## 7 Research Directions  
The existing security solutions for IoT systems primarily address the access-level security (see Section 5.1) and information security requirements (see Section 5.2). Little attention has been paid to the resource efficiency aspect and functional robustness feature (see Section 5.3) of the security schemes, which are very fundamental requirements for IoT applications. These schemes also hardly consider privacy issues encountered in an IoT-based system. Apart from that, there are many other security aspects that are either not properly addressed or remain unnoticed. This is because many recent and proven technologies, including M2M [46], RFID [171], and Ubicomp [172], are yet to be in complete convergence with the IoT paradigm. In this section, we identify those security problems and try provide some guidelines to design the appropriate solutions for them. Table 13 summarizes the research problems along with the associated research directions. The details of these open issues and future directions are successively presented below.  
\begin{table}
\begin{tabular}{l l l c c c c c c} \hline \hline
**Model** & **Scheme** & **Approach** & **I** & **R** & **S** & **CO** & **CC** & **MR** \\ \hline \multirow{2}{*}{RBAC} & OpenID based [134] & Centralized & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & Context aware [135] & Centralized & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \hline \multirow{10}{*}{CapBAC} & Cloud PDP [136] & Centralized & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & Embedded PDP [139; 140] & Distributed & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & XACML, SAML based [137] & Centralized & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & Kerberos, RADIUS based [138] & Centralized & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & Proxy Assisted [141] & Distributed & \(\mathbf{\times\times}\) & \(\mathbf{\times}\) & \(\mathbf{\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & Context-aware [142] & Centralized & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) \\ \cline{2-10}  & OAuth based [143; 144] & Centralized & \(\mathbf{\times\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times}\) & \(\mathbf{\times\times\times}\) \\ \hline \hline \end{tabular}
\end{table}
Table 12: A comparison between authorization methods. Notations used for the security properties are: I = Interoperability, S = Scalability, R = Resiliency, CO = Communication Overhead, MR = Memory Requirement, and CC = Computation Complexity. A security property can have three difference values: high (\(\mathbf{\times\times\times}\)), medium (\(\mathbf{\times\times}\)), and low (\(\mathbf{\times}\)). A value is assigned to a security property based on an authorization scheme’s performance to support that property.