Identifying IoT device certificates with a revoked intermediate CA using Amazon Web Services IoT Device Defender

Introduction

Dynamically verifiable device identity is a foundational component of a Zero Trust Architecture (ZTA). Ongoing dynamic evaluation of identity and trust requires complete and timely visibility into relevant components of that identity. Active device certificates issued by a revoked intermediate Certificate Authority (CA) can pose a security threat due to the intermediate CA being potentially compromised. Previously, there had been no ready-made solution to identify active device certificates that were issued by a revoked intermediate CA.

Background

Figure 1. Hierarchical public key infrastructure (PKI) chain including root CA, intermediate CA, and IoT device certificates issued by an intermediate CA.

Amazon Web Services IoT Core customers can use X.509 certificates to authenticate client and device connections. These certificates can be generated by Amazon Web Services IoT, or signed by a CA, irrespective of whether the CA is registered with Amazon Web Services IoT.

In most practical applications, intermediate CAs issue device certificates as this approach provides an additional layer of security and helps manage security incidents gracefully. For example, in case of a suspected security incident with a device or group of devices, only the intermediate CA can be revoked instead of revoking the root certificate. When the intermediate CA is revoked, all device certificates that are in the same chain as the revoked intermediate CA are revoked automatically. This approach limits the cost and impact of the security incident.

Previously, Amazon Web Services IoT Core customers who brought their own device certificates backed by an external multi-level Public Key Infrastructure (PKI) hierarchy had no ready-made solution to identify active Amazon Web Services IoT Core certificates issued by a revoked intermediate CA. These customers needed to build custom solutions to gain required visibility, or they risked being exposed to potential threats stemming from unmonitored usage of possibly compromised device credentials.

Solution

Customers using their own device certificates needed an automated mechanism to identify certificates with a revoked intermediary CA. With the new CA chain audit check , Amazon Web Services IoT Device Defender addresses this gap. Amazon Web Services IoT Device Defender, a fully managed service for auditing and monitoring devices connected to Amazon Web Services IoT, supports checking for active certificates issued by a revoked intermediate CA. When a potentially compromised intermediate CA is revoked, all active certificates issued by that intermediate CA are identified as non-compliant, failing the associated audit check.

The new check makes it easier for customers to identify affected certificates using relevant X.509 certificate extension declarations and standard certificate revocation methods , such as Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP). You can use the new audit check as part of a broader integrated Amazon Web Services IoT Device Defender and Amazon Web Services Security Hub architecture to continuously audit, monitor, and remediate your Internet of Things (IoT) devices in accordance with the core principles of ZTA.

How to identify active device certificates with a revoked intermediate CA

The new audit check leverages standard revocation check methods whilst being able to traverse public key infrastructure (PKI) hierarchies. It relies on the information provided via relevant X.509 certificate extensions to discover the PKI CA hierarchy and perform the associated certificate revocation checks.

In our sample scenario shown in Figure 2, this audit check occurs as the following sequence:

1. Root CA or intermediate CA revokes the target intermediate CA certificate, where the intermediate CA is the issuer of a certificate actively used by an IoT device interacting with Amazon Web Services IoT Core.
2. Customer initiates an Amazon Web Services IoT Device Defender audit, which includes the revoked intermediate CA audit check.
3. Amazon Web Services IoT Device Defender performs the revocation check using the available revocation check method, in accordance with the hierarchy of the associated PKI.
4. If a revoked intermediate CA is identified, the audit generates a non-compliant “Intermediate CA revoked for active device certificates” finding.

Figure 2. Amazon Web Services IoT Device Defender revoked intermediate CA audit check flow.

To use this feature, you can access the Device Defender audit section within your Amazon Web Services Console and enable the new audit check. If you have not enabled Device Defender audit, you can do it with one-click using Automate IoT security audit on Device Defender to help secure your IoT devices.

Figure 3. Amazon Web Services IoT Device Defender audit section.

The check handles device certificates that have an issuer endpoint declared in the relevant X.509 extension, and reports active certificates issued by a revoked intermediate CA. You can disable the compromised device certificate using a pre-built mitigation action or initiate a custom mitigation through an Amazon Web Services Lambda function. More documentation on Amazon Web Services IoT Device Defender intermediate CA audit check can be found here .

Customer device certificates used with Amazon Web Services IoT Core need to include the necessary Authority Information Access (AIA) details required to perform the underlying CA revocation checks:

Figure 4. X.509 certificate extension declarations showing certificate Authority Information Access (AIA) and CRL endpoint details.

Subsequently, the Intermediate CA revoked for active device certificates audit check can be used to identify any active device certificates issued by the revoked intermediate CA.

Figure 5. Selecting the Intermediate CA revoked for active device certificates audit check as part of new audit creation process.

The check can leverage the AIA details and published certificate revocation information, whilst traversing the associated PKI hierarchy to determine the intermediate CA revocation status. In this test example, we can see that an intermediate CA used to issue device certificates was revoked by the root CA:

.

Figure 6. Example Certificate Revocation List (CRL) entry showing a revoked certificate corresponding to the intermediate CA.

Upon revocation, a previously compliant audit check would fail, because Amazon Web Services IoT Device Defender identifies a revoked intermediate CA.

Figure 7. Amazon Web Services IoT Device Defender Audit Result showing non-compliant audit finding.

The associated finding provides additional information about the impacted device certificates, as well as the affected issuer identifier registered with Amazon Web Services IoT Core.

Figure 8. Additional information provided as part of the associated Intermediate CA revoked for active device certificates audit finding.

You can now identify client or device certificates that have their issuing CA revoked in a CA chain via a scheduled audit automatically, or initiate an ad-hoc Amazon Web Services IoT Device Defender audit report manually as needed.

If non-compliant certificates are identified, you can initiate a pre-built mitigation action, such as disabling the affected device certificate or initiate a custom mitigation action through a Lambda function.

Conclusion

IoT devices using device certificates issued by a revoked intermediate CA can pose a security threat to your IoT solution. Amazon Web Services recommends identifying active devices issued by a revoked intermediate CA and taking actions such as disabling or replacing these device certificates.

This recommendation aligns with one of the core principles of ZTA of continuously monitoring and measuring the integrity and security posture of your IoT devices and verifying device trust on an ongoing basis.

Using the new Amazon Web Services IoT Device Defender audit check feature, customers can continuously audit, monitor, and remediate affected device identities, such as:

1. Provision new certificates, that are signed by a different CA, for the affected devices.
2. Verify that the new certificates are valid, and that the devices can use them to connect.
3. Initiate built-in Amazon Web Services IoT Device Defender mitigation actions or custom mitigation actions through a Lambda function, if required. Customers can perform these mitigation actions by calling the Amazon Web Services IoT Device Defender API or Amazon Web Services CLI directly.

The new audit check makes it easier for customers to identify affected certificates, helping to improve the overall security posture of your IoT solutions.

Authors

Ryan Dsouza is a Principal Solutions Architect for IoT at Amazon Web Services. Based in New York City, Ryan helps customers design, develop, and operate more secure, scalable, and innovative solutions using the breadth and depth of Amazon Web Services capabilities to deliver measurable business outcomes. Ryan has over 25 years of experience in digital platforms, smart manufacturing, energy management, building and industrial automation, and OT/IIoT security across a diverse range of industries. Before Amazon Web Services, Ryan worked for Accenture, SIEMENS, General Electric, IBM, and AECOM, serving customers for their digital transformation initiatives.

Maxim Chernyshev is a Sr. Solutions Architect working with mining, energy and utilities customers at Amazon Web Services. Based in Perth, Western Australia, Maxim helps customers devise solutions to complex and novel problems using a broad range of applicable Amazon Web Services services and features. Maxim is passionate about IoT, IT/OT convergence and cyber security.

Chelsea Pan is a Sr. Product Manager at Amazon Web Services and is based in Seattle. Chelsea oversees the Amazon Web Services IoT Device Management services on product strategy, roadmap planning, business analysis and insights, customer engagement, and other product management areas. Chelsea led the launch of several fast-growing security products in her career.