Internet of Things Security & Privacy

© 2016 ForgeRock. All rights reserved.
Chris Adriaensen
Senior Customer Engineer
chris.adriaensen@forgerock.com
@chrisadriaensen | @ForgeRock
Internet of Things
SECURITY & PRIVACY

2
KJERAGBOLTEN
NORWAY
ForgeRock Background
Founded 2010
Employees 500+
Customers 750+
Countries 30+
International 50%
Funding (D-Series) 140M$

© 2016 ForgeRock. All rights reserved. 3
“In the beginning the Internet was created.
This has made a lot of people very angry
and been widely regarded as a bad move.”

Desktop Web 1.0 Web 2.0 Mobile Embedded
4
Application Evolution
“Fat” Client
“Thin” Client
Internet
SO
LONG
THX

Internet of Things
CHALLENGES

10

July 2015
11

February 2012
12

Internet of Things Challenges
Hardware Properties Security Privacy
Scale & Mobility
Power & Storage
Physical Resources
Virtual Resources
Sensor Data
Provided DataServer
Thing
Device
Identity & Privacy Transparency & ConsentScalability & µServicesSolution
13

Internet of Things
IDENTITY & ACCESS

Users
Edge
(5G / LPN / WiFi / ZB / BLE)
User Interface
(GUI / PUI)
ServicesPlatforms
Application Interface
(REST / SOAP)
Low Level
(MQTT / COAP)
12
Internet of Things Architecture
Simple
Thing
Smart
Thing
Device
Gateway Platform Service
ServicePlatform

Users
Edge
(5G / LPN / WiFi / ZB / BLE)
User Interface
(GUI / PUI)
ServicesPlatforms
(REST / SOAP)
Low Level
(MQTT / COAP)
13
Internet of Things Challenge
Simple
Thing
Smart
Thing
Device
ServicePlatform
ID
ID
ID
ID
IDIDIDID
ID

Layer
Application
Network
BIN / CBOR / JSON
MQTT / COAP
XML / JSON
HTTP(S)
Physical
5G / LPN / WiFi /
ZigBee / BLE
Ethernet / WiFi
UDP
IPv6 / 6LoWPAN
TCP
IPv6 / IPv4 / IPSec
Internet of Things Network Stack
18
Internet of Things Mobile / Web 2.0 Web 1.0
HTML
HTTP(S)
5G / WiFi

Edge
(5G / LPN / WiFi / ZB / BLE)Users
User Interface
(GUI / PUI)
ServicesPlatforms
(REST / SOAP)
Low Level
(MQTT / COAP)
15
Internet of Things Identity Solution
Simple
Thing
Smart
Thing
Device
ServicePlatform
ID
ID
ID
ID
ID
ID
ID
ID
ID
Identity
Platform

Client Employee Partner Consumer Computer Device Thing
Global
Service
Anonymous
Knowledge
Access
Properties
Email / Biometrics
Identifier / Username
Membership / Attributes
Identification
URI / Electrometrics
Identifier / Serial
Brand / Model / Attributes
Identity
Attribute
Relationship
Discretionary / Mandatory
Action / Identity / Context
Professional / Personal
Discretionary / Mandatory
Action / Identity / Context
Ownership / Usage
Password / PIN
Direct / Front / Back (UI)
Biometrics / Behavior
Symmetric / Asymmetric
Direct / Front / Back (API)
Electrometrics / Behavior
Federation
Federation
AuthenticationAuthorization
Humans vs. Things Identity & Access
18

ServicesPlatformsUsers Edge
17
Simple
Thing
Smart
Thing
Device
ServicePlatform
User Thing
Gateway /
Device
Platform Service
Explicit
Bind &
Validation
Side
Channel
Bind
Login
Bind
OAuth
Device Flow
Relationships
& Workflows
OAuth
Connectors & Synchronization
Internet of Things User Binding
Technology
Stores /
Binding

The Hitchhiker’s Guide to
OPEN STANDARDS

Requesting PartyClientsResources AccessResource Owner
User Interface
(GUI / PUI)
(REST / SOAP)
User Interface
(GUI / PUI)
Application
19
Client Architecture

Resource Owner
User Interface
(GUI / PUI)
Requesting PartyClientsResources Access
User Interface
(GUI / PUI)
(REST / SOAP)
Application
20
Access Challenge
ID ID
ID
ID
ID
ID
IDIDIDID
ID

CONSUMERENTERPRISE
OASIS
22
Open Standards
IETF, OIDF & KANTARA
UMA
Access
Federation
OIDC
Identity
Federation
OAuth
DYNAMIC
Access
Control Consent
Security Scalability
Browser
Client
Generic
Client
Statefull
Design
Stateless
Design
XML /
SOAP
JSON /
REST
JWT
DYNAMIC
Identity
2000+ 2010+
SAML
Identity
Federation
XACML
Access
Federation
WS-*
DYNAMIC
Access
SAML
DYNAMIC
Identity X.509
STATIC
Identity
XACML
STATIC
Access
FIDO
AuthN

Requesting PartyClientsResources AccessResource Owner
User Interface
(GUI / PUI)
(REST / SOAP)
User Interface
(GUI / PUI)
Application
23
Open Standards
OAuth 2.0
Device Flow
OAuth 2.0
A/I Grant
User Managed
Access
OpenIDConnect

OAuth Standard
Resource
Server
Authorization
Server
Client
Access Validate
Operate
Authorize
Control
OAuth 2.0
Standard
Owner-to-App
Sharing
Synchronous
Consent
Access
Integration
OAuth Access
Tokens
Resource
Owner

OAuth Request Flows
FLOW USAGE
Authorization Grant User-Agent <> Client
Implicit Grant
Client Credentials
Resource Owner Credentials
Device Flow
User-Agent == Client
Client == Resource Owner
Exceptional!!
Constrained User Interface

OpenID Connect Standard
Authorization
Server
Client
Access
OIDC 1.0
Standard
Owner-to-App
Sharing
Synchronous
Consent
Access
Integration
OAuth Access
Tokens
JWT Identity
Tokens
Authenticate
Authorize
Identity
Owner
Operate Control
Identity
Provider

User Managed Access Standard
Resource
Server
Authorization
Server
Requesting
Party
Client
Authorize
Access Validate
Resource
Owner
Operate
Manage
Control
Negotiate
UMA 1.0
Standard
Owner-to-Party
Sharing
Asynchronous
Consent
Access
Federation
OAuth Access
Tokens

Token Security
CLIENT TOKEN
Authentication &
Authorization
Signature
Authentication &
Authorization
EncryptionSecure Storage Secure Channel
SERVICE
Proof-of-PossessionSecure Channel Usage Analysis
Issuance
Delivery
Usage

“Protect your cookies...
euhm tokens!”

Chris Adriaensen
Senior Customer Engineer
chris.adriaensen@forgerock.com
@chrisadriaensen | @ForgeRock
End of
SHOW

Internet of Things Security & Privacy

Recommended

Recommended

More Related Content

What's hot

What's hot (7)

Similar to Internet of Things Security & Privacy

Similar to Internet of Things Security & Privacy (20)

More from Chris Adriaensen

More from Chris Adriaensen (7)

Recently uploaded

Recently uploaded (20)

Internet of Things Security & Privacy