[hono-dev] Security Improvement of Protocol Adapters

["Poehn Sebastian (INST/ECS4)" <Sebastian.Poehn@xxxxxxxxxxxx>]

Hello Hono Mailing List

Some time ago I created an issue for a security improvement of Protocol Adapters:
https://github.com/eclipse/hono/issues/551

An attacker might try to brute-force the device credentials against a Protocol Adapter.
This bears confidentiality and integrity risks if the attacker successfully probes the credential.
Additionally this consumes resource in the Protocol Adapter because the credential has to be validated (which is an expensive operation).

In the issue a possible (easy) solution was discussed. The idea was to delay failed authentications and thus slowing down the attacker.

In addition I would suggest to expose the number of failed authentication attempt as a metric.

Best regards
Sebastian