IoT End-to-End Security Overview

Copyright © 2016 AWS and affiliates, all rights reserved
IoT End-to-End Security Overview
Assaf Naner,
Enterprise Solution Architect

Agenda
• Connected Devices
• AWS IoT Overview
• The risks
• Protecting the device
• Requirements
– Securing Devices
– Securing users and applications
– Thing identity

All things around us are getting connected

Things will proliferate
2013 2015 2020
Vertical Industry
Generic Industry
Consumer
Automotive
Many
Some
Lots

AWS IoT

Publish / Subscribe
Standard Protocol Support
MQTT, HTTP, WebSockets
Long Lived Connections
Receive signals from the cloud
Secure by Default
• Connect securely via X509 Certs
• and TLS 1.2 Client Mutual Auth

The Risk
I’m a thing

Protecting the device

Protecting the device
• Secure booting – SW on device is verified with digital signatures
• Access control - role based access controls in OS (least privilege)
• Update and patching – OS and application patching

Requirements
• Secure Communications with Things
• Strong Thing Identity
• Fine-grained Authorization for:
– Things
– People
• Constrains:
– Device are small, constrained in computing power and memory capacity
– Device updates

Mutual Auth TLS

The Risk - What about users and applications?
I’m a thing

Signing AWS API Requests
API: AWS Signature Version 4

Security is too expensive

Elliptical Curve Cryptography (ECC)
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
Elliptical curve logarithm vs RSA integer factorization
Smaller key sizes for same security
ECDHE – key exchange algorithm (forward secrecy with ephemeral keys)
ECDSA – signature algorithm with EC private keys (authentication)

Summary
Device  AWS IoT Users & App  AWS IoT
Server Auth TLS + Cert TLS + Cert
Client Auth TLS + Cert AWS API Keys (SigV4)
Confidentiality TLS TLS
Protocol MQTT HTTP

Strong Thing Identity
• Private Key are not saved on AWS
• You can generate your own keys (CSR)

Strong Thing Identity – client generated key pair
CSR

TLS Mutual Authentication
• Create CSR
• Create X.509 Certificate from CSR
• Activate the Certificate
• Create Policy
• Attach Policy to Certificate
• * Certificate must be issued by AWS IoT

Takeaways
• Use a unique certificate for each device / thing – this is will help with
authorization
• You can use your own keys – use CSR for public certificate
• Revoke unused certificates - in particular when moving to production
$ aws iot list-certificates
{
"certificateDescriptions": [
{
"certificateArn":
"arn:aws:iot:us-east-1:123456972007:cert/d7677b0…SNIP…026d9",
"status": "REVOKED",
"certificateId":
"d7677b0…SNIP…026d9"
] "creationDate": 1443070900.491
}
]
}

Policy and certificates
• Policy - consists of one or more statements, each of which describes one
set of permissions.
• Certificate – uniquely identify a device
• Policy is attached to one or more device certificate (best practice is to have
one certificate per device)

Policy and certificates
Device Policy
Truck 1 Allow to connect and publish
Truck 2 Allow to connect / publish /
subscribe
Truck 3 Allow to connect / publish /subscribe
/ unsubscribe

Policy actions
• Connect
• Publish
• Subscribe
• Unsubscribe
• Receive

Connect policy
{
"Version":"2012-10-17",
"Statement":[ {
"Effect":"Allow",
"Action":[ "iot:Connect" ],
"Resource":"arn:aws:iot:us-east-1:123456972007:
client/MY-THING-NAME"
} ]
}

Publish policy
{
"Version":"2012-10-17",
"Statement":[ {
"Effect":"Allow",
"Action":[ "iot:Publish" ],
"Resource":"arn:aws:iot:us-east-1:123456972007:
topic/$aws/things/MyThing/shadow/update"
} ]
}

Manage Certificates
{
"Version":"2012-10-17",
"Statement":[ {
“SID”: “ManageCerts”,
"Effect":"Allow",
"Action":[ "iot:CreateCertificateAndKeys” ,
“iot:DescribeCertificate”,
“iot:UpdateCertificate” ],
"Resource":”*"
} ]
}

Applications

Mobile
AMAZON
COGNITO

Mobile Users and Things
AMAZON
COGNITO
1
2
3
4
5

Policy for Cognito with IoT
Cognito authenticated user identity pool role policy:
{
"Effect": "Allow",
"Action": [ "iot:Connect", "iot:Publish",
"iot:Subscribe", "iot:Receive",
"iot:GetThingShadow",
"iot:UpdateThingShadow" ],
"Resource": "*"
}
Specific policy for Joe IoT Cognito user:
{
"Effect": "Allow",
"Action": "iot:UpdateThingShadow",
"Resource": "arn:aws:iot:…:thing/joe-sprinkler123"
}

Wrap up – Two Secure Protocol
API: AWS Signature Version 4
HTTP
MQTT

Wrap-up
Device  AWS IoT Users & App  AWS IoT
Server Auth TLS + Cert TLS + Cert
Client Auth TLS + Cert AWS API Keys (SigV4)
Confidentiality TLS TLS
Protocol MQTT HTTP
Identification AWS ARNs AWS ARNs
Authorization AWS Policy AWS Policy

Check and balances
• Look for suspicious activity in your code
• Identify activity signatures
• Examples:
– Same certificate used from multiple IPs or used simultaneously from two devices
– Check if certificates were compromised
• Enable 2nd level of authorization for suspicious devices – revoke the certificate
first. Ask user to reinitiate the device
• Look for rogue activity in the logic of your application

aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS

IoT End-to-End Security Overview

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to IoT End-to-End Security Overview

Similar to IoT End-to-End Security Overview (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Recently uploaded

Recently uploaded (19)

IoT End-to-End Security Overview

Editor's Notes