Public key infrastructure (PKI) provides the basis of authentication and access control in most networked systems. In the Internet of Things (IoT), however, security has predominantly been based on pre-shared keys (PSK), which cannot be revoked and do not provide strong authentication. The prevalence of PSK in the IoT is due primarily to a lack of lightweight protocols for accessing PKI services. Principal among these services are digital certificate enrollment and revocation, the former of which is addressed in recent research and is being pushed for standardization in IETF. However, no protocol yet exists for retrieving certificate status information on constrained devices, and revocation is not possible unless such a service is available. In this work, we start with implementing the Online Certificate Status Protocol (OCSP), the de facto standard for certificate validation on the Web, on state-of-the-art constrained hardware. In doing so, we demonstrate that the resource overhead of this protocol is unacceptable for highly constrained environments. We design, implement and evaluate a lightweight alternative to OCSP, TinyOCSP, which leverages recently standardized IoT protocols, such as CoAP and CBOR. In our experiments, validating eight certificates with TinyOCSP required 41% less energy than validating just one with OCSP on an ARM Cortex-M3 SoC. Moreover, validation transactions encoded with TinyOCSP are at least 73% smaller than the OCSP equivalent. We design a protocol for compressed certificate revocation lists (CCRL) using Bloom filters which together with TinyOCSP can further reduce validation overhead. We derive a set of equations for computing the optimal filter parameters, and confirm these results through empirical evaluation.

Public Key Infrastructure is the state-of-the-art credential management solution on the Internet. However, the millions of constrained devices that make of the Internet of Things currently lack a centralized, scalable system for managing keys and identities. Modern PKI is built on a set of protocols which were not designed for constrained environments, and as a result many small, battery-powered IoT devices lack the required computing resources. In this paper, we develop an automated certificate enrollment protocol light enough for highly constrained devices, which provides end-to-end security between certificate authorities (CA) and the recipient IoT devices. We also design a lightweight profile for X.509 digital certificates with CBOR encoding, called XIOT. Existing CAs can now issue traditional X.509 to IoT devices. These are converted to and from the XIOT format by edge devices on constrained networks. This procedure preserves the integrity of the original CA signature, so the edge device performing certificate conversion need not be trusted. We implement these protocols within the Contiki embedded operating system and evaluate their performance on an ARM Cortex-M3 platform. Our evaluation demonstrates reductions in energy expenditure and communication latency. The RAM and ROM required to implement these protocols are on par with the other lightweight protocols in Contiki’s network stack.

This work presents FDTLS, a security framework that combines storage and network/communication-level security on resource limited Internet of Things (IoT) devices using Datagram Transport Layer Security (DTLS). While coalescing the storage and networking security schemes can reduce redundant and unnecessary cryptographic operations, we identify security-and system-level challenges that can occur when applying DTLS towards such concept. FDTLS addresses these challenges by employing an asymmetric key generation scheme, a virtual peer-based handshaking mechanism, and a header size reduction scheme. Our results obtained using Contiki-based implementations on OpenMote devices show that compared to using storage and networking security separately, FDTLS can reduce the network response latency and improve energy savings.

This work presents FDTLS, a security framework that combines storage and network/communication-level security for resource limited Internet of Things (IoT) devices using Datagram Transport Layer Security (DTLS). While coalescing storage and networking security scheme can reduce redundent and unnecessary operations, we identify security- and system-level challenges that can occur when applying DTLS. FDTLS addresses these challenges by employing asymmetric key generation, a virtual peer, and header reduction-based storage optimization. Our results obtained using a Contiki-based implementation on OpenMote platforms show that compared to using storage and networking security separately, FDTLS can reduce the latency of packet transmission responses and also contribute to saving energy.

Energy efficient sensing is one of the main objectives in the design of networked embedded monitoring systems. However, existing approaches such as duty cycling and ambient energy harvesting face challenges in railway bridge health monitoring applications due to the unpredictability of train passages and insufficient ambient energy around bridges. This paper presents eco-friendly vibration (ECO VIBE), an on-demand sensing system that automatically turns on itself when a train passes on the bridge and adaptively powers itself off after finishing all tasks. After that, it goes into an inactive state with near-zero power dissipation. ECO VIBE achieves these by: first, a novel, fully passive event detection circuit to continuously detect passing trains without consuming any energy. Second, combining train-induced vibration energy harvesting with a transistor-based load switch, a tiny amount of energy is sufficient to keep ECO VIBE active for a long time. Third, a passive adaptive off control circuit is introduced to quickly switch off ECO VIBE. Also this circuit does not consume any energy during inactivity periods. We present the prototype implementation of the proposed system using commercially available components and evaluate its performance in real-world scenarios. Our results show that ECO VIBE is effective in railway bridge health monitoring applications.

ABSTRACT The future Internet is an IPv6 network interconnecting traditional computers and a large number of smart objects. This Internet of Things (IoT) will be the foundation of many services and our daily life will depend on its availability and reliable operation. Therefore, among many other issues, the challenge of implementing secure communication in the IoT must be addressed. In the traditional Internet, IPsec is the established and tested way of securing networks. It is therefore reasonable to explore the option of using IPsec as a security mechanism for the IoT. Smart objects are generally added to the Internet using IPv6 over Low‐power Wireless Personal Area Networks (6LoWPAN), which defines IP communication for resource‐constrained networks. Thus, to provide security for the IoT based on the trusted and tested IPsec mechanism, it is necessary to define an IPsec extension of 6LoWPAN. In this paper, we present such a 6LoWPAN/IPsec extension and show the viability of this approach. We describe our 6LoWPAN/IPsec implementation, which we evaluate and compare with our implementation of IEEE 802.15.4 link‐layer security. We also show that it is possible to reuse crypto hardware within existing IEEE 802.15.4 transceivers for 6LoWPAN/IPsec. The evaluation results show that IPsec is a feasible option for securing the IoT in terms of packet size, energy consumption, memory usage, and processing time. Furthermore, we demonstrate that in contrast to common belief, IPsec scales better than link‐layer security as the data size and the number of hops grow, resulting in time and energy savings. Copyright © 2012 John Wiley & Sons, Ltd.

Low-power networked devices, such as sensors and actuators, are becoming a vital part of our everyday infrastructure. Being networked, the continued development of these systems needs involvement from the networking community. We present a framework for simulation, experimentation, and evaluation of routing mechanisms for low-power IPv6 networking. The framework provides a detailed simulation environment for low-power routing mechanisms, and allows the system to be directly uploaded to a physical testbed for experimental measurements.