security-design

What problem does it solve?

This Skill defines and documents a complete security and authentication system to prevent unauthorized access by implementing device pairing, token-based authentication, access control, audit logging, and threat defenses, enabling secure operation of gateways and plugins.

Core Features & Use Cases

• Device Pairing & Authentication: Securely pair devices using public keys, pairing codes, challenge signatures, and issue time-limited tokens.
• Access Control & Policies: Enforce DM-level policies, channel permissions, and plugin-specific authorization rules.
• Security Auditing & Threat Protection: Record security events, audit permission changes, detect anomalous behavior, and mitigate DDoS, replay, and MITM attacks.
• Use Case: Secure an IoT gateway so only paired and authorized devices can access sensitive channels while producing auditable logs for compliance.

Quick Start

Initiate a secure pairing for deviceId DEVICE_ID using its publicKey and optional pairingCode to obtain a time-limited token and verify access rights.