Cut off one device without touching the rest

How to do it

A device can be stolen, cloned or caught sending attack traffic. Only per-device credentials, as give every device its own credentials requires, make this possible. Check the registry when each connection opens, and push revocations to every broker node. A certificate revocation list alone is too slow, because brokers fetch it only now and then. Tell the owner and offer a replacement path.

Examples

JavaScript example

export async function revokeDevice(registry, brokers, deviceId, reason) {
  await registry.markRevoked(deviceId, reason);
  await Promise.all(brokers.map(broker => broker.disconnectClient(deviceId)));
}

export const authenticate = registry => async (client, certificate) =>
  !(await registry.isRevoked(certificate.subject.CN));

Python example

def revoke_device(registry, brokers, device_id: str, reason: str) -> None:
    registry.mark_revoked(device_id, reason)
    for broker in brokers:
        broker.disconnect_client(device_id)

def authenticate(registry, certificate_device_id: str) -> bool:
    return not registry.is_revoked(certificate_device_id)

How to check

A test revokes a connected test device. Its session closes within 60 seconds, its reconnect is refused, and a second test device stays connected.

Related rules

• IOT-1 Give every device its own credentials in Connected devices