Are there any possibilities to authenticate a changing number of (service) technicians towards a device without an internet / network connection? With the possibility to revoke the access later?
Edit: Without using PKI for technical reasons. :/
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You can use PKI, each technician will own a private key and a Certificate Authority shall issue each technician with a Certificate that authorizes anyone who can demonstrate possession of the corresponding private key access to the device for the specified amount of time. The device checks for access privilege by checking the signature of the certificate against the CA's Root Certificate, its expiry date, and the certificate attributes that describes the level of access that the technician has been granted. This allows the device to recognize new technicians while remaining offline.
If this is going to be used to maintain physical devices with NFC or USB ports, you may want to consider implementing this with OpenPGP or x509 smartcard for convenience and security.
Revocation comes naturally when the certificate expires, or you can force early expiry by using a revocation list. The devices has to be online to download the latest revocation list or another technician will need to update the revocation list on the device.
It depends on how often, and if the service technicians can itself come online.
I will take 2 examples, and tell how to solve it.
Example 1: If the service technicians have a smartphone or a normal phone, or even a pager that is online (doesn't need to be internet, could be SMS/GSM aswell), you could easily have a server that hands out TOTP codes, either "online" or via SMS. When the service technicians want to authenticate, they must request it from this server. This TOTP code is then used to offline-authenticate to the device in question. Revocation is simple as disabling the service technician's mobile number or account in the TOTP server.
Example 2: The service technicians can only come online a few times a day. Then you have the same thing, but instead, you have a TOTP code that Changes once a day, or maybe once each 8 hours, or if they can come online on lunch, a code that Changes each 4th hour. On the start of the workday, the service technician needs to read off this TOTP code either by requesting it from the server, or Reading it from a physical screen in the office. This code is then only valid to the end of workday. Revocing access, same here. But revocation will not take affect until next day.
You could also push this TOTP code via SMS to their phone.
The good thing with both these solutions, is that they never require the administrated device to come online at any time, and distributing credentials to service technicians is easy, even if they aren't physically available at the time of when they should be enrolled into the system.
Another advantage is that you can refuse to give out TOTP codes to service techicians when they shouldn't have access, for example if they shouldn't have access at certain times of the day, for example on the night, your server can simply refuse to give them that TOTP code.