![](bg2.png)
ments that involve tens of millions of devices. For
example, pre-installing 10,000 128-bit AES keys on
a device takes 160KB memory and also poses signifi-
cant look-up latency. Additionally, the de-centralized
ad-hoc nature of WSNs present significant limitations
to implementing traditional security solutions. In a
decentralized ad-hoc network setup, the individual
nodes do not have fixed positions before deployment
and also do not possess knowledge of neighbouring
nodes.
In this work, we present a lightweight secure
node-to-node key exchange communication protocol
implementation based on the Elliptic Curve Diffie-
Hellman (ECDH) and Elliptic Curve Digital Signa-
ture Algorithm (ECDSA) (Strangio, 2005) on re-
source constrained devices. We extend the capabil-
ities of the Contiki-NG UDP (Contiki-Ng, 2019b)
broadcast application with a refined implementa-
tion of the ECC component of the Tinycrypt li-
brary (Wood, 2019). We do this in such a way that
will enable developers and researchers to easily build
and implement security and privacy-preserving proto-
cols by using our library as a baseline. As part of this
work, we evaluate the performance of our library by
running a toy protocol on the Zolertia Re-Mote board
and the Zolertia Orion Ethernet IP64 router. Our work
focuses on the communication between the individual
WSN devices.
Our Contribution. The main contribution of this
work is threefold. We first implement a lightweight
secure node-to-node key exchange communication
protocol based on the Tinycrypt (Wood, 2019) imple-
mentation of the ECDH and ECDSA algorithms. Our
construction was implemented and extensively tested
on the Zolertia IoT boards. Our work also extends the
Contiki-NG UDP communication application to sup-
port and facilitate the proposed implementation. This
work was designed and developed in such a way that it
can be easily adapted by different IoT operating sys-
tems and implemented on various brands of IoT de-
vices. Hence, allowing others to build even better and
more efficient secure and privacy-preserving IoT pro-
tocols.
Organization. The rest of this paper is organized as
follows. In section 2, we present existing works that
relate to privacy preserving solutions and cryptogra-
phy in resource constrained devices. In section 3, we
formally define our system model. A description of
the cryptographic primitives used for our work and
the threat model are presented in section 4. In sec-
tion 5, we give a brief overview of current security im-
plementations in Contiki-NG and provide a detailed
description of our proposed implementation. We then
delve into a security analysis of the cryptographic li-
brary we have chosen and the proposed toy protocol
in section 6. Section 7 provides an extended evalu-
ation of our proposed implementations and finally in
section 8 we conclude the paper.
2 RELATED WORK
In (Eschenauer and Gligor, 2002) authors introduced
a key-management scheme designed to meet the op-
erational and security requirements of distributed sen-
sor nodes (DSN). Their proposed scheme included se-
lective distribution and revocation of keys to sensor
nodes as well the capability of nodes to re-key with-
out substantial computational overhead. This pro-
posed scheme relied on three primary phases: key pre-
distribution, shared-key discovery and path-key es-
tablishment. Authors used probabilistic key sharing
among nodes and implemented a simple but effective
shared-key discovery protocol to achieve the primary
features of their scheme (i.e. key distribution, revo-
cation and node re-keying). Unlike this scheme, our
implementation eliminates the need to pre-distribute
keys and focuses on enabling the WSN nodes gener-
ate shared keys.
Another design of a secure network access sys-
tem for wireless sensor networks in (Sun et al., 2009)
used an elliptic curve public key cryptosystem, a
polynomial-based weak authentication scheme, and
hardware-based symmetric key cryptography. The
authors used ECC as a network admission control
to add new nodes to their environment. Further-
more, they introduced a controller node in their net-
work to authenticate new nodes using self-certified
ECDH protocol. The hardware-based symmetric key
cryptography was implemented using the hardware
security interface offered by TinyOS (Community,
2019) with the Imote2 sensor (Technology, ) running
TinyOS. The Imote2 platform comes with 256KB
SRAM, 32MB SDRAM and 32MB flash. However,
contrary to this implementation, our work does not
require the use of a controller node or any third party
entity to verify nodes.
In (Zhou et al., 2019) authors present a re-
designed NIST P-256 and 256 SM2 (Feng, 2017)
cryptographic algorithm to fit low-end IoT platforms
such as the 8-bit AVR processor. The authors adopt
an optimized finite field arithmetic and elliptic curve
group arithmetic for optimum performance on their
selected IoT platform. The primary focus of the pa-
per is the use of techniques for various modular re-
duction and the adoption of the fastest method of big
IoTBDS 2020 - 5th International Conference on Internet of Things, Big Data and Security
102