HA-CAAP: Hardware-Assisted Continuous Authentication and Attestation Protocol for IoT Based on Blockchain

The increasing integration of Internet of Things (IoT) devices in various sectors has created complex and dynamically changing interconnected systems. In several multiauthority and multidomain applications, IoT devices may continuously change their connectivity status, leading to dynamic topologies; an IoT device may be connected to different gateways at different times, to support the provisioning of a distributed service. However, these complex environments increase exposure to security threats, such as device spoofing or cloning attacks. Even worse, without continuous device inventorying, an adversary may easily duplicate a cloned device and concurrently connect compromised Sybil nodes at different gateways, without getting noticed. This article proposes Hardware-assisted, continuous authentication and attestation protocol (HA-CAAP), a hardware-assisted continuous authentication and attestation protocol for IoT devices. By using a physically unclonable function-based periodic authentication mechanism, gateways can continuously authenticate their connected devices and detect modifications in their connectivity status, in nearly real-time. Through a private blockchain, gateways are able to continuously exchange information about their connectivity state and securely share a dynamic device inventory, to detect possible Sybil attacks. In addition, by integrating a continuous gateway attestation mechanism in the blockchain, the protocol prevents nontrusted gateways from joining in and assures their integrity. To evaluate HA-CAAP, security is formally analyzed, while a proof-of-concept implementation is used to analyze the protocol’s performance, for realistic application scenarios.