# A Security Framework for the Internet of Things in the Future Internet Architecture
## 5 IoT Middleware Security
### Major Functionalities of IoT Name Resolution Service  
Our IoT Name Resolution Service (IoT-NRS) can be considered as a simplified embodiment of the MobilityFirst name-based service layer in the context of the local IoT systems. It assigns identifiers, establishes long-term keys (i.e., membership keys) and provides key/identifier related management. In the following sections, we envision the major functionalities the IoT-NRS should have. * **GUID Assignment**: IoT-NRS serves as a surrogate and works together with the NCRS to assign GUIDs to network objects, such as IoT data, certain devices or a group of IoT devices, to assist advanced network services in the global Internet. The relation between the GUID and the device/data might be _one-to-one_, _one-to-many_ and _many-to-one_. From the application point of view, generally the data is of interest and one piece of data has one GUID, which is associated with a list of attributes describing the data object. With respect to devices, it is more often than not that a group of devices map to a single GUID. As an example, it is reasonable to assign one GUID to all of the temperature sensors in a particular room. However, sometimes one device may obtain a GUID if necessary. For example, if the device is the only device in its category or it is important for the application. Also, sometimes one sensor may associate with two or more GUIDs. For example, a multi-function sensor attached to [PERSON]'s mug may have \(GUID1\) with attributes of location information and \(GUID2\) associated with the mug's temperature. * **Membership Credential Establishment**: IoT-NRS at the LSG may act as a group authority to establish membership credentials associated with the IoT device in the scope of the local IoT system. This long-term membership credential identifies the device in the local group. A proper symmetric cryptographic algorithm is chosen to generate such a credential (i.e., a symmetric key) so that low-end devices can afford to perform security operations. After establishing the membership credential, short-term keys (for example, session keys) and functional keys (for example, attestation key) may be derived from the membership key. * **Name Translation between GUID and Membership Key**: Two directional name mapping between the GUID and the membership key connects the local IoT system to the global network so that IoT-related operations can be performed seamlessly. * **Membership Management**: IoT-NRS should also provide membership management, where the membership is represented by the GUID and/or the membership key. Such management includes  
Figure 7: Three-tier name resolution framework of the MobilityFirst-based IoT architecture: Name Certificate & Resolution Service (NCRS), Global Name Resolution Service (GNRS) and IoT Name Resolution Service (IoT-NRS). The IoT-NRS connects the GUID used in global MobilityFirst network and the symmetric membership key used in the local IoT system. renewal and revocation operations. Both the GUID and the membership key have expiration times to guarantee key freshness and security strength. Therefore, renewing in a timely and efficient fashion is essential to keep the device/data \"alive\" in the system. On the other hand, revocation is needed to remove compromised/dysfunctional devices so that potential security/privacy threats can be reduced. Figure 7 illustrates the flow of IoT-NRS's major functions. The most important function of the IoT-NRS is to serve as a registrar. During device discovery, when a new IoT device joins a local group, the IoT-NRS acts as the group authority and registers this new device. The registration establishes a long-term membership key with the new device using a proper key provisioning protocol, which depends on the device's capability, as well as associates the membership key with the device's attributes/identity, such as manufacturer, model, serial number, function, etc.