UPnP Security

1
UPnP Security
Preston Huntphunt_at_intel.com Applications
Engineering MgrIntel Corp.
2
Agenda

• ?????????
• ????????? ?????????????
• UPnP ????????
• ????
• Remote plugfest ???????

3
UPnP Today
Introduction

• ?????????? UPnP
• ??????????
• ???????
• ????? it just works
• ????????????

4
?????
Introduction

• ?????????????????????????...
• ????????
• ????
• ????

5
????? ??????
Introduction

• ??????? 2001?????? Security
• ??????????? 2001?8????
• Version 0.8?????? 2002?3?
• ?????? 3rd plugfest ???

6
???
Introduction

• DeviceSecurity ??????
• SecurityConsole ?????????????????????
• DeviceStealth ?????????????????
• AuditService ???????????(?????????????)
• SecureDevice ?????????????????

7
??
Introduction

• ??? Intel, LGE, Siemens (????2?)?Sony
• Microsoft ???????????
• DeviceSecurity ??? SecurityConsole ?????2002?????
  
• DeviceStealth??????????????AuditService?????????
• ?????? IGD V2 (A/V??? )

8
?????
Introduction

• ??
• bad guys ???
• ?????????(?????????????????)
• ??
• ???????????????????
• ???????????????????
• ??? UPnP ?????????(??????????)
• ???????????????
• ???????????????????????????????

9
Version 2 (????? )

• V2 solution ??? V1 solution ??????
• ?????????????????
• ?????????????????????????
• V1 UPnP ???????????WS-Security (?????????)????????
  ????
• V2 UPnP ????????WS-Security?????????
• Microsoft ? UPnP ???? WS-Security
  ???????????????????

10
UPnP ???????????????
11
??????
Fundamentals

• ???????raw ????(????????????)
• ????????????????
• ?????????????????????
• ???? SOAP ????? (??????? )???????? X.509
  ???(????????????????)?????
• ?????????????????

12
???????
Fundamentals

• XML??????????????
• ???????????????????? ( UPnP???11??????? )
• ????????????(??????)???????????????
• ??????????????
• E.g., ltread/gt, ltAdministrator/gt,
  ltusergtltnamegt Frodo lt/namegtlt/usergt

13
?????????
Fundamentals
ltentrygt
ltsubjectgt lthashgt or ltany/gt lt/subjectgt
ltaccessgt permission elements or ltall/gt
lt/accessgt
ltvalidgt optional ltnot-beforegt and/or
ltnot-aftergt lt/validgt
lt/entrygt
14
Discovery DeviceStealth
Fundamentals

• ???????????? SecureDevice ??? BasicDevice
  ???????
• ?????? SOAP????????????????????
• Is Type Supported()
• GetDeviceDetails()

15
?? Secure SOAP
Fundamentals

• XML Dsig??????? SOAP??????????????
• SetSessionKey() ????????????
• DecryptAndExecute() ???????????????
  HTTP????????????
• ???(null) ????
• ???????? RSA, SHA1-HMAC, AES

16
Secure SOAP?????
Fundamentals
HTTP????
SOAP ?????
SOAP???? (XML signature, key info,
???????????????????
SOAP ???? (UPnP ??)
17
??????????
Fundamentals

• ????????????? DeviceSecurity??????????
• ??? subscribe call ? 4 ????????????
• KEY-ID, IV, KEY-SEQ, HMAC
• ???????????????????????????

18
????????????
Fundamentals

• ????? X.509 ??????????(????)???
• ?????(??????)????????????
• ???????????????????????????? ACLs
  ???????????????

19
?????
Fundamentals

• ???? ACL ????????
• ??????????????ID????????
• ?? ACLs ???
• ????????????????????????

20
???????????
Fundamentals

• ????????????????
• ??????????
• ??????????????????
• ?????????
• ???????????????(??)???
• ???????(????????????)

21
????
22
?????????? ????
Fundamentals

• ??????????????????????
• ??????????????????????????????????????????????????
  ???
• ?????? (e.g., IR)
• ??????? (SecurityConsole)

23
?????????????????
Scenarios
Device
Security Console
discovery
GetPublicKeys()
TakeOwnership()
24
????????????????????
Scenarios
Control Point
Security Console
discovery
PresentKey()
25
?????????????????
Scenarios
Device
Security Console
(prior TakeOwnership)
GetDefinedPermissions()
AddACLEntry()
26
??????????????????
Scenarios
Device
Control Point
GetPublicKeys()
SetSessionKeys()
SomeAction() sig or DecryptAndExecute()
27
??????????????
Scenarios
Device
Security Console
Control Point
GetMyCertificates()
CacheCertificate() optional step
SomeAction() sig cert(s)
28
???

• UPnP Security 1.0 ?????
• V2 Security???????????????????????????????????
• ???????????????????
• ?????????O/S???????????(???????????)

29
????

• http//forum.upnp.org/archives/security.html
• httpwww.upnp.org/members/repository.asp

30
Remote Plugfest???????
31
????????

• ????????????23?? plug-fests???????
• ???????????????????
• ????????? plugfests ????????????????

32
??????????

• UPnP ?????????????????????????????????????
• SSDP?????URL????????????????????????????
• ?????????????
• ?????????????????????
• VPN ???
• ???????????????????????????????
• ??????1????12????????????????

33
?????

• ??????????????????????
• just work -??????????????? F2F plugfests
  ????????
• F2F plugfests ???????????
• ?????????????????????????
• ???????????????????????????

34
???

• XML Dsig XML Digital Signature
• XML Enc XML Encryption
• SOAP Simple Object Access Protocol
• PKI Public Key Infrastructure (e.g., X.509)

35
For the interconnected lifestyle