# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Protocol Security  
A protocol is a set of rules and conventions prescribing how participant components should communicate. Any data traffic between a device and the cloud (including information transmitted via mobile apps) should be examined to ensure that it is secured.  
Due to the heterogeneity of IoT deployments, the capability to securely (re)program embedded devices over the air is confined, so SEDA [83] is designed to address confusion caused by over-the-air updates for various devices and firmware. To enable the secure multicast approach, SEDA modifies a well-known asymmetric broadcast encryption scheme, BGW, to improve communication and computation efficiency. An experiment conducted by the authors in Flocklab with the Cooja simulator proved SEDA's security against identified adversary models.  
[PERSON] et al. [36] analyzed the vulnerabilities in high-definition multimedia interface (HDMI) networks and proposed an attack framework, HDMI-WALK. This framework leverages the protocol vulnerabilities in consumer electronics control (CEC), an important HDMI component, to implement five kinds of attacks: malicious CEC scanning, eavesdropping, WPA/WPA2 handshake theft, CEC packet sniffing, and broadcast DoS. Moreover, the authors also discussed defense mechanisms to mitigate HDMI-WALK attacks, such as removing CEC functions if unnecessary, designing an IDS for CEC, or applying machine learning-based approaches to identify abnormal behaviors.  
[PERSON] et al. [81] investigated several prominent IoT protocols and found many critical security problems in practical IoT settings. They used formal symbolic security models to analyze problems of such protocols under traditional or stronger adversaries. In particular, they extended the formal analysis to cryptographic denial-of-service (DoS) attacks and showed that IoT networks can be easily flooded with fake signatures or session reinitialization requests. With EC-JPAKE as an example, they used an AES-brute-force-based server puzzle (SP) and the cookie approach to defend against DoS attacks with lower computation and communication complexities.  
[PERSON] et al. [113] first proposed ESP header compression (EHC), a novel lightweight protocol that compresses ESP packets, and defined how to compress IPSec ESP and clear-text data for IoT scenarios. Then, they presented an EHC strategy, Diet-ESP, which has small energy overhead compared to the standard IPSec ESP and non-encrypted communications. As many IoT sensors continue working until their battery dies, Diet-ESP doubles the sensors' lifetime.  
[PERSON] et al. [37] proposed a new attack model on smart lamps with bugs in the ZigBee protocol. They mainly focused on the Philips Hue bulbs, which use ZigBee Light Link (ZLL) as their communication protocol and provided over-the-air (OTA) upgrade functions. First, they used power analysis to recover the ZLL master key and the OTA update keys. Then, they generated valid encrypted and authenticated firmware to infect the adjacent lamps. Therefore, with enough initially compromised lamps, a lightbulb worm can spread in a chain reaction over a large scale.  
[PERSON] and [PERSON] [82] proposed the adaptive key establishment scheme (AKES), which makes handling reboots securely in 802.15.4. As the loss of anti-replay data and frame counters stored in RAM causes pairing problems, AKES stores these data in nonvolatile memory. AKES self-adaptively broadcasts HELLO messages to discover neighbors and start a new session with each neighbor to solve the storage issue mentioned above. The assessment results showed that the proposed scheme reduces the energy and memory consumed to establish session keys.