IDC estimates that there will be 41.6 billion connected IoT devices by 2025, opening up opportunities for increased efficiencies and innovation across industries. Yet, lack of IoT security standards and typical processes such as shipping with default password credentials and manual onboarding leave devices, and the networks they operate on, open to large-scale attack. Last summer, the FIDO Alliance announced a new standards initiative to tackle these security issues in IoT. The Alliance’s IoT Technical Working Group aims to provide a comprehensive authentication framework for IoT devices in keeping with the fundamental mission of the Alliance – passwordless authentication. These webinar slides provide an update on this new work area, including: --How FIDO Authentication and existing specifications fit into the IoT ecosystem today --The charter and goals of the IoT TWG, including development of specifications for IoT device attestation/authentication profiles to enable interoperability between service providers and IoT devices; automated onboarding, and binding of applications and/or users to IoT devices; and IoT device authentication and provisioning via smart routers and IoT hubs --The progress of the working group to date, including the use case and target architectures the IoT TWG is looking at as a foundation for its specifications and certification program

1. © FIDO Alliance 2020
Securing IoT with FIDO
Authentication
March 17, 2020

2. © FIDO Alliance 202022

3. © FIDO Alliance 2020
Today’s Speakers
3
Andrew Shikiar
Executive Director & CMO
FIDO Alliance
Giri Mandyam
Senior Director for Technology
Qualcomm
Co-Chair, IoT TWG
Dr. Rolf Lindemann
Vice President, Products
Nok Nok Labs

4. © FIDO Alliance 2020
• Introduction
• FIDO & IoT
• IoT TWG Update
• Q&A
4

5. © FIDO Alliance 2020
FIDO & IoT:
Introduction
5
Dr. Rolf Lindemann
Vice President, Products
Nok Nok Labs

6. © FIDO Alliance 20206
Source: HP Enterprise IoT Home Security Systems

7. © FIDO Alliance 2020
USA President’s Commission on Enhancing
National Cyber Security
UK National Cyber Security Strategy
avoiding default
passwords and moving to other authentication
methods
7

8. © FIDO Alliance 202088
IoT Gateway
Router
4
1
4
2
3
Cloud
Services
1. User to Cloud
2. User to Device
3. Device to Cloud
4. Device to Device
2
3
2

9. © FIDO Alliance 202099
IoT Gateway
Router
4
1
4
3
Cloud
Services
2
3
2
1. User to Cloud
2. User to Device
3. Device to Cloud
4. Device to Device
Already addressed
2

10. © FIDO Alliance 20201010
Authenticator FIDO REGISTRATIONUSER APPROVAL
Public/private
keypair is created
Public key
registered
with
account
Signed AttestationObject
Public Key
Invitation to Register
Require user gesture before
private keys can be created
Cloud Server
or IoT Device
FIDO RegistrationUser Gesture

11. © FIDO Alliance 20201111
Authenticator
Require user gesture before
private key can be used
User Gesture FIDO Authentication
Challenge
(Signed) Response
Private key
dedicated to one
app Public key
Cloud Server
or IoT Device

12. © FIDO Alliance 20201212
AuthenticatorUser Gesture FIDO Authentication
Require user gesture before
private key can be used
Challenge
(Signed) Response
Private key
dedicated to one
app Public key
Nothing to remember, no friction
added to transaction process
3
No secrets stored on the
server / IoT device
1
Authenticator cannot be
“tricked” by phishing
2
Single gesture
convenience for User
4

13. © FIDO Alliance 20201313
IoT Gateway
Router
4
1
4
3
Cloud
Services
2
3
2
1. User to Cloud
2. User to Device
3. Device to Cloud
4. Device to Device
Includes today’s topic:
Passwordless Device Onboarding
2

14. © FIDO Alliance 2020
Senior Director for Technology Qualcomm
Co-Chair, IoT TWG
14

15. © FIDO Alliance 202015

16. © FIDO Alliance 202016
IoT - Security breaches are a real issue
Mirai Botnet attack Owlet Baby Monitor St Jude’s pacemaker

17. © FIDO Alliance 2020
Key challenge = secure and easy binding of the device to cloud application
Cloud
Applications
Cloud
Data Analytics
Internet
IoT Devices
Network
Gateway
Gateway
Node
IoT Device IoT Device
IoT Device IoT Device

18. © FIDO Alliance 2020
Why FIDO Alliance in
the IoT Market ?

19. © FIDO Alliance 202019

20. © FIDO Alliance 202020

21. © FIDO Alliance 202021
The IoT TWG has been established to develop use cases,
target architectures, and specifications covering the
following topics: IoT Device Attestation/Authentication
profiles to enable interoperability between relying parties
and IoT devices, automated onboarding, and binding of
applications and/or users to IoT devices, IoT device
authentication and provisioning via smart routers and IoT
hubs, and gap analysis and extensions/modifications
(where necessary) of existing FIDO specifications related
to IoT authentication, platforms and protocols.

22. © FIDO Alliance 20202222

23. © FIDO Alliance 20202323
Category 1 “Deployment”
Category 2 “Binding”
Category 3 “Enablement”

24. © FIDO Alliance 202024
R1 Open Solution
R2 Automatic Onboarding
R3 Authorization (to onboard) is end-to-end
R4 Communications Independence
R5 Late Binding
R6 Permits Supply Chain Flexibility
R7 Repurpose / Resale
R8 Limit Correlation Attacks (Breadcrumbs)
R9 Deferred Acceptance
R10 Trusted and Untrusted Installer
R11 Localized authentication
R12 Internet, Home, Enterprise & Closed networks
R13 IOT Owner need not be Network Owner
R14 Target device range (CPU/RAM/UI/OS etc.)*

25. © FIDO Alliance 202025
Trusted Installer
e.g. Consumer
Untrusted installer
e.g. Industrial
Common late binding solution Temporary assignment of
authority
Enabling/disabling HW
and/or SW features
(outside of onboarding
process)
Enabling/disabling HW and/or SW features
(at onboarding)
Open, Closed network, network ownership etc
1 2 3
Disabling/re-sell

26. © FIDO Alliance 202026

27. © FIDO Alliance 2020
Wrap Up and
Q&A

28. © FIDO Alliance 2020
1. If you have a user to cloud
authentication use case
2. If you are an IoT device vendor wanting
to get rid of shared default passwords
28
3. If you’re interested in the IoT work

29. © FIDO Alliance 202029
Q&A
Andrew Shikiar
Executive Director & CMO
FIDO Alliance
Giridhar Mandyam
Senior Director for Technology
Qualcomm
Dr. Rolf Lindemann
Vice President, Products
Nok Nok Labs

30. © FIDO Alliance 2020
If we didn’t have time to answer your question, please reach out
to us at help@fidoalliance.org
The webinar recording and slides will be emailed to you and posted on
fidoalliance.org
Please stay on to take the survey at the conclusion of the webinar
30

31. © FIDO Alliance 2020
fidoalliance.org
31