1. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Seon Yong Park
Developer Specialist SA, APAC
서버리스 개발에서의 인증
완벽 가이드

2. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
본 강연에서는
AWS 는 어플리케이션이 작동하는 시스템에 따라 다양한
형태의 인증 방식을 지원합니다.
여러분에 모바일이나 자신이 서버의 어플리케이션에서
서버리스 서비스를 호출하는 경우 어떤 방식의 인증 방식이
적용될 수 있는지 살펴보고, 패스워드 보안을 위한
Cognito의 SRP 지원을 자세히 살펴봅니다.

3. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
인증의 형태
서버리스 API 에서 인증
제 3자 인증 제공자와의 연동
NSRP와 SRP
정리
데모

4. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
인증의 형태

5. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
인증을 받아서 AWS 서비스 기능을 실행해야 하는 주체
온프림 서버
EC2 on AWS
모바일
Role
Configure credentials
SAML 2.0
MS AD
Role
Configure credentials
SAML 2.0
MS AD Amazon Cognito
Amazon Cognito
어플리케이션

6. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SAML 2.0 연동
janedoe@Ubuntu64:/tmp$ ./samlapi.py
Username: ADjanedoe
Password: ****************
Please choose the role you would like to assume:
[ 0 ]: arn:aws:iam::012345678987:role/ADFS-Administrators
[ 1 ]: arn:aws:iam::012345678987:role/ADFS-Operators
Selection: 1
---------------------------------------------------------------
Your new access key pair has been stored in the aws configuration
file /home/janedoe/.aws/credentials under the saml profile.
Note that it will expire at 2015-05-26T17:16:20Z.
---------------------------------------------------------------

7. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
서버리스 API에서 인증

8. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Public API
POST /locations
GET /locations
GET /locations/{locationId}
DELETE /locations/{locationId}
GET /locations/{locationId}/resources
POST /locations/{locationId}/resources
DELETE /locations/{locationId}/resources/{resourceId}
GET /locations/{locationId}/resources/{resourceId}/bookings
GET /users/{userId}/bookings
POST /users/{userId}/bookings
DELETE /users/{userId}/bookings/{bookingId}

9. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Public API
Admin only
Admin only
Admin only
Admin only
POST /locations
GET /locations
GET /locations/{locationId}
DELETE /locations/{locationId}
GET /locations/{locationId}/resources
POST /locations/{locationId}/resources
DELETE /locations/{locationId}/resources/{resourceId}
GET /locations/{locationId}/resources/{resourceId}/bookings
GET /users/{userId}/bookings
POST /users/{userId}/bookings
DELETE /users/{userId}/bookings/{bookingId}

10. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
API 게이트웨이 : 3가지 인증 형태
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
Custom Identity Providers
AWS IAM authorization
Custom Authorizers
User Pools Authorizers

11. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
API Gateway: 3가지 인증 형태
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
Custom Identity Providers
AWS IAM authorization
Custom Authorizers
User Pools Authorizers

12. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon
DynamoDB
Lambda
function

13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
1. Authenticate
Amazon Cognito
User Pools

14. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
2. JWT tokens
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon
DynamoDB
Lambda
function

15. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
3. Call API Gateway resource
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools

16. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
4. Validate
Identity token
Mobile app
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools

17. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
5. Invoke API Call
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools

18. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저 풀 기반 인가
Mobile app
6. Access
AWS Resources
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools

19. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
API 게이트웨이: 3가지 인증 형태
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
Custom Identity Providers
AWS IAM authorization
Custom Authorizers
User Pools Authorizers

20. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

21. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management
1. Authenticate

22. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
2. JWT tokens
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

23. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
3. Request AWS credentials
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

24. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
4. Validate Id token
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

25. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
5. Temp AWS credentials
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

26. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
6. Call API Gateway resource
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

27. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
7. Check IAM policy
Amazon
DynamoDB
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management

28. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 기반 인가
Mobile app
8. Invoke Lambda
Lambda
function
Amazon API
Gateway
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
AWS Identity &
Access Management
Amazon
DynamoDB

29. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
IAM 정책 상세
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "execute-api:Invoke",
"Effect": ”Allow",
"Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*”
},
{
"Action": "execute-api:Invoke",
"Effect": "Deny",
"Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*/POST/locations/*＂
}
]
}

30. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
API 게이트웨이: 3가지 인증 형태
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
Custom Identity Providers
AWS IAM authorization
Custom Authorizers
User Pools Authorizers

31. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Lambda
function
Amazon API
Gateway
Amazon
DynamoDB

32. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Lambda
function
Amazon
DynamoDB
1. Authenticate

33. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Amazon API
Gateway
2. Custom
IdP Token(s)
Lambda
function
Amazon
DynamoDB

34. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Amazon API
Gateway
3. Call API Gateway resource
Lambda
function
Amazon
DynamoDB

35. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Mobile app
Amazon API
Gateway
4. Check
policy
cache
Custom Authorizer
Lambda function
Lambda
function
Amazon
DynamoDB

36. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Mobile app
Amazon API
Gateway
5.Validatetoken
AWS Identity &
Access Management
Custom Authorizer
Lambda function
Lambda
function
Amazon
DynamoDB

37. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Amazon API
Gateway
6.Generateandreturn
userIAMpolicy
Lambda
function
Amazon
DynamoDB

38. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Amazon API
Gateway
7. Validate IAM
permissions
AWS Identity &
Access Management
Lambda
function
Amazon
DynamoDB

39. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀
인가
Custom Authorizer
Lambda function
Mobile app
Amazon API
Gateway
8. Invoke
Lambda
function
Amazon
DynamoDB

40. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
커스텀 인가 람다 함수
예제 코드
var testPolicy = new AuthPolicy(”userIdentifier", "XXXXXXXXXXXX", apiOptions);
testPolicy.allowMethod(AuthPolicy.HttpVerb.POST, "/locations/*");
testPolicy.allowMethod(AuthPolicy.HttpVerb.DELETE, "/locations/*");
callback(null, testPolicy.getPolicy());

41. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
API 게이트웨이: 3가지 인증 형태
Amazon Cognito
User Pools
Amazon Cognito
Federated Identities
Custom Identity Providers
AWS IAM authorization
Custom Authorizers
User Pools Authorizers

42. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
제 3자 인증제공자와의 연동

43. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
어플리케이션 제3자 인증제공자 연동
Built-in, Customizable
User Interface for Sign up
/ Sign in
OAuth 2.0 SupportFederation with Facebook,
Login with Amazon, Google,
and SAML2 providers
1 2 3

44. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
소셜 인증제공자와의 연동
1. Initiate sign-in

45. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
소셜 인증제공자와의 연동
1. Initiate sign-in
2. Sign-in with 3rd party IdP

46. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
소셜 인증제공자와의 연동
1. Initiate sign-in
Amazon Cognito
User Pools
2. Sign-in with 3rd party IdP
3. Get user tokens

47. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
기업의 인증제공자와의 연동
1. Initiate sign-in

48. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
기업의 인증제공자와의 연동
1. Initiate sign-in
2. Sign-in with 3rd party IdP
SAML
Endpoint
e.g. ADFS
or Shibboleth
Corporate Directory
e.g. Active Directory
or OpenLDAP

49. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
기업의 인증제공자와의 연동
1. Initiate sign-in
Amazon Cognito
User Pools
2. Sign-in with 3rd party IdP
3. Get user tokens
SAML
Endpoint
e.g. ADFS
or Shibboleth
Corporate Directory
e.g. Active Directory
or OpenLDAP

50. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
기업의 인증제공자와의 연동

51. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
NSRP 와 SRP

52. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
Username Email Password
beverly123 beverly123@example.com Password$123
pilotjane pilotjane@example.com a##eroplan3
sudhir1977 sudhir197@example.com mmd414997a
2. Sign-in
1. Sign-up
평범한 문자로 패스워드 저장하기

53. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
• Never store passwords in plaintext!
• Vulnerable to rogue employees
• A hacked DB results in
all passwords being compromised
Username Email Password
beverly123 beverly123@example.com Password$123
pilotjane pilotjane@example.com a##eroplan3
sudhir1977 sudhir197@example.com mmd414997a
2. Sign-in
1. Sign-up

54. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
Username Email Hashed Password
beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f
pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883
sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d
2. Sign-in
1. Sign-up
패스워드 해쉬 값으로 저장하기

55. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
• MD5/SHA1 collisions
• Reverse Lookup Tables
• Rainbow Tables
• Dictionary attacks, brute-force (GPUs can compute
billions of hashes/sec)
Username Email Hashed Password
beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f
pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883
sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d
2. Sign-in
1. Sign-up

56. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
Username Email Salted Hash
beverly123 beverly123@example.com 1e66f9358530620b2bcae79dada717c…
pilotjane pilotjane@example.com 88fccd9cf82377d11d2fede177457d47…
sudhir1977 sudhir197@example.com 08a5981de4fecf04b1359a179962a48...
2. Sign-in
1. Sign-up
• Incorporate app-specific salt +
random user-specific salt
• Use algorithm with configurable # of iterations (e.g.
bcrypt, PBKDF2), to slow down brute force attacks

57. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP가 요구되는 이유
Username Email SRP Verifier function
beverly123 beverly123@example.com <password-specific verifier>
pilotjane pilotjane@example.com <password-specific verifier>
sudhir1977 sudhir197@example.com <password-specific verifier>
2. Sign-in
1. Sign-up
• Secure Remote Password (SRP) Protocol
• Verifier-based protocol
• Passwords never travel over the wire
• Resistant to several attack vectors
• Perfect Forward Secrecy

58. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP 처리과정
Client Server
임시 비밀값 ‘a’생성
공개 A 생성 : A = ( g ^ a ) % N
N = 아주 큰 소수값
g = 2
K = hash(N, g)
LoginRequest (Username, A)
1. 유저DB 로부터 salt ’s’ verifier ‘v’가져옴
2. 임시 비밀 값 ‘b’를 생성
3. 공개 임시값 ‘B’를 생성
B = [ k * v + ( (g ^ b ) %N)] % N
4. 스크램블 값 ’u’ 생성
u = hash (A, B)
5. 세션 키 K 생성
S = [ ( A * (( v ^ u) % N)) ^b] % N
K= hash(S)
6. 다음 사용을 위해 [ A, B, K, s] 저장
LoginResponse(s, B)

59. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
SRP 처리과정
Client Server
1. 스크램블 값 ’u’ 생성
u = hash (A, B)
2. 유저 개인 값 ‘x’생성
x= hash(s, password)
3. 세션 키 ‘K ‘계산
S = [ B - k * (g ^x % N)) ^ ( a + u * x)] % N
K = hash (S)
LoginResponse(s, B)
4. K 값 전달
M1 = hash (A, B, K)
1. M1 계산
M1 = hash(A, B, K)
2. 받은 M1과 계산한 M1이 같으면
유저는 인증
이후 통신은 암호화

60. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
유저 풀
NoSRP client SRP client

61. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Cognito 유저풀 인가
Mobile app
Amazon Cognito
User Pools
server app
SRP

62. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
정리

63. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
인증/인가
• 인증이 필요한 어플리케이션이 동작하는 기기에 따라 인증 방식 구분
• Role for EC2
• Cognito 를 사용할 것
- UserPools
- OpenidConnect
- Synchronize
- Federated Identity

64. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Summit 모바일 앱과 QR코드를
통해 강연 평가 및 설문 조사에 참여해
주시기 바랍니다.
내년 Summit을 만들 여러분의 소중한
의견 부탁 드립니다.
#AWSSummit 해시태그로 소셜 미디어에 여러분의 행사
소감을 올려주세요.
발표 자료 및 녹화 동영상은 AWS Korea 공식 소셜 채널로
공유될 예정입니다.
여러분의 피드백을 기다립니다!