Kranky geek15 - securing IoT with webrtc

Building a different sort of

WebRTC appTim Panton - Protocol Droid - westhawk Ltd

@steely_glint

@steely_glint - Westhawk Ltd






Security isn’t what it was.


Ideal Internet of everything

Protocol would beStandardized

Secure

Widely deployed

Peer-to-Peer (NAT traversal)

Realtime

Strong on Identity management

Mobile capable (and smaller)

User-centric


RTCweb Protocol is

Standardized

Secure

Widely deployed


Realtime


Mobile capable (and smaller) ?

User-centric


What we will build today

Realtime

Authenticated

P2P communication

Between a small device

and a webRTC browser

- using the DataChannel but no passwords.


Components we need

WebRTC (datachannel) app in my smartphone

WebRTC (datachannel) embedded in a device

WebRTC service for rendevous

Some sort of pairing


Components we will use

Chrome on android (well Mac - for easy AV)

Lightweight stack on device

Simple websockets message hub

(https://github.com/steely-glint/fingersmith)

QRcode pairing


Duckling protocol

Described by Ross Anderson in

1990s

Device trusts first thing it sees

We flip this and the device shows

QRcode

Smartphone then calls this address

First to connect claims ownership

https://www.flickr.com/photos/bunnygoth/14021732859/

https://www.flickr.com/photos/bunnygoth/14021732859/

Demo of QR using yoPet.us

http://yoPet.us

Code walk through of

Fingersmith


Which address token?

WebRTC has no built in identity so …

Random key

Generated server side (like XMPP anon)

Generated client side and asserted to service

(As in Respoke, Twillio etc)

Exchanged over QR code at ‘hatching’

Stored locally and reused for ‘life’


But wait…Full disclosure:

this is such a good idea I filed a patent on it

Whats this fingerprint thing ?

Hash of the x509 cert used in DTLS exchange

Can we use that as an address ?

Yes - it means the duckling can tell that it is mommy calling

and ignore all other distractions.

More on this at IIT RTC conference in October…


Javascript walkthrough

Dummy offer to find it at start-up

Phono.sdp.js parse SDP to extract fingerprint

(open source - thanks tropo)

Ipseorama to set up DataChannel

via Fingersmith

generateCertificate + IndexDB to make firefox use

stable identity


Device Code options

Javascript

Use google’s webrtc wrapped in node

C/C++

Use Janus codebase etc….

Java

DIY


Yep, you guessed it,

I took the Java way.

STUN/TURN/ICE

Ice4j - Jitsi

DTLS

BouncyCastle - Tropo (now Cisco)

SCTP/DCEP

in progress….


Demo on Beaglebone

Think of it as an American Pi :-)

Typical of future devices

Small footprint

Low power

Linux

ARM (see Intel Edison)


What, that’s not small enough

Arm 9

300Mhz

64 Mb

Linux


Lego EV3

Lego EV3

Arm 9

300Mhz

64 Mb

Linux

LeJos Java ;-)


Demo


By using webRTC

data channel we haveStandardized

Secure

Widely deployed


Realtime


Mobile capable (and smaller)

User-centric

tldr;

WebRTC isn’t just for video calls - it

can solve Internet of Everything

problems too.Tim Panton - Protocol Droid - Westhawk Ltd

@steely_glint