Securing IoT Connected Device Applications Ian Massingham - - PowerPoint PPT Presentation

▶

securing iot connected device applications

Securing IoT Connected Device Applications Ian Massingham - - PowerPoint PPT Presentation

Oct 15, 2022 265 likes •1.17k views

Securing IoT Connected Device Applications Ian Massingham Technology Evangelist, AWS IanMmmm IoT isnt a new use-case for AWS Amazon Amazon Kinesis Amazon AWS Lambda API Gateway Streaming Analytics DynamoDB Run Code in Build,

slide-1

SLIDE 1

Securing IoT Connected Device Applications

Ian Massingham Technology Evangelist, AWS IanMmmm

slide-2

SLIDE 2

IoT isn’t a new use-case for AWS

Amazon SNS   Mobile Push   and Notifications Amazon DynamoDB Predictable and Scalable NoSQL Data Store AWS Lambda Run Code in Response to Events Amazon Redshift Petabyte-Scale   Data Warehouse

…and more

Amazon API Gateway Build, Deploy, and Manage APIs Amazon Kinesis Streaming Analytics Amazon Cognito User Identity and Data Synchronization

slide-3

SLIDE 3

AWS IoT: simplify and accelerate IoT development

Amazon SNS   Mobile Push   and Notifications Amazon DynamoDB Predictable and Scalable NoSQL Data Store AWS Lambda Run Code in Response to Events Amazon Redshift Petabyte-Scale   Data Warehouse

…and more

Amazon API Gateway Build, Deploy, and Manage APIs Amazon Kinesis Streaming Analytics Amazon Cognito User Identity and Data Synchronization AWS IoT Connect Devices to the Cloud

slide-4

SLIDE 4

AWS IoT

“Securely connect one or one billion devices to AWS,   so they can interact with applications and other devices”

slide-5

SLIDE 5

slide-6

SLIDE 6

slide-7

SLIDE 7

slide-8

SLIDE 8

slide-9

SLIDE 9

slide-10

SLIDE 10

slide-11

SLIDE 11

slide-12

SLIDE 12

slide-13

SLIDE 13

http://192.168.1.200:8080

slide-14

SLIDE 14

http://192.168.1.200:8080

slide-15

SLIDE 15

http://192.168.1.200:8080 http://a.public.address:8080

slide-16

SLIDE 16

http://192.168.1.200:8080 http://a.public.address:8080

slide-17

SLIDE 17

http://192.168.1.200:8080 http://a.public.address:8080

slide-18

SLIDE 18

http://192.168.1.200:8080 http://a.public.address:8080

slide-19

SLIDE 19

http://192.168.1.200:8080 http://a.public.address:8080

slide-20

SLIDE 20

http://192.168.1.200:8080 http://a.public.address:8080

slide-21

SLIDE 21

http://192.168.1.200:8080 http://a.public.address:8080

slide-22

SLIDE 22

http://192.168.1.200:8080 http://a.public.address:8080

slide-23

SLIDE 23

http://192.168.1.200:8080 http://a.public.address:8080

slide-24

SLIDE 24

slide-25

SLIDE 25

slide-26

SLIDE 26

slide-27

SLIDE 27

slide-28

SLIDE 28

DADDY, WHERE DO BOTNETS COME FROM?

slide-29

SLIDE 29

It doesn’t have to be this way

slide-30

SLIDE 30

slide-31

SLIDE 31

slide-32

SLIDE 32

slide-33

SLIDE 33

slide-34

SLIDE 34

slide-35

SLIDE 35

http://192.168.1.200:8080

slide-36

SLIDE 36

http://192.168.1.200:8080

slide-37

SLIDE 37

slide-38

SLIDE 38

slide-39

SLIDE 39

slide-40

SLIDE 40

slide-41

SLIDE 41

slide-42

SLIDE 42

IoT Security: One Slide Primer

Variably-constrained devices Variably-constrained environment & networks Remote locations, variable physical security Diverse IoT market segments, threat models Variable criticality of the IoT applications

slide-43

SLIDE 43

Start with a threat model

slide-44

SLIDE 44

Safety

slide-45

SLIDE 45

slide-46

SLIDE 46

slide-47

SLIDE 47

Bad things can happen in the real world

slide-48

SLIDE 48

How can we defend against these threats?

slide-49

SLIDE 49

Secure Communications with Things Strong Thing Identity Fine-grained Authorisation for: Thing Management (Control plane) Pub/Sub Data Access (Data plane) Access to Services (To add features)

slide-50

SLIDE 50

Secure Communications with Things

slide-51

SLIDE 51

Mutual TLS Authentication

TLS/SSL MUTUAL TLS AUTHENTICATION

slide-52

SLIDE 52

Public Key Cryptography Options

For same bits & level of security ECC keys are much smaller that RSA keys

Symmetric Key Size (bits) RSA Key Size (bits) Elliptic Curve Key size (bits) 80 1024 160 112 2048 224 128 3072 256 192 7680 384 256 15360 512

https://aws.amazon.com/blogs/iot/elliptic-curve-cryptography-and-forward-secrecy-support-in-aws-iot-3/

slide-53

SLIDE 53

Communicating with non-things (Humans)

slide-54

SLIDE 54

How we implement this

MQTT + Mutual Authn TLS AWS Authn + HTTPS Server Authn TLS + Cert TLS + Cert Client Authn TLS + Cert AWS API Keys Confidentiality TLS TLS Protocol MQTT HTTP

slide-55

SLIDE 55

Strong Thing Identity

slide-56

SLIDE 56

Strong Thing Identity

X.509 Certificates

https://aws.amazon.com/blogs/iot/just-in-time-registration-of-device-certificates-on-aws-iot/

slide-57

SLIDE 57

Fine Grained Authorisation

slide-58

SLIDE 58

AWS IoT

slide-59

SLIDE 59

AWS IoT

Data Plane Control Plane Service Access Data Plane

slide-60

SLIDE 60

Applying Permissions to Thing Management

{ "Version": "2012-10-17", "Statement": [ { "Sid": ”ManageCerts", "Action": [ "iot:CreateCertificateAndKeys", "iot:CreateCertificateFromCsr", "iot:DescribeCertificate", "iot:UpdateCertificate", "iot:DeleteCertificate", "iot:ListCertificates” ], "Effect": "Allow", "Resource": "*" } ] } { "Version": "2012-10-17", "Statement": [ { "Sid": "RevokeOneThing", "Action": [ "iot:UpdateCertificate" ], "Effect": "Allow", "Resource": "arn:aws:iot:us-east-1:123456972007:cert/d7677b0…SNIP…026d9", "Condition": { "IpAddress": { "aws:SourceIp": "192.168.42.54" } } } ] }

slide-61

SLIDE 61

Allowing/Denying Access to MQTT Topics

{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "iot:Connect" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "iot:Publish" ], "Resource":[ "arn:aws:iot:us-east-1:123456972007: topic/$aws/things/MyThing/shadow/update"] }, { "Effect":"Allow", "Action":[ "iot:Subscribe", "iot:Receive" ], "Resource":[ "arn:aws:iot:us-east-1:123456972007: topicfilter/$aws/things/MyThing/shadow/*" ] } ] }

slide-62

SLIDE 62

Hardware Security (Private Key & Platform Protection)

slide-63

SLIDE 63

IoT Gateways

slide-64

SLIDE 64

Amtel Zero Touch Secure Provisioning Kit

slide-65

SLIDE 65

If you spend a lot of time on securing your IoT applications, you’re not spending time solving problems for your customers.

slide-66

SLIDE 66

So don’t build a platform, unless you’re building a platform. In which case, fine, build a platform.

slide-67

SLIDE 67

Building ‘Hello World’ (for IoT Developers)

slide-68

SLIDE 68

slide-69

SLIDE 69

Turns out, developers are creative

slide-70

SLIDE 70

Sassy Ping Pong  Score Keeper

Source: https://www.hackster.io/youngd/ping-pong-showdown-eabaed

slide-71

SLIDE 71

Slack-powered Doorbell

Source: www.theatlantic.com/notes/2016/07/make- every-week-2-a-silent-slack-powered-doorbell/ 490880/

slide-72

SLIDE 72

Source: http://www.andrewmcgill.me/2016/08/19/make-every-week-sweetgreen-salad-button.html

Emergency  Sweet Green Ordering

slide-73

SLIDE 73

Push a button to get directions to the right meal within your

budget. (Integrate time of day,

weather, Google Directions, Yelp, and Stripe)

Source: https://medium.com/@_adeel/nerding-out-with-the-amazon-iotbutton-84a6e14b6b28#.ekd5hsnez

slide-74

SLIDE 74

How does it work?

Invoke a Lambda function Put object in an S3 bucket Insert, Update, Read from a DynamoDB table Publish to an SNS Topic  

r Endpoint

Publish to a Kinesis stream Kinesis Firehose > Redshift Republish to AWS IoT

AWS IoT

slide-75

SLIDE 75

But wait, I live in Europe and I want to do this. Right now!

slide-76

SLIDE 76

HARDWARE YOU WILL (& MIGHT) NEED

A Raspberry Pi 
Electronics Kit
Try the SunFounder 37 modules Sensor Kit v2.0 for

Raspberry Pi 3, 2, Model B+ with 40-Pin GPIO Extension Board & Jump Wires

http://www.amazon.co.uk/dp/B014PF05ZA
Example tutorial
Raspberry Pi Sense Hat (optional fun)
https://www.raspberrypi.org/products/sense-hat/

slide-77

SLIDE 77

SETTING UP FOR GPIO/SENSE HAT

Your own electronics/sensor build C (for embedded C)

http://wiringpi.com

Python Wrapper Module for WiringPI

https://github.com/WiringPi/WiringPi-Python

For the Sense Hat Python Module

https://github.com/RPi-Distro/python-sense-hat

slide-78

SLIDE 78

SETTING UP FOR AWS IOT

Use the AWS Console to create your device Download the required crypto materials & save the C header file contents with your endpoint, cert, and key details Download & set up your chosen AWS IoT SDK Get them at : https://aws.amazon.com/iot/sdk/ Building the C SDK on the Raspberry Pi requires the CppUTest library from: https://github.com/cpputest/cpputest/releases/tag/v3.6 Get started with the sample applications that come with the AWS SDKs

slide-79

SLIDE 79

EXAMPLES & DEMOS

Emulating the AWS IoT Button (C++) https://github.com/ianmas-aws/iot-button-emulator Controlling the Sense Hat via AWS IoT Device Shadow (Python) https://github.com/ianmas-aws/PiPyIoT

slide-80

SLIDE 80

slide-81

SLIDE 81

Go Build, Have Fun

Ian Massingham Technology Evangelist, AWS IanMmmm

slide-82

SLIDE 82

1.

slide-83

SLIDE 83

2.

slide-84

SLIDE 84

2.

slide-85

SLIDE 85

3.

slide-86

SLIDE 86

4.

slide-87

SLIDE 87

Alert Someone: AWS IoT to AWS Lambda to SNS

Lambda Function

AWS IoT Rules Engine

Policy Private Key & Certificate Button Rule SDK AWS IoT AWS Services Execution Role Policy

SNS Topic

Permission Action SNS Topic Subscription

Rule: “Select * from ‘iotbutton/+’

Event Source Function SMS or Email

slide-88

SLIDE 88

Count items or Track Usage: AWS IoT to DynamoDB to Dashboard

DynamoDB

Rules Engine

Dashboard

S3 Website

Lambda Function

Policy Private Key & Certificate Button Rule SDK AWS IoT AWS Services Execution Role Policy Permission Action

Rule: “Select * from ‘iotbutton/+’

Event Source Function DynamoDB API Gateway

slide-89

SLIDE 89

Start or Stop Something : AWS IoT to AWS Lambda to an External Endpoint

Lambda Function

Rules Engine

Policy Private Key & Certificate Thing/Device Rule SDK AWS IoT AWS Services Execution Role Policy

External Endpoint

Permission

Rule: Select * from ‘iotbutton/+’

Action

External API

LifX API