Chapter 7. Identity and Access Management Solutions for the IoT

While society continues to adopt ever more smart home appliances and IoT wearables, the IoT is diversifying into broader applications for different professions, and governments and throughout industries. The network connectivity needed to support it is becoming ubiquitous and, to that end, devices will need to be identified and access provisioned in new and different environments and organizations. This chapter provides an introduction to identity and access management for IoT devices. The identity life cycle is reviewed, and a discussion on infrastructure components required for provisioning authentication credentials is provided, with a heavy focus on PKI. We will also examine different types of authentication credentials and discuss new approaches to providing authorization and access control for IoT devices.

We will address these subjects in the following topic areas:

• Introductory discussion on Identity and Access Management...

An introduction to IAM for the IoT

Security administrators have traditionally been concerned with managing the identities of people and controlling access to systems that interact with their technology infrastructure. The concept of Bring Your Own Device (BYOD), for example, can allow authorized individuals to associate mobile phones or laptops with their corporate account to receive network services on their personal devices. The allowed network services may be given once minimal security assurances are deemed to have been satisfied on the device. This may include using strong passwords for account access, application of virus scanners, or even mandating partial or full disk encryption to help with data loss prevention.

The IoT introduces a much richer connectivity environment than BYOD. Many more IoT devices are expected to be deployed throughout an organization than the usual one or two mobile phones or laptops for each employee. IAM infrastructures must be designed to scale to the number...

The identity life cycle

Before we begin to examine the technologies that support IAM for the IoT, it is useful to lay out the life cycle phases of what we call identity. The identity life cycle for an IoT device begins with defining the naming conventions for the device; it ends with the removal of the device's identity from the system. The following diagram provides a view of the process flow:

 

This life cycle procedure should be established and applied to all IoT devices that are procured, configured, and ultimately attached to an organization's network. The first aspect requires a coordinated understanding of the categories of IoT devices and systems that will be introduced within your organization, both now and in the future. Establishing a structured identity namespace will significantly help manage the identities of the thousands or millions of devices that will eventually be added to your organization.

Establish naming conventions and uniqueness requirements

Uniqueness is a feature that...

Authentication credentials

IoT messaging protocols often support the ability to use different types of credentials for authentication with external services and other IoT devices. This section examines the typical options available for these functions.

Passwords

Some protocols, such as MQTT, only provide the ability to use a username/password combination for native-protocol authentication purposes. Within MQTT, the connect message includes the fields for passing this information to an MQTT broker. In the MQTT Version 3.1.1 specification defined by OASIS, you can see these fields within the connect message (reference: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html):

Note

There are no protections applied to support the confidentiality of the username/password in transit by the MQTT protocol. Instead, implementers should consider using the Transport Layer Security (TLS) protocol to provide cryptographic protections.

There are numerous security considerations related to using...

IoT IAM infrastructure

Now that we have addressed many of the enablers of identity and access management, it is important to elaborate how solutions are realized in infrastructure. This section is primarily devoted to Public Key Infrastructures (PKI) and their utility in securing IAM deployments for the IoT.

802.1x

The 802.1x authentication mechanisms can be employed to limit IP-based IoT device access to a network. Note though that not all IoT devices rely on the provisioning of an IP address. While it cannot accommodate all IoT device types, implementing 802.1x is a component of a good access control strategy able to address many use cases.

Enabling 802.1x authentication requires an access device and an authentication server. The access device is typically an access point and the authentication server can take the form of a RADIUS or some Authentication, Authorization, and Accounting (AAA) server.

 

PKI for the IoT

Chapter 6, Cryptographic Fundamentals for IoT Security Engineering, provided...

Authorization and access control

Once a device is identified and authenticated, determining what that device can read or write to other devices and services is required. In some cases, being a member of a particular Community Of Interest (COI) is sufficient; however, in many instances there are restrictions that must be put in place, even upon members of a COI.

OAuth 2.0

To refresh, OAuth 2.0 is a token-based authorization framework specified in IETF RFC 6749, which allows a client to access protected, distributed resources (that is, from different websites and organizations) without having to enter passwords for each. As such, it was created to address the frequently cited sad state of password hygiene on the internet. Many implementations of OAuth 2.0 exist, supporting a variety of programming languages to suit. Google, Facebook, and many other large tech companies make extensive use of this protocol.

The IETF ACE working group has created working papers that define the application of OAuth...

Summary

This chapter provided an introduction to identity and access management for IoT devices. We reviewed the identity life cycle and discussed infrastructure components such as PKIs required for provisioning authentication credentials. We examined different types of authentication credentials and explored new approaches to providing authorization and access control for IoT devices.

In Chapter 8, Mitigating IoT Privacy Concerns, we will visit the complex ecosystem in which IoT privacy concerns need to be addressed and mitigated. Security controls, such as effective identity and access management, which were discussed in this chapter, represent only one element of the IoT privacy challenge.