# Secure Authentication and Credential Establishment in Narrowband IoT and 5G
###### Abstract
Furthermore, the use of mechanisms to access external services (beyond the access to the network) is also important and has to be done securely. The next generation of mobile communications with 5G is already taking this into account, providing the secondary authentication schema to secure the communication with external services [8]. In this work, we take into account these features and aim to provide a solution that can be compatible with said security schema using NB-IoT. The process of bootstrapping is a first step, prior to an IoT device being able to securely communicate in a wireless network. This process involves authentication, authorization, and key management operations, and it is vital to control network resources and data communications. Nevertheless, traditional bootstrapping is not adapted to the features of recent wireless technologies (e.g., NB-IoT) formed by IoT devices with limitations in computing and networking capacities to implement complex security protocols. In this sense, some of the bootstrapping protocols that are proposed do not account for constrained networks [9] or multi-domain scenarios. The interested reader can follow the discussion about this topic in [10]. In 3 GPP cellular communication standards, bootstrapping consists of both _primary authentication_ and _secondary authentication_. Primary authentication always must be successfully performed before starting any secondary authentication. On the one hand, primary authentication is managed exclusively by the network operator--it defines the mechanisms and steps necessary for a device to connect to the serving network, i.e., the 4G or 5G Core. On the other hand, secondary authentication is related to security domains outside of the serving network, thus not necessarily managed by the same entity as the 4G/5G Core. This allows flexibility with regard to communication technology for security domain administrators. To mitigate these challenges, this paper is focused on providing a secure and lightweight bootstrapping process for the authentication and key establishment of constrained IoT devices with a focus on scenarios of the smart industry, cities, and global sectors such as Industry 4.0. In particular, this paper provides the implementation and comparison of a secure bootstrapping solution called Low-Overhead CoAP-EAP (LO-CoAP-EAP) [10], with a protocol for carrying out Authentication for Network Access (PANA), a current standard, in a real scenario of an NB-IoT network compliant with future 5G networks. The use of LO-CoAP-EAP, in this case, is complementary to the network access in NB-IoT, fulfilling the need for the secure authentication and key establishment of IoT devices with external services in a trusted and secure manner. In this paper, we introduce a set of contributions that aim to provide secure bootstrapping and enable secondary authentication envisioned in the next generation mobile networks (5G) using the EAP lower layer known as LO-CoAP-EAP. We have implemented the protocol in an experimental testbed using real hardware devices. The rest of the paper is organized as follows. Section 2 provides an overview of the works related to this area. Section 3 provides the background of the technologies and protocols in this work. Section 4 gives a clear use case where this contribution can be applied. Section 5 explains the design choices and the proposed architecture and testbed. In Section 6, we provide the experimental results and evaluation, and in Section 7 we have conclusions and provide suggestions for future work.