One-to-Many Secure Notification Responses for the IoT Using CoAP and Group OSCORE

Sammanfattning

The Internet of Things (IoT) connects large numbers of resource-constrained devices— limited in processing power, memory, and energy — requiring network protocols adapted to these constraints. Traditional protocols like HTTPS are not appropriate for these devices. CoAP provides lightweight RESTful communication, while OSCORE secures CoAP messages end-to-end at the application layer, thus even in the presence of intermediaries. A common IoT pattern is resource observation, where clients receive notifications from a server whenever a monitored resource changes state. Currently, CoAP sends these notifications by individual IP-unicast delivery to each observer — even when many clients observe the same resource. Studies show that IP-multicast delivery achieves lower overhead, better scalability, and reduced latency compared to IP-unicast. This thesis investigates how CoAP can be extended to support secure one-to-many multicast notifications, where a single notification reaches all observing clients, secured end-to-end using Group OSCORE. The solution is implemented by extending the Californium CoAP library with a phantom-request-based multicast observation model and Group OSCORE integration. The evaluation compares unicast and multicast notification delivery in terms of communication overhead at the server, and validates the security properties of the proposed solution against a defined attack model. The results show that the per-notification cost at the server is constant in the number of observers for multicast (95 bytes per notification) but grows linearly for unicast (95 bytes per observer per notification). The higher per-client setup cost of multicast (321 bytes for the informative response, against 95 bytes for a unicast observe registration response) is recovered within a small number of notifications after which multicast is more efficient than unicast for any further notification. Multicast also delivers notifications more synchronously across observers, with a mean inter-client spread of 16.9 ms against 93.4 ms for unicast. Replay rejection, confidentiality, and source authentication were verified for both unicast and multicast delivery, demonstrating that secure multicast CoAP notifications are feasible and reduce communication overhead at the server without weakening the end-to-end security guarantees provided by Group OSCORE.