# A Security Framework for the Internet of Things in the Future Internet Architecture
## 6 Delegation-Based Key Provisioning Protocol
### System Model  
Figure 8 describes the system model for the delegation-based key provisioning protocol, which consists of three participants: _Child_, _Guardian_ and _Parent_. A local IoT network may include a Child device and a Guardian device. A Parent device, can be either within or outside this IoT network. This Parent may be, but not necessarily, a (relatively) more capable computing device, such as a server computer, gateway device, personal computer, smartphone, or any other type of computing device. For example, the Parent may be a computing system of a manufacturer, such as the manufacturer of the Child device. The importance of the Parent arises from its existing trust relationship with the Child, from where we can extract and establish a new trust relationship.  
The Child is an edge IoT device, e.g., sensor, actuator, etc. To indicate its trust relationship and parenthood status with regard to the Child, the Parent may provision a _parent key_ into a non-volatile storage of the Child device. This non-volatile storage may be a secure storage, accessible only in a trusted execution environment (TEE) [39; 40] of the Child device. In some cases, this TEE may be implemented using separate hardware circuitry, such as a separate micro-controller from a main processor of the child device, e.g., a central processing unit (CPU).  
A Guardian device is also present in the network. In our MobilityFirst-based IoT architecture, the Guardian is the IoT-NRS of the local IoT network. In other embodiments, the Guardian may take the form of a gateway, smartphone, or consumer computer with an installed delegation protocol package. As an example, the Guardian may be a central authority for a domain (such as an entire IoT network or a portion thereof). The symmetric _membership key_ shared only between the Child and the Guardian is the local long term membership credential established by our key provisioning protocol.  
Thus, in the context of Figure 8, the two parties to establish a trust relationship represented by a key are the Child and the Guardian. A third party Parent has an existing parent key provisioned to the Child, though the Child and the Parent may or may not have a direct communication channel at this point. The only available communication channels are the one between the Child and the Guardian and the one between the Guardian and the Parent through out a protocol session. With the delegation provided herein, key provisioning between the Child and the Guardian can occur, given that the Parent is a trusted third party to provide authentication and authorization of the Guardian to the Child.  
Figure 8: The block diagram illustrates the framework of the delegation-based key provisioning protocol: _Child_ device is an edge IoT device who wants to join the IoT system and establish a _membership key_ with the Guardian device; _Guardian_ device is the group authority of the local IoT network, who contacts Parent device to verify Child device and obtains authorization; _Parent_ device has a pre-existing trust relationship with Child device in terms of the _Parent key_, and provides verification/delegation to the Guardian device so that Guardian device and Child device can reach a resultant key agreement: membership key.