Securing Complex IoT Platforms with Token Based Access Control and Authenticated Key Establishment

Abstract

Abstract-In this paper we propose a new authorization and authentication framework for the IoT that combines the security model of OAuth 1.0a with the lightweight building blocks of ACE. By designing self-securing tokens the security of the framework no longer depends on the security of the network stack. We use basic PKI functionalities to bootstrap a chain-of-trust between the devices which simplifies future token exchanges. Finally, we propose an alternate key establishment scheme for use cases where devices cannot directly communicate.We test our proposal by implementing the critical aspects on a STM32L4 microcontroller. The results indicate that our framework guarantees a strong level of security for IoT devices with basic asymmetric cryptography capabilities.

SETUCOM: Secure and Trustworthy Context Management for Context-Aware Security and Privacy in the Internet of Things

“…To solve the problems related to key exchange, we propose to use ECIES (Elliptic Curve Integrated Encryption Scheme) [41]. It is an authenticated public key cryptography system that aims at generating a secret key for onetime use by both parties of a communication.…”

Context-aware security in the internet of things: a survey

“…This prevents cloning, intrusion and replacement by illegitimate devices. For example, in (Claeys et al, 2017), authors proposed a new authentication technique based on OAuth1.0a and ACE (Authentication and Authorization for Constrained Environments). In this solution, a cryptographic protocol EDHOC (Ephemeral Diffie Hellman over Cose (Concise Object Signing and Encryption (Bormann and Hoffman, 2013;Schaad, 2016)) (Selander et al, 2016) is used for authentication.…”

“…Several variants of these mechanisms have been implemented and have proven their effectiveness. For example, in (Claeys et al, 2017), a token-based secure access control system is implemented. The main advantage of such a system is that it can be used in unsecured network environments.…”

“…Secondly, research must be carried out on the awareness of these mechanisms to the context. For example, it may be possible to define contextual authorization tokens as proposed in the MCIASIoTE project but based on the solution implemented in (Claeys et al, 2017). Indeed, unlike the mechanism proposed in the MCIASIoTE project, the mechanism proposed in (Claeys et al, 2017) is based on ACE (Shaad et al, 2018) and OAuth2 and does not require a secure connection for token management.…”

“…For example, it may be possible to define contextual authorization tokens as proposed in the MCIASIoTE project but based on the solution implemented in (Claeys et al, 2017). Indeed, unlike the mechanism proposed in the MCIASIoTE project, the mechanism proposed in (Claeys et al, 2017) is based on ACE (Shaad et al, 2018) and OAuth2 and does not require a secure connection for token management. However, this mechanism does not enable the user to have the ability to define and manage permissions.…”