TLS/PKI Challenges and Certificate Pinning Techniques for IoT and M2M Secure Communications

The wide spread of using handheld devices offers an opportunity for mobile devices to be used as a universal payment method. However, some issues impede the widespread acceptance of mobile payment; for example: privacy protection, limited capability of mobile devices, and limited bandwidth of wireless networks. In ecommerce payment, Secure Socket Layer (SSL) protocol has been used to establish a secure channel between customers and merchants to secure the payment and the order information. SSL has some disadvantages regarding customer privacy that the customer payment information is revealed to the merchant. Secure Electronic Transaction (SET) has resolved SSL protocol disadvantages by dividing order message into: 1) order information which is revealed to merchant M, 2) payment information which is revealed to Payment Gateway (PG). Both SSL and SET assume the existence of Public Key Infrastructure (PKI) where extensive computations are carried out. In mobile payment, the same protocols of ecommerce payment are used but their application is limited due to heavy computations over wireless and GSM networks. A Modified Secure Electronic Transaction (MSET) protocol is proposed to minimize the extensive computations of SET protocol through replacing time consuming public key encryption and decryption algorithms by symmetric key cryptography.

In-network middleboxes are vital for the Internet-of-Things (IoT) system security, but the widely adopted transport layer security (TLS) protocol blinds application-level middleboxes due to the encryption of traffic data. To resolve this problem, many solutions have been proposed to date. Among them, SplitTLS is widely adopted in the industry by proxy manufacturers. It requires TLS client to install customized root certificates and incurs additional security flaws, e.g., disabling server authentication and using weak cipher suites. Another approach is to customize the TLS protocol where middleboxes are enabled via either performing handshake directly with TLS endpoints or receiving session key materials in an out-of-band manner. Overall, current solutions would either jeopardize the original TLS handshake procedure or incur additional overheads on the endpoints. In this article, we design a new middlebox-enhanced TLS (ME-TLS), which enables endpoints to introduce authenticated middleboxes into a TLS session while control middleboxes' access permission and processing order of traffic data. Particularly, in our proposed ME-TLS, the handshake structure of TLS keeps unchanged and middleboxes work in a passive manner. That is, middleboxes in the ME-TLS could recover session key materials by monitoring handshake messages passively instead of interacting with endpoints; secondary secure channels for key transmission are also not needed in our ME-TLS. We implement our ME-TLS based on the TLS 1.3 protocol and evaluate its performances. The experimental results demonstrate that our proposal is practical and deployable for real-world IoT scenarios.

Modern Internet TCP uses Secure Sockets Layers (SSL)/Transport Layer Security (TLS) for secure communication, which relies on Public Key Infrastructure (PKIs) to authenticate public keys. Conventional PKI is done by Certification Authorities (CAs), issuing and storing Digital Certificates, which are public keys of users with the users identity. This leads to centralization of authority with the CAs and the storage of CAs being vulnerable and imposes a security concern. There have been instances in the past where CAs have issued rogue certificates or the CAs have been hacked to issue malicious certificates. Motivated from these facts, in this paper, we propose a method (named as Trustful), which aims to build a decentralized PKI using blockchain. Blockchains provide immutable storage in a decentralized manner and allows us to write smart contracts. Ethereum blockchain can be used to build a web of trust model where users can publish attributes, validate attributes about other users by signing them and creating a trust store of users that they trust. Trustful works on the Web-of-Trust (WoT) model and allows for any entity on the network to verify attributes about any other entity through a trusted network. This provides an alternative to the conventional CA-based identity verification model. The proposed model has been implemented and tested for efficacy and known major security attacks.

4 - Security, Scalability, and Speed

The rapid advancement of digital communication technologies has increased the need for secure remote access within corporate environments.This study develops and implements a secure network architecture for PT Tanjungenim Lestari Pulp & Paper using Virtual Private Network (VPN) mechanisms based on Internet Protocol Security (IPsec) and Secure Socket Layer (SSL).The existing network, which utilizes a star topology and file-sharing mechanisms, was found to lack sufficient security, particularly in protecting data transmission to external partner companies.The proposed system integrates IPsecbased VPN tunneling to ensure encrypted communication channels and SSL certificates to safeguard FTP authentication processes.Data were collected through action research and document studies, followed by network design, IP addressing, router configuration, VPN deployment, FTP server installation (VSFTPD), and file transfer testing.The results demonstrate successful establishment of secure tunnels, encrypted data exchange, and protection against credential interception during authentication.This study concludes that implementing IPsec VPN and SSL-secured FTP significantly enhances remote access security, maintains data confidentiality, and strengthens the overall network infrastructure of PT Tanjungenim Lestari Pulp & Paper.

Transport Layer Security (TLS) is one of the most popular security protocols for end-to-end communications. The handshake process of TLS has high computation complexity and heavy delay, while the devices in Internet of Things (IoT) always have limited resources. Therefore, it is hard to deploy TLS in IoT. To tackle this problem, we propose a novel method to simplify the TLS handshake protocol based on Software Defined Network (SDN) for a general end-to-end communication scenario. Firstly, instead of doing the Diffie-Hellman key exchange to calculate the premaster secret of TLS, the controller is used to generate the premaster secret dynamically and then distributes this secret to the IoT devices through the encrypted channel between the SDN switch and the controller. Secondly, the certificate verification of TLS is transferred from the IoT devices to the more powerful controller. Furthermore, the security of our simplified protocol is validated by the deduction of BAN logic and the analysis for malicious attacks. The experimental results show that our protocol reduces both the latency in the whole handshake process and the computational overhead in the IoT devices compared with the traditional TLS.

The Transport Layer ensures that data is sent transparently between end-users while also enabling reliable data transfer services to the higher levels. Cryptographic protocols Secure Socket Layer (SSL) and Transport Layer Security (TLS) enable data encryption and authentication between various homogeneous and heterogeneous devices such as servers, computers, and software applications running all over a network. These protocols have been successfully used to protect World Wide Web communication between a client and a server that has been encoded using the HTTP protocol for many years. When communicating between client and server, these algorithms address challenges like confidentiality, integrity, availability, and non-repudiation. The significant challenge faced is the attack on these protocols. Among the reported attacks on TSL is the Drown attack which is a prevalent type of attack. In order to prevent such types of attacks, a Public Key Infrastructure (PKI) method is proposed in this study for encapsulating messages between the client and the server while doing the TLS handshake process. The proposed method removes the need for credentials, including client-server certificates and client-server key exchange.

WEDDS, the WITS Encrypted Data Delivery System, is a framework for supporting distributed mission operations by automatically transferring sensitive mission data in a secure and efficient manner to and from remote mission participants over the Internet. WEDDS was orimally developed as part of WITS, the Web Interface for Telescience, and was to be used in the 1998 Mars Polar Lander Mission to support distributed mission operations over the Internet for the first time in NASA history. WEDDS is written in Java, and is designed to provide secure distributed operations capabilities to any existing mission application with little modification, and in a manner that is nearly transparent to the existing application and its users. WEDDS relies on the NASA Public Key Infrastructure (PKI) to verify the identity of remote users. Remote users must apply in person at a NASA security office or another trusted security authority in order to receive a digital certificate. All connections are made using the Secure Sockets Layer (SSL) protocol in conjunction with the user's certificate, and all transmissions are protected against eavesdropping through encryption with the Triple-DESEDE3 algorithm.

Xcert's business is in developing Internet and Intranet security enhancement technology. Xcert was founded in April 1996 by Andrew Csinger and Pat Richard and was headquartered in Vancouver, Canada. Xcert's solution to Internet security was a public key infrastructure (PKI). PKI is a system of digital certificates, certificate authorities (CAs) and other registration authorities that verify and authenticate the validity of each party involved in an Internet transaction. Xcert's PKI technology allows organizations of any size to issue digital certificates to their members. These organizations become their own CA and are empowered to issue digital certificates to their individual client base. This case study is about a start-up company that is in transition from a dream stage to a reality stage. One of the issues that surfaces in the case study is intraindustry competition. Despite being an early entrant into the Internet security business, Xcert faced brutal competition from companies such as Entrust, Nortel, VeriSign and Netscape. The problems facing the company include (1) finances, (2) future direction and leadership, (3) structure, experience and size and (4) marketing. This is a very rich case study with a number of interrelated issues. The case serves two teaching aims. Firstly, this case allows students to confront and discuss real-life issues facing a start-up information technology (IT) company. The students analysing the case are asked to provide alternatives and solutions to the problems by putting themselves in the positions of the founders of the company. Students should come to understand the difficulty in managing a start-up company and the various trade-offs the management needs to make. Secondly, the case study introduces various Internet security concepts to students.

Basic Security Concepts - Why is Computer and Network Security Important. Background and History. The Security Trinity. Information Security. Risk Assessment. Security Models. Basic Terminology. More Basic Terminology. Threats, Vulnerabilities and Attacks - Protocols. The OSI Reference Model. TCP/IP Protocol Suite. Useful Web Sites. Search Engines. Mailing Lists. Encryption, Digital Signatures and Certification - Cryptography. Stream Ciphers. Breaking Ciphers. Block Ciphers. Encryption. Public Key Cryptosystems. Message Integrity. Authentication. Digital Signatures. Competing Standards. Digital Certificates. Limitations of Digital Certificates. Certificate Authorities. Public Key Infrastructure. The Future. The Limitations of Encryption. Kerberos - How Kerberos Works. Kerberos- Limitations. Encryption on the WWW - The World Wide Web. Secure Sockets Layer (HTTPS). Secure HTTP (SHTTP). Microsoft's Internet Explorer. Viewing Digital Certificates with Internet Explorer. Viewing the Encryption Strength of IE5. Viewing Certification Authorities with IE5. Netscape Navigator. Viewing Digital Certificates with Navigator. Authenticode Certificates. E-Mail - E-Mail Issues. E-Mail Issues. Secure E-Mail Protocols. Web-Based E-Mail Services. Security of Stored Messages. Identity: Spoofing and Hiding. E-Mail as a weapon. E-Mail Policies. E-Mail Privacy. Auto-Responses. Operating System Security -- Passwords. Password Attacks. Onetime Passwords. Access Control. Data Redundancy. General Recommendations. Modems. Useful Tools. LAN Security - LAN Guidelines. Controlling End-User Access. Concurrent Logins. Available Disk Space. Restrictions to Location or Workstation. Time/Day Restrictions. Access to Directories and Trustee Rights. File Attributes. Other Privileges. Single Sign-On. Policy-Based Network Management. Honeypot Systems. Network Segmentation. Static IP Addresses vs. DHCP. Media and Protocols - Network Media. Plenum Cabling and Risers. WANs. Redundancy and Alternative Connections. Routers and SNMP - Router Issues. SNMP. Virtual Private Networks - Encryption on the Network. Node-to-Node Encryption. End-to-End Encryption. Where to Encrypt. Virtual Private Networks. PPTP. L2TP. IPSec. SOCKS. Firewalls - Firewalls Pros and Cons. Types of Firewalls. Packet Filters vs. Proxies. Firewall Configurations. Restricting Users' Access to the Internet. Firewall Products. Personal Firewalls. Biometrics - Identification and Authentication. Biometric Identification and Authentication. Biometric Identification Reliability. Backup Authentication. Environmental Conditions. User Acceptance. Security of the Biometric System. Interoperability. Costs vs. Savings. Policies and Procedures - Policies vs. Procedures. Information Security Policy Objectives. Developing Security Policies. Policy and Procedure Manuals. Policy Awareness & Education. Policy Enforcement. Policy Format. Security Policy Suggestions. Information Protection Team. Crisis Management Planning. Sources for Information Policies. Auditing and Intrusion Detection - What is an Audit. Operational Security Audits. System Security Auditing. Activity and Usage Auditing. Audit Mistakes. Deficiencies of Traditional Audit Techniques. Intrusion Detection. Intrusion Detection Systems. Host-Based Intrusion Detection Systems. Network-Based Intrusion Detection Systems. Knowledge-Based Intrusion Detection Systems. Statistical-Based Intrusion Detection Systems. Defense In-Depth Approach . Future Directions. Crisis Management Planning - Crisis Management. Disaster Recovery Planning. Computer Security Incident Response Plan. Browser Security - Cookie Files. Cache Files. Autocomplete.

This article considers problems with security of applications based on the TLS protocol. Scenarios, when these applications fall under attacks using revoked certificates, are described. The current methods of checking the status of X.509 public key infrastructure certificates used together with the TLS protocol are compared, and their strong and weak points are specified.

Since the Internet of Things (IoT) will be entwined with everything we use in our daily life, the consequence of security flaws escalates. Smart objects will govern most of the home appliances and car engines yielding potential disaster scenarios. In this context, successful attacks could lead to chaos and scary scenarios (www.darkreading.com). Unprotected personal information may expose sensitive and embarrassing data to the public and attacks may threaten not only our computers and smart devices, but our intimacy and perhaps our lives too. Because persons and objects will be bonded with each other, user consent becomes critical. Therefore, thing, object, and user Identity will be the focus of future IoT security solutions, yielding a Trust, Security, and Privacy (TSP) paradigm, which may constitute the Achilles' heel of IoT. While security issues are quite straightforward, mainly from background knowledge, privacy issues are far more complex. Privacy constitutes a rather challenging task, even for the m...

Research on the Internet of Things (IoT) has been a hot spot in recent years. Resource authentication and management in IoT is a most important and challenging problem and is far to be solved. In this paper, we propose an effective distributed hierarchical IoT resource authentication and management model based on the key technologies of distributed hash table, Chord Ring and public key infrastructure. By using the exceptional advantage of search and Research on the Internet of Things (IoT) has been a hot spot in recent years. Resource authentication and management in IoT is a most important and challenging problem and is far to be solved. In this paper, we propose an effective distributed hierarchical IoT resource authentication and management model based on the key technologies of distributed hash table, Chord Ring and public key infrastructure. By using the exceptional advantage of search and query ability of the above technologies, the proposed model owns enhanced security and improved efficiency. Simulation results show that the proposed model can mutually authenticate the IoT end entities each other in more short time compared to other existing approaches. query ability of the above technologies, the proposed model owns enhanced security and improved efficiency. Simulation results show that the proposed model can mutually authenticate the IoT end entities each other in more short time compared to other existing approaches.

Many approaches for securing Internet of Things (IoT) applications are nowadays based on the use of Transport Layer Security (TLS), but this may result in difficulties when upgrading the security algorithms, and this fact may shorten the life of IoT devices. To overcome these difficulties, this paper studies the possibility of using Secure Socket Shell (SSH) as a feasible alternative to secure communications in IoT applications based on HTTP and HTTP/2 protocols. A comparison between these schemes is performed, using SSH with TCP over 6loWPAN in an 802.15.4 network. The results show that our approach (called IoTsafe) not only provides a more robust and easy-to-update solution, but it can also offer an improvement of the overall performance in terms of goodput and energy consumption.

Purpose – The purpose of this paper is to study lightweight security scheme for Internet of Things (IoT) applications using Constrained Application Protocol (CoAP). Resource-constrained characteristics of IoT systems have ushered in compelling requirements for lightweight application protocol and security suites. CoAP has already been established as the candidate protocol for IoT systems. However, low overhead security scheme for CoAP is still an open problem. Existing security solutions like Datagram Transport Layer Security (DTLS) is not suitable, particularly due to its expensive handshaking, public key infrastructure (PKI)-based authentication and lengthy ciphersuite agreement process. Design/methodology/approach – This paper proposes a lightweight security scheme in CoAP using Advanced Encryption Standard (AES) 128 symmetric key algorithm. The paper presents an object security (payload embedded)-based robust authentication mechanism with integrated key management. The paper introduces few unique modifications to CoAP header to optimize security operation and minimize communication cost. Findings – It is resilient to number of security attacks like replay attack, meet-in-the-middle attack and secure under chosen plaintext attack. This scheme is generic in nature, applicable for gamut of IoT applications. The paper proves efficacy of our proposed scheme for vehicle tracking application in emulated laboratory setup. Specifically, it compares with DTLS-enabled CoAP to establish the lightweight feature of our proposed solution. Research limitations/implications – This paper mainly focuses on implementing in-vehicle tracking systems as an IoT application and used CoAP as the application protocol. Practical implications – Such a lightweight security scheme would provide immense benefit in IoT systems so that resource constraint-sensing devices and nodes can be made secure. This would impact IoT eco systems to a large extent. Originality/value – Such kind of security suite that provides both robustness and lightweight feature is hitherto not known to the authors, particularly in CoAP for IoT applications.