## 2 Literature Review on IoT and Lightweight Security Protocols
### Standardized Protocols for IoT
[PERSON] and [PERSON] [17] provided a brief comparison of communication protocols such as IEEE 802.15.4, 6 LoWPAN, and IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL), and security mechanisms available to protect these standards at each layer of the communication stack. They briefly mentioned security parameters based on the CIA triad for each layer, but no specific protocols are mentioned at all layers except for the 6 LoWPAN adaptation layer. [PERSON] et al. [2] provided a comprehensive and systematic review of recent studies on authentication protocols for IoT in four environments: Machine-to-Machine (M2M), Internet of Vehicles (IoV), Internet of Energy (IoE), and Internet of Sensors (IoS). First, they surveyed a large number of studies published between 2010 and 2016 and discussed them in chronological order. Many reviews about the security of IoT systems started being published between 2014 and 2015. Second, they described several types of cryptosystemsthat are being used for authentication. Among them, some use Elliptic Curve Cryptography (ECC), an asymmetric encryption system that has a public and a private key and can be used for M2M, IoV, and IoS authentication and key distribution. Finally, they described more than forty authentication protocols that provide authentication in those four IoT scenarios, and compared their advantages and limitations. Most of the schemes are not standardized and they cover specific tasks, such as what happens in the registration phase when the smart device joins the network. The schemes surveyed were not necessarily lightweight schemes. [PERSON] et al. [18] addressed the issue of security key generation and distribution among IoT devices, which are known as key bootstrapping methods. This study focused on public-key cryptography, which, they argued, is more scalable and provides more protection against cyber threats. Traditional key bootstrapping algorithms, such as IP security/Internet Key Exchange (IPSec/IKE), TLS, or DTLS, require a lot of resources from IoT devices. Thus, they reviewed key bootstrapping in the context of IoT applications. First, they analyzed the standard IoT security protocols, layer by layer:  
* IEEE802.15.4 at the physical/data link layer, which does not specify a key management protocol. * IPv6 LowPAN, which they reference as an adaptation layer that allows IPv6 packets to be carried over IEEE 802.15.4 frames. * IPv6 Routing Protocol for Low Power and Lossy Networks (RPL) is the routing protocol at the network layer, along with its two security modes: preinstalled keys, or authenticated mode, where nodes such as routers obtain keys from a certification authority (CA). * CoAP at the application layer and DTLS, which has different authentication modes, such as pre-shared keys, raw public keys, and certificate mode. When COAP is used with DTLS, it is recommended to use raw public keys, which means that the public keys are pre-programmed in the devices at the time of manufacturing. All devices in the same network know the other devices' public keys. Second, the study [18] classified several new proposals based on the key delivery mechanism and the authentication modes, such as raw public key, certificate-based vs. certificate-less, and identity-based. Most of the new protocols are lightweight versions of existing protocols, such as Diffie-Hellman and ECC (ECDH) for key agreement, or some type of compression, such as the new idea of using implicit certificates, where all components of a certificate are superimposed on each other. Among them, the Elliptic Curve Qu-Vanstone (ECQV) is a common type of implicit certificate. [PERSON] et al. [19] presented a review of communication protocols in the application layer, including MQTT, AMQP, XMPP, Data Distribution Service (DDS), HTTP, and CoAP. They addressed specific challenges in the context of fog and cloud computing.