contiki-os/contiki — pull request #557 by kkrentz (2014-02-04 16:37:42+00:00)
Title: Integration of Link Layer Security

This pull request addresses #526.

I added a new NETSTACK layer, called LLSEC, in between the MAC and the NETWORK layer for implementing link layer security. This change is in line with the current architecture and the handling of the LLSEC layer is similar to that of other NETSTACK layers. For example, link layer security can be disabled by configuring the nullsec driver.

The interface of LLSEC drivers comprises four functions `bootstrap`, `send`, `on_frame_created`, and `input`. I have successfully used this abstraction for implementing two LLSEC drivers, which provide authentication, confidentiality, as well as replay protection. One of them uses a network-wide key (Noncoresec) and the other one uses pairwise keys (Coresec). This pull request only contains Noncoresec, which is an 802.15.4-compliant LLSEC driver.

The symmetric-key algorithms of 802.15.4 are encapsulated as CCM* drivers. I have a software-based CCM* driver and a hardware-accelerated CCM* driver for the CC2420 transceiver. Implementing further CCM* drivers is straightforward using these examples.

To make all this work, I extended the framer to support frames with security headers. Furthermore, I cleaned up the CC2420 driver. In addition, it will also be necessary to touch each platform's main file to support link layer security. However, this task can be deferred since everything continues to work when link layer security is disabled. Only Sky is currently supported.

Further information can be found [here](https://github.com/kkrentz/contiki/wiki).