Authentication & Access · Study deck

Advanced Access Control: Capability-Based Authorization

A capability grants one subject a narrow right to one object.

Shield Shelly is your guide for this deck.

authconceptssecurity

After studying this chapter

Learning objectives

You will be able to:

Explain: The EST connection authenticates the existing device certificate, and the replacement certificate must be checked against the new key and expected device identity before activation.
Explain: The next question is what credential carries that state across API calls, and what happens when that credential is refreshed, revoked, or stolen.
Explain: One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.
Explain: At an assumed $0.03 per device, total modeled cost is $1,500; EST does not prescribe a server fee.

Major section

Start With the Story

One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.

A single “staff” label is too broad for all three jobs.
Access control is the rule set that decides who or what may perform an action.
Refuse the request when any needed fact is missing.

Major section

Start With the Story (continued)

Revoke it after loss, role change, or suspected misuse.

A device may also need to prove that its software is in an accepted state.
That check helps, but it does not prove the device is harmless or that every request is valid.
The IoT lesson is that advanced access control is mostly about time, context, and failure.

Major section

Try It: Session Timeline Simulator

Adjust the parameters and add activity timestamps to see when the session expires.

The session simulator showed how state expires.
The next question is what credential carries that state across API calls, and what happens when that credential is refreshed, revoked, or stolen.

Major section

Worked Example: Enterprise Certificate Rotation at Scale

Each meter uses ECDSA-P256 keys stored in a secure element.

You need to renew all certificates without service disruption.
Step 2: Design Renewal Protocol (EST: RFC 7030): The following is protocol pseudocode, not a deployable C++ implementation.
Step 3: Handle Renewal Failures: The percentages below are scenario assumptions for planning, not measured failure rates.

Major section

Worked Example: Enterprise Certificate Rotation at Scale (continued)

The EST connection authenticates the existing device certificate, and the replacement certificate must be checked against the new key and expected device identity before activation.

They overlap and cannot be added to infer the final success rate.
Illustrative result: At the assumed 98.5% automated renewal rate, 750 devices (1.5%) require manual intervention.
At an assumed $0.03 per device, total modeled cost is $1,500; EST does not prescribe a server fee.

Deck summary

Key takeaways

One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.

Revoke it after loss, role change, or suspected misuse.
Adjust the parameters and add activity timestamps to see when the session expires.
Each meter uses ECDSA-P256 keys stored in a secure element.
The EST connection authenticates the existing device certificate, and the replacement certificate must be checked against the new key and expected device identity before activation.

Retrieval practice

Recall check 1 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q1An IoT system uses capability-based access control with flags: READ (0x01), WRITE (0x02), EXECUTE (0x04), ADMIN (0x08). A user has capabilities 0x07. Which operation will be denied?

AReading sensor data (requires READ)

BWriting configuration (requires WRITE)

CRunning diagnostics (requires EXECUTE)

DManaging users (requires ADMIN)

Show answer

Answer: D 0x07 binary is 0111, which does not include the ADMIN bit (0x08 = 1000).

Retrieval practice

Recall check 2 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q2A session token is issued at 10:00 AM with a five-minute access-token lifetime and three allowed refreshes. Each successful refresh issues a replacement access token valid for five minutes from that refresh; no minimum interval applies. Refreshes succeed at 10:03, 10:06, and 10:09. At 10:11, the user presents the latest token. What happens?

AAccess granted - the token was refreshed three times extending its validity

BAccess granted at 10:11; token valid until 10:14, with zero refreshes left.

CAccess denied - the token reached maximum refresh count and expired

DAccess denied - tokens cannot be refreshed more than twice

Show answer

Answer: B The 10:09 AM refresh extended validity to 10:14 AM.

Retrieval practice

Recall check 3 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q3A smart thermostat boots and must prove to the cloud that it is running authentic firmware before receiving updates. The device's secure element contains an attestation key that signs a hash of the boot firmware. An attacker replaces the firmware with malware. Why does device attestation detect this?

AThe malware cannot access the attestation key in the secure element

BThe cloud checks the signed hash against known-good firmware

CThe attestation signature will be invalid because the firmware hash changed

DThe secure element refuses to sign attestations if firmware is modified

Show answer

Answer: B Correct, if trusted boot code produced the measurement: the verifier checks fresh signed evidence from the enrolled device and compares the firmware digest with approved reference values.

Retrieval practice

Recall check 4 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q4A fleet of 50,000 battery-powered soil moisture sensors needs MFA-style security but has only 128KB RAM, intermittent connectivity, and must last 5 years on a coin cell. The security team proposes: (1) Device certificate in secure element, (2) TOTP code generated every 30 seconds, (3) SMS confirmation to farmer. What is the critical flaw?

ASecure elements are too expensive for low-cost sensors at scale

BTOTP needs a synced clock; SMS needs connectivity and battery power.

C128KB RAM is insufficient to store the device certificate

DFarmers cannot be expected to enter TOTP codes for 50,000 sensors

Show answer

Answer: B TOTP is computed offline from a shared secret and time; it needs a sufficiently accurate clock, not a network connection for each code.

Retrieval practice

Recall check 5 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q5An industrial IoT platform implements authentication (certificate-based mTLS) and authorization (role-based). A compromised sensor's certificate is used to authenticate, but authorization prevents it from accessing admin functions. However, the attacker uses the authenticated connection to flood the server with valid-but-excessive API calls (DoS). What security layer is missing?

AAuthentication failed - compromised certificates should be detected

BAuthorization failed because the compromised sensor could open the blocked admin functions.

CThis attack cannot be prevented - authenticated users can send unlimited requests

DAccounting/Monitoring is missing - rate limiting, quotas, and anomaly detection needed

Show answer

Answer: D Identity and role checks did not stop excessive requests to permitted APIs.

Retrieval practice

Recall check 6 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q6Complete the password hashing function for IoT admin accounts:

Asalt = os.urandom(16)

Bsalt = 'fixed_salt'.encode()

Csalt = hashlib.sha256(password.encode()).digest()

Dsalt = bytes(16)

Show answer

Answer: A os.urandom() generates cryptographically secure random bytes. PBKDF2 with 100k iterations makes brute-force attacks expensive.

Print reference

Answers 1 of 2

Answer key.

D · 0x07 binary is 0111, which does not include the ADMIN bit (0x08 = 1000).
B · The 10:09 AM refresh extended validity to 10:14 AM.
B · Correct, if trusted boot code produced the measurement: the verifier checks fresh signed evidence from the enrolled device and compares the firmware digest with approved reference values.
B · TOTP is computed offline from a shared secret and time; it needs a sufficiently accurate clock, not a network connection for each code.

Print reference

Answers 2 of 2

Answer key.

D · Identity and role checks did not stop excessive requests to permitted APIs.
A · os.urandom() generates cryptographically secure random bytes. PBKDF2 with 100k iterations makes brute-force attacks expensive.