## 5 Security Requirements
### Functional Security Requirements  
**Interoperability:** Heterogeneous hardware and software, such as radio transceivers and operating systems, are embedded with IoT devices. Security solutions should be designed and developed such that their deployment to an IoT system does not interrupt functional operations between heterogeneous things or prevent a device from communicating with its peer securely. For instance, a device with a newer version of a security method should be able to communicate with a device with the older version of the security scheme. Moreover, the same security scheme can be integrated with devices with different operating systems or software platforms. In this case, the security method should allow the devices to communicate to each other seamlessly without compromising message authenticity, integrity, and confidentiality. This property can be evaluated based on the amount of information (such as multiple versions of cryptographic algorithms, certificates, and keys) that a device needs to store in its memory to establish security associations (such as identify validation and session key establishment) with devices that have heterogeneous operating systems. **Scalability:** According to recent research by Forbes Forbes (2015), over the next five years, one million IoT devices will be commercialized per year. Therefore, security systems should scale well for IoT systems with a large number of smart nodes. A criterion for evaluating the scalability of a security method can be the architecture, centralized or distributed, on which the method is designed. For instance, distributed key management may be better than centralized key management for a smart city, which accommodates a large number of smart devices ranging from roadside sensors to smart cars. **Memory Efficiency:** Smart devices have limited storage in RAM and ROM. Security methods should be designed such that cryptographic materials, such as keys and certificates, and program codes take minimal space in the flash memory (ROM). Security schemes should also be optimized to reduce memory (RAM) consumption during the execution of the cryptographic algorithms, such as identity verification, making authorization decisions, encryption, signature validation, and session key computations. **Minimal Communication Overhead:** IoT networks are lossy and low powered and have limited network bandwidths. Therefore, security methods should minimize the total number of messages and bytes that devices are required to exchange between them to establish session keys. Moreover, radio-transceivers consume a significant amount of energy to receive and deliver network packets. The exchange of a minimal number of protocol messages will reduce energy consumption and increase battery life. **Minimal Computation Cost:** IoT devices are embedded with low-power CPUs that operate at slower CPU clocks. Security schemes should avoid computation-intensivecryptographic operations in authentication and session key derivation to allow IoT devices to execute security algorithms faster. Moreover, the execution of such security schemes will enable devices to avoid burning too many CPU cycles, reduce energy consumption by CPUs, and ensure longer battery life. **Exception Handling Capability:** This property allows IoT devices to provide a minimal level of service during unfavorable incidents, such as software glitches, malfunctioning hardware, dislocation environmental hazards, and denial-of-service attacks. This property also ensures that IoT devices can continue services, even in an anomalous situation, without compromising information security. **Resiliency:** The security of an IoT system should not be compromised even if adversaries get unauthorized access to one or more nodes of the system. As such, this property allows security methods to avoid single points of failure on the IoT network. For instance, an adversary can compromise one or more nodes of an IoT system.