# A Security Framework for the Internet of Things in the Future Internet Architecture
## 6 Delegation-Based Key Provisioning Protocol
### Protocol Specifications  
As illustrated in Figure 8, there are three participants in the protocol: the Child, Guardian and Parent. The Child and the Parent share a symmetric key \(kek\) representing their pre-established trust relationship, but they can not communicate directly. The Guardian has direct communication channels with both the Child and the Parent. The output of the delegation-based key provisioning protocol is a symmetric key \(sk\) shared only between Child and Guardian. Figure 9 presents the format and the flow of nine messages in the \"full fledge\" delegation-based key provisioning protocol. Table 1 lists the notations used in Figure 9. For simplicity, the Child, the Guardian and the Parent are denoted by \(C\), \(G\) and \(P\) respectively in the following discussion. Below we present the delegation-based key provisioning protocol specifications:  
1. \(G\to C:\{N_{1},ID_{G}\}\)
2. \(G\) sends Message 1 to \(C\) to initiate a protocol session. The goal is to establish a trust relationship and a corresponding symmetric key to represent such trust. To construct Message 1, \(G\) generates a random nonce \(N_{1}\) and sends it together with its identifier \(ID_{G}\) to \(C\) in plaintext. \(C\to G:\{N_{1},ID_{G},N_{2},ID_{C},ID_{P}\}\)  
Currently, \(C\) has no knowledge regrading \(G\), but sends back Message 2 to direct \(G\) to \(P\) for further authentication and delegation. Message 2 contains identity information for all three parties, and initial random nonces from \(C\) and \(G\) for a protocol session. \(G\to P:\{N_{1},ID_{G},N_{2},ID_{C},ID_{P}\}\)  
Upon receiving Message 2 from \(C\), \(G\) first verifies \(N_{1}\) and \(ID_{G}\) are from Message 1 as well as no duplicate identifiers, i.e., \(ID_{C}\
eq ID_{G}\) and \(ID_{P}\
eq ID_{G}\) and \(ID_{C}\
eq ID_{P}\). If all the verifications succeed, \(G\) then forwards Message 2 as Message 3 to \(C\)'s parent party \(P\);  
\(P\to G:\{N_{1},ID_{G},N_{2},ID_{C},ID_{P},N_{3},g^{x}\}\)  
Upon receiving Message 3 from \(G\), \(P\) should validate the following:  
1. All the identity information are correct. 2. \(G\) can be authenticated. 3. \(C\) is indeed its child entity. 4. Requested privilege on \(C\) can be authorized to \(G\). 5. Authorization decision could be based on \(G\)'s identity and an additional data structure for the authorization. In different embodiments, various information may be included in the authorization data structure. Such data structure may be sent and verified by \(P\) and \(G\) in protocol exchange with Messages 4-6. Then \(P\) generates its own nonce \(N_{3}\), the Diffie-Hellman private exponent \(x\) and public value \(g^{x}\) to construct Message 4, which corresponds to the first message of SIGMA protocol. Message 4 includes all three nonces so as to enhance the three-party context. This works as a challenge to \(G\) to reduce the chance of a denial of service (DoS) attack on \(P\). 5. \(G\to P:\{N_{1},N_{2},N_{3},g^{y},sig_{G}(g^{x}||g^{y}),[ID_{C},cert_{G}]_{ak}\}\)  
Now \(G\) and \(P\) engage in a mutual authentication from Message 4 to Message 6. \(G\) first verifies that \(N_{1}\), \(ID_{G}\), \(ID_{P}\), \(N_{2}\) and \(ID_{C}\) are from Message 3 as well as \(g^{x}\) is an element of the Diffie-Hellman group. Then \(G\) sends Message 5, which corresponds to the second message of the SIGMA protocol, with the enhanced protocol context (e.g., matching identifiers and all three nonces) and its own Diffie-Hellman public value \(g^{y}\). \(G\) signs Diffie-Hellman public values with its public key certificate \(cert_{G}\), and then computes a Message Authentication Code (MAC) on \(G\)'s own identity, further bound with \(C\)'s identity using the derived key from both parties Diffie-Hellman values. Note that the key \(ak\) used to compute the MAC is derived by Equations (1) and (2). \[dk=prf(hash(N_{1}||N_{2}||N_{3}),g^{xy}) \tag{1}\]  
\[ak=prf(dk,1) \tag{2}\]  
6. \(P\to G:\{\alpha,\beta,sig_{P}(g^{y}||g^{x}),[cert_{P}]_{ak}\}\)  
\(P\) parses and validates the following in Message 5:  
1.