IoT security is a hot-button issue in today's world: there are more internet-connected devices than there are people, and the amount of data being shared has exploded over the past few years. However, keeping that data safe is becoming a problem just as quickly— especially with the advent of health-sensitive devices, and devices that could be dangerous if compromised, like vehicles!
I can't claim to have all the answers, but I do have one trick up my sleeve that should help you in your quest for security — JSON Web Tokens, which I'll also refer to as JWTs. These small, portable, verifiable tokens help make sure the communications you are sending and receiving from your devices and servers are from a trusted source. They also make great bearer and access tokens.
What's a JSON Web Token?
For those who haven't come across these before, JSON Web Tokens are JSON-based tokens used to send verified information across the web. They are base64 encoded before they are sent, so they tend to look like this:
[caption id="attachment_134494" align="aligncenter" width="1024"]
What you are seeing above is the JWT debugger at JWT.io, a site where you can learn a lot more about JWTs than we'll have room to go over in this article. On the left is the encoded, completed JWT. It includes:
- The header, base64 encoded, concatenated with a '.'
- The payload, base64 encoded, with another '.'
- The signed key
On the right is the decoded header and payload. They consist of claims (which is just a fancy name for JSON key-value pairs). Some claims are declared by the standard — "alg" is for the signing algorithm for the key and "sub" stands for subscriber. Other claims you make yourself, such as "admin".
The key consists of a signed hash of the header, concatenated with a ".", then the payload, all base64 encoded. It is signed with a secret that is to be held by both parties, and can be symmetrical (a string) or asymmetrical (an RSA public/private key pair).
These claims come together to describe the token itself and anything else you'd like to keep such as user information and relevant session data. Just be sure to keep this data limited — one of the big benefits of JWTs is they are very small if you don't overstuff them!
You send JWTs by putting them in the Authorization HTTP header with the format:
[code language="js"]
Authorization: bearer <token>
[/code]
If you can't modify HTTP headers, many services will also accept the JWT as a body parameter, or even a query parameter. Those methods aren't recommended if you can use HTTP headers.
What Are The Benefits of JWTs?
The IoT world is a world of small devices, and developers strive to make the HTTP calls these devices make as small as possible. JWTs help with this by having very little overhead. They use the minimalistic JSON scheme and base64 encoding to achieve this. Just make sure you don't add too many claims of your own, or else the benefit of size will overridden by your usage of them! Keep the claims to a minimum to keep your app functioning.
Why not cookies? This also hearkens to the HTTP request need. Instead of your server having to use the cookie to go find other information about the user's session, it is all inside the JWT from the start. This means there are no extra database or external service calls to make. Again, this depends on how you use them, so think carefully about what claims you need, and which you don't.
Another benefit of JWTs is that they are universal — JSON parsers exist for nearly every platform, and the ability to access base64 encoding/decoding along with hsa256 signing and verification is becoming more and more of a given. Also, JWTs are backed by a web standard, so you can be confident knowing you are using tech that can easily integrate with other web standards-compliant services, including many OAuth2 providers and all providers of the OpenID Connect standard.
Even if your IoT device cannot decode the token, it can be handed to the device as an access token for your servers and services. As long as your device can store a string given to it, JWTs can be used as a stored credential by your IoT devices. Just be extra sure to secure these tokens and keep a close eye on them, as bearer tokens can be dangerous if leaked!
One of the many challenges of today's web architecture is validating yourself across services scattered across multiple domains — even a single hobbyist or company might have services running on different PaaS providers! JWTs make this cross-domain negotiation easier — as long as all parties share the same secret to verify the key, then the JWT doesn't care about domain, subdomain, port, etc.
Continue reading %Securing Your IoT Devices and Services with JSON Web Tokens%
by Kassandra Perch via SitePoint
No comments:
Post a Comment