Authentication & Access · Study deck

Advanced Access Control: Capability-Based Authorization

A capability grants one subject a narrow right to one object.

Shield Shelly is your guide for this deck.

authconceptssecurity

Shield Shelly, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: The next question is what credential carries that state across API calls, and what happens when that credential is refreshed, revoked, or stolen.
Explain: One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.
Explain: Mistake: Developers often handle the "happy path" (token issued, used, expired) but fail to account for real-world edge cases.
Explain: That check helps, but it does not prove the device is harmless or that every request is valid.

Major section

Start With the Story

One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.

A single “staff” label is too broad for all three jobs.
Access control is the rule set that decides who or what may perform an action.
Refuse the request when any needed fact is missing.

Major section

Start With the Story (continued)

Revoke it after loss, role change, or suspected misuse.

A device may also need to prove that its software is in an accepted state.
That check helps, but it does not prove the device is harmless or that every request is valid.
The IoT lesson is that advanced access control is mostly about time, context, and failure.

Major section

Try It: Session Timeline Simulator

Adjust the parameters and add activity timestamps to see when the session expires.

The session simulator showed how state expires.
The next question is what credential carries that state across API calls, and what happens when that credential is refreshed, revoked, or stolen.

Try It: Session Timeline Simulator

Major section

Common Mistake: Ignoring Token Lifecycle Edge Cases

Mistake: Developers often handle the "happy path" (token issued, used, expired) but fail to account for real-world edge cases.

Scenario: An ESP32 device loses power during a token refresh operation.

Deck summary

Key takeaways

One worker may view a machine, another may change a limit, and a supervisor may approve an urgent action for ten minutes.

Revoke it after loss, role change, or suspected misuse.
Adjust the parameters and add activity timestamps to see when the session expires.
Mistake: Developers often handle the "happy path" (token issued, used, expired) but fail to account for real-world edge cases.

Retrieval practice

Recall check 1 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q1An IoT system uses capability-based access control with flags: READ (0x01), WRITE (0x02), EXECUTE (0x04), ADMIN (0x08). A user has capabilities 0x07. Which operation will be denied?

AReading sensor data (requires READ)

BWriting configuration (requires WRITE)

CRunning diagnostics (requires EXECUTE)

DManaging users (requires ADMIN)

Show answer

Answer: D Correct!

Retrieval practice

Recall check 2 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q2A session token was issued at 10:00 AM with a 5-minute lifetime and 3 refresh attempts allowed. The user refreshes at 10:03 AM, 10:06 AM, and 10:09 AM. At 10:11 AM, the user tries to access a resource. What happens?

AAccess granted - the token was refreshed three times extending its validity

BAccess denied - the token reached maximum refresh count and expired

CAccess granted, but no refreshes remain

DAccess denied - tokens cannot be refreshed more than twice

Show answer

Answer: C Correct!

Retrieval practice

Recall check 3 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q3A smart thermostat boots and must prove to the cloud that it is running authentic firmware before receiving updates. The device's secure element contains an attestation key that signs a hash of the boot firmware. An attacker replaces the firmware with malware. Why does device attestation detect this?

AThe malware cannot access the attestation key in the secure element

BThe attestation signature will be invalid because the firmware hash changed

CThe cloud checks the signed hash against known-good firmware

DThe secure element refuses to sign attestations if firmware is modified

Show answer

Answer: C Correct!

Retrieval practice

Recall check 4 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q4A fleet of 50,000 battery-powered soil moisture sensors needs MFA-style security but has only 128KB RAM, intermittent connectivity, and must last 5 years on a coin cell. The security team proposes: (1) Device certificate in secure element, (2) TOTP code generated every 30 seconds, (3) SMS confirmation to farmer. What is the critical flaw?

ASecure elements are too expensive for low-cost sensors at scale

BTOTP and SMS require frequent connectivity and drain the battery

C128KB RAM is insufficient to store the device certificate

DFarmers cannot be expected to enter TOTP codes for 50,000 sensors

Show answer

Answer: B Correct!

Retrieval practice

Recall check 5 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q5An industrial IoT platform implements authentication (certificate-based mTLS) and authorization (role-based). A compromised sensor's certificate is used to authenticate, but authorization prevents it from accessing admin functions. However, the attacker uses the authenticated connection to flood the server with valid-but-excessive API calls (DoS). What security layer is missing?

AAuthentication failed - compromised certificates should be detected

BAuthorization failed - API rate limits should be enforced per role

CAccounting/Monitoring is missing - rate limiting, quotas, and anomaly detection needed

DThis attack cannot be prevented - authenticated users can send unlimited requests

Show answer

Answer: C Correct!

Retrieval practice

Recall check 6 of 6

Shield Shelly says: answer from memory, then check your reasoning.

Q6Complete the password hashing function for IoT admin accounts:

Asalt = os.urandom(16)

Bsalt = 'fixed_salt'.encode()

Csalt = hashlib.sha256(password.encode()).digest()

Dsalt = bytes(16)

Show answer

Answer: A os.urandom() generates cryptographically secure random bytes. PBKDF2 with 100k iterations makes brute-force attacks expensive.

Print reference

Answers

Answer key.

D · Correct!
C · Correct!
C · Correct!
B · Correct!
C · Correct!
A · os.urandom() generates cryptographically secure random bytes. PBKDF2 with 100k iterations makes brute-force attacks expensive.