Leveraging Public-key-based Authentication for the Internet of Things
Master Thesis, Hossein Shafagh · 2013
The vision of the IP-based Internet of Things (IoT) anticipates the interconnection of constrained devices in the physical world with the Internet. Specifically, the IoT aims at enabling future technologies and visions, e.g., smart home, building automation, smart city, and e-health. In many of these scenarios, it is possible to prevent leakage of personal information and harmful actuating tasks by means of peer authentication and secure data transmission. However, standard IP-based security solutions do not suffice as they are not designed with the limitations of constrained devices in mind. Hence, more lightweight security mechanisms which are tailored for constrained environments are needed. Public-key-based peer authentication is predominantly considered impracticable for constrained environments, due to expensive crypto operations. In this thesis, we investigate this claim. To this end, we implement the public-keyand certificatebased DTLS to add practical results to the applicability discussion and determine the resource requirements for constrained devices. We introduce proposals for minimal required certificate information and extensions of existing protocol mechanisms to reduce the overheads after the initial handshake. Furthermore, we introduce a novel delegation architecture for one-way certificate-based authentication, despite exceedingly high constraints for public-key crypto. Our evaluation results show that the certificate-based authentication causes 3 times higher transmission overhead and 28 times higher processing overhead than a preshared-key-based authentication. Our delegation architecture requires similar amount of resources as the pre-shared-key approach and causes overheads of the same order. The high overhead of a certificate-based authentication, can be amortized over several sessions by means of our protocol extensions. Hence, the number of expensive certificate-based authentications could be reduced to only installation and maintenance phases.