# A Security Framework for the Internet of Things in the Future Internet Architecture
## 6 Delegation-Based Key Provisioning Protocol
### Protocol Specifications
Verify \(N_{1}\), \(N_{2}\), \(N_{3}\), \(cert_{G}\) and \(ID_{C}\) (\(ID_{C}\
eq ID_{G}\)) are from Message 4. 2. Verify \(cert_{G}\) and \(G\) is authorized to receive a key for \(C\). 3. User the public key contained in \(cert_{G}\) to verify the signature \(sig_{G}(g^{x}||g^{y})\). 4. Verify \(g^{y}\) is an element of the Diffie-Hellman group. 5. Use \(ak\) derived as in Equations (1) and (2) to verify the MAC tag on \([ID_{C},cert_{G}]_{ak}\). Then \(P\) sends back Message 6, which corresponds to the third message of the SIGMA protocol, with matching protocol context, signing Diffie-Hellman public values in reverse order (to protect against reflection attacks) with its own public key certificate \(cert_{G}\), and computes the MAC on \(P\)'s own identity, using the same derived key \(ak\). Note that Message 6 introduces additional data structures as part of the 3 PKD protocol, namely two key provisioning tokens, upon making delegation decision to \(G\): 1. \(P\) as the key provisioning server, generates a random key material \(k\), which will be used later by \(G\) and \(C\) to compute shared secret key \(sk\), to be delivered to both \(G\) and \(C\). 2. \(P\) generates token \(\alpha\) for \(G\) using Equation (4), which includes authenticated data for this protocol instance (all identifiers and nonces) and encrypts the key \(k\) using \(ek\), which is derived by Equation (3). 3. \(P\) generates an associated token \(\beta\) for \(C\) using Equation (5), which includes the same authenticated data for this protocol instance (all identifiers and nonces) and encrypts the key \(k\) using \(kek\), which is the existing parent key that \(P\) has established with \(C\), prior to this protocol execution. 4. As the key material \(k\) is securely encapsulated into \(\alpha\) and \(\beta\), \(P\) sends both tokens to \(G\) in Message 6, in addition to SIGMA authentication data structures. \[ek=prf(dk,2)\] (3) \[\alpha=[N_{1}||ID_{G}||N_{2}||ID_{P}||ID_{C}||N_{3}||\{k\}]_{ek}\] (4) \[\beta=[N_{1}||ID_{G}||N_{2}||ID_{P}||ID_{C}||N_{3}||\{k\}]_{ek}\] (5)
7. \(G\to C:\{\beta\}\) Upon receiving Message 6, \(G\) first validates as the following: 1. Verify \(N_{1}\), \(ID_{G}\), \(N_{2}\), \(ID_{P}\), \(ID_{C}\) and \(N_{3}\) are from Message 5. 2. Parse \([cert_{P}]_{ak}\) as \(cert_{P}\) and \(tag^{\prime}\). 3. User \(ak\) to verify \(tag^{\prime}\). 4. Verify \(cert_{P}\). 5. Verify signature \(sig_{P}(g^{y}||g^{x})\). If all the validations succeed, at this point, \(G\) and \(P\) have completed mutual authentication and established a fresh secret symmetric key \(ek\) derived from the Diffie-Hellman handshake and the current session information as in Equation (3). Then \(G\) uses \(ek\) to decrypt token \(\alpha\) and extract the secret \(k\), which implies \(G\) receives an authorization from \(P\). Then \(G\) directly extracts \(\beta\) from Message 6, and forwards it to \(C\) as Message 7 to further confirm with \(C\) whether they can reach the agreement that \(P\) has granted authorization to this delegation bounding to the same session. 8. \(C\to G:\{[sid,ID_{C}]_{ck}\}\) \(C\) validates the token \(\beta\) with matching session information (namely, \(N_{1}\), \(ID_{G}\), \(N_{2}\), \(ID_{P}\) and \(ID_{C}\) are from Message 2), then recovers the same key material \(k\) with \(kek\). To construct Message 8, \(C\) computes session ID \(sid\) as in Equation (6) and uses key \(ck\) derived by Equation (7) to authenticate the message. As an option, \(G\) and \(C\) could further engage in an additional exchange locally to establish a pair secret \(ps\) (\(ps\) could be \(null\)). This pair secret may be used as a contribution to the session information and further derivation, so that \(P\) has no knowledge of the established key between \(G\) and \(C\); \[sid=hash(N_{1}||ID_{G}||N_{2}||ID_{P}||ID_{C}||N_{3}||ps)\] (6)\[ck=prf(k,1||sid) \tag{7}\]
9. \(G\to C:\{[sid,ID_{G}]_{ck}\}\) \(G\) parses Message 8 as \(sid\), \(ID_{C}\) and MAC \(tag\).