Successfully reported this slideshow.
Nov 11, 2015
ARM TechCon presentation about the use of OAuth 2.0 to support authorization in Internet of Things deployments.
for Internet of Things
using OAuth 2.0
Technology Big Picture
A design pattern is a general reusable solution to a commonly
A few design patterns have emerged in the IoT space, as
described in RFC 7452 and recent Internet Society IoT
Backend Data Portability
Devices upload data to the cloud operated by a specific vendor.
Backend data sharing of protected data via OAuth-alike mechanisms and
Device talks directly to other device (often smart phone).
Security based on direct relationship between the device
Vendor A Vendor BE.g. Bluetooth Smart,
IoT devices need to be accessed by multiple users
Access rights dynamically change?
Access rights are fine-grained?
Number of IoT devices is large?
Access policies need to be managed centrally?
Access rights can be delegated?
System has to be integrated in a larger context
(e.g., other, existing identity management
HMAC-SHA256 (AS-RS Key)HMAC-SHA256 (PoP Key)
“action” : “open”
“alg” : “HMAC-SHA256”
“exp” : “1300819380”
“iv” : “<iv>”
“scope” : “open”,
“audience” : “door lock foo-bar”,
“key” : “<encrypted key”>
“alg” : “HMAC-SHA256”,
“token” : “<access token>”,
“timestamp” : “1300919380”
Request Access Token
Technology Big Picture
Authentication and Authorization for Constrained Environments
(ace) aims to standardize solutions for interoperable security for
IoT Use Cases – draft-ietf-ace-usecases
OAuth 2.0 Profile for IoT – draft-seitz-ace-oauth-authz
Authorization protocol widely used on the Web and on smart
Core OAuth 2.0 functionality specified in RFC 6749
Proof of Possession Security Extension
Architecture – draft-ietf-oauth-pop-architecture
Key Distribution – draft-ietf-oauth-pop-key-distribution
JSON Web Token (JWT) – RFC 7519
JWT Key Claim – draft-ietf-oauth-proof-of-possession
Browser views allow for a secure browser context inside the native
app now available for Android and IOS
(described in draft-wdenniss-oauth-native-apps).
Example code available for Android and IOS.
Concise Binary Object Representation (CBOR), RFC 7049,
defines an efficient binary encoding based on the JSON data
CBOR Object Signing and Encryption (COSE) offers security
services for CBOR-based structures.
Signing, Encryption, Key Exchange, and Key Representation
Builds on OAuth 2.0 and provides support for federated login
and the ability to convey authentication information.
Organization offers self-certification program.
Work done in working groups, such as the Heart working group.
Main specifications can be found at
Additional information about the organization can be found at
User Managed Access (UMA)
OAuth-based protocol designed to give users a unified control
point for authorizing who and what can get access to their data
Separates resource owner from requesting party.
More information available at:
Lightweight Machine-to-Machine Communication (LWM2M)
Specification available for download at
The FIDO (Fast IDentity Online) Alliance was formed in July
2012 to address the lack of interoperability among strong
authentication technologies, and remedy the problems users
face with creating and remembering multiple usernames and
Specifications at https://fidoalliance.org/specifications
Universal Second Factor (U2F) protocol
Universal Authentication Framework (UAF) protocol
More info about the alliance, certification programs and tutorials
Technologies used in Demo Setup
OAuth 2.0 & Extensions
OAuth 2.0 Proof of Possession
OAuth 2.0 IoT profile
JSON Web Token (JWT)
There are ongoing standardization efforts. Help us make the
Technologies and eco-systems can be re-used to solve IoT
Code is available. We are planning to add more to make