Although continuous authentication is a relatively new type of verification, it is gaining attention of researchers and companies seeking new forms to protect sensitive data for unauthorized access [2]. Basically, continuous authentication performs an ongoing monitoring of user interactions with objects and builds a behavior or biometrics profile leveraging Machine Learning (ML) technology to re-verify the legitimacy of the connected nodes and assure cybersecurity protection.

The application of this new form of authentication is advantageous also when traditional forms of verification do not fit the appropriate level of security. Indeed, (i) single-factor authentication, which provides protection at login, and (ii) two-factor authentication, which adds a second device for security check at the login phase, do not offer continuous validation of a user’s identification.

With the aim to balance security and usability, biometric approaches are gaining momentum. Given the nature of IoT devices and their closeness to users, using them for continuous authentication purposes is specially attractive [24]. For example, smart mobile devices like smartphones and tablets are equipped with various built-in sensors like camera for iris recognition, heart-bit sensor, fingerprint scanner and microphone for voice recognition among others. But if on one hand, they are more secure, since biometric traits like iris or face are difficult to be reproduced, on another this type of authentication may provide also false positives and true negatives [25].

The authors of [26] identify two categories of biometric identification: physiological identification and behavioral one. The former includes facial, voice and fingerprint recognition, which are mostly device dependent mechanisms and require costly processing units. The latter is a form of continuous identification which is based on behavioral traits and is less intrusive, because it relies on human habitual patterns like typing [27,28], walking [29], social interactions and communication.

In [8] the authors describe WifiU, a Wi-Fi based human authentication system which recognizes users extracting unique biometrics information from Wi-Fi signals and uses it to perform human authentication. In particular, it is based on user gait. Indeed, the authors start from the consideration that, Wi-Fi signal reflected by the human body generates unique, although small, variations in wireless channel metrics on the receiver, due to the well-known multipath effect of wireless signals.

A recent trend analysed by a number of researchers deals with continuous identification of users on mobile devices within the social IoT paradigm [13,14]. In particular, in [14] the authors propose a scheme based on online behaviometrics of mobile users collected via smartphones. This scheme is able to extract features from smartphone sensors and users’ social network interactions. In [13], instead, the authors propose a mobile behaviometric framework that assesses users’ social activity, and introduce sociability metrics to generate signatures of users’ activities.

The papers cited above aim at continuously authenticating the user by exploiting his interactions with IoT devices or against third parties. With respect to these approaches, our proposals has a more extended objective. Indeed, with the aim of enabling reliable human-to-human interactions, our framework leverages some of the strategies described in this section to obtain continuous authentication of humans with their objects. Moreover, we develop an advanced mechanism to constantly verify whether the identity of an object or a human is unchanged.

Typically, we refer to remote attestation as the security service through which an object can ascertain the current state of a potentially compromised remote device before interacting with it. The aim of remote attestation is to allow a remote system (i.e., challenger) to check the level of trust of another system (i.e., attestator). In [30], the authors present a Multiple-Tier Remote Attestation protocol, called MTRA, verifying program integrity in IoT devices. In particular, more powerful devices are monitored by means of trusted hardware through a Trusted Platform Module (TPM), while less capable ones are verified leveraging a software-based attestation. Still in this context, the paper presented in [31] describes a many-to-one attestation scheme for device swarms, which reduces the possibility of single point of failure verifier typical of architectures in which a single node (i.e., the verifier) has to attest the reliability of multiple IoT devices.

Other works focusing on object-to-object interaction study a way to address the challenge of IoT device identification [8,21,22,23,32,33]. These works leverage the concept of device fingerprinting, that is a way to identify an object not relying on its classical network identities, such as IP or MAC address, but exploiting the information from the packets which the device exchanges over the network. In particular, the work presented in [21] tackles this issue by analyzing a sequence of packets from high-level network traffic and extracting from it a set of unique flow-based features to create a fingerprint for each device through machine learning techniques. The authors of [23] have the same goals, but they base their proposal on deep learning techniques. Whereas, the authors of [22] present an approach called IoT Sentinel able to automatically identifying vulnerable devices being connected to an IoT network and enforcing mitigation measures for them, so as to minimize damage resulting from their compromise. Also the proposal presented in [32] provides an IoT device identification method that models the behavior of the network packets communicated by the devices.

In the context of object-to-object interaction, a related concept is the definition of reliability and trust among things. However, due to the highly dynamic nature of the network and the large number of entities with heterogeneous computation abilities involved, it is difficult to directly apply to IoT classical approaches thought for sensor or P2P networks [16,34,35,36].

In particular, works leveraging cryptographic primitives [16,17,36] are computational demanding and they are not secure against internal malicious nodes having the valid cryptographic keys. On the other hand, nodes can be hacked or compromised, but they can also have hardware faults, and relying only on cryptographic mechanisms does not lead to the exclusion of these nodes from the network.

In [35], the authors describe an approach based on cryptographic primitives in which each entity has a unique and trustworthy identity. In addition, a trusted device evaluates the behavior and the performance of the nodes comparing a saved trust metric and the indirect information from a third node. In [37], the authors present IoTrust a trust architecture with a middleware layer performing authorization. The main drawback of these two schemes is that they are based on an external and reliable level that computes node reputation score. Furthermore, they defend only against some kind of attacks, such as: modification, replay, and message dropping attacks.

The proposals of [38,39,40] are based on Blockchain technology to provide forms of trust or authentication in a IoT network. In particular, in [38] the authors describe an Obligation Chain containing obligations generated by a number of nodes, called Service Consumers, which are first locally accepted by Service Providers and, then, shared to the rest of the network. This kind of framework is based on Islands of Trust, portion of the network where the trust is regulated by a full local PKI and Certification Authority. Also the approach in [40] relies on the security advantages provided by Blockchains, creating secure virtual zones (bubbles) where things can identify and trust each other. Moreover, although Blockchain technology provides decentralized security and privacy, it involves significant energy, delay, and computational overhead, not suitable for most resource-constrained IoT devices.

A new perspective of Internet of Things is provided by [41], that introduces the Social Internet of Things (hereafter, SIoT). This paradigm redefines the relationships among objects putting into evidence objects autonomy. Things can navigate through the network to find resources and services of their interest, provided by other things, without human intervention. The formalization of methods and technologies allowing an object to crawl the network for finding other (possibly heterogeneous) objects and the analysis of the new social graphs thus obtained are two aspects analyzed in [42]. A step forward is done by [43], in which the authors investigate the trustworthiness management of a SIot starting from the concepts coming from P2P and social networks. They combine two models, such as a subjective and an objective one. In the former model, each node computes the trustworthiness of its friends on the basis of its own experience and on the opinion of the friends in common with the potential service providers. In the latter model, the information about each node is distributed and stored making use of a distributed hash table structure, so that any node in the network can make use of the same information.

Finally, the approach proposed in [44] deals with object reliability in a Multiple Internet of Things, defining also a profile for an object. Differently from our approach, the principle underlying the reliability of an instance in a MIoT is that it is directly proportional to: (i) the fraction of successful transactions performed by the instances, and (ii) the reliability of the corresponding objects.

It is worth observing that, our proposal exploits some of the concepts and strategies proposed by the approaches presented in this section. However, while these related solutions leverage direct interactions to compute objects reliability, our H2O scheme enhances machine-learning based fingerprinting with a consensus-based strategy to enable a wisdom-of-crowd attestation of objects behavior. In our paper, we define an object profile made up by different properties. These properties are object features related to how it usually interacts with other entities, the environment or its owner. A profile can be used as input of a machine learning solution, which computes a behavioral fingerprint for an object. This is the former step of our scheme, whose goal is to provide a complete framework equipping all entities involved (both objects and humans) with a mechanism to compute the reliability of their peers.

The problem of assessing reliability on a network of humans is a crucial task both in real and virtual world [45,46]. Typical solutions for identity deception attacks rely on legitimate community members and administrators, who are called to manually identify malicious accounts or persons [47]. The approach presented in [19] aims at computing a level of trust for each node of a network of humans on the basis of neighborhood recognition and behavioral biometric support. It describes keystroke dynamics as solution for continuous authentication for enhancing trust in social networks, in particular, biometric data are exploited as a feedback to a trust model to measure the trustworthiness of an online profile.

Trust in social networks is an extremely discussed topic, and often the boundaries between the real and virtual world are blurred in such a way that some approaches useful to compute trust between two persons in the real world can benefit measures and techniques coming from the virtual world, and vice-versa [48]. Indeed, authors of [49] state that the trust results in different communication behaviors among persons, this means that trusted communications are statistically different from random ones, and detecting trust-like behaviors allows researchers to develop a quantitative measure of who trusts whom in the network. In this context, the authors of [50] describe a model of a trust-based recommendation system which has the goal of filtering information for agents based on the agents’ social network and trust relationships, thus providing recommendations for real entities through virtual ones.

Differently from these approaches, our work provides human-to-human reliable communications, by ensuring a degree of reliability. Therefore, when a human wants to interact with a peer never met before, he will need some evidence of his identity, at the start of the communication. This proof can be produced by the combination of the assessment of an object owned by the second person and the continuous authentication technique an object can provide its owner with.

In this subsection, we summarize in Table 1 the comparison with all the works introduced in the previous sections. Specifically, we evaluate and compare all the approaches on the basis of the typology of relationship that they consider, namely:

H-O: the cited article deals with an approach to compute the reliability of a person through an object or in the communication with an object;

The symbol ‘x’ denotes that the cited paper provides the corresponding property.

In this section we deep dive in the description of the behavioral fingerprint computation. Behavioral fingerprint is a very timely research subjects and several investigations are already available in the scientific literature [8,21,22,23]. Most of the existing works deal with the problem of identifying general features that can be applied to any existing IoT device, but, such that, together can unequivocally represent a single specific object. Generally, two categories of fingerprinting strategy are adopted, namely: (i) non-behavioral fingerprinting and (ii) behavioral fingerprinting [53].

The first category of approaches leverages features related to physical and link layer characteristics [56,57]. For instance, the authors of [56] extracted 19 features from the 802.11 probe fields. The selected features have been identified by observing which variations are typically recorded when the devices are under attack or involved in anomalous situations in their environment. In particular, this approach works as follows. In the first phase, wireless network traffic from devices is collected, and probe request frames are filtered out to extract the data-link layer header from the frames. After removing the outliers, a set of unique, tamper-proof, non-reproducible features that can be used for the device type fingerprinting are chosen. Signature has been used to generate the profile for each device type. Finally, these profiles are then matched in the verification phase through some similarity measures to establish if the device type is registered in the system.

In the approach described in [57], instead, the authors focused on a different set of features related to clock characteristics and TCP timestamp. In particular, this approach is based on thirteen clock characteristics to remotely identify different IoT device models of various manufacturers. The authors define a set of machine learning features related to how monotonic timestamp clocks generate TCP timestamp values, and they use these features to detect model specific characteristics. Moreover, they compare different machine learning algorithms and identified Random Forest as the best classifier in this setting. In general, non-behavioral fingerprinting can be successfully applied if the considered features can be adapted to the characteristic of the network, in which the object is located. In this way, particular situations in the network, like congestion or bottlenecks, do not impact on the fingerprinting model.

Behavioral fingerprinting, instead, focuses on more application-level features to model objects’ traits. Therefore, instead of focusing only on the physical and link layers information, the approaches belonging to this category go further in the characteristic of the packets generated by extracting information. Among these characteristics there are: protocols, request-response sequences and any periodicity in specific typology of packets along with their sizes [58,59,60]. In particular, the approach of [58] focuses on TCP/IP connections and extracts features from them (such as, time-to-live, byte sent and received, etc.). With these features, the authors trained a Random Forest model and were able to distinguish the monitored objects from external ones with a precision of 97%.

Similarly, the approach described in [59] focuses on different typologies of traffic an object can generate, for instance queries to DNSs, packets related to user activity on known application (e.g., google home, maps, etc.), and interaction with known service. With these information, the authors adopted a deep learning solution based on LSTM-CNN model. This approach reaches a best accuracy value of 80.1%.

Very close to our application scenario is the solution described in [60]. In this paper, the authors describe a distributed solution for behavioral IoT fingerprinting. Indeed, because models for fingerprint must be kept updated in accordance to possible variation in the devices’ configuration, a centralized solution would suffer from scalability issues. For this reason, they identify some nodes, i.e. the gateways, inside the IoT that can monitor objects using trained classification models, thus providing scalability to the solution. The training part, instead, is performed by special controller nodes, which in this scenario are considered as part of the ISP. Inside such an architecture, the authors identify a feature vector with 111 dimensions. They tested the performance of their approach obtaining an accuracy of 97% when classifying known devices.

With the evolution of the IoT technology, nowadays paradigms such as Internet of Multimedia Things (hereafter, IoMT) have been introduced. In such settings, the devices are assumed to have higher computational capabilities than classical sensors belonging to the Internet of Things. With this in mind, we argue that, in modern general IoT scenarios, we can consider that a combination of Multimedia Things and simple classical smart objects coexists. Therefore, in our H2O network, we consider that the role of controller nodes can be played by the top powerful devices, belonging to NPPU, which are in charge of training the models by leveraging edge/cloud computing solutions [61]. Whereas, the monitoring nodes can be more common objects with sufficient computational capabilities to execute a trained model. Finally, low-power objects, belonging to NLPU or NLPAN can leverage delegation strategies to gain reliability information about other nodes. All the controller devices use the same algorithm to build object fingerprints and the same set of features, say S. During the safe starting phase, objects with monitoring capabilities interact with their peers to acquire the training set to build the corresponding models. The training set is, hence, used by the controller nodes to fit the model. With that said, in our scenario each monitoring node, say ni, associates and maintains a profile with each of its contacts, say nj which were added before the safe starting phase. In particular, a profile can be defined as follows:(1)Pni,nj=〈Netnj,Fni,nj〉

Here, Netnj is a set containing information related to connectivity aspects (such as, the IP address, the MAC address, and so forth), and Fni,nj represents the fingerprint of nj maintained by ni. In particular, the fingerprint that ni associate with nj can be defined as:(2)Fni,nj=〈mni,nj,S〉 where, mni,nj represents the model built during the safe starting phase according to the data exchanged between ni and nj. Whereas, the set S represents the set of features considered in the model. After the safe starting phase Fni,nj is used by the monitoring node ni to assess whether the behavior of nj is unchanged. This information can be, then, used by the network members to estimate a reliability score for the others. In the next section, we will describe this aspect in more detail.

In this section, we describe how the reliability of an object is assessed by leveraging object-to-object interactions. In order to detail all the steps of this part of our approach, we preliminary define a redundancy parameter r, that is a positive integer representing a minimum consensus level to suitably estimate the reliability of an object. Moreover, given the set of neighbors of ni, namely Γ(ni), we denote by R(ni)⊆Γ(ni) the set of nodes which have been tested by ni and whose identity is monitored (either directly or through delegation strategies) by comparing the current interactions with their behavioral fingerprints.

As stated before, we assume that there exists a safe starting phase in which neither fraudulent access nor physical damage to legitimate nodes can be performed. During this phase the machine learning algorithms, described in Section 4, can be trained to produce the fingerprints for each objects. In a subsequent non-safe phase, objects can leverage such models referring to other nodes which they usually communicate with. Periodically, a node ni can test one of its neighbors (whose behavior has been modeled during the safe starting phase), to assess whether it has been corrupted or hacked. Let us denote with nj∈Γ(ni) the node to be tested. To do this, ni exploits the behavioral fingerprinting model providing data extracted from a set of transactions done with nj, as input. The output of the model is a normalized fingerprint rate, represented as fr(ni,nj), whose values range in (0,1). In order to assume nj reliable, the fingerprint rate must be greater than a give assurance threshold 0<1−ϵ≤1; in other words, the fingerprint rate should be such that 1−ϵ≤fr(ni,nj)≤1 to consider nj still reliable.

After this check, ni stores fr(ni,nj) in a internal table for future transactions.

Now, let us suppose that the node nj wants to interact with nz, but it has not met nz during the safe starting phase. In this case, no information about the reliability of nz is available, directly. To address this situation, our approach adopts a strategy based on the consensus of a suitable portion of the neighbors of nj to compute a derived fingerprint rate.

In particular, let Δ(nj,nz)={nx|nx∈Γ(nj)∩Γ(nz)∧nz∈R(nx)} be the set of objects belonging to both the neighbors of nj and nz, which have computed a normalized fingerprint rate for nz. The derived fingerprint rate for nz can be computed by nj as follows:(3)dfr(nj,nz)=∑nx∈Δ(nj,nz)fr(nx,nz)Δ(nj,nz)

At this point, nz can be considered reliable by nj if the following conditions are true: (i) dfr(nj,nz)≥1−ϵ and (ii) Δ(nj,nz)≥r.

Therefore generalizing the above reasoning, in order to be reliable for nj, a node nz has to match one of the following set of conditions:

(i)nz∈R(nj) and (ii) fr(ni,nz)≥1−ϵ; that is, nj holds a fingerprint model of nz and the normalized fingerprint rate is distant from the maximum value no more than a certain threshold ϵ;

We call this last property r-redundancy. It is based on the assumption that multiple confirmation of the reliability of a node can be considered sufficient to trust the behavior of that node [19]. Obviously, the higher the value of r, the higher the reliability about the object behavior.

To better understand the steps above, let us consider the example represented in Figure 4. This figure reports a portion of an H2O network containing the nodes nj and nz along with their neighbors. Black edges represent interactions assured by the presence of a fingerprint model. Hence, the two nodes linked by such edges have first met during the safe starting phase. Moreover, consider an example configuration in which ϵ=0.3 and r=2.

Suppose again that the node nj wants to interact with nz, but it has not met nz during the safe starting phase. The dashed edge in Figure 4 represents the possible future interaction between nj and nz. Before starting the communication, nj checks whether nz∈R(nj). If nj had a direct access to a fingerprint model for nz, it could check if fr(nj,nz)≥1−ϵ. However, in this example, nj has no direct access to a behavioral model for nz. Therefore, nj contacts the objects in its neighborhood (Γnj={na,ni,ny,nw} in the example reported in Figure 4) to obtain information about nz. In particular, nj looks for objects in its neighborhood, who can leverage a behavioral model of nz to assess its reliability, which, as a consequence, belong also to the neighborhood of nz. In the example, two nodes, namely ni and nw, belong to the interception set Γ(nj)∩Γ(nz)={ni,ny,nw} and have access to a behavioral fingerprint of nz (Δ(nj,nz)={ni,nw}). These two nodes answer to nj with fr(ni,nz) and fr(nw,nz), respectively.

Having this two values, nj computes the formula in Equation (3), which becomes: dfr(nj,nz)=fr(ni,nz)+fr(nw,nz)2=0.74+0.842=0.79

At this point, nj will consider nz reliable because dfr(nj,nz)≥0.70 and r≤2.

Algorithm 1 summarizes the steps of our approach for object-to-object reliability assessment.

As for the overall computational complexity of the above consensus mechanism, we can express it in terms of number of messages sent during the object-to-object reliability assessment. Therefore, leveraging asymptotic analysis, we can state that this solution guarantees a linear computational complexity, O(m), in the dimension, say m, of the number of neighbors for a node. It is worth noting that, in this analysis, we do not consider the computational cost of the fingerprint rate fr(ni,nj), that depends on the fingerprint algorithm used during the safe start phase (see Section 4).

This section is devoted to detail the various biometric authentication techniques our approach can rely on, in order to make an object in the H2O network, capable of continuously identifying its owner. As will be clearer in the next, this step is essential to provide a mean to assess entities reliability also in human-to-human communications. Biometric identification is defined as the mechanism to automatic identify a person through the analysis of his biological (physiological, anatomical) or behavioral traits. This may happen since most of the biological and behavioral characteristics used are peculiar of an individual and can uniquely identify him. Indeed, in the last years, the use of ID cards, keys, passwords, or other standard systems has been replaced in lots of contexts by these more dependable forms of authentication [62]. Obviously, not all the human characteristics can be chosen to be used in biometric authentication. Therefore, according to the National Institute of Standards and Technology (NIST) (https://www.nist.gov, accessed on 30 April 2021), there are some features that make a human trait distinctive and hence, eligible for acceptance. These features are: universality, uniqueness, permanence, measurability, performance, acceptability and circumvention [63]. Examples falling in the aforementioned biological category of biometric mechanisms are: fingerprint, hand geometry, iris, face, and ear. Whereas, examples of behavioral biometrics mechanisms include: gait, signature, and keystroke dynamics. Algorithm 1: Algorithm for object-to-object reliability computation.

As already said, the diversity of devices and applications in the IoT universe leads to a variety of solutions to the problem of continuous authentication of users (through biometrics). Such a diversity is mostly due to the different capabilities of the devices themselves.

According to this reasoning, we can divide IoT devices that interact with humans and which compute biometrics to authenticate their owners, into two sets. The former is composed of objects having a permanent physical contact with the person during usage, such as: activity trackers, smartwatches, and insulin pumps. The latter consists of devices that do not maintain permanent contact with humans, such as: intelligent thermostats, occupancy sensors, and smart household appliances. To the first set belong wearable devices holding an inertial measurement unit (IMU), which are, in turn, comprised of an accelerometer and a gyroscope, and that can verify and authenticate their owner by his gait. The concept underneath is that humans move their limbs in unique patterns, and these patterns can be sensed be the device. Leveraging machine learning techniques to learn these patterns, software inside smartphones, fitbands, smartwatches and specific health sensors can be able to verify a human through his gait.

Similarly, photoplethysmogram (PPG) sensors generate signals according to the amount of blood that flows in a person’s veins, which depends on frequency heartbeat. In particular, this last trait that can be analysed through echocardiogram signals (ECG) can be monitored by smartphones, fitbands, smartwatches and specific health sensors. It contains enough information to enable user authentication. Potentially this kind of information can be combined with the one coming from IMU to provide a multiple-biometrics measure, more accurate and stable, that traces ECG according also to changes in speed of user’ movements.

Always in the context of biological traits, specifically anatomical ones, distinctive physical human characteristic are the iris, the shape and appearance of ears, the face, the fingers and the hands’ palms. These features are invariant during the growth period of children and in adult lifetime [62]. For instance, the visible colored rings around pupil that compose the iris have a unique size for each individuals. Also the shape and appearance of ears are unique and have relatively little change during the lifetime of an adult. Moreover, also fingerprints and palms of the skin of the hands have unique pattern of ridges and valleys. All this traits can be analysed by a camera or via specific sensors for fingerprint installed in a laptop or smartphone.

On the other hand, there is a number of mechanisms performing continuous authentication based on the analysis of human behaviour. All these approaches can be referred as behaviometrics, that is the analysis of a person’s behavior, rather than his physical characteristics, with the aim to identify uniquely that person. One of the most popular is keystroke [64], which tries to identify the authenticity of a user when he is working via a keyboard. In particular, this process analyzes the way a user types at a terminal by monitoring the keyboard with the aim to identify users based on habitual typing rhythm patterns.

Always in the context of behavioral biometrics, recent works rely on the particular way a person uses the devices he usually interacts with. For instance, in [65] the authors extracted some side-channel features from network traffic generated by smartphones. Specifically, they state that the use of the most popular smartphone applications, such as Facebook, WhatsApp, Skype and Dropbox generate a network traffic peculiar for a single individual; and it can be used to reliably identify the owner’s smartphone. Also the use of Social Networks through the smartphone can be consider characteristic for an individual. Indeed, the works presented in [13,14] deal with this challenge, proposing some mobile behaviometric frameworks assessing users’ social activity, and introducing sociability metrics to generate signatures of users’ activities. Typically, to compute behavioral biometrics a user has to rely on powerful devices, such as smartphones or personal laptops.

In summary, the are various possibilities for IoT devices to assess, in any moment, if their owner is who he claims to be. Specifically, in H2O network, each device can perform continuous authentication of its owner according to its own capabilities. For instance, a camera can rely on face recognition, whereas a fingerprint sensor on human fingerprint. The set of possibilities for a smartphone are, surely, wider, since this kind of personal device has a number of capabilities spanning from biological human traits to behaviometrics. The choice of the particular mechanism for each device is orthogonal to our study, as long as a device can provide an answer to another object about its owner identity, once requested. Anyway, as already stated, in H2O network not all the devices are equipped with biometric sensors able to perform a continuous authentication task. If the device belongs to a NLPAN, our approach leverages delegation strategies ensuring to this device the possibility to rely on a more powerful one, always belonging to the same PAN. The whole list of steps and the conditions for which a device can rely on another device’s to identify the common owner, will be explained in the following section.

In this section we describe the second reliability mechanism our H2O network is equipped with. Indeed, in Section 4.2, we detailed how the interaction between two objects can be made more robust against attacks aiming at corrupting or damaging a node. Indeed, our approach provides a way for a node to assess the reliability of a second node it is interacting with. At the same time, if a node requests a service from another one for the first time, it can rely on our approach to know what its neighbors think about that node and assess whether it can be considered reliable or not.

By applying a similar reasoning, our approach can be extended also to human-to-human interactions. A sequence diagram showing our solution in this particular case is reported in Figure 5.

In particular, if a human wants to interact with another human in the H2O network our protocol will perform a sequence of steps useful to assess the reliability of the second human. In particular, as showed in Figure 5, let us hypothesize that Chad wants to interact with Hope to send a personal file. For this task, Chad relies on one of his object, let us say nc, whereas Hope’s object, that has to receive the file, is identified with nh. In this scenario, two cases may happen. The first possibility is that nh is an object with sufficient computational power (i.e., it belongs to Hope’s NPPAN) and it is equipped with an algorithm for the computation of biological or behavioral biometrics mechanisms (showed in Section 4.3). In this case, before nc sends the file to nh, it will request the result of the biometrics authentication mechanism nh is equipped with. At this point, our scheme provides nc with a way to assess nh reliability, too. In order to do so, it will perform the sequence of steps described in Section 4.2 for object-to-object reliability assessment. If nh is reliable and its response about Hope reliability is positive, the file exchange can safely take place.

The second case happens if nh is a lower power object (i.e., it belongs to Hope’s NLPAN), hence, it is not equipped with a way to authenticate its owner, Hope. Our approach allows nh to rely on more powerful objects belonging to Hope’s PAN for this computation. To do so, an approach based on consensus, similar to the one described in Section 4.2, can be adopted. Specifically, let ΔH(nh) be the set of objects belonging to the PAN of nh, which have the capability of computing biological or behavioral biometrics mechanisms to authenticate their owner. Let ΔH(nh)^⊆ΔH(nh) be the set of nodes of ΔH(nh) that can be considered reliable by nh according to the strategy described in Section 4.2. To authenticate its owner, nh can relay on any node belonging to ΔH(nh)^; moreover, nc must adopt again the strategy described in Section 4.2 to confirm the reliability of nh’s answer. Finally, if all the involved nodes are reliable and the response about Hope’s reliability is positive, the file exchange can safely take place.

Algorithm 2 summarizes the steps of our approach for human-to-human reliability assessment.

Concerning the computational complexity of this functionality, we can consider two contributions. The former is the cost of the continuous authentication mechanism, say auth(hi), that strictly depends on the specific biometrics approach adopted. For these reason, we generically refer to this cost as Cauth and we do not include it in our analysis.

The latter, which is the cost introduced by our approach, can be expressed, once again, in terms of the number of messages exchanged by the objects involved in this task. In particular, the human starting the communication will use one of his object for this task. This object will exploit the object-to-object mechanism, described in Section 4.2, to assess the reliability of the object owned by the target human. As stated before this task has a linear computational complexity in the dimension of the number of neighbors for a node, say m. Moreover, in the worst case, the object owned by the target human will query his whole PAN. Assuming that the maximum size of the set of objects of a PAN is s, then this further step will have a linear cost with respect to it. Overall, the cost of this strategy can be estimated as O(m·s). Algorithm 2: Algorithm for human-to-human reliability computation.

As a preliminary assumption, we consider a realistic scenario in which a sufficient number of nodes is available both in the starting phase, called safe starting phase, and in the fully operational one. Therefore, we do not consider anomalous situations, in which the number of the nodes available in the network is less than the minimum necessary one, preventing to implement our scheme successfully. Moreover, we include in our threat model the following assumptions:

As for the first assumption, we recall that our protocol is collaborative and a node ni can compute the reliability score of another nodes nj through the responses of the set of its neighbors Γni. Some nodes might be corrupted, but we assume that most of them are honest, as done in [71,72].

The list of the security properties (hereafter, SP) of our framework is the following:SP.1 

Resistance to Node Tampering Attacks.

In this section, we detail the security properties cited above, analysing how our approach can guarantee each of them.