A Secure and Efficient ECQV Implicit Certificate Issuance Protocol for the Internet of Things Applications

For the purpose of securing mutual communication, Internet of Things (IoT) applications should establish a security association in advance for two or more sensor devices acting as the roles of sensors and actuators. Even though the X-509-based public key certificate can be a viable solution for such purpose, it is not efficient to employ in the IEEE 802.15.4 network, since it is too large to be loaded in IEEE 802.15.4 frames. So, the elliptic-curve Qu-Vanstone (ECQV) implicit certificate has been employed for lightweight security association establishment for the IoT environment. However, it is mandatory to secure the transaction between the sensor device requesting the certificate and the certificate authority. The previous ECQV certificate issuance protocol has several weaknesses, in terms of security and efficiency. In this paper, we propose a new ECQV certificate issuance protocol that addresses the security problems of the previous protocol. Our protocol design is based on integration into the secure join protocol of the IEEE 802.15.4, where we employ a cryptographically generated address for security bootstrapping to secure the join and certificate issuance protocol. We extensively analyze and compare our protocol with the previous protocol in terms of security and performance.