In this manuscript, we describe the soft- and hardware architecture as well as the implementation of a modern Internet of Medical Things (IoMT) system for sensor-assisted telepsychotherapy. It enables telepsychotherapy sessions in which the patient exercises therapy-relevant behaviors in their home environment under the remote supervision of the therapist. Wearable sensor information (electrocardiogram (ECG), movement sensors, and eye tracking) is streamed in real time to the therapist to deliver objective information about specific behavior-triggering situations and the stress level of the patients. We describe the IT infrastructure of the system which uses open standards such as WebRTC and OpenID Connect (OIDC). We also describe the system’s security concept, its container-based deployment, and demonstrate performance analyses. The system is used in the ongoing study SSTeP-KiZ (smart sensor technology in telepsychotherapy for children and adolescents with obsessive-compulsive disorder) and shows sufficient technical performance.

OpenID Connect (OIDC) is a widely used authentication standard for the Web. In this work, we define a new Identity Certification Token (ICT) to enable end-to-end user authentication by using and extending OIDC’s native mechanisms. An ICT can be thought of as a JSON-based, short-lived user certificate for end-to-end user authentication without the need for cumbersome key management. A user can request an ICT from his OpenID Provider (OP) and use it to prove his identity to other users that trust the OP. We call this approach Open Identity Certification with OpenID Connect (OIDC2) and compare it to other well-known end-to-end authentication methods. Unlike certificates, OIDC2 does not require installation and can be easily used on multiple devices, making it more user-friendly. We outline protocols for implementing OIDC2 based on existing standards. We discuss the trust relationship between entities involved in OIDC2, propose a classification of OPs’ trust level, and propose authentication with multiple ICTs from different OPs. We explain how different applications such as video conferencing, instant messaging, and email can benefit from ICTs for end-to-end authentication and recommend validity periods for ICTs. To test OIDC2, we provide a simple extension to existing OIDC server software and evaluate its performance.

The Plug-and-Charge (PnC) standard defined in ISO 15118 facilitates simple Electric Vehicle (EV) charging with modern Charge Points (CPs). When drivers plug in their EV into a CP, the EV authenticates itself to the CP with a so-called contract certificate. Then, the CP automatically initiates charging and billing. In this paper, we identify gaps in PnC regarding the installation process of the contract certificate in EVs.We propose an alternative approach based on modern extensions of OAuth 2, i.e., OpenID Federation with a Device Authorization Grant and a Rich Authorization Request. We perform a symbolic protocol verification using the Tamarin prover to prove security, provide an open-source implementation to demonstrate the feasibility of the concept, and evaluate the performance of the prototype. The new approach is more user-friendly, more secure, and features a less complex EV charging authorization than existing solutions. The proposed cross-device authorization flow can also be applied to use cases beyond EV charging where users authorize IoT devices from a trusted smartphone.