![Page 1: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/1.jpg)
We believe that we are on the verge of the Internet of Things explosion. Now is the time to make sure that IoT incorporates everything we’ve learned about digital security and infrastructure resiliency over the last 20 years of the Internet.
1
![Page 2: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/2.jpg)
IDENTITY
SECURITY BEGINS WITH
![Page 3: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/3.jpg)
IDENTITY User name and password
![Page 4: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/4.jpg)
IDENTITY Smartcard
![Page 5: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/5.jpg)
IDENTITY Biometrics
![Page 6: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/6.jpg)
IDENTITY Certificate
![Page 7: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/7.jpg)
IDENTITY API KEY
AE5021 B3209A FEA409
![Page 8: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/8.jpg)
IDENTITY TRUST
![Page 9: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/9.jpg)
IDENTITY TRUST
![Page 10: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/10.jpg)
IDENTITY APPLYING THESE MECHANISMS TO IOT AND M2M
![Page 11: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/11.jpg)
AE5021 B3209A FEA409
IDENTITY PROGRAMMATIC PHYSICAL
![Page 12: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/12.jpg)
AE5021 B3209A FEA409
IDENTITY PROGRAMMATIC PHYSICAL
![Page 13: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/13.jpg)
CERTIFICATES PUBLIC KEY INFRASTRUCTURE (PKI)
l Trusted and well established technology l Allows for mutual authentication
l Can be used for message signing
![Page 14: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/14.jpg)
CERTIFICATES
![Page 15: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/15.jpg)
CERTIFICATES
![Page 16: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/16.jpg)
CERTIFICATES
![Page 17: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/17.jpg)
CERTIFICATES COST
$$$$$ $$$$$ $$$$$
![Page 18: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/18.jpg)
CERTIFICATES COST
$$$$$ $$$$$ $$$$$
![Page 19: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/19.jpg)
CERTIFICATES SECURITY
![Page 20: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/20.jpg)
CERTIFICATES SECURITY - Revocation
Certificate Revocation List
Online Certificate Status Protocol
CERTIFICATE AUTHORITY
![Page 21: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/21.jpg)
CERTIFICATES SECURITY - Revocation
Certificate Revocation List
Online Certificate Status Protocol
CERTIFICATE AUTHORITY
![Page 22: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/22.jpg)
CERTIFICATES SECURITY - Revocation
Certificate Revocation List
Online Certificate Status Protocol
CERTIFICATE AUTHORITY
![Page 23: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/23.jpg)
CERTIFICATES SECURITY - TRUST
CERTIFICATE AUTHORITY
![Page 24: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/24.jpg)
CERTIFICATES SECURITY - TRUST
CERTIFICATE AUTHORITIES
![Page 25: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/25.jpg)
CERTIFICATES SECURITY - TRUST
CERTIFICATE AUTHORITIES
device123.example.com
device123.example.com
Certificate Authority A
Certificate Authority B
![Page 26: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/26.jpg)
CERTIFICATES MANAGEMENT
![Page 27: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/27.jpg)
CERTIFICATES INTEROPERABILITY
FOO.COM CERTIFICATE AUTHORITY
BAR.COM CERTIFICATE AUTHORITY
![Page 28: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/28.jpg)
CERTIFICATES INTEROPERABILITY
FOO.COM CERTIFICATE AUTHORITY
BAR.COM CERTIFICATE AUTHORITY
![Page 29: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/29.jpg)
CHALLENGES How do we deploy PKI at Internet of Things scale. l Keep cost low l Be interoperable l Deploy at scale l Improve security
![Page 30: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/30.jpg)
DANE
![Page 31: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/31.jpg)
DNS-BASED AUTHENTICATION OF NAMED ENTITIES
![Page 32: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/32.jpg)
DNSSEC Provides a secure global registry l Highly scalable
![Page 33: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/33.jpg)
DNSSEC Provides a secure global registry l Highly scalable l Globally distributed
![Page 34: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/34.jpg)
DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient
![Page 35: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/35.jpg)
DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based
![Page 36: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/36.jpg)
DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based l Ubiquitous
![Page 37: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/37.jpg)
DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based l Ubiquitous l Secure
![Page 38: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/38.jpg)
DNSSEC Provides a secure global registry l Secure
l Cryptographically signed l Supports delegation
. root key
.com key
.example.com key
zone.example.com
….... ….... …....
![Page 39: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/39.jpg)
DANE RFC 6698 - establishes new record types for DNS Allows publishing of certificate data in DNS Data integrity validated by cryptographic signature
zone.example.com
….... ….... …....
![Page 40: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/40.jpg)
DANE RFC 6698 - establishes new record types for DNS l Effectively replaces local CA store as means of validating certificates l Allows records to be queried in real time l Allows records to be cached for specific amount of time l Removes the need for CRLs and OCSP l Can work with CA issued certificates or self signed certificates
![Page 41: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/41.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
Device provisioning
Public key is published in DNS Device creates public/private keypair
![Page 42: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/42.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
DNS “TLSA” record maps device name to public key
Device only needs name does not need published IP address
![Page 43: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/43.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
IoT Platform
Sensor initiates TLS connection to IoT Platform
![Page 44: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/44.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
IoT Platform
TLS handshake includes device name and public key
![Page 45: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/45.jpg)
Sensor
Keys
IoT Platform
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
….... Recursive DNS Server
IoT Platform queries secure DNS
for public key for device
![Page 46: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/46.jpg)
Sensor
Keys
IoT Platform
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
….... Recursive DNS Server
IoT Platform retrieves public key from secure DNS Server
![Page 47: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/47.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
IoT Platform compares device's published
key with the key used during negotiation
= ?
![Page 48: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/48.jpg)
Sensor
Keys
DNS Registry
device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com
deviceX.example.com
…....
The keys match so the client certificate
is validated
![Page 49: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/49.jpg)
DANE Advantages of DANE l Highly scalable l Economically viable l Highly secure
l Limited scope of trust l Instant revocation l Transparency
![Page 50: We believe that we are on the verge of the Internet of ... · Recursive DNS Server IoT Platform retrieves public key from secure DNS Server . Sensor Keys DNS Registry device1.example.com](https://reader034.vdocuments.us/reader034/viewer/2022042307/5ed3f2c6816c347eef6faf39/html5/thumbnails/50.jpg)
WHAT NOW ?
50
COMMUNITY ENGAGEMENT Working with the community on DANE enablement across the stack including crypto libraries and common runtime frameworks.
FEEDBACK We'd love to talk! email us at [email protected]