Subject: [lp-wan] gap analysis (Security and LP-WAN section)

From: Dan García Carrillo <[email-masked]>
Date: Mon, 14 Mar 2016 19:08:05 +0100

Hello all: 

I am a Ph.D. student working in the area of security, authentication, authorization and key management in IoT, and I am interested in the specific case of LP-WAN. I did an initial scouting of the current state, and how the different technologies deal with these issues.

Please, see my conclusions below:

DASH7
====================

o They define 2 keys for specific users (root, user) 
o There is also a network key.

> Not specified how these keys are obtained.

LoRaWAN
====================

o Device Activation

Over the Air Activation (when an end-device is deployed or reset): 
- From the Root-specific-app-key or AppKey to derive NwkSKey and AppSKey with the information exchanged in the join procedure.

Personalization (join procedure is by-passed)
- NwkSKey and AppSKey are directly stored into the end-device.

802.15.4k
====================

- MLME (Medium access control (MAC) sublayer management entity) association is defined.

- A TRLE PAN relay association with optional security.

No mention of acquiring keys to secure any of these processes. 

802.15.4g
====================
No mention of a joining or association process. I assume that this is not unexpected since this document deals with "Physical Layer (PHY) Specifications" 

Sigfox
====================
I only found some presentation documents and in one of them they say the provide:
Identification and authentication. Each device contains a unique ID and secure key.

There is no mention of how the keys are set in the devices. 

RPMA
====================
The same here, I did not found technical specifications, only presentations. 

They say they use security algorithms and provides for mutual device authentication, message authentication, message confidentiality, and secure over the air firmware upgrades.

No mention about how the keys are set in the devices.

Qowisio
====================
The same here, I did not found technical specifications, only presentations. (any pointer?)

Any comments? Do you think it would be worth to include it in the gap analysis (security section) ?

Best Regards,
Dan Garcia.

---

From: Alexander Pelov <[email-masked]>
Date: Tue, 15 Mar 2016 16:18:18 +0100

Hi Dan,

Thanks a bunch for doing this great survey! We should definitely include it in the gap analysis document. 

There is an ongoing discussion on SigFox security and I think there will be more information that will be shortly made available: http://j.mp/1nL4daj 

I have no information on the 802.15.4k nor 802.15.4g. The latter was quite discussed on the mailing list. Also, I would be curious to add the IEEE 802.15.4ah to the comparison list. Maybe something related to IEEE 802.15.9? 

Best,
Alexander

> Le 14 mars 2016 à 19:08, Dan García Carrillo <[email-masked]> a écrit :
> 
> Hello all: 
> 
> _______________________________________________
> lp-wan mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lp-wan

---

From: Dan García Carrillo <[email-masked]>
Date: Tue, 22 Mar 2016 15:34:29 +0100

Hi Alexander, 

Thanks for the link about Sigfox, it was an interesting reading. 

Regarding the other technologies I would include the following:

802.11 ah
==============

Security Implications: 
    1 - Efficient
    2 - Long validity of the secure session
    3 - Avoid involvement of on-line and remote network devices 
    4 - Should not reduce flexibility of (re)deployment over lifetime
    5 - Should be carried out in operational network (“hot swap”)

Use Cases characteristics:
	- Devices from many vendors (Federation) *
	- Easy Configuration and maintenance (least human interaction possible)

* Without further elaboration this might be in contraposition with implication 3.

I do not see how they propose to address these points yet. Although they are, I think, reasonable.

802.15.9
==============

Defines:
   - Message exchange framework based on Information Elements to transport (KMP) datagrams.
   - Guidelines for the use of some existing KMPs with the IEEE Std 802.15 and IEEE Std 802.15.7. 
   - They do not create a new KMP.

Sigfox
==============

- Provide integrity of the communications. 
- Encryption at application level
- Future integration of a secure element to store key material. 

Best Regards,
Dan. 

> El 15 mar 2016, a las 16:18, Alexander Pelov <[email-masked]> escribió:
> 
> Hi Dan,
>

---

From: Alexander Pelov <[email-masked]>
Date: Tue, 22 Mar 2016 17:49:12 +0100

Thanks, Dan! Great reading!

Do you have an idea how is approached the question of "long validity of the secure session" in 802.11ah? Any read you could recommend?

Best,
Alexander

> Le 22 mars 2016 à 15:34, Dan García Carrillo <[email-masked]> a écrit :
> 
> Hi Alexander, 
>