Authentication & Access Control · Study deck
IoT Access Control: OAuth and Identity Lifecycle
A screen-free device cannot type a normal web password.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Least privilege shrinks the blast radius: a compromised low-privilege account or token can do little, whereas over-broad grants turn any breach into a full compromise.
- Explain: An authorization flaw lets the right person do the wrong thing - privilege escalation, or accessing another user's object by changing an ID (insecure direct object reference).
- Explain: Mixing the two is the root of a large class of real security bugs, where a correctly logged-in user reaches data that was never theirs.
- Explain: The deeper sections separate authentication, authorization, accounting, credentials, trust, lifecycle controls, and access evidence.
Major section
Identity and Access Control Roadmap
Application programming interface means a defined way for software systems to request actions or data; it is often shortened to API.
- A gateway means the boundary system that connects local devices to another network or service.
- This runway does not prove that every account or service is secure.
- When you later use hardware, the same process applies.
Major section
Identity and Access Control Roadmap (continued)
Finish at the protocol layer, where TLS or DTLS protects the proof in transit and application protocols carry authorised operations.
- The deeper sections separate authentication, authorization, accounting, credentials, trust, lifecycle controls, and access evidence.
- Learn how IoT systems prove identity, issue trust, and limit what each user or device can do.
- Authorization then uses a model.
Major section
Identity and Access Control Roadmap (continued)
An IoT system is not secure just because it uses encryption.
- The system must also know who is connecting, what that identity is allowed to do, and how to revoke access when something goes wrong.
- That order is the learning route the chapter guide now turns into concrete choices.
- Grant the minimum permissions a role needs.
Major section
Identity and Access Control Roadmap (continued)
Keeping them distinct is the foundation of the whole module.
- For beginners, the key idea is simple: authentication answers "Who are you?" and access control answers "What are you allowed to do?": Both are required.
- If either one is weak, attackers can move from a single stolen password or device key into the rest of the IoT system.
- Getting through the door is not the same as being allowed everywhere inside.
Major section
Identity and Access Control Roadmap (continued)
A system can authenticate you flawlessly and still must separately decide what you may touch.
- The map prevents a common sequencing error: studying an access-control model before understanding which credential established the subject it will govern.
- The only difference is that credentials come from real devices, cards, keys, or certificates instead of examples on the page.
- Logging in as yourself (authentication) does not entitle you to read someone else's records (authorization).
Major section
Identity and Access Control Roadmap (continued)
Authentication asks "who are you?" - it proves identity.: Authorization asks "what are you allowed to do?" - it grants permissions.
- Mixing the two is the root of a large class of real security bugs, where a correctly logged-in user reaches data that was never theirs.
- Intuition: authentication is showing your ID at the door; authorization is the guest list deciding which rooms your badge opens.
- password + SMS code -> know + have = real MFA password + security question -> know + know = NOT real MFA fingerprint + hardware key -> are + have = real MFA.
Major section
Identity and Access Control Roadmap (continued)
Identities have a lifecycle: provision, rotate credentials, and - critically - revoke on role change or offboarding.
- Because authentication and authorization are separate, they fail in separate ways - and both must be tested.
- An authorization flaw lets the right person do the wrong thing - privilege escalation, or accessing another user's object by changing an ID (insecure direct object reference).
- Stale, un-revoked access is a leading cause of breaches; deprovisioning is as important as onboarding.
Major section
Identity and Access Control Roadmap (continued)
Least privilege shrinks the blast radius: a compromised low-privilege account or token can do little, whereas over-broad grants turn any breach into a full compromise.
- Logs turn "someone changed this" into "this identity changed this at this time," which is essential for both response and deterrence.
- So the identity layer is five verbs, not one: identify, authenticate, authorize, log, and revoke.
- Authentication and access control provide the identity and permission layer for IoT security.
- Secure IoT systems need identity for every actor and least-privilege access for every action.
Deck summary
Key takeaways
Application programming interface means a defined way for software systems to request actions or data; it is often shortened to API.
- Finish at the protocol layer, where TLS or DTLS protects the proof in transit and application protocols carry authorised operations.
- An IoT system is not secure just because it uses encryption.
- Keeping them distinct is the foundation of the whole module.
- A system can authenticate you flawlessly and still must separately decide what you may touch.
Retrieval practice
Recall check 1 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q1Place each identity-system responsibility where it lives so you can route a design question to proof of identity, a permission decision, or lifecycle management.
Show answer
Answer: A Authentication, authorization, and identity lifecycle are connected but distinct routes: prove the subject, decide the action, and keep identities trustworthy over time.
Retrieval practice
Recall check 2 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q2An IoT deployment uses 5,000 battery-powered sensors that need to authenticate with a cloud backend. The sensors have 32KB RAM and must operate for 5 years on a coin cell battery. Which authentication approach is most appropriate?
Show answer
Answer: B PSK with DTLS provides mutual authentication with minimal RAM usage and low energy cost per handshake.
Retrieval practice
Recall check 3 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q3Complete the Python code to implement HMAC-based device authentication for an IoT gateway:
Show answer
Answer: A HMAC authentication combines device_id, timestamp, and payload into a message string, then signs it with the shared secret using HMAC-SHA256.
Q4What is the difference between authentication and authorization?
Show answer
Answer: A Identity (authentication) and permissions (authorization) are distinct decisions.
Retrieval practice
Recall check 4 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q5Why is 'password + security question' not considered true multi-factor authentication?
Show answer
Answer: A MFA requires different factor types so one theft does not defeat all factors.
Retrieval practice
Recall check 5 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q6A correctly logged-in user changes the numeric ID in a request URL and views another user's private record. Which control failed?
Show answer
Answer: A Being authenticated is not being authorized; per-object permission checks were missing.
Print reference
Answers 1 of 2
Answer key.
- A · Authentication, authorization, and identity lifecycle are connected but distinct routes: prove the subject, decide the action, and keep identities trustworthy over time.
- B · PSK with DTLS provides mutual authentication with minimal RAM usage and low energy cost per handshake.
- A · HMAC authentication combines device_id, timestamp, and payload into a message string, then signs it with the shared secret using HMAC-SHA256.
- A · Identity (authentication) and permissions (authorization) are distinct decisions.
Print reference
Answers 2 of 2
Answer key.
- A · MFA requires different factor types so one theft does not defeat all factors.
- A · Being authenticated is not being authorized; per-object permission checks were missing.