Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols
Communication security of an Internet-of-Things (IoT) product depends on the variety of protocols employed throughout its lifetime. The underlying low-power radio communication technologies impose constraints on maximum transmission units and data rates. Surpassing maximum transmission unit threshol...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2024-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10487947/ |
| _version_ | 1827287530197745664 |
|---|---|
| author | Rikard Hoglund Marco Tiloca Goran Selander John Preus Mattsson Malisa Vucinic Thomas Watteyne |
| author_facet | Rikard Hoglund Marco Tiloca Goran Selander John Preus Mattsson Malisa Vucinic Thomas Watteyne |
| author_sort | Rikard Hoglund |
| collection | DOAJ |
| description | Communication security of an Internet-of-Things (IoT) product depends on the variety of protocols employed throughout its lifetime. The underlying low-power radio communication technologies impose constraints on maximum transmission units and data rates. Surpassing maximum transmission unit thresholds has an important effect on the efficiency of the solution: transmitting multiple fragments over low-power IoT radio technologies is often prohibitively expensive. Furthermore, IoT communication paradigms such as one-to-many require novel solutions to support the applications executing on constrained devices. Over the last decade, the Internet Engineering Task Force (IETF) has been working through its various Working Groups on defining lightweight protocols for Internet-of-Things use cases. “Lightweight” refers to the minimal processing overhead, memory footprint and number of bytes in the air, compared to the protocol counterparts used for non-constrained devices in the Internet. This article overviews the standardization efforts in the IETF on lightweight communication security protocols. It introduces EDHOC, a key exchange protocol, as well as OSCORE and Group OSCORE, application data protection protocols adapted for securing IoT applications. The article additionally highlights the design considerations taken into account during the design of these protocols, an aspect not present in the standards documents. Finally, we present an evaluation of these protocols in terms of the message sizes, and we compare them with the non-constrained counterpart, the (D)TLS protocol. We demonstrate that the novel key exchange protocol EDHOC achieves <inline-formula> <tex-math notation="LaTeX">$\times 5$ </tex-math></inline-formula> reduction over DTLS 1.3 authenticated with pre-shared keys in terms of total number of bytes transmitted over the air, while keeping the benefits of authentication with asymmetric credentials. |
| first_indexed | 2024-04-24T11:01:01Z |
| format | Article |
| id | doaj.art-a6b4bab4414a46a4ade459a10f8753f7 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-24T11:01:01Z |
| publishDate | 2024-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-a6b4bab4414a46a4ade459a10f8753f72024-04-11T23:00:47ZengIEEEIEEE Access2169-35362024-01-0112498654987710.1109/ACCESS.2024.338409510487947Secure Communication for the IoT: EDHOC and (Group) OSCORE ProtocolsRikard Hoglund0https://orcid.org/0000-0002-9437-5764Marco Tiloca1https://orcid.org/0000-0001-8842-9810Goran Selander2John Preus Mattsson3Malisa Vucinic4https://orcid.org/0000-0002-7700-9121Thomas Watteyne5https://orcid.org/0000-0002-3695-9315RISE Research Institutes of Sweden, Kista, SwedenRISE Research Institutes of Sweden, Kista, SwedenEricsson Research, Stockholm, SwedenEricsson Research, Stockholm, SwedenInria Paris, Paris, FranceInria Paris, Paris, FranceCommunication security of an Internet-of-Things (IoT) product depends on the variety of protocols employed throughout its lifetime. The underlying low-power radio communication technologies impose constraints on maximum transmission units and data rates. Surpassing maximum transmission unit thresholds has an important effect on the efficiency of the solution: transmitting multiple fragments over low-power IoT radio technologies is often prohibitively expensive. Furthermore, IoT communication paradigms such as one-to-many require novel solutions to support the applications executing on constrained devices. Over the last decade, the Internet Engineering Task Force (IETF) has been working through its various Working Groups on defining lightweight protocols for Internet-of-Things use cases. “Lightweight” refers to the minimal processing overhead, memory footprint and number of bytes in the air, compared to the protocol counterparts used for non-constrained devices in the Internet. This article overviews the standardization efforts in the IETF on lightweight communication security protocols. It introduces EDHOC, a key exchange protocol, as well as OSCORE and Group OSCORE, application data protection protocols adapted for securing IoT applications. The article additionally highlights the design considerations taken into account during the design of these protocols, an aspect not present in the standards documents. Finally, we present an evaluation of these protocols in terms of the message sizes, and we compare them with the non-constrained counterpart, the (D)TLS protocol. We demonstrate that the novel key exchange protocol EDHOC achieves <inline-formula> <tex-math notation="LaTeX">$\times 5$ </tex-math></inline-formula> reduction over DTLS 1.3 authenticated with pre-shared keys in terms of total number of bytes transmitted over the air, while keeping the benefits of authentication with asymmetric credentials.https://ieeexplore.ieee.org/document/10487947/IETFstandardizationsecurityInternet of ThingsCoAPEDHOC |
| spellingShingle | Rikard Hoglund Marco Tiloca Goran Selander John Preus Mattsson Malisa Vucinic Thomas Watteyne Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols IEEE Access IETF standardization security Internet of Things CoAP EDHOC |
| title | Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols |
| title_full | Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols |
| title_fullStr | Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols |
| title_full_unstemmed | Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols |
| title_short | Secure Communication for the IoT: EDHOC and (Group) OSCORE Protocols |
| title_sort | secure communication for the iot edhoc and group oscore protocols |
| topic | IETF standardization security Internet of Things CoAP EDHOC |
| url | https://ieeexplore.ieee.org/document/10487947/ |
| work_keys_str_mv | AT rikardhoglund securecommunicationfortheiotedhocandgrouposcoreprotocols AT marcotiloca securecommunicationfortheiotedhocandgrouposcoreprotocols AT goranselander securecommunicationfortheiotedhocandgrouposcoreprotocols AT johnpreusmattsson securecommunicationfortheiotedhocandgrouposcoreprotocols AT malisavucinic securecommunicationfortheiotedhocandgrouposcoreprotocols AT thomaswatteyne securecommunicationfortheiotedhocandgrouposcoreprotocols |