Decentralised Edge Authentication in the Industrial Enterprise IoT Space

Authors: C. P. Autry, A.W. Roscoe

Abstract:

Authentication protocols based on public key infrastructure (PKI) and trusted third party (TTP) are no longer adequate for industrial scale IoT networks thanks to issues such as low compute and power availability, the use of widely distributed and commercial off-the-shelf (COTS) systems, and the increasingly sophisticated attackers and attacks we now have to counter. For example, there is increasing concern about nation-state-based interference and future quantum computing capability. We have examined this space from first principles and have developed several approaches to group and point-to-point authentication for IoT that do not depend on the use of a centralised client-server model. We emphasise the use of quantum resistant primitives such as strong cryptographic hashing and the use multi-factor authentication.

Keywords: Authentication, enterprise IoT cybersecurity, public key infrastructure, trusted third party.

References:

[1] Ellis J.H., The Possibility of Secure and Non-Secure Digital Encryption, 1970, and archived 2014 at the Wayback Machine.
[2] Chen, Bangdao, L.H. Nguyen, and A.W. Roscoe. When context is better than identity: authentication by context using empirical channels. International Workshop on Security Protocols. Springer, Berlin, Heidelberg, 2011.
[3] M. Shahrzade, P. Røe, A Survey of the State of the Art in Public Key Infrastructure, 2003, ISBN 82-539-0502-5, Publication No. 995.
[4] J. Lopez, R. Oppliger, and G. Pernul, Why Public Key Infrastructures have failed so far?, Internet Research, vol. 15, pp. 544-556, 2005.
[5] L. Lamport, Password Authentication with Insecure Communication, Communications of the ACM, 1981, vol. 24, no 11, pp 770-772.
[6] R. Simon, Leijun Huang, E. Farrugia, Using multiple communication channels for efficient data dissemination in wireless sensor networks, Mobile Adhoc and Sensor Systems Conference, Washington DC, 2005.