## 6 Security Solutions
### Communication Security
#### 6.2.3 End-to-End Transport Security
The authors implemented the proposed solution on Opal sensor nodes with 48 MHz processors and 48 KB RAM [25] and provided a performance evaluation regarding computation, communication, and memory overheads for the DTLS handshaking and data transmission phases. Although the proposed solution showed performance improvement for Opal sensor nodes, the scheme may not perform well for a heavy resource-constrained device, such as T-Mote Sky [24] and Z1-Mote [23], because the storage capacity and computation speeds of these devices are less than the Opal sensor nodes. Additionally, the proposed system cannot process certificate chains and revocation lists. Finally, the proposed approach is not cost effective for an IoT system that comprises a significant number of nodes because there is a considerable cost of buying the TPM chips and embedding them with every device of the smart system. **DTLS Pre-Shared Key (DTLS-PSK):** The authors in [122] proposed a pre-shared key-based authentication method [129] for DTLS that allows IoT devices to join a network securely. In the proposed system, every device of an IoT network shares a secret with a trusted entity of the network named as Domain Manager (DM). An IoT device and the DM perform the DTLS-PSK procedure for authentication. The DM provides network access credentials to the IoT device after successful authentication. However, once a device joins the network, the proposed system does not follow the DTLS protocol to protect communication between two peers. Instead, devices use the AMIKEY key agreement [125] to ensure the confidentiality of messages. The DTLS-PSK scheme has less communication overhead compared to the public key-based DTLS scheme because it reduces the number of exchanged messages. However, the scheme is vulnerable to a single point of failure because an adversary can take control of an entire IoT system by compromising the DM. **Modified DTLS:** The MTU of an IoT network is 127 bytes [68]. The DTLS headers are too large to fit in a single MTU and sent in multiple fragments. To reduce the size of the DTLS headers, a header compression technique is proposed in [130]. In the proposed solution, an IoT Gateway performs the header compression upon observing DTLS handshakes. The compression reduces the size of the DTLS record and handshake headers and the number of packet fragments. The improvement in the packet size reduces the number of fragments, packet processing time, and message delivery time. The energy consumption is also reduced because a sender and receiver have to process fewer packets. Although the header compression scheme increases resource efficiency, its design does not consider the function for providing backward compatibility with standard DTLS protocols. A device without the header compression module in the DTLS layer cannot communicate with a device that has header compression capabilities. **Delegation-based DTLS:** The authors in [131] separate the DTLS protocol into two phases (handshake and encryption), to reduce message delivery overheads, such as packet \begin{table}
\begin{tabular}{c c c} \hline \hline
**DTLS** & **Security Mode** & **Property** \\ \hline \multirow{2}{*}{Disabled} & \multirow{2}{*}{No security} & – No protocol security \\  & & – Relies on underlying layers security \\ \hline \multirow{6}{*}{Enabled} & \multirow{2}{*}{Pre-shared key} & – List of keys are generated \\  & & – Each key includes a list of nodes to be communicated with \\ \cline{2-3}  & & – Asymmetric key pair \\  & & – A public key is trusted but not associated with a certificate \\ \cline{2-3}  & & – Asymmetric key pair \\  & Certificate-based & – X.509 certificate binds to a public key \\ \cline{2-3}  & public key & – Signed certificate \\ \hline \hline \end{tabular}
\end{table} 
Table 10: CoAP(s) security modes and their properties. fragmentation, reassembly, loss, and retransmission. In the proposed scheme, an IoT device delegates the handshake phase to an IoT Gateway. The Gateway performs the handshake for the IoT device and sends the session key to the device.