The proliferation of Internet-of-Things (IoT) devices in critical infrastructure requires robust security mechanisms to verify device integrity and trustworthiness. Remote Attestation (RA) is a security mechanism for validating the software and hardware state of remote devices. Existing RA solutions for resource-constrained IoT devices lack comprehensive frameworks for secure attestation channels and focus primarily on local evidence generation without addressing end-to-end security. This paper introduces M-AuRA, a lightweight RA solution that fills these gaps by leveraging the newly standardized Ephemeral Diffie-Hellman over COSE (EDHOC) protocol. M-AuRA seamlessly integrates attestation with authentication, enabling both unilateral and mutual attestation modes while maintaining minimal resource overhead. Our framework specifies how to transport existing attestation mechanisms in parallel with secure communication establishment, providing a complete end-to-end security solution for IoT deployments. We demonstrate M-AuRA’s practicality through implementation on the nRF5340 microcontroller running at 64 MHz, evaluating performance across both software and hardware cryptographic back-ends. In mutual attestation mode, our implementation uses only 4,692 B RAM and 19,350 B flash memory, occupying 0.9% and 1.85% of available nRF5340 resources, respectively. The four-message EDHOC exchange (45 B, 65 B, 177 B and 120 B) enables mutual trustworthiness verification in 10.46 s using a software-based cryptographic back-end, or only 0.43 s with hardware acceleration, consuming 171.43 mC and 7.97 mC of charge, respectively.

Remote Attestation (RA) is a security process that verifies the integrity and trustworthiness of a remote device’s software and hardware. While RA for high-end devices is well-developed, RA in constrained IoT environments remains incomplete. Existing embedded RA mechanisms focus on local evidence generation and verification, but lack a complete process that includes a secure attestation channel. This paper introduces AuRA, a lightweight RA solution that builds upon the newly standardized Ephemeral Diffie-Hellman over COSE (EDHOC) protocol. AuRA specifies how to transport existing attestation mechanisms in parallel with network authentication. We evaluate AuRA on the nRF5340 microcontroller running at $\mathbf{6 4 ~ M H z}$. This implementation has a memory footprint of 6,665 B of RAM and 17,163 B of flash. The device completes Remote Attestation by exchanging three EDHOC messages with a verifier entity, of sizes $42 \mathrm{~B}, 59 \mathrm{~B}$ and 223 B. This allows the device to prove that it is running the right hardware and software in only 5.51 s, consuming as little as 88 mC of charge.

Authenticated key exchange protocols play a crucial role in the communication security stack of an Internet-of-Things (IoT) device: they authenticate the communicating parties and establish a shared symmetric secret between them. Following a large debate in the community, the Internet Engineering Task Force (IETF) has recently standardized a new protocol called EDHOC for authenticated key exchange targeting IoT environments. The EDHOC protocol performs a compact Diffie-Hellman key exchange handshake, requiring several times less bytes-over-the-air than the de-facto solution used in the Internet, the (D)TLS protocol. In this paper, we study how this reduction in message size correlates with the usage of other scarce resources in IoT environments: time, energy, and memory. We evaluate EDHOC and DTLS with different authentication configurations over two IoT radio technologies. First, we measure the EDHOC and DTLS handshakes on constrained hardware over an IEEE 802.15.4 radio. We observe that EDHOC achieves ×6 to × 14 reduction in packet sizes, × 1.44 improvement in handshake duration and ×2.79 reduction in energy consumed. Next, we simulate time on air on LoRaWAN networks and find that, in the most restrictive configuration (SF = 12), DTLS uses at least × 7 more time on air than EDHOC. Finally, we measure flash memory and RAM usage, with the EDHOC implementation achieving a ×4 reduction in both.

Running tests on Internet of Things (IoT) platforms can be challenging, yet of increasing practical importance. The potential complexity of IoT networks, especially for heterogeneous networks, is a challenge for testbeds. The laboriousness in setting up a large IoT network makes it harder to stress test systems and assess their performance and communication. This work systematizes the types and applicability of test approaches for IoT and proposes a virtualized platform based on containers for a leaner, intermediate step between development and deployment. To demonstrate this methodology, we use a swarm surveillance use case resulting in finding some improvements in the software tested. Also, a performance evaluation intends to assess the feasibility of our implementation by testing scalability properties to investigate if this approach is suited for testing in swarm platforms.

While attribute-based access control (ABAC) is a promising technique to govern interactions in the Internet of Things (IoT), most existing ABAC models are designed to run on remote servers or gateway devices. This scenario is misaligned with recent trends toward IoT decentralization, such as the Swarm, which expects devices to autonomously share resources, making their own access decisions for enhanced privacy and reliability. In this article, we propose SmartABAC: a fast, concise, and expressive ABAC model that can be executed in constrained IoT devices. It combines the performance of policies based on attribute enumeration, with techniques that enhance policy expressiveness, such as typed and hierarchical attributes. We specified SmartABAC using first-order logic, designed a use case, and evaluated it in both constrained and nonconstrained IoT environments. Results show that our model can represent a variety of access policies, including nested multiattribute rules, while using less than 100 bytes per policy, on average, for a smart home use case. Our C-based SmartABAC implementation is at least 255 times faster than existing models and can evaluate 3000 policies under 5 ms on a 32-MHz MCU.

The Internet of Things (IoT) is steadily growing and migrating to decentralized architectures. In this context the Swarm approach, based on organic, edge-centric IoT networks, proposes one step further toward cooperation among devices, through the creation of a communication mediator called Swarm Broker. An important aspect in creating a cooperation network in the Swarm is the economical domain: the Swarm economy that guarantees fair rules to stimulate resource sharing among participants. This economic aspect is even more challenging in networks with distributed governance and motivates the adoption of a technology for a trustworthy and immutable public registry, such as blockchain, to store transaction information. In this paper, we aim to create an economic model that regulate the cooperation among the participants of the Swarm, by implementing strategies, to fulfill the restrictions posed by the decentralized network and the presence of resource-constrained devices that integrate the Swarm. We created a microeconomic model for resource sharing in the Swarm and a transaction model, based on the price and reputation of participants. We created a blockchain-based system for storing currency, contract, and reputation information in a distributed way. We included the resulting models and implementation into the Swarm network, by adding a module into the Swarm Broker.