Secure deployment confirmation of IOT devices via bearer tokens with caveats
The disclosed technology teaches confirming proper deployment of sensors, with an authorization server (AS) issuing to a first client a Macaroon access token (MAT), optionally with caveats, including a root signature, and providing the MAT to a client. The client modifies the MAT to produce multiple instances by appending caveats that add a deployment location to each of the instances, and applies a message authentication code (MAC) chaining algorithm to generate updated signatures to include in the instances of a MAT with caveats (MATwC). The first client forwards the multiple instances of the MATwC to respective sensor instances, and a second client receives, from the sensor instances, sensed data and location indicative data, accompanied by respective MATwC instances. The second client verifies that the location indicative data is consistent with the deployment location caveat in the respective MATwC and utilizes instances of the sensed data that are verified as consistent.
1. A method of confirming proper deployment of sensors, including:
an authorization server (AS) issuing to a first client a Macaroon access token (MAT), optionally with caveats in the MAT, including a root signature, and directly or indirectly providing the MAT to a client;
the first client modifying the MAT to produce multiple instances by appending caveats to the MAT that add a deployment location to each of the multiple instances, and by applying a message authentication code (MAC) chaining algorithm to generate updated signatures to include in the multiple instances of a MAT with caveats (MATwC);
the first client forwarding the multiple instances of the MATwC to respective sensor instances;
a second client receiving, from the sensor instances, sensed data and location indicative data, accompanied by respective MATwC instances; and
the second client verifying that the location indicative data is consistent with the deployment location caveat in the respective MATwC and utilizing instances of the sensed data that are verified as consistent.
2. The method of claim 1 , further including the MAT being compatible with either of OAuth 2.0 or OAuth 2.1 drafts as of November 2020.
3. The method of claim 1 , further including:
the second client passing each of the respective MATwC instances to the AS;
the AS determining authenticity of each MATwC as a bearer token; and
the AS reporting results of the determining authenticity to the second client.
4. The method of claim 1 , further including the AS determining and reporting the deployment location from each MATwC.
5. The method of claim 1 , further including the AS evaluating and reporting whether the location indicative data satisfies the deployment location from each accompanying MATwC.
6. The method of claim 1 , further including the first client applying a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of a MATwC instance amongst the multiple instances of MATwC.
7. The method of claim 6 , wherein the MAT includes caveats, the AS generating a pre-issuance signature for part of the MAT not including the caveats, then the AS using the pre-issuance signature as a key in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
8. The method of claim 6 , wherein the root signature is excluded from the content of each MATwC instance.
9. A non-transitory computer readable storage medium impressed with computer program instructions to confirm proper deployment of sensors, the instructions, when executed on a processor, implement a method comprising:
an authorization server (AS) issuing to a first client a Macaroon access token (MAT), optionally with caveats in the MAT, including a root signature, and directly or indirectly providing the MAT to a client;
the first client modifying the MAT to produce multiple instances by appending caveats to the MAT that add a deployment location to each of the multiple instances, and by applying a message authentication code (MAC) chaining algorithm to generate updated signatures to include in the multiple instances of a MAT with caveats (MATwC);
the first client forwarding the multiple instances of the MATwC to respective sensor instances;
a second client receiving, from the sensor instances, sensed data and location indicative data, accompanied by respective MATwC instances; and
the second client verifying that the location indicative data is consistent with the deployment location caveat in the respective MATwC and utilizing instances of the sensed data that are verified as consistent.
10. The non-transitory computer readable storage medium of claim 9 , implementing the method further comprising:
the MAT being compatible with either of OAuth 2.0 or OAuth 2.1 drafts as of November 2020.
11. The non-transitory computer readable storage medium of claim 9 , implementing the method further comprising:
the second client passing each of the respective MATwC instances to the AS;
the AS determining authenticity of each MATwC as a bearer token; and
the AS reporting results of the determining authenticity to the second client.
12. The non-transitory computer readable storage medium of claim 9 , implementing the method further comprising the AS determining and reporting the deployment location from each MATwC.
13. The non-transitory computer readable storage medium of claim 9 , implementing the method further comprising the AS evaluating and reporting whether the location indicative data satisfies the deployment location from each accompanying MATwC.
14. The non-transitory computer readable storage medium of claim 9 , implementing the method further comprising the first client applying a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature root signature from content of a MATwC instance amongst the multiple instances of MATwC.
15. The non-transitory computer readable storage medium of claim 14 , wherein the MAT includes caveats, the AS generating a pre-issuance signature for part of the MAT not including the caveats, then the AS using the pre-issuance signature as a key in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
16. The non-transitory computer readable storage medium of claim 14 , wherein the root signature is excluded from the content of each MATWC instance.
17. A system including one or more processors coupled to memory, the memory loaded with computer instructions to confirm proper deployment of sensors, the instructions, when executed on the processors, implement actions comprising:
an authorization server (AS) issuing to a first client a Macaroon access token (MAT), optionally with caveats in the MAT, including a root signature, and directly or indirectly providing the MAT to a client;
the first client modifying the MAT to produce multiple instances by appending caveats to the MAT that add a deployment location to each of the multiple instances, and by applying a message authentication code (MAC) chaining algorithm to generate updated signatures to include in the multiple instances of a MAT with caveats (MATwC);
the first client forwarding the multiple instances of the MATwC to respective sensor instances;
a second client receiving, from the sensor instances, sensed data and location indicative data, accompanied by respective MATwC instances; and
the second client verifying that the location indicative data is consistent with the deployment location caveat in the respective MATwC and utilizing instances of the sensed data that are verified as consistent.
18. The system of claim 17 , further implementing actions comprising the MAT being compatible with either of OAuth 2.0 or OAuth 2.1 drafts as of November 2020.
19. The system of claim 17 , further implementing actions comprising:
the second client passing each of the respective MATwC instances to the AS;
the AS determining authenticity of each MATwC as a bearer token; and
the AS reporting results of the determining authenticity to the second client.
20. The system of claim 17 , further implementing actions comprising the AS determining and reporting the deployment location from each MATwC.
21. The system of claim 17 , further implementing actions comprising the AS evaluating and reporting whether the location indicative data satisfies the deployment location from each accompanying MATwC.
22. The system of claim 17 , further implementing actions comprising the first client applying a hash-based message authentication code (HMAC) chaining algorithm to generate the updated signature, including using the root signature as a key for the HMAC and excluding the root signature from content of a MATwC instance amongst the multiple instances of MATwC.
23. The system of claim 22 , wherein the MAT includes caveats, the AS generating a pre-issuance signature for part of the MAT not including the caveats, then the AS using the pre-issuance signature as a key in the MAC chaining algorithm when generating the root signature to the MAT including the caveats.
24. The system of claim 22 , wherein the root signature is excluded from the content of each MATwC instance.