Similarly to elsewhere on the Internet, practical security in the Internet of Things (IoT) is achieved by combining an array of mechanisms, at work at all layers of the protocol stack, in system software, and in hardware. Standardized protocols, such as Datagram Transport Layer Security (DTLS 1.2) and Transport Layer Security (TLS 1.2), are often recommended to secure communications to/from IoT devices. Recently, the TLS 1.3 standard was released and DTLS 1.3 is in the final stages of standardization. In this paper, we give an overview of version 1.3 of these protocols, and we provide the first experimental comparative performance analysis of different implementations and various configurations of these protocols, on real IoT devices based on low-power microcontrollers. We show how different implementations lead to different compromises. We measure and compare bytes-over-the-air, memory footprint, and energy consumption. We show that, when DTLS/TLS 1.3 requires more resources than DTLS/TLS 1.2, this additional overhead is quite reasonable. We also observe that, in some configurations, DTLS/TLS 1.3 actually decreases overhead and resource consumption. All in all, our study indicates that there is still room to optimize the existing implementations of these protocols.

The Internet of Things (IoT) is the next wave of innovation that promises to improve and optimize our daily life based on intelligent sensors and smart objects working together. Through Internet Protocol (IP) connectivity, devices can now be connected to the Internet, thus allowing them to be read, controlled, and managed at any time and at any place. Security is an important aspect for IoT deployments. However, proprietary security solutions do not help in formulating a coherent security vision to enable IoT devices to securely communicate with each other in an interoperable manner. This paper gives an overview of the efforts in the Internet Engineering Task Force (IETF) to standardize security solutions for the IoT ecosystem. We first provide an in-depth review of the communication security solutions for IoT, specifically the standard security protocols to be used in conjunction with the Constrained Application Protocol (CoAP), an application protocol specifically tailored to the needs of adapting to the constraints of IoT devices. Since Datagram Transport Layer Security (DTLS) has been chosen as the channel security underneath CoAP, this paper also discusses the latest standardization efforts to adapt and enhance the DTLS for IoT applications. This includes the use of 1) raw public key in DTLS; 2) extending DTLS record Layer to protect group (multicast) communication; and 3) profiling DTLS for reducing the size and complexity of implementations on embedded devices. We also provide an extensive review of compression schemes that are being proposed in IETF to mitigate message fragmentation issues in DTLS.

This paper presents an evaluation of the quality of Service Signalling Layer Protocol (QoS-NSLP) of the NSIS (next steps in signalling) protocol suite. The QoS-NSLP in combination with the NSIS Transport Layer Protocol (NTLP) is proposed by the Internet Engineering Task Force (IETF) as an alternative to the Resource reSerVation Protocol (RSVP). We describe our implementations of the software architecture, both on a network simulator and on a Linux implementation. Both implementations are used in a complimentary manner to illustrate the performance of the QoS-NSLP protocol. The results show the performance of QoS-NSLP with respect to resource consumption, packet processing time, session set up time, refresh interval and protocol overhead. Furthermore, we analyse the protocol performance during route change scenarios.

Public safety answering points (PSAPs) serve limited geographic areas, so emergency callers must be directed to the most appropriate PSAP. As part of the overall Internet Engineering Task Force (IETF) emergency services architecture, we have developed a new protocol, LoST (location-to-service translation), that allows end systems and voice-over-IP (VoIP) proxies to map location data into URLs representing either PSAPs or other session initiation protocol (SIP) proxies that perform a more fine-grained mapping. LoST is designed to operate globally, with a highly-distributed authority.

Recently, there has been increased interest, shown by the research community and by industry fora, to enable emergency services for voice-over-IP based architectures. In order to provide emergency services functionality over the Internet, several aspects like location determination, dial string configuration, location conveyance, routing to the appropriate public safety answering point (PSAP) and security aspects have to be considered. This paper discusses security threats for the IP-based emergency architecture concentrating on denial-of-service attacks against public safety answering points (PSAPs) by using faked calls that aim to exhaust limited PSAP resources, such as the emergency personnel. We illustrate a number of different approaches that have been mentioned in the past to tackle these threats, including location signing, location-by-reference and authenticated emergency calls.

The General Internet Signaling Transport (GIST) protocol is currently being developed as the base protocol component in the IETF Next Steps In Signaling (NSIS) protocol stack to support a variety of signaling applications. We present our study on the protocol overhead and performance aspects of GIST. We quantify network-layer protocol overhead and observe the effects of enhanced modularity and security in GIST. We developed a first open source GIST implementation at the University of Göttingen, and study its performance in a Linux testbed. A GIST node serving 45,000 signaling sessions is found to consume average only 1.1 ms for processing a signaling message and 2.4 KB of memory for managing a session. Individual routines in the GIST code are instrumented to obtain a detailed profile of their contributions to the overall system processing. Important factors in determining performance, such as the number of sessions, state management, refresh frequency, timer management and signaling message size are further discussed. We investigate several mechanisms to improve GIST performance so that it is comparable to an RSVP implementation.

The pre-shared key based mechanisms for Transport Layer Security (TLS) were recently standardized by the IETF to extend the set of ciphersuites by utilizing existing key management infrastructures. The benefit of pre-shared based mechanisms is the avoidance or reduction of the cryptographic operations used in public-key based mechanisms. However, so far there are no performance measurements for pre-shared key based ciphersuites available. In this paper, we present a systematic analysis and performance comparison between the pre-shared key exchange mechanisms and the standard public key exchange mechanisms in TLS. Our performance metrics are processing time and transmitted amount of data for a handshake establishment. Furthermore, the interaction between the overall TLS handshake duration and the network environment is evaluated. The results for different key exchange mechanisms are comparatively studied and the design choices of pre-shared key based key exchange mechanisms have been validated. Experimental results give details about the performance improvement of the pre-shared key based mechanisms compared to the standard public key based mechanisms.

The most typical configuration procedure of a host involves the provision of an IP address and most often this is done with the help of dynamic host configuration protocol (DHCP). Unfortunately, the security of this procedure is largely non-existent. While the closed nature of the access networks has mitigated the vulnerability, the evolvement of the networks and increase in wireless use demand more stringent secure measures. This paper proposes the integration of DHCP with host identity protocol (HIP) mechanisms, so that the security measures inherent to HIP can be extended to protect the configuration information and its provisioning as well

Reservation-based quality of service (QoS) in a mixed wireless and wireline environment requires an end-to-end signaling protocol that is capable of adapting to the idiosyncrasies of the different networks. The QoS NSIS signaling protocol (QoS-NSLP) has been created by the Next Steps In Signaling working group at the IETF to fulfill this need for an adaptive reservation protocol. It allows reservation requests to be interpreted by equipment implementing different QoS models along the path between a data sender and a data receiver. This paper describes the QoS-NSLP, and an example of a particular QoS model that is based on resource management in DiffServ (RMD). RMD provides a scalable dynamic resource management method for DiffServ networks. RMD has two basic functions to control the traffic load in a DiffServ domain: it provides admission control for flows entering the network and it has an algorithm that terminates the required amount of flows in case of congestion caused by failures (e.g. link or router) within a DiffServ domain. The admission control within the domain can be either measurement - or reservation-based. The basic signaling mechanism is described for different signaling scenarios and the expected performance of the protocol is discussed.

Tackling the major Internet security, scalability and mobility problems without essentially changing the existing Internet architecture has turned out to be a very challenging task. The overlay routing approaches fortunately seem to offer a sound way to mitigate most of these issues. Basically, they decouple the end-point identifiers from locators by defining a new namespace. Overlay routing is based on the dynamic binding, at middle-boxes, between the two namespaces. The approach is very close to Network Address Translation (NAT) principles. Therefore, the IPsec NAT traversal related problems apply also to overlay architectures. In this paper, we integrate IPsec into the overlay routing using Security Parameter Index (SPI) multiplexed NAT (SPINAT). Our approach reduces tunneling overhead and supports asymmetric communication paths. We believe that the SPINAT will be a key component in securing overlay routing infrastructures, like in the Internet Indirection Infrastructure (i^3).