Rafael Marin-Lopez

Network access authentication performed by constrained devices is a cornerstone of security in Internet of Things (IoT) environments. In this regard, the Internet Engineering Task Force (IETF) has recently standardised CoAP-EAP (RFC 9820), an authentication service that transports the Extensible Authentication Protocol (EAP) over Constrained Application Protocol (CoAP), thus bringing this authentication framework to the IoT realm. This paper analyses and provides a comprehensive overview of CoAP-EAP, explaining the main design decisions made throughout its standardisation, describing its applicability across different network infrastructures, and presenting a proof-of-concept implementation that has been evaluated in a realistic IoT testbed.

The rapid growth of the Internet of Things ecosystem has intensified the need for secure, resource-efficient communication protocols. The EDHOC protocol is a lightweight authenticated key-exchange protocol, recently developed by the Internet Engineering Task Force. EDHOC addresses the challenges of transport over constrained radio technologies and execution on constrained microcontroller units. In its standardized version, the key-exchange can be authenticated using signatures or static Diffie-Hellman keys. However, many Internet of Things deployments in the wild rely on Pre-Shared Keys. As such, the potential use of EDHOC in those deployments requires a new authentication method for this protocol, based on Pre-Shared Keys. Two variants of Pre-Shared Keys authentication in EDHOC are currently under consideration in the Internet Engineering Task Force LAKE working group. This paper presents a comprehensive analysis of these variants, examining their performance metrics, implementation complexity, and security and privacy considerations. Our evaluation focuses on computational time, memory usage, and deployment challenges in diverse Internet of Things ecosystems. Based on our analysis, we have formulated a recommendation to the Working Group, which has opted to adopt and standardize PSK2.

The Transport Layer Security (TLS) protocol is widely used for protecting end-to-end communications between network peers (applications or nodes). However, the administrators usually have to configure parameters (e.g., cryptography algorithms or authentication credentials) to establish TLS connections manually. However, this way of managing security connections becomes infeasible when the number of network peers is high. This paper proposes a TLS management framework that configures and manages TLS connections in a dynamic and autonomous manner. The solution is based on well-known standardized protocols and models that allow providing the necessary configuration parameters to establish a TLS connection between two network nodes. Nowadays, this is required in several application scenarios such as virtual private networks, virtualized network functions, or service function chains. Our framework is based on standard elements of the Software Defined Networking paradigm, widely adopted to provide flexibility to network management, such as for the scenarios aforementioned. The proposed framework has been implemented in a proof of concept to validate the suitability of the proposed solution to manage the dynamic configuration of TLS connections. The experimental results confirm that the implementation of this framework enables an operable and flexible procedure to manage TLS connections between network nodes in different scenarios.

In the renowned Internet-of-Thing (IoT) networks, it is expected a vast number of devices with IP connectivity and constrained capabilities. Due to reduced resources they are target of different type of attacks and providing security has become a basic pillar for the success and evolution of IoT. Among the specific key security aspects are the authentication, access control and key distribution for data protection. In particular, all these aspects are included in the process of bootstrapping, which allows a Smart Object to join a network domain in a secure fashion. This process, which indeed involves authentication, authorization and key distribution, typically requires communication between the Smart Object and an entity, the Controller, in charge of steering the bootstrapping process within the network’s domain. However, direct communication between both might be impeded, e.g., when the entity is unreachable by radio, or the Smart Object does not have a routable IP address until it is successfully authenticated and authorized to join the network. A common solution is to use an intermediate entity (the Intermediary) to aid in this task. For example, the Zigbee IP standard defines a relay for the Protocol for Carrying Authentication for Network Access (PANA). Moreover, the IETF is exploring the use of an Intermediary to help this process. In this work we analyse, explore and design an intermediary based on CoAP. We pay attention to the authentication with the Extensible Authentication Protocol (EAP) and CoAP, which has resulted in a more constrained alternative to PANA for EAP-based bootstrapping in IoT. Nevertheless, our design of the CoAP-based intermediary is so general that it is independent of the authentication protocol in use. In particular, we have analysed as intermediary the usage of a CoAP proxy, as defined in the CoAP standard; alternatively we have introduced the concept of the CoAP relay and CoAP stateless proxy. We evaluate the performance of each solution and we compare between them and with PANA relay.

The Internet-of-Things (IoT) landscape is expanding with new radio technologies. In addition to the Low-Rate Wireless Personal Area Network (LR-WPAN), the recent set of technologies conforming the so-called Low-Power Wide Area Networks (LP-WAN) offers long-range communications, allowing one to send small pieces of information at a reduced energy cost, which promotes the creation of new IoT applications and services. However, LP-WAN technologies pose new challenges since they have strong limitations in the available bandwidth. In general, a first step prior to a smart object being able to gain access to the network is the process of network access authentication. It involves authentication, authorization and key management operations. This process is of vital importance for operators to control network resources. However, proposals for managing network access authentication in LP-WAN are tailored to the specifics of each technology, which could introduce interoperability problems in the future. In this sense, little effort has been put so far into providing a wireless-independent solution for network access authentication in the area of LP-WAN. To fill this gap, we propose a service named Low-Overhead CoAP-EAP (LO-CoAP-EAP), which is based on previous work designed for LR-WPAN. LO-CoAP-EAP integrates the use of Authentication, Authorization and Accounting (AAA) infrastructures and the Extensible Authentication Protocol (EAP) protocol. For this integration, we use the Constrained Application Protocol (CoAP) to design a network authentication service independent of the type of LP-WAN technology. LO-CoAP-EAP represents a trade-off between flexibility, wireless technology independence, scalability and performance in LP-WAN.