onboarding in the iot

ON-BOARDING IN THE IOT – A REPORT CARD

Paul MadsenSenior Technical ArchitectPing Identity (The Identity Division of Vista Equity)

Copyright © 2014 Ping Identity Corp. All rights reserved. 1

Onboarding, process of provisioning a client with credentials for accessing a network resource and assigning appropriate permissions


Flavours of onboarding in Smart Home

•Device to Device– E.g Getting a device onto home wifi

•User(Device) to Device – E.g. Getting house guest onto home wifi

•Device to Application– Binding a device to a cloud account

• Application to Application– Assigning a web app permissions to

access API dataCopyright © 2014 Ping Identity Corp. All rights

reserved. 3

Desired qualities

•Security – must not leak credentials nor create opportunity for MITM to insert themselves into process •Usable – intuitive, learnable & consistent•Granularity – associated permissions should be constrained beyond y/n•Interoperability – proprietary doesn’t scale (nor enable consistency)


Device to Device


WiFi Provisioning mechanisms

•Device hotspot•WPS Push Button• Apple Wireless Accessory Configuration (WAC)• TI SmartConfig•OOB, eg BLE, BlinkUp, NFC


Insecure

• Lifx bulb creates its own WiFi AP in order to collect creds of house WiFi

• If turned on/off 5 times, bulb resets & creates a new hotspot

• If attacker creates their own hotspot at same time, user can be phished into providing wifi creds

Proprietary


• TI SmartConfig app provisions SSID credentials to specialized CC3000 chip

• App encodes credentials as length of UDP packets

• CC3000 can see the encrypted packets and their sizes.

• Chip can decode SSID & pwd– even from encrypted packets

Weird….


• ElectricImp BlinkUp app transmits wifi creds by rapidly flashing light pulses on the device’s screen

• Light flashes picked up by optical sensor on device

• Wifi creds decoded and network joined

Report card


Security Usability Granularity

Interoperability

Device to Device

C- B- D D

User(Device) to DeviceDevice to ApplicationApplication to Application

User (Device) to Device


Google OnHub password sharing


Authorization features


But

•Current authz constraint & automation mechanisms are defined in terms of the device•Doesn’t adequately account for shared devices•Should instead manage the combination of the user & the device (ie relationship)


Password anti-pattern (in the small)

•Discourages strong wifi passwords•No granularity of authorizations•Phishable•Difficult to revoke permissions


Report card



Interoperability

Device to Device

C- B- D D

User(Device) to Device

C- B+ C B-

Device to ApplicationApplication to Application

Device to Application


Two fold•How to– bind a specific device to

an existing account at an IoT provider

– Issue that device with a credential that can be used to authenticate to a cloud endpoint


Current model


Device

Server

Server

x.509 (or key pair)

pwd

A new anti-pattern?

•Normal challenges of lifecycle management of certs, ie PKI•Can’t support shared devices•Doesn’t inhibit correlation


Authentication Chain


Attestation keys

Device generatedkeys

Signed device keys

User creds

Tokens

Report card



Interoperability

Device to Device

C- B- D D


C- B+ C B


C B D D

Application to Application

Good news


Cautionary tale

•OAuth 2.0 is not a silver bullet•Doesn’t guarantee appropriate permissions/scopes• Authz to ‘close’ door should not necessarily mean authz to ‘open door’


Report card



Interoperability

Device to Device

C- B- D D


C- B+ C B


C B D D


B+ B+ B- A-

Time to graduate

Problem is using primary credentials (certs, device keys, passwords) where secondary (tokens) are more appropriate


Need to apply delegated authz model to all flavours of Smart Home onboarding (and not just app to app)


What do we need

• OAuth AS capabilities in routers/hubs– Emerging authz features in routers a first step?

• Bindings of delegated authz model to constrained IoT protocols– a la IEF ACE WG– NAPPS TA?

• Intuitive & usable authz ceremonies– App-based– Voice? Amazon Echo et al



Thing

THANKS@paulmadsen


onboarding in the iot

Internet