# A Survey on Cybersecurity in IoT
## 2 Device Authentication and Identity Management  
Device authentication and identity management are critical components of the security architecture in the IoT ecosystem, serving as the first line of defense against unauthorized access and malicious activities [26]. Unlike traditional computing environments, IoT networks are characterized by a massive scale of heterogeneously connected devices, each with varying levels of computational power and security capabilities [27]. Diverse IoT scenarios impose varying requirements for authentication mechanisms. For instance, in healthcare IoT systems, device authentication must align with stringent privacy regulations like HIPAA to safeguud patient data. At the same time, industrial IoT environments demand real-time authentication to secure machinery and prevent unauthorized access. Similarly, smart city applications often require scalable identity management to handle dynamic additions and removals of devices such as connected traffic lights and environmental sensors [28; 29; 30]. One of the primary challenges in IoT device authentication is establishing trust in environments where devices are often deployed in untrusted or hostile settings [31]. Identity management in IoT extends beyond mere authentication to encompass the entire lifecycle of device identities, from provisioning and registration to revocation and decommissioning. One of the key challenges in IoT identity management is the dynamic nature of IoT environments, where devices frequently join and leave the network, often with little or no human intervention. This dynamic nature requires identity management systems that can operate autonomously, ensuring that devices are securely integrated into the network and that their identities can be managed without compromising security [32; 33; 34; 35; 36]. Traditional authentication mechanisms, such as Public Key Infrastructure (PKI), though widely used in conventional IT systems, are often impractical for IoT devices due to their resource-intensive nature [37; 38; 39]. IoT devices, particularly those with limited processing power and memory, cannot easily handle the computational overhead associated with PKI's key generation, encryption, and decryption processes. This limitation has spurred the development of alternative authentication methods specifically tailored to the constraints of IoT devices [40]. Elliptic Curve Cryptography (ECC) has emerged as a prominent solution for lightweight authentication in IoT [41; 42]. ECC offers comparable security to traditional Rivest-Shamir-Adleman (RSA) encryption but with significantly smaller key sizes, leading to reduced computational and storage requirements [43]. The reduced key size translates into faster processing times and lower energy consumption, making ECC particularly well suited for IoT devices that operate on limited power sources [44]. However, the implementation of ECC in IoT environments requires the careful consideration of various factors such as key management, resistance to side-channel attacks, and the ability to scale across large networks [45]. In addition to ECC, symmetric key cryptography remains a popular choice for IoT authentication due to its efficiency in terms of both speed and energy consumption [46]. Protocols like the Advanced Encryption Standard (AES) are frequently employed for device authentication in IoT systems [47; 48]. The AES, with key lengths of 128, 192, and 256 bits, is widely used for device authentication in IoT systems. A 128-bit key provides sufficient security against brute-force attacks while minimizing computational overhead, making it suitable for resource-constrained devices. Longer keys, such as 256-bit, offer enhanced security but increase processing requirements. The secure exchange of AES keys, often facilitated by the Diffie-Hellman or Elliptic Curve Diffie-Hellman protocols, can introduce vulnerabilities like susceptibility to man-in-the-middle attacks if not implemented correctly [49].