Nonce-based authenticated key establishment over OAuth 2.0 IoT proof-of-possession architecture

Renzo Efrain Navas (1, 2) , Manuel Lagos (1, 2) , Laurent Toutain (1, 2) , Kumaran Vijayasankar (3)

1 RSM - Département Réseaux, Sécurité et Multimédia
2 OCIF - Objets communicants pour l'Internet du futur
3 Texas Instruments - R&D center [USA]

The Internet of Things will scale to billions of devices in the next coming years. A secure communication framework is needed to interconnect all these objects, by taking into account their intrinsic constrained in terms of energy, cpu and memory; Several proposals relying on adapting existing well-known and standardized security solutions exist, but we believe there is still a gap for most-constrained nodes to provide fine-grained authorization and secure establishment of fresh cryptographic keys. We propose a mechanism that runs on top of the OAuth Authorization architecture and provides the bootstrapping of fresh authenticated symmetric cryptographic material between previously unknown parties using a nonce-based protocol. We set up an energy measurement platform to evaluate our proposal and compare it with existing work.

Mots clés: Energy; Authorization; IoT; Authenticated key establishment; OAuth; Symmetric cryptography; Nonce

Domaines: Réseaux et télécommunications [cs.NI]

Renzo Efrain Navas, Manuel Lagos, Laurent Toutain, Kumaran Vijayasankar. Nonce-based authenticated key establishment over OAuth 2.0 IoT proof-of-possession architecture. WF-IoT 2016 : IEEE 3rd World Forum on Internet of Things, Dec 2016, Reston, Va, United States. pp.317 - 322, ⟨10.1109/WF-IoT.2016.7845424⟩. ⟨hal-01522039⟩