Integrating PHY Security Into NDN-IoT Networks By Exploiting MEC: Authentication Efficiency, Robustness, and Accuracy Enhancement

TL;DR

This paper enhances security in NDN-IoT networks by integrating physical-layer device-specific radio-frequency features into the authentication process, significantly improving efficiency, robustness, and accuracy while reducing computational costs.

Contribution

It introduces a novel lightweight PHY-ID-based authentication scheme integrated with NDN signatures for MEC-enabled IoT, addressing resource constraints and security challenges.

Findings

Authentication time is significantly reduced.

Robustness against impersonation attacks is improved.

Authentication accuracy and differentiation rate are increased.

Abstract

Recent literature has demonstrated the improved data discovery and delivery efficiency gained through applying named data networking (NDN) to a variety of information-centric Internet of things (IoT) applications. However, from a data security perspective, the development of NDN-IoT raises several new authentication challenges. In particular, NDN-IoT authentication may require per-packet-level signatures, thus imposing intolerably high computational and time costs on the resource-poor IoT end devices. This paper proposes an effective solution by seamlessly integrating the lightweight and unforgeable physical-layer identity (PHY-ID) into the existing NDN signature scheme for the mobile edge computing (MEC)-enabled NDN-IoT networks. The PHY-ID generation exploits the inherent signal-level device-specific radio-frequency imperfections of IoT devices, including the in-phase/quadrature-phase imbalance, and thereby avoids adding any implementation complexity to the constrained IoT devices. We derive the offline maximum entropy-based quantization rule and propose an online two-step authentication scheme to improve the accuracy of the authentication decision making. Consequently, a cooperative MEC device can securely execute the costly signing task on behalf of the authenticated IoT device in an optimal manner. The evaluation results demonstrate 1) elevated authentication time efficiency, 2) robustness to several impersonation attacks including the replay attack and the computation-based spoofing attack, and 3) increased differentiation rate and correct authentication probability by applying our integration design in MEC-enabled NDN-IoT networks.

Figures

Equations

$$\mathbf{z}$$

$$+[c_1\mathbf{H}(1-(1+{\alpha }_{})e^{j{\theta }_{}})+c_2{\mathbf{H}}^{\ast }(1+(1+{\alpha }_{})e^{-j{\theta }_{}})]\frac{{\mathbf{x}}^{\ast }}{2},$$

$$\hat{a}=a+n_a,$$

$$q(\hat{a})=a_{[m]},m=1,2\cdots M$$

$$H=-\sum _{m=1}^M{\tilde{f}}_A(a_{[m]}){\log }_2{\tilde{f}}_A(a_{[m]}),$$

$$\displaystyle\left\{\begin{array}[]{clc}&\!\!\!\!\!\!\!\!b_{0}=a_{\text{min}},\\ &\!\!\!\!\!\!\!\!b_{m+1}=F_{a}^{-1}\left(\frac{1}{M}+F_{a}(b_{m})\right),\end{array}\right.$$

$$b_m=\left(\frac{2m}{M-1}-1\right)a_{\text{max}}.$$

$$a=g_1(\theta )g_2(\alpha )+c,$$

$$\displaystyle\!\!f_{A}(x)=\left\{\begin{array}[]{clc}\tau_{1}(x-c),&g_{\text{min}1}g_{\text{min}2}<g<g_{\text{min}1}g_{\text{max}2}\\ \tau_{2}(x-c),&g_{\text{min}1}g_{\text{max}2}<g<g_{\text{max}1}g_{\text{min}2}\\ \tau_{3}(x-c),&g_{\text{max}1}g_{\text{min}2}<g<g_{\text{max}1}g_{\text{max}2}\end{array}\right.,$$

$$\displaystyle\!\!f_{A}(x)=\left\{\begin{array}[]{clc}\tau_{1}(x-c),&g_{\text{min}1}g_{\text{min}2}<g<g_{\text{max}1}g_{\text{min}2}\\ \tau_{4}(x-c),&g_{\text{max}1}g_{\text{min}2}<g<g_{\text{min}1}g_{\text{max}2}\\ \tau_{3}(x-c),&g_{\text{min}1}g_{\text{max}2}<g<g_{\text{max}1}g_{\text{max}2}\end{array}\right.,$$

$$\displaystyle f_{A}(x)=\left\{\begin{array}[]{clc}\tau_{1}(x-c),&g_{\text{min}1}g_{\text{min}2}<g<g_{\text{min}1}g_{\text{max}2}\\ \tau_{3}(x-c),&g_{\text{min}1}g_{\text{max}2}<g<g_{\text{max}1}g_{\text{max}2}\end{array}\right.,$$

$${\tau }_i(x)={\int }_{{\kappa }_{b_{(i)}}}^{{\kappa }_{t_{(i)}}}\frac{1}{x}{f}_{G_1}(x)f_{G_2}(g/x)\text{d}x,i=1,2,3,4$$

$$\displaystyle b_{m+1}\!=\!\left\{\begin{array}[]{clc}&\!\!\!\!\!\!\!\!\!\!F_{\tau_{2}}^{-1}\left(\frac{1}{M}-F_{\tau_{1}}\left(G_{1}\right)+F_{\tau_{1}}(b_{m})+F_{\tau_{2}}\left(G_{1}\right)\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{1},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)<\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{1}}^{-1}\left(\frac{1}{M}+F_{\tau_{1}}(b_{m})\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{1},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)>\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}-F_{\tau_{2}}\left(G_{2}\right)+F_{\tau_{2}}(b_{m})+F_{\tau_{3}}\left(G_{2}\right)\right),\\ &\text{if}\ \ G_{1}<b_{m}<G_{2},\left(F_{\tau_{2}}\left(G_{2}\right)-F_{\tau_{2}}(b_{m})\right)<\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{2}}^{-1}\left(\frac{1}{M}+F_{\tau_{2}}(b_{m})\right),\\ &\text{if}\ \ G_{1}<b_{m}<G_{2},\left(F_{\tau_{2}}\left(G_{2}\right)-F_{\tau_{2}}(b_{m})\right)>\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}+F_{\tau_{3}}\left(b_{m}\right)\right),\\ &\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \text{if}\ \ G_{2}<b_{m}<G_{3},m<M\end{array}\right..$$

$$\displaystyle b_{m+1}\!=\!\left\{\begin{array}[]{clc}&\!\!\!\!\!\!\!\!\!\!F_{\tau_{4}}^{-1}\left(\frac{1}{M}-F_{\tau_{1}}\left(G_{1}\right)+F_{\tau_{1}}(b_{m})+F_{\tau_{4}}\left(G_{1}\right)\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{2},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)<\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{1}}^{-1}\left(\frac{1}{M}+F_{\tau_{1}}(b_{m})\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{2},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)>\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}-F_{\tau_{4}}\left(G_{1}\right)+F_{\tau_{4}}(b_{m})+F_{\tau_{3}}\left(G_{1}\right)\right),\\ &\text{if}\ \ G_{2}<b_{m}<G_{1},\left(F_{\tau_{4}}\left(G_{1}\right)-F_{\tau_{4}}(b_{m})\right)<\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{4}}^{-1}\left(\frac{1}{M}+F_{\tau_{4}}(b_{m})\right),\\ &\text{if}\ \ G_{2}<b_{m}<G_{1},\left(F_{\tau_{4}}\left(G_{1}\right)-F_{\tau_{4}}(b_{m})\right)>\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}+F_{\tau_{3}}\left(b_{m}\right)\right),\\ &\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \text{if}\ \ G_{1}<b_{m}<G_{3},m<M\end{array}\right..$$

$$\displaystyle b_{m+1}\!=\!\left\{\begin{array}[]{clc}&\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}-F_{\tau_{1}}\left(G_{1}\right)+F_{\tau_{1}}(b_{m})+F_{\tau_{3}}\left(G_{1}\right)\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{1},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)<\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{1}}^{-1}\left(\frac{1}{M}+F_{\tau_{1}}(b_{m})\right),\\ &\ \ \ \ \ \ \ \,\text{if}\ \ b_{m}<G_{1},\left(F_{\tau_{1}}\left(G_{1}\right)-F_{\tau_{1}}(b_{m})\right)>\frac{1}{M}\\ &\!\!\!\!\!\!\!\!\!\!F_{\tau_{3}}^{-1}\left(\frac{1}{M}+F_{\tau_{3}}\left(b_{m}\right)\right),\\ &\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \text{if}\ \ G_{1}<b_{m}<G_{3},m<M\end{array}\right..$$

$$f_{G_1}(x)=\frac{1}{{\theta }_m\sqrt{1-x^2}},x\in [\cos {\theta }_m,1]$$

$$f_{G_2}(x)=\frac{1}{{\alpha }_m},x\in \left[\frac{1-{\alpha }_m}{2},\frac{1+{\alpha }_m}{2}\right].$$

$${\tau }_1(x)=\frac{1}{{\theta }_m{\alpha }_m}\ln \left(\frac{\frac{x}{\cos {\theta }_m}+\sqrt{{\left(\frac{x}{\cos {\theta }_m}\right)}^2-x^2}}{\frac{1-{\alpha }_m}{2}+\sqrt{{\left(\frac{1-{\alpha }_m}{2}\right)}^2-x^2}}\right)$$

$${\tau }_2(x)=\frac{1}{{\theta }_m{\alpha }_m}\ln \left(\frac{\frac{1+{\alpha }_m}{2}+\sqrt{{\left(\frac{1+{\alpha }_m}{2}\right)}^2-x^2}}{\frac{1-{\alpha }_m}{2}+\sqrt{{\left(\frac{1-{\alpha }_m}{2}\right)}^2-x^2}}\right)$$

$${\tau }_3(x)=\frac{1}{{\theta }_m{\alpha }_m}\ln \left(\frac{1+{\alpha }_m}{2x}+\sqrt{{\left(\frac{1+{\alpha }_m}{2x}\right)}^2-1}\right)$$

$${\tau }_4(x)=\frac{1}{{\theta }_m{\alpha }_m}\ln \left(\frac{1}{\cos {\theta }_m}+\sqrt{{\left(\frac{1}{\cos {\theta }_m}\right)}^2-1}\right).$$

$$y_{[k]}={\hat{a}}_{x[k]}-a_A=a_{\Delta }+n_{a[k]},k=1,2,\cdots ,N_s$$

$$\displaystyle\left\{\begin{array}[]{clc}\mathcal{H}_{0}:&a_{\Delta}=0\\ \mathcal{H}_{1}:&a_{\Delta}\neq 0\end{array}\right.,$$

$$L_{\text{NP}}=\frac{r{\sum }_{k=1}^{N_s}{y}_{[k]}}{a_{\Delta }{N}_s}\underset{{\mathcal{H}}_1}{\overset{{\mathcal{H}}_0}{\lessgtr }}{b}_v,$$

$$b_v=Q^{-1}(\rho )\sqrt{\frac{r}{N_s}},$$

$$\rho ={\int }_{b_v}^{\infty }\sqrt{\frac{N_s}{2r\pi }}\exp \left(-\frac{N_s{x}^2}{2r}\right)\text{d}x.$$

$$r_{\text{D}}=Pr(L_{\text{NP}}>b_v|{\mathcal{H}}_1)=Q\left(\sqrt{r{N}_s}\left(\frac{b_v}{r}-1\right)\right).$$

$$L_{\text{GLRT}}=\frac{\left(N_s-1\right){\left({\sum }_{k=1}^{N_s}{y}_{[k]}\right)}^2}{N_s{\sum }_{k=1}^{N_s}(y_{[k]}-\frac{1}{N_s}{\sum }_{k=1}^{N_s}{y}_{[k]}{)}^2}\underset{{\mathcal{H}}_1}{\overset{{\mathcal{H}}_0}{\lessgtr }}{b}_v,$$

$$\displaystyle\!\!\!\!L_{\text{GLRT}}\sim\left\{\begin{array}[]{clc}&\!\!\!\!\!\!\!\!\!\!F(1,N_{s}-1)\ \ \ \ \ \ \ \ \ \ \,\text{under}\,\mathcal{H}_{0}\\ &\!\!\!\!\!\!\!\!\!\!F^{\prime}(1,N_{s}-1,\frac{N_{s}a^{2}_{\Delta}}{\sigma^{2}})\ \ \text{under}\,\mathcal{H}_{1}\end{array}\right.,$$

$$\rho$$

$$=1-N_s(N_s-1){\int }_0^{\frac{b_v}{b_v+N_s-1}}(1-t{)}^{N_s-2}\text{d}t,$$

$$I_x(d_1,d_2)=\frac{(d_1+d_2-1)!{\int }_0^x{t}^{d_1-1}(1-t{)}^{d_2-1}\text{d}t}{(d_1-1)!(d_2-1)!}.$$

$$r_{\text{D}}=Pr(L_{\text{GLRT}}>b_v|{\mathcal{H}}_1)$$

Full text

I Introduction

To build secure, scalable smart city networks, an enormous variety of new Internet of things (IoT) devices are deployed ubiquitously every day to sense every concern of the city with minimal human intervention and to provide the sensed data to various information-centric applications via the Internet. As part of efforts to supportively address the explosive increase in IoT data traffic, investigations of mobile edge computing (MEC) architecture and named data networking (NDN) have aroused extensive attention in recent years. The MEC-enabled IoT can supplement the cloud computing-based IoT through harvesting the cache/storage ability, the idle computational capacity, and the context-aware resources located at the network edge [1]. NDN with the abilities of data content naming111In NDN-IoT, the information produced by the IoT end devices at the network edge can be regarded as content [2]. and in-network caching can be beneficial to the IoT in terms of supporting device mobility [3] and raising the efficiency of data discovery and delivery [2] for the information-centric applications, such as intelligent transportation systems [4, 5] and building automation and management systems [6]. These IoT applications need to monitor and process big volumes of sensitive information collected from a large number of simple sensors. Given the open nature of wireless propagation and the constrained computational power of wireless IoT end devices (EDs), EDs are especially vulnerable to the impersonation-based DDoS attacks, e.g., content poisoning [7]. From the data security perspective, authentication is of significant importance either before granting any connectivity of IoT devices to the NDN or accepting any contents from the NDN data producers.

I-A Research Motivations

In most host-centric IoT applications, data provenance is guaranteed by authenticating an instantaneous end-to-end (E2E) communication channel/session. While the information-centric NDN-IoT applications need to validate the data packets that are fetched from the intermediate caches [2, 5]. In this regard, the authentication task of NDN has to tie to the content of every data packet directly rather than securing the E2E connection. Currently, NDN relies on the digital signature to protect the data provenance at the network layer, which, most of the time, requires the data producer (i.e., IoT end devices) to execute asymmetric cryptography at a packet granularity [8, 9, 4, 10]. The workload of the signing task can be intolerably high, especially for low-end sensor-based IoT devices [11, 12]. Therefore, offloading such heavy cryptographic workloads from constrained IoT devices is promising for implementing efficient and secure NDN-IoT networks, motivating the exploitation of the two following helpful techniques.

Per-signal-level PHY RF fingerprinting: At a wireless IoT transmitter, every encapsulated NDN packet will be sent to the physical layer and radiated through the RF front-end and is thus inevitably affected by the RF imperfection parameters. At the receiver, these device-specific parameters can be extracted from any NDN packet and can represent the unique fingerprint/identity of the ED. Moreover, the estimation of RF parameters is usually a mandatory function of a receiver for signal compensation purposes. These readily available estimates can be cost-effectively used to produce an unforgeable PHY identity (PHY-ID) for transmitter authentication [13, 14, 15, 16, 17], which has the potential to help relieve the excessive computational burden of the signature encryption.

Exploitation of MEC: MEC devices (MECDs) located at the network edge can quickly observe/collect the PHY information of the served IoT devices, including the RF fingerprints, and usually possess more powerful CPUs than the EDs for performing encryption. The NDN naming and in-network caching schemes with built-in interest/data primitives are well-suited for MEC-enabled networks [18, 19].

Consequently, it is practically feasible to replace the NDN packet signing at the resource-constrained ED with two steps: 1) MECD authenticates ED using PHY-ID, and 2) MECD works with the authenticated EDs in a coordinated manner to offload the signing task from EDs [20, 21, 22].

I-B Related Work and Technical Problems

In the field of NDN signature schemes, the US-founded NDN project[8] defined the architecture and functions of packet signature-based authentication. The detailed, usable NDN signature scheme was introduced in [23]. The work in [9] and [11] reported the high-cost problem caused by executing signature-based authentication at simple IoT sensors without providing detailed solutions. An encryption authentication protocol in which the data provider and consumer should directly find each other with agreed services at the mobile edge was designed in [19]. The studies of [24] and [25] integrated identity-based cryptography (IBC) and hierarchical IBC into NDN for authentication purposes. In a recent study [4], a symmetric key-based IoT device (standard node) authentication along with NDN routing was proposed for the smart city scenario. However, applying these methods in NDN-IoT could require additional encryptions to be carried out by the constrained IoT devices. Most importantly, the inherent problem of the above-mentioned cryptography-based authentication methods is that the impersonation attackers with rapidly growing processing power are capable of compromising or even reconstructing the encryption credentials (e.g., key and certificate) of a resource-limited IoT device in a much shorter time than before [16], e.g., via brute-force computation. The encryption credentials are essentially virtual numbers that are not directly associated with the hardware of IoT devices. In this case, an attacker possessing the correct credentials could be authenticated and can thus inject poisoned contents into NDN without triggering any alarm. However, due to the limited memory, computing, and energy capacities of IoT data providers, it is impractical to prevent the computation-based malicious cryptanalysis by straightforwardly increasing the computational intractability of the NDN-IoT system, e.g., using a longer key.

In this case, [8] highlighted the prospects of investigating a secure collaboration scheme that allows trusted proxies to sign on behalf of the constrained devices. The authors of [6] considered using the gateway to sign packets on behalf of the ED in building management systems. In [20, 21, 22], several collaborative task offloading schemes that exploit the CPU resources between MECDs and end users were investigated. Given that the signature in NDN packet is used for data provenance verification, the authenticity of “signing task provider” should be verified before the MECD accepts the unsigned packets, but with two requirements: 1) the authentication cannot impose much additional computational burden on resource-constrained EDs, and 2) the ED authentication can be completed even at the packet granularity.

Signal-level PHY RF fingerprinting can meet these two requirements and can be used in the MEC-enabled NDN-IoT networks as mentioned earlier. In [26], RF-based device fingerprinting was surveyed, and the implementation of modulation domain in-phase/quadrature-phase imbalance (IQI)-based fingerprinting was reported to be less complicated than that of the waveform domain methods. In [13, 27, 28, 29], unclonable IQI fingerprints were used to authenticate wireless transmitters in different device-to-device scenarios. The studies of [16, 30] proved that the stable RF-based PHY-ID is suitable for integration into cryptography primitives for the dynamically fluid IoT environment. The well-established RF fingerprinting technology is robust in nature due to the immense difficulty in arbitrarily changing hardware-level RF features within the short duration of an authentication session. Additionally, given the low distinguishability of range-limited RF parameters, the authors of [30] used the entropy to measure the randomness of PHY-ID and proposed the multiple-attributes multiple-observations (MAMO) technique to improve the authentication accuracy through increasing the entropy. However, the optimal entropy-based method was not derived, and thus its performance under a high density of IoT devices is obviously deteriorated. To the best of the authors’ knowledge, the practical exploitation of PHY fingerprinting and MEC architecture for NDN-IoT authentication still faces two technical challenges.

Challenge 1: A design is needed to integrate PHY fingerprinting into NDN-IoT signature scheme seamlessly in order to accomplish secure signing task offloading.

Challenge 2: Achieving high authentication accuracy and strong robustness in a high-density IoT environment.

I-C Our Contributions

This paper investigates the integration of PHY fingerprinting into the NDN-IoT signature scheme to achieve the signing task offloading and address the above challenges. We consider an MEC-enabled NDN-IoT network in which groups of IoT EDs can serve as the data providers, an MEC device can be a small-scale data center co-located with the gateway that connects IoT devices and the NDN, and NDN is capable of preliminarily processing the received NDN interest/data packets. In an offline phase, the MECD can prepare the maximum entropy-based (MEB) quantization rules and register the legitimate PHY-IDs, which are associated with the RF IQI of the EDs. By integrating this PHY-ID into the NDN-IoT signature scheme, the MECD can examine packets provenance using our two-step authentication, securely execute the costly signing task on behalf of the authenticated IoT device in an optimal manner, and finally publish the contents under its application-defined namespace. The technical contributions of this paper are summarized as follows.

• •

We complete the integration design with limited computational complexity imposed on the constrained IoT device. As a result, the packet signing task can be securely offloaded from the constrained IoT devices, which improves the time efficiency of the NDN-IoT network.

• •

Given that diverse estimation methods can produce different IQI parameters, we derive the MEB quantization rule to generally address various IQI parameters rather than merely a specific one. Using our offline MEB quantizer and online two-step authentication, the authentication accuracy is improved in terms of the increased differentiation rate and correct authentication probability.

• •

Compared to traditional encryption-based security, our PHY-aided authentication exhibits stronger resistance to an impersonation attacker with the compromised signing key and thus can effectively prevent content poisoning DDoS attacks in NDN-IoT networks.

The remainder of this paper is organized as follows. In Section II, the system framework and the proposed method are described. The proposed offline MEB quantization rule, integration design, online two-step authentication, and signing task offloading are described in Section III, Section IV, Section V, and Section VI, respectively. Section VII evaluates the performance of the proposed method. The conclusions are presented in Section VIII.

Notations: $(\cdot)^{*}$, $\lfloor\cdot\rfloor$, $\lceil\cdot\rceil$, and $(\cdot)^{T}$ denote conjugate, floor function, ceiling function, and transpose operations, respectively. Bold lowercase and uppercase letters represent vectors and matrices, respectively. $a_{(i)}$ denotes the $i$th element of vector $\mathbf{a}$. $\det(\mathbf{A})$ is the determinant of matrix $\mathbf{A}$. $\Re(x)$ and $\Im(x)$ denote the real part and imaginary part of $x$, respectively. $\max(\cdot)$ and $\min(\cdot)$ return the maximum value and minimum value.

II Framework of The System And Proposed Method

II-A Overview of the MEC-enabled NDN-IoT Network and RF Signal Model

Fig. 1 illustrates the considered MEC-enabled NDN-IoT network. A cluster of IoT EDs can serve as the data provider to send data to consumers via a gateway using NDN packet forwarding (the red line shows this data flow). The consumer at the other end can access the content of interest via an IoT application. The gateway connects the EDs and NDN to receive EDs’ packets and publish the contents of interest to NDN under its namespace [10, 2]. An MECD can be a resource-rich, small-scale data center that is co-located with the gateway and is granted the privilege via gateway for executing the costly computing tasks such as the packet signing. The gateway can take over the responsibilities of the MECD if it has sufficient computing power for the signing task offloading. As shown in the figure, MECD/gateway can communicate with EDs directly or via a trusted cluster head (CH) node.

At an ED, the NDN-IoT data packet can be encapsulated at the application layer under its own prefix and finally sent down to the physical layer for analog RF signal emission. We assume that an ED’s imperfect RF front-end can process signals using the in-phase/quadrature-phase (IQ) processing, where the signals suffer from the imbalanced gain and phase-shift between I-channel and Q-channel mainly due to the imperfect local oscillator and mixer [31]. We use $\theta$ and $\alpha$ to represent phase-shift mismatch and amplitude mismatch, respectively, where the independent $\theta$ and $\alpha$ follow the uniform distributions , $\theta\sim U(-\theta_{m},\theta_{m})$ and $\alpha\sim U(-\alpha_{m},\alpha_{m})$, and $\theta_{m}>0$ and $\alpha_{m}>0$ are regulated by the RF manufacturer/market[32, 30, 33]. We consider that all EDs in the MECD’s coverage are produced under the same maximum $\alpha$ and $\theta$ requirement. At the receiver side, the received signals with IQI effect can be represented as [34, 30]

[TABLE]

where $\mathbf{x}$ denotes the transmitted symbol vector in a time instant, $\mathbf{H}$ is the corresponding channel gain matrix, and $c_{1}$ and $c_{2}$ are two constants representing the IQI of the receiver. Usually, the IQI estimation is a mandatory function of the signal receiver for IQI compensation, and the estimated IQI parameter can be generally represented by

[TABLE]

where $\hat{a}$ and $a$ denote the estimated and actual values of the constant IQI parameter, respectively, and $n_{a}$ denotes the estimation noise that follows $n_{a}\sim\mathcal{N}(0,\sigma^{2})$ [13, 35]. Here, $a$ is a function of $\theta$ and $\alpha$; the different forms of $a$ will be discussed in Section III.

Typically, NDN-IoT requires that all data packets are signed by the private signing key ($PvtK_{\text{ED}_{A}}$) of the resource-constrained $\text{ED}_{A}$ for data provenance authentication, where $\text{ED}_{A}$ denotes the end device A. The packet signing is based on asymmetric encryption, which employs, for example, ECC and RSA in most NDN networks. This could impose a heavy computational workload on the constrained $\text{ED}_{A}$ and significantly delay the packet uploading. It is assumed that EDs cannot afford the per-packet-level asymmetric encryption when preparing the packets due to their limited computation capacities; meanwhile, the MECD is assumed to be unconstrained. The private-public key pair and certificate generation and distribution are beyond the scope of our paper; interested readers can refer to [6, 4, 36].

This paper focuses on how to replace the task of signing NDN packets at the EDs with the following two steps:

• •

Step 1: MECD first authenticates an ED using IQI-based PHY-ID accurately 1) under the dense IoT environment and 2) without imposing excessive computational complexity on this ED.

• •

Step 2: MECD offloads the signing task from the authenticated ED through accepting parts of the unsigned packets and completes the packet signing.

II-B Threat Model and Assumptions

Given the vulnerability of resource-limited EDs, we consider that the DDoS attacker’s objective is to inject poisoned contents into the NDN cache via impersonating the legitimate EDs. We assume that the attackers with high computing power can compromise or even reconstruct the signing key of an ED within the lifetime of signature through key leaking, replaying the captured packets, brute-force computation, etc. It is assumed the attackers can be aware of the current pending interest for particular content or can anticipate the popular interests of consumers. Hence, such attackers are able to produce poisoned contents under a popular name prefix, sign contents using the compromised key, and try to publish the poisoned data packets on NDN. We suppose that the consumers know the trust schema for data provenance verification and that the trust anchors do not change over time (i.e., consumers know how to construct valid certification chains). Consequently, although the consumer or NDN router can reach the correct certificate along the trust chain, none of them can determine the signature of attacker as invalid if purely relying on the traditional encryption-based method; thus, they will accept the poisoned contents without triggering any alarm. In addition, we assume that the EDs’ DDoS attacks targeting MECD without using any identity impersonation/spoofing methods will be detected by the MECD.

II-C Framework of the Proposed Offline/Online Counter Solution and Assumptions

To accomplish the aforementioned two-step strategy, we propose to integrate the IQI-based PHY-ID into the existing signature-based NDN-IoT authentication scheme with the aid of MECD, which consists of an offline phase and an online phase. In the following, as MECD and gateway are co-located, we use the two terms interchangeably when presenting the communication procedures for simplicity.

II-C1 Offline phase

The offline phase is responsible for preparing the MEB quantization rule, as well as generating and registering the PHY-ID of the legitimate EDs, as shown in Fig. 2. We consider to address a legitimate EDA with IQI parameter $a_{A}$ as an example. Since the IQI of $\text{ED}_{A}$ automatically affects all transmitted RF signals, the MECD is able to extract $a_{A}$ from any received packets of $\text{ED}_{A}$ (Hello Message in the figure) or obtain $a_{A}$ through the relaying of CH. Then, MECD can input $a_{A}$ into the proposed MEB quantizer to generate $q(\hat{a}_{A})$ and $\text{PHY-ID}_{A}$ of $\text{ED}_{A}$ and send $\text{PHY-ID}_{A}$, two primitive numbers $P$ and $G$, and $MAC[\text{PHY-ID}_{A},P,G]$ back to EDA, where $MAC[\cdots]$ denotes the hashed-message authentication code (MAC) and $q(\cdot)$ is a quantization function defined as

[TABLE]

where $M$ denotes the number of quantization levels. We define $\text{PHY-ID}\triangleq hash(a_{[m]})$, where $hash(\cdot)$ denotes the hash function. After that, EDA and MECD need to establish a shared session key ($k_{\text{ED}_{A}-MECD}$), for example, using Diffie-Hellman key exchange in our case. Note that if $k_{\text{ED}_{A}-MECD}$ is generated using a technique other than Diffie-Hellman key exchange, then $P$ and $G$ do not need to be included in the “Hello Message”. EDA and MECD can exchange $[\text{PHY-ID}_{A}]_{k_{\text{ED}_{A}-\text{MECD}}}$ to confirm whether the same $k_{\text{ED}_{A}-\text{MECD}}$ and PHY-IDA are shared through the “Finished Message”, where $[\cdots]_{k}$ denotes the message encrypted by $k$. Finally, MECD registers $(a_{A},q(a_{A}))_{\text{PHY-ID}_{A}}$ in the whitelist as legitimate and creates a mapping relationship between PHY-IDA and EDA’s name prefix like “/ndn/ucla/…/sensor/A/voltage/….”, where /sensor/A/voltage denotes the voltage data of EDA. Thereafter, EDA needs to add this registered PHY-IDA to the frame header of its medium access control layer when preparing the data packets if EDA requires the help of the MECD for signature delegation.

We assume that MECD knows $\theta_{m}$ and $\alpha_{m}$ when determining the MEB quantization rule and that all devices are capable of completing the key exchange and enough times of hashed-MAC. The public key of MECD/gateway can be obtained from an authorized manager by any entity who needs to verify its signature. It is also assumed that all devices are trusted during the offline preparation. The authentication and confidentiality orientated encryptions are used to secure the communication between MECD and CH if a direct link between the ED and MECD does not exist.

II-C2 Online phase

In the online phase, we consider that an IoT $\text{ED}_{B}$ claiming PHY-IDA tries to send the unsigned NDN-IoT data packets to the MECD, as shown in Fig. 3. After exchanging the signing request and ACK messages, EDB can verify MECD’s signature in the ACK and sends unsigned NDN data packets to MECD. The MECD can obtain $a_{B}$, which is physically associated with the RF of the current $\text{ED}_{B}$ and, thus, can examine the claimed PHY-IDA using our two-step authentication (presented in Section V). If authentication fails, the unsigned NDN data packets are rejected. If the identity is verified, MECD can confirm that the unsigned packets are truly sent by the legitimate $\text{ED}_{A}=\text{ED}_{B}$, obtain the signing key $SK_{\text{ED}_{A}}$ in the form of $[SK_{\text{ED}_{A}}]_{k_{\text{ED}_{A}-MECD}},MAC[[SK_{\text{ED}_{A}}]_{k_{\text{ED}_{A}-MECD}}]$, execute the costly signing task on behalf of the validated $\text{ED}_{B}$ and cache the signed data packet in the content store (CS) of an NDN node. At the other end, the NDN router may receive the consumer’s interest packet and check CS for an interest-name match. If a match is found, the interest request can be satisfied by feeding the cached contents to the consumer. If one is not found, pending interest table (PIT) lookup could be performed to see if a previous unsatisfied interest with the same name is still pending. Only if a PIT entry does not exist, the interest is forwarded according to the forwarding information base, and a new PIT entry is created.

II-C3 Assumptions

It is assumed that IQI estimation is mandatory at the signal receiver (MECD/CH), for example, using [37, 38, 34, 39]. Therefore, MECD can process the readily available $\hat{a}$ in both the offline and online phases. The noise term $n_{a}$ in (2) can be ignored in offline registration. The hardware-level $a$ can be stable as a constant during a period that is much longer than a regular authentication session, and thus $n_{a}$ can be remarkably eliminated based on increasingly many samples of $\hat{a}$, e.g., using diversity combining techniques. However, this $n_{a}$ is not negligible in a specific online authentication test due to insufficient samples of this ED’s $\hat{a}$. All devices cannot be physically captured/broken without triggering any alarm, and the cooperative MECD/CH are always trusted. This study focuses mainly on the perspective of authenticating the data producer ED. Notably, our method can also be applied to the data consumer since the RF parameters can also be extracted from the NDN interest packet if it is transmitted by the wireless node-based consumer. Since signing the interest packet is not mandatory in NDN, the consumer-related authentication issues are not discussed. In addition to the authentication, we suppose that the data integrity and confidentiality are protected by the hash-based encryption and the session key-based encryption, respectively, and therefore, we do not discuss them in this paper.

In the next sections, we present several key techniques according to the order of process flow, including the MEB-based PHY-ID generation (Section III), the seamless integration of PHY-ID into the NDN-IoT signature (Section IV), and the online two-step authentication (Section V). Finally, we combine them into an algorithm in Section VI.

III Offline MEB Quantization Rules

In this section, we derive the MEB quantization rule for PHY-ID generation. Given the probability density functions (PDFs) of $\theta$ and $\alpha$, the EDs’ parameters $a$ are random variables with a specific PDF, $f_{A}(\cdot)$. In the case of nonuniform distribution, the distribution of $a$ can be denser in some quantization intervals, implying a higher probability for different $a$ to appear in these intervals. This could result in deteriorated decision accuracy in testing $q(a_{A})$ and $q(a_{B})$. Thus, it is important to consider the PDF of $a$ in designing the quantizer.

Generally, the Shannon entropy of $a_{[m]}$ can be given by

[TABLE]

where $\tilde{f}_{A}(a_{[m]})$ denotes the probability mass function of $a_{[m]}$.

Lemma 1

In the authentication context, the minimization of $\tilde{f}_{A}(a_{[m]}),m=1,2,\cdots,M,$ leads to the maximized distinguishability of $a_{[m]}$ and PHY-IDs.

As the measurement of randomness, $\max(H)$ can be interpreted as the maximized randomness of the possible $a_{[m]}/$PHY-IDs. For the purpose of distinguishing EDs, it is expected that different EDs’ IQI parameters can be quantized into different PHY-IDs with the maximized probability given $f_{A}(\cdot)$. Since $\tilde{f}_{A}(a_{[m]})>0$, $\max(H)$ can be obtained by minimizing all $\tilde{f}_{A}(a_{[m]})$ based on (4).

Theorem 1

Based on Lemma 1, the MEB quantizer can be obtained by making the quantization boundaries $b_{m},\ m=0,1,\cdots,M-1$, satisfy

[TABLE]

where $a\in[a_{\text{min}},a_{\text{max}}]$ and $F_{a}(\cdot)$ denotes the antiderivative function of $f_{A}(\cdot)$.

Proof: See Appendix A.

However, the challenge of using (7) is that $a$ could have different representations due to the diversity of IQI estimation techniques. Generally, the representation of $a$ can be classified into two cases.

• •

Case 1: Ideally, $\theta$ and $\alpha$ can be directly estimated, implying $a=\theta$ or $a=\alpha$ [37].

• •

Case 2: In most practical cases, $a$ is a function of $\theta$ and $\alpha$, implying $a=f(\theta,\alpha)$ [38, 34, 39].

Using Theorem 1, the MECD can prepare the MEB quantization rules offline for the two cases as follows.

III-A Offline MEB Quantization Rule for Case 1 $(a=\theta$ or $\alpha)$

Since $a$ is either $\theta$ or $\alpha$ in Case 1, we obtain $a\sim U(a_{\text{min}},a_{\text{max}})$, where $-a_{\text{min}}=a_{\text{max}}>0$. Hence, $a$ is zero mean, variance $\sigma_{a}^{2}=\frac{a_{\text{max}}^{2}}{3}$, and $f_{A}(x)=\frac{1}{2a_{\text{max}}},x\in[-a_{\text{max}},a_{\text{max}}]$. For uniformly distributed input $a$, only a uniform quantizer can satisfy (7); thus, the decision boundary of an interval is

[TABLE]

III-B Offline MEB Quantization Rule for Case 2 $\left(a=f(\theta,\alpha)\right)$

Without loss of generality, we express $a$ in this case as

[TABLE]

where $g_{1}(\theta)$ is a function of $\theta$, $g_{2}(\alpha)$ is a function of $\alpha$, and $c$ is a constant. We use $g_{1}$ and $g_{2}$ in the following for simplicity.

Theorem 2

Given the independent random variables $\alpha$ and $\theta$ and $g_{1}\in[g_{\text{min}1}g_{\text{max}1}]$ and $g_{2}\in[g_{\text{min}2},g_{\text{max}2}]$, an ED’s IQI parameter $a$ with the expression of (9) has the PDF $f_{A}(x)$, which can be derived as follows.

If $g_{\text{min}1}g_{\text{max}2}<g_{\text{max}1}g_{\text{min}2}$,

[TABLE]

if $g_{\text{min}1}g_{\text{max}2}>g_{\text{max}1}g_{\text{min}2}$,

[TABLE]

if $g_{\text{min}1}g_{\text{max}2}=g_{\text{max}1}g_{\text{min}2}$,

[TABLE]

where

[TABLE]

where $f_{G_{1}}(x)$ and $f_{G_{2}}(x)$ are the PDFs of $g_{1}$ and $g_{2}$, respectively, $\bm{\kappa}_{t}=[g/g_{\text{min2}},\,g/g_{\text{min2}},\,g_{\text{max1}},\,g_{\text{max1}}]$, and $\bm{\kappa}_{b}=[g_{\text{min1}},\,g/g_{\text{max2}},\,g/g_{\text{max2}},\,g_{\text{min1}}]$.

Proof: See Appendix B.

Let $F_{\tau_{1}}$, $F_{\tau_{2}}$, $F_{\tau_{3}}$, and $F_{\tau_{4}}$ represent the antiderivative functions of $\tau_{1}(x-c)$, $\tau_{2}(x-c)$, $\tau_{3}(x-c)$ and $\tau_{4}(x-c)$, respectively, $b_{0}=a_{\text{min}}$, $G_{1}=g_{\text{min}1}g_{\text{max}2}$, $G_{2}=g_{\text{max}1}g_{\text{min}2}$, and $G_{3}=g_{\text{max}1}g_{\text{max}2}$. Using Theorem 1, MECD can obtain the MEB boundaries for eq. (13) as

[TABLE]

The MEB boundaries for eq. (17) can be given by

[TABLE]

The MEB boundaries for eq. (20) can be given by

[TABLE]

Based on the derivations above, the MEB quantization rule can be determined using Algorithm 1.

Case study: We present a case study to show how to practically apply our general Algorithm 1. We consider $a=\frac{1}{2}+\frac{1}{2}(1+\alpha)\cos\theta$ since this representative $a$ can be available in most IQI estimation methods. For example, study [38] can produce $\eta_{t}=\frac{1-u_{\text{}}}{u_{\text{}}}$, where $\Re(u)=a$. Studies [34] and [39] can produce $k_{1},k_{2},k_{3}$, and $k_{4}$, and the same $\eta_{t}$ can be obtained by $\eta_{t}=\frac{k_{3}}{k_{1}}$. Through some manipulations, we can obtain $a=\frac{1}{\Re(\eta_{t}+1)}$.

Fig. 4 compares the simulation and analytical density of this $a$, where (a), (b), and (c) can correspond to eq. (13), (17), and (20), respectively. Regarding the analytical results, we first make $g_{1}=\frac{1}{2}(1+\alpha)$, $g_{2}=\cos\theta$, $c=\frac{1}{2}$ using (9) so that $f_{G_{1}}(x)$ and $f_{G_{2}}(x)$ can be given by

[TABLE]

Substituting (III-B) into (13), (17), and (20), $f_{A}(x)$ of the three cases can be obtained by comparing $(1+\alpha_{m})\cos\theta_{m}$ and $1-\alpha_{m}$, and $\tau_{1}(x)$, $\tau_{2}(x)$, $\tau_{3}(x)$, and $\tau_{4}(x)$ become

[TABLE]

[TABLE]

The segmented functions $\tau_{1}$, $\tau_{2}$, $\tau_{3}$, and $\tau_{4}$ represent the analytical results in Fig.4. Regarding the simulation results, we randomly generate $10^{5}$ samples of $\theta$ and $\alpha$ according to their PDFs, and plot the corresponding PDF of $a$ statistically. As expected, the analytical and simulation results closely match, which validates our derivations in Theorem 2.

We take the case of $(1+\alpha_{m})\cos\theta_{m}<1-\alpha_{m}$ as an example. In practical offline preparations, MECD can use Algorithm 1 to obtain $g_{1}(\alpha)=\frac{1}{2}(1+\alpha)$, $g_{2}(\theta)=\cos\theta$, $c=\frac{1}{2}$ using (9), calculate $f_{A}(x)$ using (13) (52) (53) (54), and finally determine the MEB boundaries by substituting $f_{A}(x)$ into (32).

IV Integration of PHY-ID Into The NDN-IoT Signature Scheme

In this section, we consider the offline preparation has been completed, and EDA’s PHY-IDA has been generated using our MEB quantization and registered by MECD. Fig. 5 illustrates our NDN signature scheme. Both the NDN data packet and certificate packet have the same format, which consists of the Name, Content, Signature Value and KeyLocator fields. The primary purpose of Name is to facilitate the name-indexed content identification and routing. To this end, application-driven NDN can define the hierarchical structure Name, e.g., /ndn/ucla.edu/building/melnitz/studio/1/data/sensor/J/voltage /$<$timestamp$>$[6], where the segment sensor/J can denote EDA at the network layer. The Signature Value is the result of signing on the Content, which requires asymmetric encryption. The name of the signing key is put in KeyLocator so that the verifier can retrieve the public key in the same manner as it can retrieve the signed data packet for signature verification.

We consider that $\text{ED}_{B}$ is claiming PHY-IDA in the medium access control layer frame header of the unsigned NDN data packets to the MECD. As shown in the figure, the NDN data packet leaves Signature Value empty. Since the actual IQI of $\text{ED}_{B}$ inevitably affects all unsigned packets at physical layer, the MECD is able to obtain the EDB-specific $a_{B}$ and generate $\mathcal{B}=(a_{B},q(a_{B}))_{\text{PHY-ID}_{B}}$. MECD can extract the claimed $\text{PHY-ID}_{A}$ and check if it can be mapped to the name “…sensor/J…” that falls in its name prefix. If correct, MECD can use $\text{PHY-ID}_{A}$ as an index to find the registered $\mathcal{A}=(a_{A},q(a_{A}))_{\text{PHY-ID}_{A}}$, and the identity of $\text{ED}_{B}$ can be verified by comparing $\mathcal{A}$ and $\mathcal{B}$ using our two-step authentication method. In brief, if $q(a_{A})\neq q(a_{B})$, it means the claimed $\text{PHY-ID}_{A}$ does not belong to this EDB, and thus MECD should reject the NDN data packet of EDB. If $q(a_{A})=q(a_{B})$, MECD will further compare $a_{A}$ and $a_{B}$. If they are identical, MECD can start to sign on every data packet on behalf of the validated EDA. Otherwise, MECD rejects EDB. In NDN, the name in KeyLocator of the signed data packet could point to a certificate for retrieving the public key. The certificate can be linked to the next one until it finally reaches the pre-agreed trust anchor. The multiple retrieved keys between the unsigned data packet and the trust anchor form a trust chain to protect the authentication scheme [23].

V Online Two-Step Authentication

This section presents the accurate online two-step authentication technique in the scenario that a large number of EDs are densely deployed. We consider that an EDB ($\text{ED}_{B}\neq\text{ED}_{A}$) moves to the coverage of the MECD and claims PHY-IDA. As aforementioned, MECD can obtain $(\hat{a}_{B},q(\hat{a}_{B}))_{\text{PHY-ID}_{A}}$ from EDB’s packets and find $(a_{A},q(a_{A}))_{\text{PHY-ID}_{A}}$ from the whitelist.

In step 1, we directly compare $q(\hat{a}_{B})$ with the registered $q(a_{A})$. Since our MEB quantization minimizes the probability of two IQI parameters falling into the same quantization interval, $q(a_{A})\neq q(\hat{a}_{B})$ can be produced in most cases. However, if $a_{A}$ and $a_{B}$ are very close, it is possible to obtain $q(a_{A})=q(\hat{a}_{B})$. The chance of encountering this problem can increase when a large number of EDs are involved. To resolve this problem, we further propose another virtual boundary, $b_{v}$, for the step 2 examination.

In step 2, this problem can be mathematically formulated as $a_{A}\neq a_{B}$, but $q(a_{A})$ and $q(a_{B})$ fall in the interval $[b_{m},b_{m+1}]$. We assume $a_{A}$ and $a_{B}$ have been registered so that MECD knows $a_{A}$ and $a_{B}$. Note that the assumption of known $a_{B}$ can be relaxed without changing the authentication performance, as will be discussed later. For presentation simplicity, we set that ${\hat{a}}_{x}={a}_{x}+{n_{a}}$ is under the step 2 test, where $x=A$ or $B$. Since the same $a_{x}$ affects all RF signals or even all subcarriers of an OFDM signal [16, 40], it is considered that $N_{s}$-independent estimation samples of $\hat{a}_{x}$ can be conveniently observed from $N_{p}$ packets. At the MECD, the offset between $a_{A}$ and the $k$-th $\hat{a}_{x[k]}$ is

[TABLE]

where $a_{\Delta}=a_{x}-a_{A}$. Based on (56), a binary hypothesis testing can be modeled by

[TABLE]

where $\mathcal{H}_{0}$ implies $a_{x}=a_{A}$, and $\mathcal{H}_{1}$ means $a_{x}=a_{B}$. Therefore, $y_{[k]}\sim\mathcal{N}(0,\sigma^{2})$ under $\mathcal{H}_{0}$ with the likelihood function $p_{Y}(y|\mathcal{H}_{0})$ and $y_{[k]}\sim\mathcal{N}(a_{\Delta},\sigma^{2})$ under $\mathcal{H}_{1}$ with the likelihood function $p_{Y}(y|\mathcal{H}_{1})$. Since $q(a_{A})=q(\hat{a}_{B})$, $a_{A}$ is extremely close to $a_{B}$, implying the difficulty in detecting the nonzero $a_{\Delta}$ under $\mathcal{H}_{1}$.

V-1 Known $\sigma^{2}$

If $\sigma^{2}$ is known, the Neyman-Pearson lemma can be used to differentiate the hypotheses since it can maximize the probability of detecting $\mathcal{H}_{1}$ given a false alarm rate [41]. The likelihood ratio test (LRT) based on $N_{s}$ samples is $\left(\frac{p_{Y}(y|\mathcal{H}_{1})}{p_{Y}(y|\mathcal{H}_{0})}\right)^{N_{s}}$, which produces

[TABLE]

where $r=\frac{a_{\Delta}^{2}}{\sigma^{2}}$ is the offset-to-noise ratio, $b_{v}$ denotes the virtual boundary for differentiating $a_{A}$ and $a_{B}$, and $L_{\text{NP}}\sim\mathcal{N}\left(r,\frac{r^{2}\sigma^{2}}{N_{s}a_{\Delta}^{2}}\right)$ under $\mathcal{H}_{1}$. If $L_{\text{NP}}>b_{v}$, $a_{A}$ and $a_{B}$ (i.e., $\mathcal{H}_{1}$) can be differentiated; otherwise, $\mathcal{H}_{0}$ is determined. Given a required false alarm rate $\rho$, the $b_{v}$ can be given by

[TABLE]

where $Q^{-1}(\cdot)$ is the inverse of the Q-function, and $\rho$ can be mathematically defined by

[TABLE]

The differentiation rate is defined by

[TABLE]

More generally, if $a_{B}$ is not registered, $a_{\Delta}$ becomes unknown. In this case, (60) can become $L_{\text{NP}}=\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}y_{[k]}$ and (61) can become $b_{v}=\frac{\sigma}{\sqrt{N_{s}}}Q^{-1}(\rho)$. As a result, the differentiation performance remains unchanged since the new $L_{\text{NP}}$ and $b_{v}$ can result in the same $r_{\text{D}}$ in (63).

V-2 Unknown $\sigma^{2}$

In practice, the variance of the estimation noise is not always available. If $\sigma^{2}$ is unknown, we can use the generalized LRT (GLRT) to process the offset samples $y_{[k]}$. In this case, the GLRT-based hypothesis decision can be made by

[TABLE]

where the PDF of $L_{\text{GLRT}}$ is

[TABLE]

where $F$ and $F^{\prime}$ denote central/non-central Fisher–Snedecor distributions ($F$-distribution). Please see Appendix C for the proofs of (64) and (67).

Let $F_{L_{\text{GLRT}}}(x|\mathcal{H}_{0}/\mathcal{H}_{1})$ denote the cumulative distribution function of $L_{\text{GLRT}}$, the required $\rho$ equals

[TABLE]

where $I_{x}(d_{1},d_{2})$ is the regularized incomplete beta function. Given that $d_{1}$ and $d_{2}$ are positive integers in our case, $I_{x}(d_{1},d_{2})$ can be calculated by

[TABLE]

Therefore, $b_{v}$ can be obtained by solving (V-2). Consequently, both $L_{\text{GLRT}}$ and $b_{v}$ are independent of the unknown $\sigma^{2}$.

$r_{\text{D}}$ can be mathematically computed by

[TABLE]

Since (V-2) cannot be used directly for numerical computations, we give its approximation in (V-2) according to [42].

Once $a_{A}$ and $a_{B}$ are successfully differentiated using either (60) or (64), the MECD can adjust $\text{PHY-ID}_{A}$ and $\text{PHY-ID}_{B}$. For example, $\text{PHY-ID}_{A}$ remains unchanged, whereas $\text{PHY-ID}_{B}=hash(q(a_{B})+\epsilon)$, where $\epsilon$ is a user-defined number for guaranteeing $\text{PHY-ID}_{A}\neq\text{PHY-ID}_{B}$. In addition, one can impose a new boundary $\widetilde{b}=\frac{a_{A}+a_{B}}{2}$ to divide $a_{A}$ and $a_{B}$ into two different intervals as $a_{A}\in[b_{m},\widetilde{b}]$ and $a_{B}\in[\widetilde{b},b_{m+1}]$. In doing so, if $a_{B}$ appears again, the step 2 test can be avoided since $a_{B}$ can be differentiated from $a_{A}$ by the step 1 test. Additionally, the $H$ in bits after the insertion of $\widetilde{b}$ becomes

[TABLE]

where $C=\frac{1}{\int_{b_{m}}^{\frac{a_{B}+a_{A}}{2}}f_{A}(x)\text{d}x}$ and $D=\frac{1}{\int_{\frac{a_{A}+a_{B}}{2}}^{b_{m+1}}f_{A}(x)\text{d}x}$.

VI Signing Task Offloading Algorithm

It is considered that $\text{ED}_{B}$ has been authenticated as $\text{ED}_{A}$ using the method presented in the previous section. Then, the MECD can start to offload the signing task from the verified EDA.

The signing task can be summarized as follows: $\text{ED}_{A}$ has $N_{p}$ unsigned NDN data packets that need to be signed and published to NDN. MECD can consider its own available time to decide to undertake $N_{p1}$ out of the $N_{p}$ packets and leave $N_{p2}=N_{p}-N_{p1}$ packets to EDA. We assume that the computational workload of signing each packet is $B_{s}$ (in the number of bits), and the signing of all $N_{p}$ packets should be completed before the deadline $T$. However, the MECD is considered to be available only for the duration $\phi T$, where $0<\phi<1$. $f_{\text{MEC}}$ and $f_{\text{ED}}$ are the fixed CPU-cycle frequency per second of MECD and $\text{ED}_{A}$, respectively, and $C_{b}$ is the number of CPU cycles required for computing 1 bit of the input task. Since all signed NDN data packets need to be published to NDN through gateway/MECD regardless of whether the offloading is performed or not, there is no need to consider the time cost for additional task uploading/downloading between the MECD and EDA. The time difference between EDA and MECD for completing the signing of the same $N_{P}$ packets is given by

[TABLE]

Recall the online phase procedure (Fig.3). EDA sends the signing request to MECD. Then, MECD considers the partitioning of the signing task in the packet granularity and replies that the first $N_{p1}$ unsigned packets can be sent. It is assumed that the MECD can complete the signing encryption of $N_{p1}$ packets in time $t_{1}$ and that EDA can complete up to $N_{p2}$ packets within $t_{2}$. This procedure can be mathematically summarized as a minimax problem as

[TABLE]

Ideally, setting $t_{1}=t_{2}$ can achieve the shortest time. If the calculated $N_{p1}$ and $N_{p2}$ are not integers, we intentionally use $\lceil N_{p1}\rceil$ and $\lfloor N_{p2}\rfloor$ since $\frac{B_{s}C_{b}}{f_{\text{ED}}}>\frac{B_{s}C_{b}}{f_{\text{MEC}}}$.

Although the MECD can help complete the signing task efficiently, it may introduce the single-point-of-failure problem into the system as the MECD may become out of service. To avoid this, the use of MECD for task offloading is optional in our system, and the MECD will accept ED’s signing request only when the MECD is available, as shown in the online procedures.

Finally, the whole signing task offloading procedures with our offline MEB preparations and online authentication are summarized in Algorithm 2.

VII Performance Evaluation

In this system evaluation section, we first show the performance improvements in terms of the authentication accuracy and authentication time efficiency. Then, we analyze the robustness performance in defending against several malicious impersonation attacks.

VII-A Numerical Results

We consider the OFDM communication between IoT EDs and MECD. The QPSK modulated signal with $512$ sub-carriers is used when preparing every NDN data packet. The transmitted signal is affected by the ED-specific IQI parameters, passes through the multi-path channel, and finally arrives at the MECD, as shown in eq. (II-A). We consider that the circulant channel matrix $\mathbf{H}$ with the first column formed by an L × 1 channel impulse response vector $\mathbf{h}=[h_{(1)},h_{(2)},\cdots,h_{(L)}]^{T}$, where the length $L=8$. The elements of $\mathbf{h}$ are i.i.d. complex circularly symmetric Gaussian random variables as $\mathbf{h}\sim\mathcal{CN}(\mathbf{0},2\mathbf{I}_{L})$. Regarding the IQI parameters, $\theta\sim U(-\theta_{m},\theta_{m})$, $\alpha\sim U(-\alpha_{m},\alpha_{m})$, where $\theta_{m}=\frac{5\pi}{36}$, $\alpha_{m}=0.04$ if not otherwise specified. We consider $a=\frac{1}{2}+\frac{1}{2}(1+\alpha)\cos\theta$ as used earlier in the example study for the offline quantization rule preparation and use [30] to obtain the estimated $\hat{a}$ in the online test phase; the other variables, such as $N_{p}$, $N_{s}$, $M$, and $r$, will be given later in each specific evaluation figure.

Fig. 6 shows the offline MEB quantization boundaries derived by Algorithm 1 with the comparison of the two other methods, which are named uniform and random. To be specific, the widths of all $M$ quantization intervals are the same regardless of the PDF of $a$ in the uniform method [30]. In the random method, all boundaries are randomly picked within $[a_{\text{min}},a_{\text{max}}]$. It is observed that the MEB boundary value grows faster than those of the other two compared methods. This result occurs because the density of $a$ at the beginning is low, as shown in Fig. 4 (a), resulting in wider intervals for determining the first several $b_{m}$. However, the width of our MEB quantization intervals narrows as the density increases.

The $r_{\text{D}}$ and the corresponding virtual boundary $b_{v}$ of our online step 2 test are evaluated in Fig. 7 and Fig. 8, respectively. In this simulation, we choose two close IQI parameters, $a_{A}=1.00166$ and $a_{B}=1.00177$, indicating that $a_{\Delta}=a_{A}-a_{B}$ is equal to only $0.011\%\times a_{A}$. It is challenging to handle this small $a_{\Delta}$ by the step 1 test since this likely results in $q(a_{A})=q(a_{B})$, and thus, the step 2 test is needed. It shows that $r_{\text{D}}$ of both known/unknown $\sigma^{2}$ cases keep growing with increasing $r$ and $\rho$. This increase occurs because for a fixed $r$, a larger $\rho$ could lead to a smaller $b_{v}$, as shown in Fig. 8 (a) and (b). However, $L_{\text{NP}}$ is monotonically increasing with respect to $r$ based on eq. (60), and $L_{\text{GLRT}}$ is independent of $r$ based on (64). Fig.8 also shows that $b_{v}$ of case (b) is independent of $r$ compared to $b_{v}$ of case (a) since $r$ becomes the unknown in case (b).

After the separate evaluations of the proposed MEB quantization and the online test above, we combine them to evaluate the authentication accuracy performance by executing Algorithm 2. To thoroughly test the accuracy in the large number of IoT EDs, we randomly create up to 2000 IoT EDs with different IQI values and register them as the legitimate devices in the offline phase. In each round of the online authentication test, we either randomly generate an attacker or pick up a legitimate one from 2000 IoT EDs. It is further considered that the attacker is sufficiently sophisticated to claim a legitimate PHY-ID and that the attacker’s IQI parameter, $a_{ATTK}$, is different from any of the legitimate ones. After the examination of all EDs one by one, we show the correct authentication probability (CAP) in Fig. 9, where the CAP is defined as the number of correct authentication decisions made by Algorithm 2 divided by the total authentication attempts. In the step 1 test, CAP of our MEB method outperforms those of the uniform and random methods, which demonstrates the accuracy improvement gained by using our MEB quantizer. The CAP of our MEB (step 1 test) is consistently larger than 95% when the number of tested IoT EDs grows from 0 to 200. However, more IoT EDs can lead to a higher probability of a failed step 1 test, which results in decreased CAPs when a large number of EDs appear. In this case, our step 2 test can further elevate the CAP as shown by the curves of MEB steps 1&2 under both known/unknown $\sigma^{2}$.

According to Algorithm 2, the MECD could offload the signing task only if our online two-step test authenticates the ED. Next, we evaluate the time efficiency improvement by the signing task offloading given by (73), (74), (75), and (76). Three different types of devices are considered to serve as either an IoT ED or an MECD. Specifically, we use the Texas Instrument Zigbee cc2430 node with a 32 MHz processor, which is commonly used for deploying IoT-based IEEE 802.15.4 wireless sensor networks. This device serves as the constrained ED. A Raspberry Pi 3 model-B with a 1.2 GHz CPU and a laptop with a 2.4 GHz CPU serve as MECDP and MECDL, respectively. To compare the time efficiency, the same RSA and ECC signing algorithm is run by the three devices to obtain the fixed $\xi=\frac{B_{s}C_{b}}{f_{\text{ED/MEC}}}$ for each device. We assume that all NDN-IoT data packets’ contents have been hashed to get the fixed-length digests, and thus the same $\xi$ is spent in signing on the digest for every NDN-IoT data packet. We show the time $N_{p}\xi$ needed by each type of device to complete the $N_{p}$ NDN-IoT packets’ signings in Fig. 10, where $\phi=1,0.3$ and $0.025$, respectively, indicate that 100%, 30%, and 2.5% of the evaluation time of MECDL/P is available for the signing task offloading. The optimal execution time of using (73) is shown by MECDL/P-ED (optim.). In Figs. 10 (a) (b) (d) and (e), the execution time is reduced significantly since all $N_{p}$ packets are signed by either MECDL or MECDP instead of the constrained ED. In Fig. 10 (c) and (f), the extremely busy MECDL/P ($\phi=0.025$) is not able to undertake all $N_{p}$ signings, and as a result the curves of MECDL/P become close to the curve of the IoT ED. In this case, our optimization offloading method can further reduce the execution time compared to letting either the MECDL/P or the IoT ED complete all tasks alone.

VII-B Analysis of the Robustness Enhancement

In this subsection, we analyze the robustness improvement gained through integrating the PHY-ID into the MEC-enabled NDN-IoT networks. It is considered that an attacker (ATTK) is trying to impersonate the legitimate $\text{ED}_{A}$ in order to injects his poisoned contents into NDN. This ATTK can be aware of the current pending interest for particular content or can anticipate the popular interests of consumers, and thus this ATTK is able to produce poisoned content under the popular name prefix and sign contents using the compromised key. Hence, once MECD/gateway is fooled, the poisoned content will be cached at NDN, and furthermore, copies of the poisoned content can be forwarded to any consumer with matched interests without triggering any alarm since the signature of ATTK is valid.

Attack 1: It is assumed that an ATTK can act as the man-in-the-middle between EDA and MECD but does not know the authentication scheme. ATTK can passively eavesdrop on all NDN-IoT packets that are transmitted by the legitimate $\text{ED}_{A}$ without being detected. To mimic EDA, this ATTK can send the intercepted packets to the MECD without any content modification (i.e., replay attacking). However, the device-specific IQI parameter, $a_{ATTK}$, that is associated with ATTK’s RF hardware can inevitably affect the replayed packet. In our method, MECD can stealthily extract $a_{ATTK}$ from the replayed packets and generate $(\hat{a}_{ATTK},q(\hat{a}_{ATTK}))_{\text{PHY-ID}_{ATTK}}$ rather than actively requesting that any pre-agreed secret be embedded into the NDN packet for authentication. Through checking the registered $(a_{A},q(a_{A}))$, MECD can find $(\hat{a}_{ATTK},q(\hat{a}_{ATTK}))\neq(a_{A},q(a_{A}))$ and detect the presence of the ATTK since the ATTK’s amplitude mismatch and phase-shift mismatch cannot be simultaneously the same as those of $\text{ED}_{A}$. Consequently, our method is secure against the replay attacks.

Attack 2: It is considered that, occasionally, ATTK’s ${a}_{ATTK}$ is similar to ${a}_{A}$, which may challenge our authentication scheme if $q(a_{A})=q(\hat{a}_{ATTK})$. Our offline/online phases are designed with a full consideration of this potential risk. At first, our offline MEB quantization technique ensures that ${a}_{ATTK}$ and ${a}_{A}$ can be quantized into different intervals with maximized probability. Then, as demonstrated in Fig. 9, our two-step authentication technique can accurately differentiate ${a}_{ATTK}$ and ${a}_{A}$ even if $q(a_{A})=q(\hat{a}_{ATTK})$. In addition, motivated by the MAMO technique [16], we find that exploiting more RF features, such as the carrier frequency offset (CFO), can further prevent this risk for two reasons: 1) taking more RF features into account can likely lead to sufficiently different ${a}_{ATTK}$ and ${a}_{A}$, and 2) our method that already uses two features (i.e., $\alpha$ and $\theta$) can be extended to incorporate more RF features. Taking the CFO as an example, we assume that (9) becomes $a=xg_{3}(\psi)+c$, where $x=g_{1}(\alpha)g_{2}(\theta)$ and $\psi$ is the CFO parameter. After obtaining the PDF of $x$ using (21), $xg_{3}(\psi)+c$ can be processed as in the case of two features by implementing Algorithm 1. Consequently, using our offline MEB quantization technique, online two-step authentication technique, and this potential MAMO technique together can make the NDN-IoT network robust to this kind of ATTK.

Attack 3: We assume that the ATTK with strong computing power can compromise the signing key of EDA, decipher our MEB quantization rule, and spoof and claim the legitimate $\text{PHY-ID}_{A}$ to the MECD. In this case, ATTK can be authenticated as legitimate by the traditional encryption-based authentication method since the signature can be created by ATTK using the compromised signing key of EDA. In our method, the claimed $\text{PHY-ID}_{A}$ is not directly trusted by MECD but is used only as an index to find the registered $a_{A}$. In fact, MECD generates the $a_{ATTK}$ via physical-layer RF analysis. As long as $a_{A}\neq a_{ATTK}$, MECD can prevent ATTK with a high CAP and thereby refuse to send the poisoned contents to the NDN. If the claimed PHY-ID cannot point to a registered $a_{A}$, this ATTK’s packets will be immediately rejected. As a result, our MEC-enabled NDN-IoT network is secure against this computation-based PHY-ID spoofing attack.

In summary, Fig. 6, Fig. 7, and Fig. 8 validate the proposed MEB quantization technique and the two-step authentication technique. Fig. 9 demonstrates the high authentication accuracy in the case of a large number of EDs. Fig. 10 demonstrates the time efficiency enhancement using our signing task offloading. Finally, the analysis in Section VII-B demonstrates the stronger robustness of our method gained by integrating the PHY-ID into the MEC-enabled NDN-IoT networks.

VIII Conclusion

This paper investigated a design that integrates the PHY fingerprinting into the NDN signature scheme for the MEC-enabled NDN-IoT networks. With the aid of an MECD, the device-specific PHY-ID associated with the RF hardware of an IoT device can be generated using the proposed MEB quantization technique. This PHY-ID is then seamlessly integrated into the NDN signature with limited computational complexity imposed on the resource-constrained IoT devices. As a result, the MECD can examine IoT devices using our two-step authentication method and offload the signing task from the authenticated IoT device in an optimal manner. The evaluation results show that the MEC-enabled NDN-IoT networks can be improved in terms of the authentication accuracy, time efficiency, and robustness.

Appendix A Proof for Theorem 1

Given $M$ quantization levels, the entropy $H$ can be maximized as

[TABLE]

[TABLE]

where $\mathbf{b}=[b_{0},b_{1},\cdots,b_{M}]$. In fact, $\tilde{f}_{A}(a_{[m]})$ is dependent on $[a_{\text{min}},a_{\text{max}}]$, $f_{A}(x)$, and $b_{m}$ in (3), but only $b_{m}$ can be adjusted to maximize $H$. Setting the Lagrange multiplier variables as $\lambda$, (77) can be solved by

[TABLE]

Since every $\tilde{f}_{A}(a_{[m]})$ is only dependent on $\lambda$ and $\sum_{m=1}^{M}\tilde{f}_{A}(a_{[m]})=1$, we can conclude that $H$ can be maximized by setting $\tilde{f}_{A}(a_{[m]})=F_{a}(b_{m+1})-F_{a}(b_{m})=\frac{1}{M}$ and $b_{0}=a_{\text{min}}$, which yields (7).

Appendix B Proof for Theorem 2

Using (9), the key point of deriving $f_{A}(\cdot)$ becomes how to figure out the distribution of the product of $g_{1}$ and $g_{2}$. Note that the $\alpha$-related $g_{1}$ and the $\theta$-related $g_{2}$ are independent of each other. We define a transformation $\mathbb{G}_{1}=\{(g_{1},g_{2})|g_{\text{min1}}<g_{1}<g_{\text{max1}},g_{\text{min2}}<g_{2}<g_{\text{max2}}\}\to\mathbb{G}_{2}=\{(x,g)|g_{\text{min1}}<x<g_{\text{max1}},xg_{\text{min2}}<g<xg_{\text{max2}}\}$ as

[TABLE]

Therefore, the inverse transformation function can be given by

[TABLE]

and the Jacobian of $\mathbf{f}(x,g)$ is

[TABLE]

The PDF of $g_{1}g_{2}$ can be computed based on the joint PDF of $X$ and $G$, $(x,g)\in\mathbb{G}_{2}$, as

[TABLE]

where $D$ is the region $[g_{\text{min1}},g_{\text{max1}}]$ with appropriate sub-intervals as shown in (21). Finally, replacing $x$ with $x-c$ in (B) can yield the eq. (13), (17) and (20) in Theorem 2.

Appendix C Proof for Eq. (64) and (67)

Without loss of generality, let $\mathbf{y}=[y_{[1]},y_{[2]},\cdots,y_{[N_{s}]}]^{T}$, and (56) can be rewritten as $\mathbf{y}=\mathbf{H}_{0}\mathbf{a}_{\Delta}+\mathbf{n}_{a}$, where $\mathbf{H}_{0}$ is the $N_{s}\times p$ matrix of rank $p$, $\mathbf{a}_{\Delta}$ is a $p\times 1$ offset vector, and $\mathbf{n}_{a}$ is the $N_{s}\times 1$ noise vector with PDF $\mathcal{N}(\bm{0},\sigma^{2}\mathbf{I}_{N_{s}})$. We replace $\mathbf{a}_{\Delta}$ with $\mathbf{A}\mathbf{a}_{\Delta}$ in (59), where $\mathbf{A}$ is an $r\times N_{s}$ matrix of rank $r$. Then, the GLRT of $\mathbf{y}$ with unknown $\sigma^{2}$ is [41, Eq. (9.14)]

[TABLE]

where $\bm{\hat{a}}_{\Delta}=(\mathbf{H}_{0}^{T}\mathbf{H}_{0})^{-1}\mathbf{H}_{0}^{T}\mathbf{y}$. Considering our system, $p=1,r=1,\mathbf{A}=1$ and $\mathbf{H}_{0}=[1,1,\cdots,1]^{T}$ can be substituted into (85) to decide $\mathcal{H}_{0}/\mathcal{H}_{0}$ as

[TABLE]

which confirms (64). Note that ${\hat{a}}_{\Delta}=\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}y_{[k]}$ so that $\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}y_{[k]}^{2}-\hat{a}_{\Delta}^{2}=\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}y_{[k]}^{2}-2\hat{a}_{\Delta}(\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}y_{[k]})+\hat{a}_{\Delta}^{2}=\frac{1}{N_{s}}\sum_{k=1}^{N_{s}}(y_{[k]}-\hat{a}_{\Delta})^{2}$ is used in deriving (C).

Setting $x_{1}=\mathbf{y}^{t}\mathbf{C}\mathbf{y}=(\sqrt{N_{s}}\hat{a}_{\Delta}/\sigma)^{2}$, where $\mathbf{C}=\mathbf{H}_{0}(\mathbf{H}_{0}^{T}\mathbf{H}_{0})^{-1}\mathbf{H}_{0}^{T}/\sigma^{2}$, and $x_{2}=\mathbf{y}^{T}\mathbf{B}\mathbf{y}$, where the rank of $\mathbf{B}=(\mathbf{I}_{N_{s}}-\mathbf{H}_{0}(\mathbf{H}_{0}^{T}\mathbf{H}_{0})^{-1}\mathbf{H}_{0}^{T})/\sigma^{2}$ is $N_{s}-1$, we can get $L_{\text{GLRT}}=\frac{x_{1}}{x_{2}/(N_{s}-1)}$. Since $\sqrt{x_{1}}\sim\mathcal{N}(\frac{\sqrt{N_{s}}a_{\Delta}}{\sigma},1)$, $x_{1}\sim\chi^{2}_{1}$ under $\mathcal{H}_{0}$ and $x_{1}\sim\chi^{\prime 2}_{1}(\frac{N_{s}a^{2}_{\Delta}}{\sigma^{2}})$ under $\mathcal{H}_{1}$, where $\chi^{2}_{1}$ and $\chi^{\prime 2}_{1}(\frac{N_{s}a^{2}_{\Delta}}{\sigma^{2}})$ are the central/non-central chi-square distribution with 1 degree of freedom and $\frac{N_{s}a^{2}_{\Delta}}{\sigma^{2}}$ is the noncentrality parameter. $\mathbf{B}$ is idempotent as $\mathbf{B}^{2}=\mathbf{B}$. Since $\mathbf{H}_{0}^{T}\mathbf{B}=\mathbf{B}\mathbf{H}_{0}=\bm{0}$, we obtain $x_{2}\sim\chi^{2}_{N_{s}-1}$ according to [41, Eq.(2.29)]. Since $\mathbf{C}(\mathbf{\sigma}^{2}\mathbf{I}_{N_{s}})\mathbf{B}=\bm{0}$, $x_{1}$ and $x_{2}$ are independent [43]. Given that the ratio of two independent $\chi^{2}$ random variables leads to an $F$-distributed random variable, the PDF of $L_{\text{GLRT}}$ is

[TABLE]

which confirms eq. (67).