1. Lightweight Security Scheme for Vehicle Tracking System Using CoAP
Published in
ASPI’13 Proceedings of the International Workshop on Adaptive Security Article No.3. (2013) UbiComp  Conference.
Authors
Arijit Ukil, Soma Bandyopadhyay,
Abhijan Bhattacharyya, Arpan Pal
Presenter:
Chao-Chun, Sung
Date:
107/11/14
Department of Computer Science and Information Engineering,
National Cheng Kung University, Tainan, Taiwan, R.O.C.

2. Computer & Internet Architecture Lab
Introduction
We endeavor to embed a low overhead security mechanism consisting of both authentication with integrated key management and encryption on CoAP(Constrained Application Protocol).
Our proposed security scheme leverages the request-response layer of CoAP. A novel approach is designed to enable secure mode of CoAP by introducing a unique option in CoAP header.
It further adapts handshaking level of its secure channel depending on the state of vehicle (like moving fast, moving slowly, at rest etc.).
提出一個類似HTTP/TCP設計，但是屬於輕量版的HTTP/UDP，使得其有利於感測節點進行網路傳輸
CoAP是主從(Client/Server)架構，感測節點多半為CoAP Server提供資源，由CoAP Client請求讀取/控制資源狀態。CoAP使用UDP 對於資料是否要重傳或傳送順序(Reordering) 全交由上層應用層來決定，對於資源有限的MCU則不需要有完整TCP/IP協定實作。而CoAP同HTTP一樣具有REST(Representational State Transfer)設計風格，也支援GET/PUT/POST/DELETE及URIs的請求方式。
CoAP採用二進位整數格式且封包標頭4 個byte而非HTTP使用字串格式(ASCII code)，所以封包傳送時的額外負擔小且不必像HTTP一樣得進行耗時的字串解析處理。
Computer & Internet Architecture Lab
CSIE NCKU

3. Computer & Internet Architecture Lab
Related work
Web-enablement of constrained sensor and gateways using traditional HTTP based protocol would be unsustainable and non- scalable. CoAP is established as candidate lightweight protocol for Internet connectivity of such energy-constrained sensors.
The trend of using security scheme for sensor devices is based on symmetric key.
Computer & Internet Architecture Lab
CSIE NCKU

4. Computer & Internet Architecture Lab
System Architecture
Computer & Internet Architecture Lab
CSIE NCKU

5. Threat Model And Security Engineering
Computer & Internet Architecture Lab
CSIE NCKU

6. Authentication Mechanism(1/)
Our proposed security solution is symmetric key based authentication with integrated key management. Exchanged symmetric key is used with AES 128 CBC (Cipher Block Chaining) mode.
At the time of provisioning of a sensor gateway and server a unique secret is pre-shared, which in our case is considered as hardcoded with the device at the time of manufacturing and deployment.
Computer & Internet Architecture Lab
CSIE NCKU

7. Authentication Mechanism(2/)
Computer & Internet Architecture Lab
CSIE NCKU

8. Authentication Mechanism(3/)
In order to secure the authentication scheme against the threats described earlier, we propose nonce based authentication-key management.
Computer & Internet Architecture Lab
CSIE NCKU

9. Authentication Mechanism(4/)
Computer & Internet Architecture Lab
CSIE NCKU

10. Authentication Mechanism(5/)
Computer & Internet Architecture Lab
CSIE NCKU

11. Authentication Mechanism(6/)
Computer & Internet Architecture Lab
CSIE NCKU

12. Authentication Mechanism(7/)
Computer & Internet Architecture Lab
CSIE NCKU

13. Security Analysis(1/)

14. Computer & Internet Architecture Lab
Security Analysis(2/)
Computer & Internet Architecture Lab
CSIE NCKU

15. Computer & Internet Architecture Lab
Security Analysis(3/)
Computer & Internet Architecture Lab
CSIE NCKU

16. Security Analysis(4/)
Nonces are generally generated using larger length random number generation (RNG) to minimize collision attack. However, in practice, true RNG is difficult to find.
Uses a pseudo random number generation (PRNG) appended with a timer(counter).

17. Embedding Authentication(1/)
‘AUTH’ uses an unused option indicating a critical option class. Along with ‘AUTH’ one more option ‘AUTH_MSG_TYPE’ is introduced to indicate different messages for establishing an authentication session
Computer & Internet Architecture Lab
CSIE NCKU

18. Embedding Authentication(2/)
Computer & Internet Architecture Lab
CSIE NCKU

19. Embedding Authentication(3/)
Computer & Internet Architecture Lab
CSIE NCKU

20. Embedding Authentication(4/)
Computer & Internet Architecture Lab
CSIE NCKU

21. Embedding Authentication(5/)
Computer & Internet Architecture Lab
CSIE NCKU

22. Embedding confidentiality
Payload consists of following fields: <vehicle ID, Route ID, Lat, Long, Time Stamp, Accelerometer Data>
Computer & Internet Architecture Lab
CSIE NCKU

23. Experimental Results And Analysis
We consider stringent wireless network condition with 9.6KBps data rate and three types of packet loss: 0%, 10% and 20%.
Computer & Internet Architecture Lab
CSIE NCKU