DTLS 기반의 안전한 CoAP 응용을 위한 접근제어 메커니즘
Access Control Mechanism for Secure CoAP Applications Based on DTLS
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
DTLS의 PSK 모드는 DTLS 핸드쉐이크의 성능 측면에서 가장 효율이지만 센서 디바이스의 개수가 증가함에 따라 칭키 을 미리 배포하는 것과 리하는 것이 용이하지 않다. 반면에 RPK 모드와 인증서 모드는 키 리가 용이하지만 계산상의 효율성은 매우 떨어진다. 본 논문에서는 자원 제약인 센서 디바이스에 합한 인증서인 ECQV를 통한 인증서 모드와 PSK 모드를 사용하여 그룹 환경에서의 종단 간 보안을 달성하기 한 로토콜을 제 안한다. Initial DTLS 핸드쉐이크는 ECQV 인증서 모드를 사용하고, 이후 동일 그룹에 속한 CoAP 서버와의 Subsequent DTLS 핸드쉐이크는 PSK 모드를 사용하기 때문에 그룹내 CoAP 서버들과의 체인 계산 부담을 감소시킬 수 있다. 제안 로토콜에서는 특정 CoAP 클라이언트가 그룹의 제한된 CoAP 서버에 근 할 수 있게끔 세한 근제어가 행해진다.
Abstract
While the PSK mode of the DTLS is the most efficient in terms of the performance, it is not easy to pre-distribute and manage the symmetric key pairs as the number of sensor devices increases. On the other hand, both the RPK and certificate modes offer a convenient key management tool, but they do not guarantee a good computational performance. In this paper, the end-to-end security protocol suitable for the constrained devices is proposed, based on both the ECQV certificate and the PSK mode. Namely, the initial DTLS handshake is performed using the ECQV certificate, and the subsequent DTLS handshakes with the other CoAP servers in the same group are performed using the PSK mode for the purpose of reducing the overall computational load. Furthermore, a fine-grained access control for the CoAP client can be enforced to allow access to the limited number of CoAP servers.
참고문헌 (18)
- "IEEE std. 802.15.4-2011, Part 15.4:Wireless Medium Access Control (MAC)and Physical Layer (PHY) Specifications for Low-Rate Wireless Personal Area Networks (LR-WPANs)", Standard for Information Technology Std, ~ (2011)
- E. Rescorla, "Datagram Transport Layer Security", IETF RFC 6347, ~ (2012)
- Z. Shelby, "The Constrained Application Protocol(CoAP)", IETF RFC 7252, ~ (2014)
- D. R. L. Brown, "Provably Secure Implicit Certificate Schemes", Financial Cryptography, LNCS 2339, pp.156~165 (2001), Springer-Verlag
- R. Hummen, "Towards Viable Certificate-based Authentication for the Internet of Things", Proc. of the 2nd ACM Workshop on Hot Topics on Wireless Security and Privacy, pp.37~42 (2013)
- N. Kang, "ESSE: Efficient Secure Session Establishment for Internet-Integrated Wireless Sensor Networks", International Journal of Distributed Sensor Networks (2015)
- S. Raza, "S3K : Scalable Security With Symmetric Keys—DTLS Key Establishment for the Internet of Things", IEEE Transactions on Automation Science and Engineering, 13(3), pp.1270~1280 (2016)
- T. Kothmayr, "DTLS based Security and Two-way Authentication for the Internet of Things", Ad Hoc Networks, 11(8), pp.2710~2723 (2013)
- Y. B. Saied, "Lightweight Collaborative Key Establishment Scheme for the Internet of Things", Computer Networks, 64, pp.273~295 (2014)
- J. Granjal, "End-to-End Transport-Layer Security for Internet-Integrated Sensing Applications with Mutual and Delegated ECC Public-Key Authentication", Proc. of IFIP Networking Conference and Workshop, pp.1~9 (2013)
- S. Raza, "Lithe : Lightweight Secure CoAP for the Internet of Things", IEEE Sensors Journal, 13(10), pp.3711~3720 (2013)
- J. Hui, "Compression Format for IPv6 Datagrams over IEEE 802. 15. 4-based Networks", IETF RFC 6282, ~ (2011)
- J. Salowey, "Transport Layer Security(TLS)Session Resumption without Server-Side State", IETF RFC 4507, ~ (2008)
- P. Wouters, "Using Raw Public Keys in Transport Layer Security(TLS)and Datagram Transport Layer Security(DTLS)", IETF RFC 7250, ~ (2014)
- Texas Instrument, "CC2538 Powerful Wireless Microcontroller System-On-Chip Datasheet", ~ (2015)
- "CETIC 6lbr"[URL]
- "TinyDTLS"[URL]
- Certicom Research, "SEC 2 : Recommended Elliptic Curve Domain Parameters", Standards for Efficient Cryptography, ver. 2.0, ~ (2010)