ECC-based authentication for IoT devices: a comparative review

Abstract

The Internet of Things (IoT) is moving from small pilots to everyday use in homes, hospitals, factories and cities, where tiny devices still need to prove who they are over lossy and low-power links. In this context, many existing lightweight schemes rely only on symmetric cryptography, which keeps computation low but is still exposed to replay, desynchronization and impersonation attacks. This paper reviews how Elliptic Curve Cryptography (ECC) is used to build mutual authentication and Authentication and Key Agreement (AKA) protocols for constrained IoT deployments. Specifically, we examine a set of recent ECC-based mutual authentication and AKA proposals for constrained IoT deployments, and we briefly include one complementary Intrusion Detection System (IDS) study to reflect defense-in-depth in real deployments. Across these papers we see common ideas, such as gateway-centric architectures that shift credential management away from devices, and multi-factor designs that combine ECC with biometrics and physically unclonable function (PUF) tokens to protect privacy and access control. However, we also find that results are reported using different metrics, which makes a direct like-for-like comparison difficult, and that some proposals only partly address Perfect Forward Secrecy (PFS), resilience to Ephemeral Secret Leakage (ESL) and credential lifecycle management under intermittent connectivity. In response, this report organizes the schemes into a small taxonomy and offers a compact comparison of their computation, communication, and security properties. We also highlight open deployment issues and research directions for PFS/ESL and credential management. In conclusion, our results imply that ECC-based authentication is a viable alternative for IoT, at least if the design community starts paying closer attention to the aspects of PFS/ESL security.