# Secure Authentication and Credential Establishment in Narrowband IoT and 5G
###### Abstract  
Security is critical in the deployment and maintenance of novel IoT and 5G networks. The process of bootstrapping is required to establish a secure data exchange between IoT devices and data-driven platforms. It entails, among other steps, authentication, authorization, and credential management. Nevertheless, there are few efforts dedicated to providing service access authentication in the area of constrained IoT devices connected to recent wireless networks such as narrowband IoT (NB-IoT) and 5G. Therefore, this paper presents the adaptation of bootstrapping protocols to be compliant with the 3 GPP specifications in order to enable the 5G feature of secondary authentication for constrained IoT devices. To allow the secondary authentication and key establishment in NB-IoT and 4G/5G environments, we have adapted two Extensible Authentication Protocol (EAP) lower layers, i.e., PANATIKI and LO-CoAP-EAP. In fact, this approach presents the evaluation of both aforementioned EAP lower layers, showing the contrast between a current EAP lower layer standard, i.e., PANA, and one specifically designed with the constraints of IoT, thus providing high flexibility and scalability in the bootstrapping process in 5G networks. The proposed solution is evaluated to prove its efficiency and feasibility, being one of the first efforts to support secure service authentication and key establishment for constrained IoT devices in 5G environments. Internet of Things; narrowband IoT; 5G; bootstrapping; authentication; EAP Article Secure Authentication and Credential Establishment in Narrowband IoT and 5G  
1  
The Internet of Things (IoT) enables advanced applications and new business opportunities in global sectors such as Industry 4.0 and Smart Cities and Precise Agriculture, among others [1]. Industry 4.0 is expanding with IoT technologies to enable advanced applications and new business opportunities. The uncertainty towards new technologies, security, and trust is one of the main obstacles to introducing Industry 4.0 service for connected manufacturing in industrial factories. The VDMA study \"Industrie 4.0 Readiness\" [2] reveals that only 4 of 10 industrial factory companies in Germany have a strategy for Industry 4.0, and more than 50% are beginning to engage with the concept of a smart factory. Industrial SME companies may not have the knowledge and capacity to setup and maintain connected IoT device products in a secure and trustworthy manner. Security is the biggest risk for the deployment of IoT networks in industrial SME and large companies. Recent IoT wireless technologies (e.g., narrowband IoT (NB-IoT) [3], LoRaWAN [4], and Sigfox [5]) such as Low-Power Wide Area Networks (LPWANs) offer long-range communications and reduced energycosts, which promotes the creation of new IoT applications and services in Industry 4.0 [6]. However, these technologies pose new cyber-security challenges [7] since IoT devices have strong limitations in computing and networking capacity. NB-IoT is one of the technologies standardized by the 3 GPP and offers a seamless integration with cellular deployments from TELCOS that give coverage and support to the technology. NB-IoT is designed to be used in wide areas (several kilometres) and provides good penetration and coverage, which makes it an interesting alternative in smart cities and other use cases. With the introduction of the new generation of cellular technologies, known as 5G, we face the situation of having several technologies--especially in the case of LPWAN, where each technology provides their own features and mode of operation. In this sense, we understand that it is paramount to provide mechanisms that unify and homogenise certain aspects of the life cycle of the IoT device, such as bootstrapping. This process involves authentication, authorization, and key management and can occur using an infrastructure that does not belong to the IoT device owner.