Publications - Pervasive Computing Laboratory

Access control anotacionsemantica authentication Cloud computing coap compromise cryptography cynamon Discovery emadrid emrisco home network I-Shaper identity management inrisco inteligenciafuentesabiertas Internet of Things IoT magos Pervasive computing Post-Quantum Cryptography privacy Protocols Qursa Ramones raudo2 Security Smart Card Trust management VANETs 
Show all
2025
 Díaz-Sánchez, Daniel;  Almenarez, Florina;  Campo, Celeste;  García-Rubio, Carlos;  Sherratt, Simon
Beyond PKI: A DNSSEC Delegation Approach for Scalable Dynamic Credential Management in IoT Journal Article 
In: IEEE Internet of Things Journal , 2025, ISSN: 2327-4662.
Abstract | Links | BibTeX | Tags: authentication, Discovery, I-Shaper, Ramones, Security, signature delegation, TLS
@article{danieldiaz031,

title = {Beyond PKI: A DNSSEC Delegation Approach for Scalable Dynamic Credential Management in IoT},

author = {Daniel Díaz-Sánchez and Florina Almenarez and Celeste Campo and Carlos García-Rubio and Simon Sherratt},

url = {https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11130501},

doi = {https://doi.org/10.1109/JIOT.2025.3600371},

issn = {2327-4662},

year  = {2025},

date = {2025-08-19},

urldate = {2025-08-19},

journal = {IEEE Internet of Things Journal },

abstract = {Internet of Things (IoT) systems that manage data across cloud, fog, and edge environments—and the devices that consume those services—face substantial challenges in confidentiality, privacy, and authentication. However, traditional Public Key Infrastructure (PKI) is too rigid and costly for massive, ephemeral IoT deployments. Moreover, device authentication is often overlooked in favor of service authentication, neglecting the security of the entire ecosystem. DNSSEC combined with DANE introduces a new paradigm in which service authentication can be managed globally, extending trust to locally generated, type-agnostic credentials. This framework can accommodate PKI certificates, self-signed credentials, and local keys, all of which can be verified by any client, local or remote. However, DNSSEC’s signature proofs grow linearly with the number of secured records, inflating communication overhead and energy consumption—an issue aggravated by the larger sizes of post-quantum signatures. Additionally, current DNSSEC delegation mechanisms lack the flexibility needed for secure load balancing and isolation. In this article, we present a collision-based DNSSEC signature-delegation mechanism designed to overcome these scalability limitations. By allowing a central DNS authority to delegate signing responsibilities to local DNS servers, our approach reduces certificate-management overhead and enables a dynamic, hierarchical trust model. It supports both service and device authentication in a unified DNS-name-based security context. Our evaluation shows that the proposed mechanism maintains a stable computational cost irrespective of credential count, a critical benefit for large-scale, resource-constrained IoT deployments. By leveraging existing DNS infrastructure and standards, this solution enhances scalability and efficiency compared to traditional PKI and DNSSEC, while promoting interoperability and ease of deployment. It also opens the adoption of future post quantum trapdoor systems still under research and development.},

keywords = {authentication, Discovery, I-Shaper, Ramones, Security, signature delegation, TLS},

pubstate = {published},

tppubtype = {article}

}

Close
Internet of Things (IoT) systems that manage data across cloud, fog, and edge environments—and the devices that consume those services—face substantial challenges in confidentiality, privacy, and authentication. However, traditional Public Key Infrastructure (PKI) is too rigid and costly for massive, ephemeral IoT deployments. Moreover, device authentication is often overlooked in favor of service authentication, neglecting the security of the entire ecosystem. DNSSEC combined with DANE introduces a new paradigm in which service authentication can be managed globally, extending trust to locally generated, type-agnostic credentials. This framework can accommodate PKI certificates, self-signed credentials, and local keys, all of which can be verified by any client, local or remote. However, DNSSEC’s signature proofs grow linearly with the number of secured records, inflating communication overhead and energy consumption—an issue aggravated by the larger sizes of post-quantum signatures. Additionally, current DNSSEC delegation mechanisms lack the flexibility needed for secure load balancing and isolation. In this article, we present a collision-based DNSSEC signature-delegation mechanism designed to overcome these scalability limitations. By allowing a central DNS authority to delegate signing responsibilities to local DNS servers, our approach reduces certificate-management overhead and enables a dynamic, hierarchical trust model. It supports both service and device authentication in a unified DNS-name-based security context. Our evaluation shows that the proposed mechanism maintains a stable computational cost irrespective of credential count, a critical benefit for large-scale, resource-constrained IoT deployments. By leveraging existing DNS infrastructure and standards, this solution enhances scalability and efficiency compared to traditional PKI and DNSSEC, while promoting interoperability and ease of deployment. It also opens the adoption of future post quantum trapdoor systems still under research and development.
Close
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11130501
doi:https://doi.org/10.1109/JIOT.2025.3600371
Close