Discovery and Connection Management Security for 2110

Presenters : Arne Bönninghoff - Riedel

Year : 2019

dlp_document_download : AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 1 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 C U R A T E D B Y Security for Discovery and Connection management of ST 2110 Media Devices Arne Bönninghoff – Head of IP Research Riedel Communications GmbH & Co. KG I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Media Node Maturity Checklist AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 2 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Why security I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Why security AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 3 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Types of traffic •Control devices to nodes •Control devices to servers •Nodes to servers •Nodes to nodes I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Levels of security •Confidentiality Data passing between client and the APIs is unreadable to third parties. •Identification The client can check whether the API it is interacting with is owned by a trusted party. •Integrity It must be clear if data travelling to or from the API been tampered with. •Authentication The client can check if packets actually came from the API it is interacting with, and vice versa. •Authorisation The API can determine whether the client interacting with it has authorisation to carry out the operation requested. courtesy Simon Rankine BBC R&D AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 4 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Work areas AMWA BCP -003 Establishing Trust ‒Public key infrastructure with x509 certificates ‒Explore how PKI can be used in a broadcast environment Connection Security ‒HTTP over TLS (HTTPS) – IS-04, -05, -06, ( -07), -08, -09 ‒Identify cipher suites for interoperability ‒Establish best practice for use of TLS with AMWA NMOS APIs Client Authorisation ‒OAuth 2.0 with JSON Web Tokens ‒Identify what is needed to ensure interoperability courtesy Simon Rankine BBC R&D I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Work areas AMWA BCP -003 Establishing Trust ‒Public key infrastructure with x509 certificates ‒Explore how PKI can be used in a broadcast environment Connection Security ‒HTTP over TLS (HTTPS) – IS-04, -05, -06, ( -07), -08, -09 ‒Identify cipher suites for interoperability ‒Establish best practice for use of TLS with AMWA NMOS APIs Client Authorisation ‒OAuth 2.0 with JSON Web Tokens ‒Identify what is needed to ensure interoperability BCP -003 -01 courtesy Simon Rankine BBC R&D AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 5 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Work areas AMWA BCP -003 Establishing Trust ‒Public key infrastructure with x509 certificates ‒Explore how PKI can be used in a broadcast environment Connection Security ‒HTTP over TLS (HTTPS) – IS-04, -05, -06, ( -07), -08, -09 ‒Identify cipher suites for interoperability ‒Establish best practice for use of TLS with AMWA NMOS APIs Client Authorisation ‒OAuth 2.0 with JSON Web Tokens ‒Identify what is needed to ensure interoperability BCP -003 -02 IS-10 courtesy Simon Rankine BBC R&D I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – establish trust AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 6 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – establish trust I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – establish trust AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 7 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – DNS as a prerequesite I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – DNS as a prerequesite •Issued on Hostname not on IP Address •DNS resolution essential AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 8 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 DNS Resolution – follow TR -1001 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Key Exchange – additional entity AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 9 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Certification Authorisation I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Client and Server: Example IS -04 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 10 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Client and Server: Example IS -04 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Client and Server : Example IS -05 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 11 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Client and Server : Example IS -05 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Connection Security – Interoperable HTTPS Cipher Suites for keys TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS ECDHE ECDSA WITH AES 128 CCM 8 Use TLS v1.2 – be ready for v1.3 when available! https://www.bbc.co.uk/rd/publications/whitepaper337 Should support Shall support AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 12 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Interop Workshop discussion TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS ECDHE ECDSA WITH AES 128 CCM 8 Use TLS v1.2 – be ready for v1.3 when available! Should support Shall support I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Interop Workshop discussion TLS v1.2 Summary Most -supported ciphers (by all who submitted results): TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 Note that the sample size below is just four implementations AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 13 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Conclusion BCP -003 -01 •Broadcast devices need to be able to import Root CA certificates (trust Servers) as well as import or generate Key/Certificate pairs (acting as server) •Broadcast devices need to support range of required cipher suites •Broadcast Controller need to trust Root CA certificates •Broadcast Infrastructure needs to provide CA or Internet Access •Broadcast Infrastructure needs to provide DNS workflow Security implementation simple for end devices – cipher suite topic aside Infrastructure more challenging CA, DNS, DHCP -> TR -1001 Needs more participation from vendors, all AMWA workshops now based on TLS NMOS APIs prepared for TLS I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 BCP -003 -02 •As a user, I want my main control system to be the only system being authorized to query the network for IS -04 ressources •As a user, I want my main control system to be the only system being authorized to make connections with IS -05 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 14 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 BCP -003 -02 •Describes techniques how to retrieve a token and get authorized access •Describes techniques for NMOS nodes how to validate tokens •Describes the type of information stored in the token I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 How to become authorized? AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 15 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Initial setup – IS -10 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Accessing Resources AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 16 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 OAuth2 + JWT for NMOS •Authorization server issues keys to ressource servers (=NMOS Nodes) ‒Needed to be able to decrypt tokens for validation ‒Keys are refreshed in short intervals (1 hour) •Authorization server issues tokens to Clients (=control systems) ‒Needed to be able to perform actions against ressource servers ‒Clients need to be listed in advance in the auth server (out of scope) •LDAP/AD/SSO I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 JWT •Header, Body, Signature •Body containing claims •Rfc7519 Issued key needed to verify the signature only valid tokens are processed AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 17 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 •Simple claims today •More granular claims in future ‒Location ‒Role I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 BCP -003 -02 in the "NMOS World" •Authorisation server visible through DNS -SD •Backwards compatible ‒Just send IS -04 and IS -05 without token •Also applicable for IS -04 query API ‒Example: only some controllers are allowed to retrieve information AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 18 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 •Device exchange takes time •Automating certificate handling and key exchange is a vulnerability  Don‘t let additional effort stop you from implementing security best practices Real word considerations I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Security - Conclusion •IS-0x are based on standard IT technology •HTTP and JSON are used by many other applications •Other applications use OAuth2 and JWT already in large scale •Key exchange workflow provides the fundamental environment for HTTPS transport •Secure Transport enables OAuth2 •TR -1001 workflows a must have AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 19 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 •VPN Setup ‒DHCP ‒DNS ‒CA ‒Registry (HTTP/HTTPS) ‒Authorization •Still online •Become AMWA member •Contact Thomas Edwards Virtual Workshop June 3 -7 2019 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Thank you Thank you to our Media Partners Arne Bönninghoff arne.boenninghoff@riedel.net | +49 177 8347500 42