Data security has become a major concern in end-to-end communication of Internet of Things (IoT) devices. To establish an encrypted and trusted channel, certificate-based authentication is broadly adopted in many resource-constrained IoT environments, especially Elliptic Curve Qu-Vanstone (ECQV) implicit certificates, optimized for bandwidth and processing time compared to X.509 certificates. However, certificates in Public Key Infrastructure (PKI) inherently face the security problem that Certificate Authorities (CAs) with absolute trust might issue fraudulent certificates maliciously/unintentionally. To mitigate this problem, Certificate Transparency (CT) has been widely deployed, but it brings more transmission and validation overhead, posing new challenges for IoT devices. To inherit the advantage of implicit certificates and make CT more friendly to resource-restricted IoT systems, this paper proposes ImCT, the first feasible and efficient scheme for deploying ECQV implicit certificates with CT in IoT. It (1) offers an ingenious and compact design of certificate extension for integrating CT into implicit certificates, ensuring sufficiently small memory use and low validation cost; (2) provides a generic Bloom Filter-based solution to efficiently deploy ImCT in interactive protocols with compatibility with existing CT validation rules; (3) allows for incremental deployment and deploys to TLS 1.3 easily with only a few self-defined TLS extensions. The security of ImCT is also analyzed, and the performance evaluation shows its practicality and high efficiency.

The security, privacy, and trust are the critical concerns in Vehicular Ad Hoc Networks (VANETs). The Security Credential Management System (SCMS) is one of the most promising PKI-based solutions, which adopts linkage-based pseudonym certificates and has been standardized by IEEE. This paper aims to address the issues of certificate revocation in the SCMS architecture. We propose ESCORT, achieving: (i) a privacy-preserving revocation transparency for linkage-based pseudonym certificates, enhancing the reliability of the SCMS architecture; (ii) an efficient certificate status check for vehicles, eliminating complicated computations in checking CRLs. We analyze the security and feasibility of ESCORT, and experimental results indicate its superior efficiency.

Two-factor authentication (2FA) offers very important security enhancement to traditional username-password authentication, while in many cases incurring undesirable user burdens (e.g., entering a one-time verification code sent to a phone via SMS). Some zero-effort authentication techniques (e.g., Sound-Proof) have been proposed to relieve such burdens without degrading security, but are vulnerable to prediction attacks and co-existence attacks. This paper proposes ABLE, a zero-effort 2FA approach based on co-location detection leveraging environmental Bluetooth Low Energy (BLE) signal characteristics. In this approach, a laptop on which the user tries to authenticate to a web server, and the user’s smartphone placed nearby which is trusted by the server, both collect and send a record of environmental BLE signal characteristics to the server. The server decides whether the two devices are co-located by evaluating the similarity of the two records, and makes the authentication decision. ABLE is constructed based on the fact that only two devices in close proximity share similar environmental signal characteristics, which distinguishes a legitimate user device from potential adversaries. Due to its location-sensitive nature, combining favorable features brought with the BLE protocol, ABLE is gifted with good resistance to attacks that threaten existing zero-effort authentication schemes. ABLE is not only immune to remote attackers, but also achieves an accuracy over 90% even against co-present attackers.

ECQV implicit certificates are special public-key certificates, proposed for smaller size and faster verification. In resource-constrained environments such as Internet of Things (IoT), it’s common to replace X.509 certificates with ECQV implicit certificates for better efficiency. Google’s Certificate Transparency (CT) makes the certificate issuance be publicly-visible to everyone, to enhance the trustworthiness of Public Key Infrastructure (PKI). However, the conventional CT approach based on Signed Certificate Timestamp (SCT) will be a burden for ECQV certificate verifiers in resource-constrained environments. In this paper, we propose an efficient scheme, named ECQV Implicit Certificate Transparency (EICT), to integrate CT with implicit certificates following the same assumption and approach of ECQV implicit certificates. EICT obtains better performance than CT applied in traditional X.509 PKIs. We also conduct the security analysis and performance evaluation of the proposed scheme.