a range of options during connection establishment Negotiated challenge response based protection. OAUTHBEARER support : SASL profile combined with OAuth token Supported by AMQP Not supported by MQTT 11:18 AM

MQTT : Brief Overview Source : MQTT, A practical protocol for the Internet of Things, Bryan Boyd, IBM 11:18 AM

AMQP : Brief Overview 11:18 AM Source : AMQP and Rabbit MQ, Intro and Messaging patterns, Javier Arias Losada, Telefonica

Authentication , Authorization and Access Control : AMQP Authentication in AMQP : OAuth plugins SASL certificates Authorization in AMQP : vhost level Broker level support, for example, RabbitMQ supports : Per operation (read, write, configure) per resource (queue, exchange) rabbitmqctl set_permissions -p /myvhost tonyg "^tonyg-.*" ".*" ".*” ACL’s cached on per-connection or per-channel basis. Reconnect request needed for effecting operational changes. Operations on resources restricted by ACL’s 11:18 AM

Authentication , Authorization and Access Control : MQTT Authentication in MQTT : Username and Password fields in CONNECT message Client Identifier X.509 certificate Authorization in MQTT : Broker level support, for example, HiveMQ supports : Topic permissions Allowed topic Allowed operation Allowed QOS tunability OpenSource Plugin support : OnAuth Callback 11:18 AM

BasicAuth (MQTT) vs OAuth (AMQP) Username and password, standard HTTP headers, Base64 encoding No encryption, no hashing Single point of failure if server gets compromised, replay attacks No cached session or cookies, no token management Password or key rotation helps Scheduling, configuring and management of key rotation Rotation over a deployment of 1K-1M devices 11:18 AM

BasicAuth vs OAuth : Continued Private key never leaves the host No single point of failure Attack surface is significantly minimized Access token as bearer in Auth header Token management with TTL, grant types Configurable scopes 11:18 AM

Connected Cars & OAuth Dynamic scope configuration Run time access control Privilege management 11:18 AM Source : UIEvolution & Wikipedia

OAuth : Limitations OAuth is a big step in IoT Lack of anonymity : single sign-on across devices Limited spread of OAuth client support Grant bearer token : abstract concept Web, enterprise and IoT worlds. OAuth itself is not sufficient (for fine grained ACL’s ?) OAuth + ACS ? https://github.com/predix/acs 11:18 AM

MQTT vs AMQP MQTT is still very popular Low foot print : simple pub-sub model Low power draw Light on network bandwidth Ideal for embedded devices and hence for IoT 3 QoS levels : Fire and forget At least once Exactly once 11:18 AM

Fine-grained access control Application level support for finer control Desired degree of configurability ? Role based access control Policy based access control Operational requirements based access control Inheritance of access privileges Proxy and sharing of access control Example : Predix ACS https://github.com/predix/acs 11:18 AM

Security considerations : Pluggable backend for authorization and authentication Cost of a redirect loop to such backend systems Elliptical crypto support PKI support Interoperability of plugins Order of evaluation Ease of deployment and management Ease of run time changes to settings 11:18 AM

Web vs IoT Security Web security standard : IoT security : HTTPS + OAuth + OpenIDConnect + Application (ACS) IoT security : SASL + OAuth + ? 11:18 AM

Questions ? 11:18 AM