On-device IoT Certificate Revocation Checking with Small Memory and Low Latency
On-device IoT Certificate Revocation Checking with Small Memory and Low Latency
复制标题
DOI：
10.1145/3460120.3484580
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Xiaofeng Shi;Shouqian Shi;Minmei Wang;Jonne Kaunisto;Chen Qian
中科院分区：
文献类型：
--
作者：
Xiaofeng Shi;Shouqian Shi;Minmei Wang;Jonne Kaunisto;Chen Qian
允许设备验证另一个设备的数字证书是许多涉及设备到设备通信的新兴和未来物联网系统的安全协议的基本要求和关键构建块。但是，对当前设备的设备证书验证具有挑战性，主要是因为证书撤销（CR）检查步骤在IoT设备上的资源过多，并且CR状态与设备的同步会产生较长的延迟。本文提出了一个名为TinyCR的设备CR检查系统，该系统可实现100％的准确性，内存和计算效率，低同步延迟和低网络带宽，同时与当前证书标准兼容。我们设计了一种称为DASS的新型紧凑和动态数据结构，用于在TinyCR中的设备上存储和查询全局CR状态。我们的实施表明，TinyCR仅花费每个设备1.7 MB的内存，以跟踪1500万个物联网证书，吊销率为1％。检查一个证书的CR状态在Raspberry Pi 3上的花费少于1微秒。当添加或撤销新证书时，也可以立即更新TinyCR。
Allowing a device to verify the digital certificate of another device is an essential requirement and key building block of many security protocols for emerging and future IoT systems that involve device-to-device communication. However, on-device certificate verification is challenging for current devices, mainly because the certificate revocation (CR) checking step costs too much resource on IoT devices and the synchronization of CR status to devices yields a long latency. This paper presents an on-device CR checking system called TinyCR, which achieves 100% accuracy, memory and computation efficiency, low synchronization latency, and low network bandwidth, while being compatible with the current certificate standard. We design a new compact and dynamic data structure called DASS to store and query global CR status on a device in TinyCR. Our implementation shows that TinyCR only costs each device 1.7 MB of memory to track 100 million IoT certificates with 1% revocation rate. Checking the CR status of one certificate spends less than 1 microsecond on a Raspberry Pi 3. TinyCR can also be updated instantly when there are new certificates added or revoked.