ImCT: A Feasible Scheme for Deploying Implicit Certificates with Certificate Transparency in IoT

Data security has become a major concern in end-to-end communication of Internet of Things (IoT) devices. To establish an encrypted and trusted channel, certificate-based authentication is broadly adopted in many resource-constrained IoT environments, especially Elliptic Curve Qu-Vanstone (ECQV) implicit certificates, optimized for bandwidth and processing time compared to X.509 certificates. However, certificates in Public Key Infrastructure (PKI) inherently face the security problem that Certificate Authorities (CAs) with absolute trust might issue fraudulent certificates maliciously/unintentionally. To mitigate this problem, Certificate Transparency (CT) has been widely deployed, but it brings more transmission and validation overhead, posing new challenges for IoT devices. To inherit the advantage of implicit certificates and make CT more friendly to resource-restricted IoT systems, this paper proposes ImCT, the first feasible and efficient scheme for deploying ECQV implicit certificates with CT in IoT. It (1) offers an ingenious and compact design of certificate extension for integrating CT into implicit certificates, ensuring sufficiently small memory use and low validation cost; (2) provides a generic Bloom Filter-based solution to efficiently deploy ImCT in interactive protocols with compatibility with existing CT validation rules; (3) allows for incremental deployment and deploys to TLS 1.3 easily with only a few self-defined TLS extensions. The security of ImCT is also analyzed, and the performance evaluation shows its practicality and high efficiency.