# Secure Authentication and Credential Establishment in Narrowband IoT and 5G
## 2 Related Work  
LPWAN technologies do not provide a standardized or common solution for securing communications, bootstrapping, or the management of the life cycle of the device and the key material. As we can see in Table 1, not every solution covers key management, and in some cases ciphering the payload of the information is optional. Among the proprietary solutions, there is little that we can do to influence their future design choices, but we can demonstrate that a comprehensive secure solution is possible. In this sense, interest in providing a solution that supports the secure management of a great number of devices--management that is envisioned to be present in an LPWAN--has been present in Internet Drafts (I-Ds) from the Internet Engineering Task Force (IETF) [7; 11], as well as in a Request for Comments (RFC)of the IETF LPWAN Working Group (WG) [12], where the use of authentication, authorization, and accounting (AAA) infrastructures is portrayed as a possible future direction to manage such large numbers of devices. There are some early proposals in IETF I-Ds to extend the LoRaWAN Joining Procedure with AAA infrastructures [13; 14], which, although focused on a specific technology, serves as a demonstration that LPWAN technologies could actually benefit from their integration with AAA. In addition to the IETF, other organizations and alliances such as Open Mobile Alliance (OMA) in their white paper _Lightweight M2M 1.1_[15] integrate different technologies including LPWAN and consider new strategies and protocols to provide security, with the incorporation of OSCORE [16], a recent IETF standard, in their protocol stack to provide security at the application layer. The EU has also shown a clear interest in the advancement of security-related topics, through actions such as _The Next Generation Internet_ (NGI) initiative by the Digital Single Market of the European Commission ([[https://www.ngi.eu/opencalls/ngi_trust-open-call/](https://www.ngi.eu/opencalls/ngi_trust-open-call/)]([https://www.ngi.eu/opencalls/ngi_trust-open-call/](https://www.ngi.eu/opencalls/ngi_trust-open-call/))). NGI TRUST requests security technologies such as bootstrapping to support the development of a human-centric Internet by developing a stronger European ecosystem of researchers, innovators, and technology providers. Bootstrapping trust at the protocol level maintains a trustworthy Internet Infrastructure. \begin{table}
\begin{tabular}{l c c c c} \hline
**Technology\(\backslash\)Feature** & **Authentication** & **Integrity** & **Cipher** & **Key Management** \\ \hline LoRaWAN & YES & YES & YES & YES \\ \hline Sigfox & YES & YES & Optional & NO \\ \hline Weightless & YES & YES & YES & YES \\ \hline NB-IoT & YES & YES & YES & YES \\ \hline DASH-7 & YES & YES & YES & NO \\ \hline RPMA & YES & YES & YES & YES \\ \hline WSUN & YES & YES & YES & YES \\ \hline \end{tabular}
\end{table} 
Table 1: High level description of the security features of several Low-Power Wide Area Network (LPWAN) technologies. We understand from the aforementioned initiatives that the process of achieving a secure system should go through the reliance of known, tried, and tested standards, which lay the foundation for stable and trusted systems. As the landscape of a new generation of communication technologies evolves, for example with the development of 5G [17], we can see that there is a reliance on standards to provide security to the communications. They use an Extensible Authentication Protocol (EAP) for network access and secondary authentication [18], and AAA infrastructures. Furthermore, among the different topics of the next 3 GPP Release 16 [19], there are aspects about the inclusion of industrial IoT technologies, which coincides with the aim of this paper. In our early work, we also focused on providing an LPWAN with the necessary mechanisms to secure communications, being proponents of different mechanisms to secure LPWANs [13; 14; 20]. In this work, we continue that effort to confirm that providing security to LPWAN technologies is possible.