Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Serverless 개발에서의 인증 완벽 가이드::박선용::AWS Summit Seoul 2018

1,435 views

Published on

Published in: Technology
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ..................................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, CookeBOOK Crime, eeBOOK Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Serverless 개발에서의 인증 완벽 가이드::박선용::AWS Summit Seoul 2018

  1. 1. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Seon Yong Park Developer Specialist SA, APAC 서버리스 개발에서의 인증 완벽 가이드
  2. 2. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 본 강연에서는 AWS 는 어플리케이션이 작동하는 시스템에 따라 다양한 형태의 인증 방식을 지원합니다. 여러분에 모바일이나 자신이 서버의 어플리케이션에서 서버리스 서비스를 호출하는 경우 어떤 방식의 인증 방식이 적용될 수 있는지 살펴보고, 패스워드 보안을 위한 Cognito의 SRP 지원을 자세히 살펴봅니다.
  3. 3. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 인증의 형태 서버리스 API 에서 인증 제 3자 인증 제공자와의 연동 NSRP와 SRP 정리 데모
  4. 4. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 인증의 형태
  5. 5. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 인증을 받아서 AWS 서비스 기능을 실행해야 하는 주체 온프림 서버 EC2 on AWS 모바일 Role Configure credentials SAML 2.0 MS AD Role Configure credentials SAML 2.0 MS AD Amazon Cognito Amazon Cognito 어플리케이션
  6. 6. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SAML 2.0 연동 janedoe@Ubuntu64:/tmp$ ./samlapi.py Username: ADjanedoe Password: **************** Please choose the role you would like to assume: [ 0 ]: arn:aws:iam::012345678987:role/ADFS-Administrators [ 1 ]: arn:aws:iam::012345678987:role/ADFS-Operators Selection: 1 --------------------------------------------------------------- Your new access key pair has been stored in the aws configuration file /home/janedoe/.aws/credentials under the saml profile. Note that it will expire at 2015-05-26T17:16:20Z. ---------------------------------------------------------------
  7. 7. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 서버리스 API에서 인증
  8. 8. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Public API POST /locations GET /locations GET /locations/{locationId} DELETE /locations/{locationId} GET /locations/{locationId}/resources POST /locations/{locationId}/resources DELETE /locations/{locationId}/resources/{resourceId} GET /locations/{locationId}/resources/{resourceId}/bookings GET /users/{userId}/bookings POST /users/{userId}/bookings DELETE /users/{userId}/bookings/{bookingId}
  9. 9. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Public API Admin only Admin only Admin only Admin only POST /locations GET /locations GET /locations/{locationId} DELETE /locations/{locationId} GET /locations/{locationId}/resources POST /locations/{locationId}/resources DELETE /locations/{locationId}/resources/{resourceId} GET /locations/{locationId}/resources/{resourceId}/bookings GET /users/{userId}/bookings POST /users/{userId}/bookings DELETE /users/{userId}/bookings/{bookingId}
  10. 10. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. API 게이트웨이 : 3가지 인증 형태 Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
  11. 11. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. API Gateway: 3가지 인증 형태 Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
  12. 12. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app Amazon API Gateway Amazon Cognito User Pools Amazon DynamoDB Lambda function
  13. 13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app 1. Authenticate Amazon Cognito User Pools
  14. 14. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app 2. JWT tokens Amazon API Gateway Amazon Cognito User Pools Amazon DynamoDB Lambda function
  15. 15. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app 3. Call API Gateway resource Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools
  16. 16. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 4. Validate Identity token Mobile app Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools
  17. 17. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app 5. Invoke API Call Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools
  18. 18. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저 풀 기반 인가 Mobile app 6. Access AWS Resources Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools
  19. 19. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. API 게이트웨이: 3가지 인증 형태 Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
  20. 20. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  21. 21. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management 1. Authenticate
  22. 22. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 2. JWT tokens Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  23. 23. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 3. Request AWS credentials Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  24. 24. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 4. Validate Id token Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  25. 25. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 5. Temp AWS credentials Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  26. 26. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 6. Call API Gateway resource Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  27. 27. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 7. Check IAM policy Amazon DynamoDB Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
  28. 28. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 기반 인가 Mobile app 8. Invoke Lambda Lambda function Amazon API Gateway Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management Amazon DynamoDB
  29. 29. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. IAM 정책 상세 { "Version": "2012-10-17", "Statement": [ { "Action": "execute-api:Invoke", "Effect": ”Allow", "Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*” }, { "Action": "execute-api:Invoke", "Effect": "Deny", "Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*/POST/locations/*" } ] }
  30. 30. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. API 게이트웨이: 3가지 인증 형태 Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
  31. 31. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Lambda function Amazon API Gateway Amazon DynamoDB
  32. 32. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Lambda function Amazon DynamoDB 1. Authenticate
  33. 33. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Amazon API Gateway 2. Custom IdP Token(s) Lambda function Amazon DynamoDB
  34. 34. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Amazon API Gateway 3. Call API Gateway resource Lambda function Amazon DynamoDB
  35. 35. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Mobile app Amazon API Gateway 4. Check policy cache Custom Authorizer Lambda function Lambda function Amazon DynamoDB
  36. 36. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Mobile app Amazon API Gateway 5.Validatetoken AWS Identity & Access Management Custom Authorizer Lambda function Lambda function Amazon DynamoDB
  37. 37. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Amazon API Gateway 6.Generateandreturn userIAMpolicy Lambda function Amazon DynamoDB
  38. 38. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Amazon API Gateway 7. Validate IAM permissions AWS Identity & Access Management Lambda function Amazon DynamoDB
  39. 39. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 Custom Authorizer Lambda function Mobile app Amazon API Gateway 8. Invoke Lambda function Amazon DynamoDB
  40. 40. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 커스텀 인가 람다 함수 예제 코드 var testPolicy = new AuthPolicy(”userIdentifier", "XXXXXXXXXXXX", apiOptions); testPolicy.allowMethod(AuthPolicy.HttpVerb.POST, "/locations/*"); testPolicy.allowMethod(AuthPolicy.HttpVerb.DELETE, "/locations/*"); callback(null, testPolicy.getPolicy());
  41. 41. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. API 게이트웨이: 3가지 인증 형태 Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
  42. 42. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 제 3자 인증제공자와의 연동
  43. 43. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 어플리케이션 제3자 인증제공자 연동 Built-in, Customizable User Interface for Sign up / Sign in OAuth 2.0 SupportFederation with Facebook, Login with Amazon, Google, and SAML2 providers 1 2 3
  44. 44. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 소셜 인증제공자와의 연동 1. Initiate sign-in
  45. 45. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 소셜 인증제공자와의 연동 1. Initiate sign-in 2. Sign-in with 3rd party IdP
  46. 46. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 소셜 인증제공자와의 연동 1. Initiate sign-in Amazon Cognito User Pools 2. Sign-in with 3rd party IdP 3. Get user tokens
  47. 47. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 기업의 인증제공자와의 연동 1. Initiate sign-in
  48. 48. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 기업의 인증제공자와의 연동 1. Initiate sign-in 2. Sign-in with 3rd party IdP SAML Endpoint e.g. ADFS or Shibboleth Corporate Directory e.g. Active Directory or OpenLDAP
  49. 49. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 기업의 인증제공자와의 연동 1. Initiate sign-in Amazon Cognito User Pools 2. Sign-in with 3rd party IdP 3. Get user tokens SAML Endpoint e.g. ADFS or Shibboleth Corporate Directory e.g. Active Directory or OpenLDAP
  50. 50. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 기업의 인증제공자와의 연동
  51. 51. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. NSRP 와 SRP
  52. 52. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 Username Email Password beverly123 beverly123@example.com Password$123 pilotjane pilotjane@example.com a##eroplan3 sudhir1977 sudhir197@example.com mmd414997a 2. Sign-in 1. Sign-up 평범한 문자로 패스워드 저장하기
  53. 53. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 • Never store passwords in plaintext! • Vulnerable to rogue employees • A hacked DB results in all passwords being compromised Username Email Password beverly123 beverly123@example.com Password$123 pilotjane pilotjane@example.com a##eroplan3 sudhir1977 sudhir197@example.com mmd414997a 2. Sign-in 1. Sign-up
  54. 54. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 Username Email Hashed Password beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883 sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d 2. Sign-in 1. Sign-up 패스워드 해쉬 값으로 저장하기
  55. 55. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 • MD5/SHA1 collisions • Reverse Lookup Tables • Rainbow Tables • Dictionary attacks, brute-force (GPUs can compute billions of hashes/sec) Username Email Hashed Password beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883 sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d 2. Sign-in 1. Sign-up
  56. 56. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 Username Email Salted Hash beverly123 beverly123@example.com 1e66f9358530620b2bcae79dada717c… pilotjane pilotjane@example.com 88fccd9cf82377d11d2fede177457d47… sudhir1977 sudhir197@example.com 08a5981de4fecf04b1359a179962a48... 2. Sign-in 1. Sign-up • Incorporate app-specific salt + random user-specific salt • Use algorithm with configurable # of iterations (e.g. bcrypt, PBKDF2), to slow down brute force attacks
  57. 57. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP가 요구되는 이유 Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign-in 1. Sign-up • Secure Remote Password (SRP) Protocol • Verifier-based protocol • Passwords never travel over the wire • Resistant to several attack vectors • Perfect Forward Secrecy
  58. 58. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP 처리과정 Client Server 임시 비밀값 ‘a’생성 공개 A 생성 : A = ( g ^ a ) % N N = 아주 큰 소수값 g = 2 K = hash(N, g) LoginRequest (Username, A) 1. 유저DB 로부터 salt ’s’ verifier ‘v’가져옴 2. 임시 비밀 값 ‘b’를 생성 3. 공개 임시값 ‘B’를 생성 B = [ k * v + ( (g ^ b ) %N)] % N 4. 스크램블 값 ’u’ 생성 u = hash (A, B) 5. 세션 키 K 생성 S = [ ( A * (( v ^ u) % N)) ^b] % N K= hash(S) 6. 다음 사용을 위해 [ A, B, K, s] 저장 LoginResponse(s, B)
  59. 59. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. SRP 처리과정 Client Server 1. 스크램블 값 ’u’ 생성 u = hash (A, B) 2. 유저 개인 값 ‘x’생성 x= hash(s, password) 3. 세션 키 ‘K ‘계산 S = [ B - k * (g ^x % N)) ^ ( a + u * x)] % N K = hash (S) LoginResponse(s, B) 4. K 값 전달 M1 = hash (A, B, K) 1. M1 계산 M1 = hash(A, B, K) 2. 받은 M1과 계산한 M1이 같으면 유저는 인증 이후 통신은 암호화
  60. 60. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 유저 풀 NoSRP client SRP client
  61. 61. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Cognito 유저풀 인가 Mobile app Amazon Cognito User Pools server app SRP
  62. 62. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 정리
  63. 63. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. 인증/인가 • 인증이 필요한 어플리케이션이 동작하는 기기에 따라 인증 방식 구분 • Role for EC2 • Cognito 를 사용할 것 - UserPools - OpenidConnect - Synchronize - Federated Identity
  64. 64. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. AWS Summit 모바일 앱과 QR코드를 통해 강연 평가 및 설문 조사에 참여해 주시기 바랍니다. 내년 Summit을 만들 여러분의 소중한 의견 부탁 드립니다. #AWSSummit 해시태그로 소셜 미디어에 여러분의 행사 소감을 올려주세요. 발표 자료 및 녹화 동영상은 AWS Korea 공식 소셜 채널로 공유될 예정입니다. 여러분의 피드백을 기다립니다!

×