Authentication is important, but how do you authenticate when user interaction is not an option? For example, an IoT app without a user interface. We need to authenticate the app ― without any predefined credentials. But how?

1. Authentication Without
Authentication
AppSec California 2018
@omerlh

2. We help people get the most out of their technology

5. “Logins are tricky.
They account for a significant amount of drop-off in app usage,
losing up to 56% of users,
but are pretty much essential for the majority of apps
out there today...”
Source: Optimizely

6. What will you choose?
Security or usability?
Source: The Matrix

7. Why not both?

8. Source: Pinterest

9. Source: https://www.engadget.com/2016/01/08/samsung-family-hub-smart-fridge-hands-on/

10. Source: https://turcomusa.com/turcom-smart-home-camera-kit-with-motion-sensor-door-sensor-and-alarm-key-fob.html

11. User authentication/authorization
● User credentials
● User name
● Group
● Role
● Etc.

12. Device authentication/authorization
● Credentials?
● Identifier?
● No user information

13. Building blocks
● OpenID connect
● Digital signature
● One time password

14. Goals
● Authentication/authorization standard
● End user identity validation
● End user profile information
● RFC

16. Can we eliminate the end user?

17. Supported authentication flows
Authorization/implicit/hybrid
Client credentials
Resource owner

18. We need a new authentication flow

19. Requirements
 Strong authentication solution
 Unique device identification
 Simple
 Unique per request
 Replay attacks
 Fault tolerant

20. Potential threats
 Stolen/compromised device:
 Existing OS protections
 Man-in-the-middle
 HTTPS (TLS)
 Certificate pinning
Temporary device access
Reverse engineering/code
tampering
Sensitive data exposure
(server side)

21. Digital signature

22. Why digital signature?
●Wide spread
●Existing implementations

23. High-level design
●One-time registration
●Authentication request

24. Registration request
1
2
3
4
5

25. Authentication request
1
2
3
4
5

26. So far we have:
 Strong authentication solution
 Unique device identification
 Simple
 Unique per request
 Fault tolerant

27. Potential threats
 Stolen/compromised device:
 Existing OS protections
 Man-in-the-middle
 HTTPS (TLS)
 Certificate pinning
Temporary device access
Reverse engineering/code
tampering
 Sensitive data exposure
(server side)

28. One time password

29. Reminder: Authentication request

30. Device Authentication API
Old 5
New 2
Old 5
New 2
Old 2
New 42
Old 5
New 2
Old 2
New 42
Token
Authentication request

31. So far we have…
 Strong authentication solution
 Unique device identification
 Simple
 Unique per request
Fault tolerant

32. Potential threats
 Stolen/compromised device:
 Existing OS protections
 Man-in-the-middle
 HTTPS (TLS)
 Certificate pinning
Temporary device access
 Reverse engineering/code
tampering
 Sensitive data exposure
(server side)

33. Questions?

34. Fault tolerance

35. Network requests can fail
● Reasons
○ Timeout
○ Network failure
○ Temporary server errors
● Unknown server state
○ State did not change
○ State did change

36. Case A: Server state did not change

37. Case B: Server state did change

38. Case B: Server state did change

39. So far we have…
 Strong authentication solution
 Unique device identification
 Simple
 Unique per request
 Fault tolerant

40. Mitigating temporary access threats

41. OpenId --- Digital Signature --- One Time Password --- Demo --- Edges Cases

46. OpenId --- Digital Signature --- One Time Password --- Demo --- Edges Cases

47. Potential threats
 Stolen/compromised device:
 Existing OS protections
 Man-in-the-middle
 HTTPS (TLS)
 Certificate pinning
 Temporary device access
 Reverse engineering/code
tampering
 Sensitive data exposure
(server side)

48. Questions?

49. Demo time

50. Very-Cool-IoT-Project
● Show device’s nickname
● Highly sensitive
● Only the device can see it’s name

51. 1
2
3
4

52. How does authorization work?

53. eyJhbGciOiJSUzI1NiIsImtpZCI6IjI5N2ZhMDhiNmY5YzlhN2NhZj
M2YWRkZTRlOWQ3ZDQ5IiwidHlwIjoiSldUIn0.eyJuYmYiOjE1M
TQ4OTgzODgsImV4cCI6MTUxNDkwMTk4OCwiaXNzIjoiaHR0c
DovL2F1dGhvcml6YXRpb24tc2VydmVyIiwiYXVkIjpbImh0dHA6
Ly9hdXRob3JpemF0aW9uLXNlcnZlci9yZXNvdXJjZXMiLCJzZW
5zaXRpdmUucmVhZCJdLCJjbGllbnRfaWQiOiJydWJ5Iiwic3ViIj
oiNTc2NjYiLCJhdXRoX3RpbWUiOjE1MTQ4OTgzODgsImlkcCI
6ImxvY2FsIiwic2NvcGUiOlsic2Vuc2l0aXZlLnJlYWQiXSwiYW1y
IjpbInB3ZCJdfQ.eW_OreVsqHAzGs3DARVBAQowr7gn71ScOr
zikdhw5_G_EHnSPN7fqjh4mp4FZOZZhx476H8oZtGBEQUf6W
w6ZM824rm8d7IZQF3dE308tIa3VgbC0h1MpQilVf7xBZG5Cpt7
FWlkSIr5Dc9ihcOQivne4EWy-
M6a8GZGIpDcSKtQ99uuMk5bBi-
HlHx53m5llygxuUbKRTJvOsPG4cpB6CyC4J3MGT0hzmWTru2
IFRhIh6B1hiaUXp7z6mCULeGwRu64X31DGqGIFTdZQpkAb5E
VF45gLcvwXVmouPsaiXNiJiMUD_38Vho4iIbn9zl87FQjdvRAJ1
JyFoGS1mMjCQ
Let’s look at the token…
https://jwt.io

54. Technology

56. Let’s see it in action...
All the code is available on GitHub

58. Let’s test authorization…

60. Questions?

61. Acknowledgments
The information in this presentation is based on my work at Soluto by Asurion, and I'd to
thank the whole company for being awesome. I'd also like to give a special thanks to the
following colleagues for their help:
● Oded Welgreen
● Asaf Kotzer
● Mark Geeslin
● Guy Segal
● Michael Kruglos

62. How can you use it?
@omerlh

63. Feedback is much appreciated!

64. Responsible disclosure
security@soluto.com
@omerlh
S/MIME certificate

65. What will you choose?
Security or usability

66. Thank you!
@omerlh
@SolutoEng