Lightweight and escrow-less authenticated key agreement for the internet of things

Abstract

a b s t r a c tSecurity is essential for wide wireless sensor network (WSN) deployments, such as the Internet of Things (IoT). However, the resource-constrained nature of sensors severely restricts the cryptographic algorithms and protocols that can be used in such platforms. Such restrictions apply especially to authenticated key agreement (AKA) protocols for bootstrapping keys between authorized nodes: in traditional networks, such schemes involve the transmission of quite large certificates and the execution of memoryand processing-intensive cryptographic algorithms, which are not suitable for WSNs. Whereas lightweight WSN-oriented schemes also exist, most of them focus on small deployments where key-escrow is possible (i.e., a fully trusted authority knows the private keys of all nodes). Aiming to identify AKA solutions suitable for the IoT scenario, in this article we assess lightweight and escrow-free schemes, evaluating their security and performance in terms of processing time and energy consumption in the TelosB platform. Besides proving that some very efficient schemes are actually flawed, we show that the combination of SMQV (strengthened-Menezes-Qu-Vanstone) with implicit certificates leads to a secure and lightweight AKA scheme.

PUF Based Authentication Protocol for IoT

“…During the key agreement process, the TTP can be involved or not. In the case when the TTP is not involved, the most efficient identity based authentication and key agreement protocol proposed in literature can be found in [20], which only requires two phases and is also based on the ECQV key establishment protocol. We also mention in this context the standard key agreement scheme in IoT, called the Datagram Transport Layer Security (DTLS) protocol [21] with raw public keys, which has as a main difference the usage of less efficient certificates.…”

WS3N: Wireless Secure SDN-Based Communication for Sensor Networks

“…The literature offers identitybased schemes as an alternative; however it has the drawback of key escrow. In addition, security flaws were discovered in special pairing-friendly curves required by those schemes [32].…”

“…Traditional Public Key Infrastructure (PKI) schemes used in the Internet are not suitable due to large certificates and heavy processing requirements [32].…”

“…Therefore we choose an implicitly certified paradigm, the iSMQV protocol, in particular [32], which combines both escrow-less capability and performance efficiency.…”

“…The Key Generation Center (KGC) is a trusted entity responsible for generating authenticated key pairs for the SDN entities by using an Implicitly Certified Authenticated Key Agreement protocol (such as iSMQV [32]). Note that although the KGC participates in the key generation procedure, the key pairs are not subject to escrow.…”