EDHOC is a lightweight authenticated key exchange protocol designed for constrained IoT devices. It currently supports asymmetric authentication, either using digital signatures or static Diffie-Hellman (DH) keys. Since many IoT deployments rely on Pre-Shared Keys (PSK) for authentication, a new PSK-based authentication method (EDHOC-PSK) is currently under standardization. This paper presents a symbolic analysis EDHOC-PSK (draft version 06) using SAPIC+, which compiles a single formal specification into multiple state-of-the-art verification tools, including Tamarin and ProVerif. Our model extends the typical Dolev-Yao (DY) adversary with additional capabilities, including leakage of ephemeral secrets, leakage of the long-term Pre-Shared Key leakage of the session key and a discrete-logarithm oracle. We verify the confidentiality, authentication, and key-agreement properties stated in the draft, and we refine the specification of identity protection by distinguishing anonymity and unlinkability. We show that EDHOC-PSK achieves anonymity for both parties against active attackers, while unlinkability holds only for the Initiator under passive attackers. Finally, we analyze a post-quantum Store-Now-Decrypt-Later (SNDL) adversary and find that all proven properties remain intact except Perfect Forward Secrecy (PFS), which cannot be preserved once DH secrets are recoverable.

Large-scale deployments of resource-constrained embedded devices require lightweight, self-contained hardware roots of trust that avoid long-term secret storage. Physically Unclonable Functions (PUFs) enable secure key extraction from intrinsic hardware variations without storing keys in non-volatile memory (NVM). SRAM PUFs leverage existing Static Random Access Memory (SRAM), but face reliability issues due to environmental noise. Existing solutions rely on complex error correction codes with NVM-stored helper data, or extensive SRAM measurements to pre-select stable cells. Eliminating NVM storage for helper data mitigates information leakage risks and manufacturing costs, offering a crucial benefit for resource-constrained devices lacking NVM. This paper presents a novel approach for stabilizing SRAM PUFs without NVM-stored helper data, using a simple decoder and few SRAM measurements, at the cost of increased SRAM size. We generate consistent On-Demand Helper Data (ODHD) temporarily stored in volatile memory and validate our method experimentally on real hardware. ODHD exposes a flexible trade-off between enrollment consistency, regeneration reliability, and SRAM size by varying a single enrollment threshold, a degree of freedom absent in the fixed Dark Bit approach. At the threshold-free operating point, ODHD achieves a key error rate of 8.2% for a 16-bit output, more than six times lower than Dark Bit’s 51.5%, using only 6 bytes of SRAM per 16-bit output, when ≈ 500 power cycles are used at every key derivation.

The proliferation of Internet-of-Things (IoT) devices in critical infrastructure requires robust security mechanisms to verify device integrity and trustworthiness. Remote Attestation (RA) is a security mechanism for validating the software and hardware state of remote devices. Existing RA solutions for resource-constrained IoT devices lack comprehensive frameworks for secure attestation channels and focus primarily on local evidence generation without addressing end-to-end security. This paper introduces M-AuRA, a lightweight RA solution that fills these gaps by leveraging the newly standardized Ephemeral Diffie-Hellman over COSE (EDHOC) protocol. M-AuRA seamlessly integrates attestation with authentication, enabling both unilateral and mutual attestation modes while maintaining minimal resource overhead. Our framework specifies how to transport existing attestation mechanisms in parallel with secure communication establishment, providing a complete end-to-end security solution for IoT deployments. We demonstrate M-AuRA’s practicality through implementation on the nRF5340 microcontroller running at 64 MHz, evaluating performance across both software and hardware cryptographic back-ends. In mutual attestation mode, our implementation uses only 4,692 B RAM and 19,350 B flash memory, occupying 0.9% and 1.85% of available nRF5340 resources, respectively. The four-message EDHOC exchange (45 B, 65 B, 177 B and 120 B) enables mutual trustworthiness verification in 10.46 s using a software-based cryptographic back-end, or only 0.43 s with hardware acceleration, consuming 171.43 mC and 7.97 mC of charge, respectively.

Remote Attestation (RA) is a security process that verifies the integrity and trustworthiness of a remote device’s software and hardware. While RA for high-end devices is well-developed, RA in constrained IoT environments remains incomplete. Existing embedded RA mechanisms focus on local evidence generation and verification, but lack a complete process that includes a secure attestation channel. This paper introduces AuRA, a lightweight RA solution that builds upon the newly standardized Ephemeral Diffie-Hellman over COSE (EDHOC) protocol. AuRA specifies how to transport existing attestation mechanisms in parallel with network authentication. We evaluate AuRA on the nRF5340 microcontroller running at $\mathbf{6 4 ~ M H z}$. This implementation has a memory footprint of 6,665 B of RAM and 17,163 B of flash. The device completes Remote Attestation by exchanging three EDHOC messages with a verifier entity, of sizes $42 \mathrm{~B}, 59 \mathrm{~B}$ and 223 B. This allows the device to prove that it is running the right hardware and software in only 5.51 s, consuming as little as 88 mC of charge.

SRAM Physically Unclonable Functions (PUFs) derive secret keys from start-up values for inherent security benefits but suffer from reliability issues due to bit flipping. We introduce the Threshold-based Majority Voting Scheme (TMVS), a lightweight method that eliminates noise and mitigates bias in SRAM PUFs while retaining the simplicity of majority voting decoders used by repetition codes, without the significant entropy loss that repetition codes incur under biased responses. TMVS runs entirely in software, requires no cell-level bit-error rate qualification or SRAM redesign, and avoids the complex decoders of heavy error correcting codes. We derive closed-form expressions for decoding-error probability and expected memory, validate them on experimental data, and present a security analysis that provides exact formulas for min-entropy and secrecy leakage due to helper data and bias, identifying conditions under which TMVS achieves zero secrecy leakage. On a large public dataset, TMVS shows near-zero cross-chip secrecy leakage and preserves average conditional min-entropy above 1 bit despite biased, spatially correlated SRAM statistics. Compared with prior work, TMVS offers the smallest decoding complexity at the cost of a larger PUF size. In a representative configuration, TMVS generates a 128-bit key with failure probability 9.15 · 10−6and zero secrecy leakage at a bit-flip probability of 10%, requiring only ∼ 248k clock cycles on a 32-bit ARM Cortex-M0. These results show that TMVS is practical and implementation-friendly for resource-constrained, low-power devices.

Authenticated key exchange protocols play a crucial role in the communication security stack of an Internet-of-Things (IoT) device: they authenticate the communicating parties and establish a shared symmetric secret between them. Following a large debate in the community, the Internet Engineering Task Force (IETF) has recently standardized a new protocol called EDHOC for authenticated key exchange targeting IoT environments. The EDHOC protocol performs a compact Diffie-Hellman key exchange handshake, requiring several times less bytes-over-the-air than the de-facto solution used in the Internet, the (D)TLS protocol. In this paper, we study how this reduction in message size correlates with the usage of other scarce resources in IoT environments: time, energy, and memory. We evaluate EDHOC and DTLS with different authentication configurations over two IoT radio technologies. First, we measure the EDHOC and DTLS handshakes on constrained hardware over an IEEE 802.15.4 radio. We observe that EDHOC achieves ×6 to × 14 reduction in packet sizes, × 1.44 improvement in handshake duration and ×2.79 reduction in energy consumed. Next, we simulate time on air on LoRaWAN networks and find that, in the most restrictive configuration (SF = 12), DTLS uses at least × 7 more time on air than EDHOC. Finally, we measure flash memory and RAM usage, with the EDHOC implementation achieving a ×4 reduction in both.

Data gathering systems in the Industrial IoT require an end-to-end latency as low as 1 s with coverage of a few hundred meters. The 6TiSCH standard is well suited for these types of applications. A 6TiSCH network is a multihop wireless IPv6 network which uses time-slotted channel hopping (TSCH). TSCH is a medium access mode of IEEE802.15.4 which provides deterministic properties, and increases robustness against external interference and multipath fading. A key component of TSCH is its scheduling function that builds the communication schedule, which greatly impacts network performance. Although there are several proposed TSCH scheduling solutions in the literature, most of them are not directly applicable to 6TiSCH for real-world deployments because they fail to take into consideration the dynamics of a network. Some of them assume afixedrouting topology, which does not match 6TiSCH where the routing topology dynamically changes with the radio environment. In this article, we propose a full-featured 6TiSCH scheduling function called YSF, that autonomously takes into account all aspects of network dynamics, including the network formation phase and parent switching. YSF aims at minimizing latency and maximizing reliability for data gathering applications. We evaluate YSF by simulation, and compare it to MSF, the state-of-art scheduling function being standardized by the IETF 6TiSCH working group.

Short development cycles, application-field diversity, and requirements on network size or reliability put an ever increasing strain on Internet of Things (IoT) application developers. Real-time embedded operating systems (RTOS) aim to provide a key set of features, abstractions and services that enable faster development. To fulfill the promise of wire-like communication reliability, wireless standards such as WirelessHART, ISA100.11a and 6TiSCH have been developed and are used in the industry. Keeping these networks synchronized requires precise timing information from the underlying hardware. However, the hardware abstractions of an RTOS do come with an overhead, and the question arises on how these abstractions impact the performance of a complex network stack. To study this, we integrated Open-WSN, a standards-compliant open-source implementation of the 6TiSCH network stack, with RIOT, a prominent open-source RTOS. We compare the minimalistic "bare metal" approach of OpenWSN with RIOT's full-fledged RTOS environment. We study the impact on network performance, power consumption and real-time application properties. On the one hand, we show that using RIOT to execute a 6TiSCH stack does not degrade power consumption or network performance. On the other hand, we demonstrate how RIOT brings improvements on the time it takes to execute application tasks.

The convergence of operational and information technologies in the industry requires a new generation of IP-compliant communication protocols that can meet the industrial performance requirements while facilitating the integration with novel web-based supervisory control and data acquisition (SCADA) systems. For more than a decade, the industry has relied on time-slotted channel hopping (TSCH) communication technology to meet these performance requirements through standards such as WirelessHART and ISA100.11a. TSCH-based networks have proven to yield over 99.999% end-to-end reliability, supporting flow isolation and QoS management while ensuring over a decade of battery lifetime. However, these technologies were designed to address the factory use cases of a decade ago, not considering IP compliance or standardized network management and resource orchestration as a must. The Internet Engineering Task Force (IETF) and the 6TiSCH working group (WG) have been actively working on this challenge by designing protocols to bridge the performance of industrial solutions with IP-compliant networks. The effort has resulted in 6TiSCH, a set of specifications that define the IPv6 control plane to manage and orchestrate a TSCH network. 6TiSCH provides the missing elements for zero-configuration TSCH network bootstrap, efficient network access authentication, and distributed and modular scheduling mechanisms. As a cross-layer effort, 6TiSCH leverages and integrates other IETF specifications and the WG has also driven the definition of novel specifications in other IETF WGs. An ultimate goal of this effort is the definition of a fully functional architecture where a combination of IETF protocols enables the envisioned convergence on top of the IEEE industrial standard. This paper introduces the work done by the 6TiSCH WG at IETF, evaluates the performance of the reference implementation, and discusses the 6TiSCH software ecosystem.

Embedded devices of the Internet of Things form the so-called low-power and lossy networks. In these networks, nodes are constrained in terms of energy, memory, and processing. Links are lossy and exhibit a transient behavior. From the point of view of energy expenditure, governing control overhead emission is crucial and is the role of the Trickle algorithm. We address Trickle's fairness problem to evenly distribute the transmission load across the network, while keeping the total message count low. First, we analytically analyze two underlying causes of unfairness in Trickle networks: 1) desynchronization among nodes and 2) nonuniform topologies. Based on our analysis, we propose a first algorithm whose performance and parameters we study in an emulated environment. From this feedback, we design a second algorithm Trickle-D that adapts the redundancy parameter to achieve high fairness while keeping the transmission load low. We validate Trickle-D in real-life conditions using a large scale experimental testbed. Trickle-D requires minimal changes to Trickle, zero user input, emits 17.7% less messages than state-of-the-art and 37.2% less messages than state-of-practice, while guaranteeing high fairness across the network.

Due to its scale and dynamism, the Internet of Things (IoT) requires efficient and flexible communication support. At the network layer, IPv6 integrates heterogeneous technologies to provide interoperability, efficient multicast group communication and a flexible address space. At the application layer, publish-subscribe (pub-sub) middleware implements a scalable, dynamic and loosely-coupled data dissemination scheme. The pub-sub paradigm is a natural use case for IPv6 multicast but the two mechanisms are poorly integrated in the IoT. We tackle this problem by proposing a framework that integrates pub-sub middleware and multicast to reduce communication overhead. Our solution maps application-layer subscriber groups to network-layer multicast groups. Pub-sub hosts can either implicitly derive the necessary multicast address or request it from a group manager. We evaluate our framework on an IoT network testbed composed of representative hardware and demonstrate improvements in bandwidth and energy consumption that scale with the size of the network. Bandwidth consumption of a publishing sensor decreases by up to 54% for 10 subscribers and 66% for 20 subscribers. Moreover, the implementation has a minimal memory footprint, requiring only an additional 1.3% dynamic memory and 4.7% flash storage.

Wireless sensor network protocols very often use the Trickle algorithm to govern information dissemination. For example, the widely used IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) uses Trickle to emit control packets. We derive an analytical model of Trickle to take into account multiple redundancy constants and the common lack of synchronization among nodes. Moreover, we demonstrate message count unfairness when Trickle uses a unique global redundancy constant because nodes with less neighbors transmit more often. Consequently, we propose a heuristic algorithm that calculates a redundancy constant for each node as a function of its number of neighbors. Our calculated redundancy constants reduce unfairness among nodes by distributing more equally the number of transmitted messages in the network. Our analytical model is validated by emulations of constrained devices running the Contiki Operating System and its IPv6 networking stack. Furthermore, results very well corroborate the heuristic algorithm improvements.

The Datagram Transport Layer Security (DTLS) protocol is the IETF standard for securing the Internet of Things. The Constrained Application Protocol, ZigBee IP, and Lightweight Machine-to-Machine (LWM2M) mandate its use for securing application traffic. There has been much debate in both the standardization and research communities on the applicability of DTLS to constrained environments. The main concerns are the communication overhead and latency of the DTLS handshake, and the memory footprint of a DTLS implementation. This paper provides a thorough performance evaluation of DTLS in different duty-cycled networks through real-world experimentation, emulation and analysis. In particular, we measure the duration of the DTLS handshake when using three duty cycling link-layer protocols: preamble-sampling, the IEEE 802.15.4 beacon-enabled mode and the IEEE 802.15.4e Time Slotted Channel Hopping mode. The reported results demonstrate surprisingly poor performance of DTLS in radio duty-cycled networks. Because a DTLS client and a server exchange more than 10 signaling packets, the DTLS handshake takes between a handful of seconds and several tens of seconds, with similar results for different duty cycling protocols. Moreover, because of their limited memory, typical constrained nodes can only maintain 3–5 simultaneous DTLS sessions, which highlights the need for using DTLS parsimoniously.

This paper presents GreenNet, an energy efficient and fully operational protocol stack for IP-enabled wireless sensor networks based on the IEEE 802.15.4 beacon-enabled mode. The stack runs on a hardware platform with photovoltaic cell energy harvesting developed by STMicroelectronics (STM) that can operate autonomously for long periods of time. GreenNet integrates several standard mechanisms and enhances existing protocols, which results in an operational platform with the performance beyond the current state of the art. In particular, it includes the IEEE 802.15.4 beacon-enabled medium access control (MAC) integrated with lightweight IP routing for achieving very low duty cycles. It offers an advanced discovery scheme that accelerates the process of joining the network and proposes an adaptation scheme for adjusting the duty cycle of harvested nodes to the available energy for increased performance. Finally, it supports security at two levels: a basic standard secure operation at the link layer and advanced scalable data payload security. This paper describes all techniques and mechanisms for saving energy and operating at very low duty cycles. It also provides an evaluation of the performance and energy consumption of GreenNet.

In this paper, we propose a new scheme that allows coupling beacon-enabled IEEE 802.15.4 with the RPL routing protocol while keeping full compliance with both standards. We provide a means for RPL to pass the routing information to Layer 2 before the 802.15.4 topology is created by encapsulating RPL DIO messages in beacon frames. The scheme takes advantage of 802.15.4 command frames to solicit RPL DIO messages. The effect of the command frames is to reset the Trickle timer that governs sending DIO messages. We provide a detailed analysis of the overhead incurred by the proposed scheme to understand topology construction costs. We have evaluated the scheme using Contiki and the instruction-level Cooja simulator and compared our results against the most common scheme used for dissemination of the upper-layer information in beacon-enabled PANs. The results show energy savings during the topology construction phase and in the steady state.

Billions of smart, but constrained objects wirelessly connected to the global network require novel paradigms in network design. New protocol standards, tailored to constrained devices, have been designed taking into account requirements such as asynchronous application traffic, need for caching, and group communication. The existing connection-oriented security architecture is not able to keep up-first, in terms of the supported features, but also in terms of the scale and resulting latency on small constrained devices. In this paper, we propose an architecture that leverages the security concepts both from content-centric and traditional connection-oriented approaches. We rely on secure channels established by means of (D)TLS for key exchange, but we get rid of the notion of the “state” among communicating entities. We provide a mechanism to protect from replay attacks by coupling our scheme with the CoAP application protocol. Our object-based security architecture (OSCAR) intrinsically supports caching and multicast, and does not affect the radio duty-cycling operation of constrained objects. We evaluate OSCAR in two cases: 802.15.4 Low Power and Lossy Networks (LLN) and Machine-to-Machine (M2M) communication for two different hardware platforms and MAC layers on a real testbed and using the Cooja emulator. We show significant energy savings at constrained servers and reasonable delays. We also discuss the applicability of OSCAR to Smart City deployments.

RPL, the routing protocol proposed by IETF for IPv6/6LoWPAN Low Power and Lossy Networks has significant complexity. Another protocol called LOADng, a lightweight variant of AODV, emerges as an alternative solution. In this paper, we compare the performance of the two protocols in a Home Automation scenario with heterogenous traffic patterns including a mix of multipoint-to-point and point-to-multipoint routes in realistic dense non-uniform network topologies. We use Contiki OS and Cooja simulator to evaluate the behavior of the ContikiRPL implementation and a basic non-optimized implementation of LOADng. Unlike previous studies, our results show that RPL provides shorter delays, less control overhead, and requires less memory than LOADng. Nevertheless, enhancing LOADng with more efficient flooding and a better route storage algorithm may improve its performance.