CIS14: Handling Identity in AllJoyn 14.06
2 likes629 views
The document discusses security and identity in embedded systems and the AllJoyn distributed messaging bus. It describes several incidents where lack of security in embedded systems led to safety issues. It then explains how AllJoyn uses various encryption methods like RSA keys, SRP, and ECDHE to authenticate devices and secure communication over the distributed bus. These methods provide features like certificate-based identity, password or PIN-based pairing, and pre-shared keys to secure connections without requiring a trusted authority.
CIS14: Handling Identity in AllJoyn 14.06
- 1. Iden%ty & Security In AllJoyn 14.06 Tim Kellogg Saturday, July 19 2014
- 2. hAps://github.com/tkellogg/alljoyn-‐examples hAps://github.com/tkellogg/alljoyn-‐core/tree/ master/alljoyn_core/src hAp://www.slideshare.net/kellogh/security-‐ iden%ty-‐in-‐alljoyn-‐1406
- 4. Mitsubishi EMI Incident (2003) • Brakes disabled when given 1000-‐10000x legal levels of EMI radia%on • Car thinks brakes are locked, so it releases • All within limits required by law
- 5. Slammer Worm (2003) • Nuclear plant safety monitoring disabled for 5 hours • “The business value of access to the data within the control center worth the risk of open connec%ons between the control center and the corporate network” • Unpatched MSSQL Server
- 6. Hello, my name is Bruce Schneier and I think routers are super duper easy to hack, mostly because you nerds never patch the so`ware hAps://www.schneier.com/essays/archives/2014/01/ the_internet_of_thin.html
- 7. University of Washington Study (2010) “We demonstrate that an aAacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-‐cri%cal systems” hAp://www.autosec.org/pubs/cars-‐ oakland2010.pdf
- 8. Hey, check it out! I made my own encryp%on algorithm
- 10. Embedded Needs “Rails” • So`ware Updates • Security & Iden%ty • Communica%on • Media Streaming • User Interfaces
- 11. Distributed Bus
- 12. Distributed Bus
- 13. Security
- 14. Auth Listeners • ALLJOYN_RSA_KEYX – X.509 cer%ficates • ALLJOYN_SRP_KEYX – Show Random PIN • ALLJOYN_SRP_LOGON – preset U/P table • ALLJOYN_ECDHE_NULL • ALLJOYN_ECDHE_PSK • ALLJOYN_ECDHE_ECDSA – DSA
- 15. ALLJOYN_RSA_KEYX • RSA = Asymmetric key encryp%on • X.509 cer%ficates – Trusted Cer%ficate Authority
- 16. SRP_KEYX & SRP_LOGON • Threshold Cryptography • No trust required to establish a secure connec%on • LOGON = Username & Password • KEYX = A PIN is displayed
- 17. ALLJOYN_SRP_KEYX
- 18. ECDHE • Ellip%c Curve (EC) Cryptography • DHE = Diffie-‐Hellman key Exchange – Symmetric key encryp%on
- 19. ALLJOYN_ECDHE_NULL • Ellip%c Curve Encryp%on • No verifica%on of iden%ty
- 20. ALLJOYN_ECDHE_PSK • PSK = Pre-‐Shared Key • Service already has the client’s public key • A password may also be used
- 21. ALLJOYN_ECDHE_ECDSA • ECDSA – Ellip%c Curve Digital Signature Algorithm • Cer%ficate shows iden%ty
- 23. Ques%ons? @kellogh Prac%cal Internet of Things