As a back-end registry operator and stakeholder in Research and Development on the use of the DNS, Afnic has been a part of the PIVOT project since 2021. The goal of this Franco-German research project is to draw on a DNS infrastructure capable to ensure more privacy and security on identifiers and metadata in the Internet of Things ecosystem.
An Internet of Things (IoT) that respects privacy means protecting content itself (a temperature reading of a device, for example), in addition to channel encryption (between the device and a gateway or an application). In this case, the goal is to check that the information is solely accessible by the receiver.
Weak data protection in the Internet of Things is often rooted in very practical economic considerations.
In the design, industrialisation and commercialisation phase, solutions are regularly subject to trade-offs between the level of security of the application solution and the device performance. A cost-benefit analysis often at the expense of security, given that greater value is placed on the functional and performance aspects.
Although the interoperability between IoT solutions was and is one of the main, long-standing impediments to the development of the Internet of Things (a topic notably covered in the article on the DiNS project), data protection issues and more generally cyber issues are increasingly a concern, both for organisations and the general public.
Data protection needs to be enhanced and upgradeable in order for the IoT to accompany digital uses, whatever the device, application or IoT networks, both current and future.
Identifiers and security
IoT currently hosts several billions of devices. Nevertheless, the current security and privacy mechanisms in IoT communications do not protect different information equally and comprehensively: device identifiers and contextual metadata. These collateral data and metadata are not sufficiently protected insofar as:
- Channel encryption is commonly intercepted at gateways and is then re-encrypted within the network to be sent to applications
- Identifiers can reveal information on communication partners and contexts (identifier received when a light bulb is turned on connected to a detection sensor set off by a security guard’s patrol)
- The cryptographic protections used can be too weak (algorithm not robust enough to resist attacks)
The PIVOT collaborative project
The innovation in PIVOT is to address the prevalent privacy and security issues in IoT by proposing content object security principles that build on privacy-friendly names, while remaining globally and seamlessly interoperable between IoT devices regardless of networks to which they may connect.
PIVOT starts from two fundamental observations:
- Firstly, a privacy-friendly IoT requires to protect content objects by themselves, in addition to commonly deployed channel encryption. Content disclosure can thus be attributed to designated receivers.
- Second, names (like domain names) can serve as the principle interface to access IoT data, eliding source identities. Hence, individual endpoint identifiers will disappear from public Internet metadata.
When it comes to naming, domain name registries like Afnic have both a specific role and interest. A registry is a player, a trust anchor for Internet naming questions and devices that are directly or indirectly connected to the Internet.
This project is a result of our response to the German-French Joint Call For Proposals on Cybersecurity (MESRI-BMBF) https://anr.fr/en/funded-projects-and-impact/funded-projects/project/funded/project/b2d9d3668f92a3b9fbbf7866072501ef-098e010f75/
It comprises 6 partners: Freie Universität Berlin, HAW Hamburg, INSA, Lobaro, TTN Berlin and Afnic. Afnic, via Sandoche Balakrichenan, is the project coordinator for France.
This consortium of industrial and academic players, representing the chain of stakeholders, has the following 4 aims:
- Put forward a cryptographic system adapted to ultra-constrained devices
- Determine a trusted architecture and enable object security
- Establish protocols that integrate decentralised object security
- Put in place a multi-stakeholder name management architecture that preserves privacy requirements and allocates and resolves names regardless of the IoT applications or networks
It draws on already existing French-German collaborations:
- The very popular RIOT operating system was co-founded and jointly developed by Freie Universität Berlin, INRIA and HAW Hamburg. RIOT has a 5% global IoT OS market share.
- A binational LoRa development community has been established, which Afnic, Lobaro, HAW Hamburg and FU Berlin are part of. Particular contributions to privacy for LoRa come from INSA Lyon/INRIA.
- FU Berlin, HAW Hamburg and Afnic are working on and contributing to the evolution of Internet standards, notably through their participation in the IETF working group for over 10 years.
As a member of the consortium, Afnic studies multi-stakeholder domain name management models that preserve privacy requirements, allocate and resolve names globally, regardless of the IoT applications or networks. We have analysed existing approaches to name space management, placing the emphasis on the DNS. In addition to managing the naming space managed by the DNS, we have also trialled and tested the use of the DNS as a Public Key Infrastructure (PKI) for IoT.
Since the start of the project in 2021, twenty-two articles have been published by the members of the consortium within the framework of the project. One of Afnic’s publications received an award for best article. The project has also contributed to work on IETF standardisation.
Afnic is testing the project hypothesis on an IoT platform using LoRa technology. A first concrete use case consists of using the DNS as a PKI for mutual authentication in LoraWAN. This initial success was demonstrated to IETF and used by the DANCE (DNS Authentication of Network Clients Everywhere) working group.
These results were also presented within the LoRa Alliance® and a task force is planned based on this work. If it is a success, one of the major problems relating to the registration/integration of devices on a network could be resolved.
Our project team is also working on research and experimentation on the classification and distinction between domain names used by IoT and Internet domain names. This work uses AI models that we train using actual data sets. If we manage to develop a functional classification model, it could typically be used by network operators to mitigate attacks caused by IoT devices and the associated traffic (inbound and outbound).
Our partner (INSA Lyon) has managed to pseudonymise identifiers (procedure consisting of concealing data and replacing identifying information with artificial identifiers) on constrained devices and networks like LoRaWAN. Another partner, Lobaro Solutions, has developed LoRa-based devices that could be incorporated into the RIOT OS. Lastly, the German universities (Freie Universität Berlin and HAW Hamburg) are working on the security of devices and carrying out tests with other naming services like NDN (Name Data Networking).
Our upcoming work
Although we intend to continue our research on classification and have an upcoming publication scheduled on this topic, we will also be working on asymmetric key compression on the LoRa network in line with members’ general objective to integrate functions in the RIOT operating system.
For further information
Project website: https://pivot-project.info/
- Sandoche Balakrichenan, Benoit Ampeau, Ibrahim Ayoub. PKI for IoT using the DNS infrastructure. https://pkiindia.in/pkia2022/, Sep 2022, Bangalore, India. ⟨1109/PKIA56009.2022.9952253⟩. ⟨hal-03798465⟩
- Ibrahim Ayoub, Gaël Berthaud-Müller, Sandoche Balakrichenan, Kinda Khawam, Benoît Ampeau. The DNS to Reinforce the PKIX for IoT Backend Servers: Implementation and Evaluation. 14th IFIP Wireless and Mobile Networking Conference, Oct 2022, Tunis, Tunisia. ⟨hal-03798669⟩