# A Survey of Internet of Things (IoT) Authentication Schemes +
## 5 Analysis of IoT Authentication Schemes
### Generic IoT Applications
The proposed scheme used a customized data encapsulation to reduce both the computation and communication overhead. The authors of [69] presented a two-way IoT authentication protocol. The authentication is handled using the Datagram Transport Layer Security (DTLS) protocol with the exchange of certificates based on RSA. This work is an enhancement of the work reported in [68], a two-way IoT authentication schemes based on RSA with the use of Trusted Platform Module (TPM). In [146], the authors proposed an authentication protocol based on PUFs that uses the zero-knowledge proof of knowledge (ZKPK) of discrete logarithm. The protocol requires a user to input a password to the device each time it requires authentication. The limitation of this protocol is providing the authentication between the user end device and the server without also taking into consideration authentication between end devices. The use of ZKPK increased the complexity of this protocol. After doing a security analysis for some of previous scheme for the authentication of devices in Low-earth-orbit satellite (LEOs) communication systems, the authors of [147] proposed an authentication and key management scheme based on Elliptic curve and symmetric cryptography. The proposed scheme provides a mutual authentication between the user and the Network Control Center (NCC), besides its resilience to stolen verifier, replay, DoS, password guessing, and impersonation attacks. The authors of [148] presented a two-factor device authentication scheme. They used both the digital signature and a novel factor called the device capability. Device capability is similar to a functional operation solved by the device, which could be a mathematical challenge or even a cryptographic-based puzzle. Such scheme can be used to authenticate both the end-device and the server too. Using a secure TLS channel, the device sends a request for communication to the server, the server then sends a nonce encrypted with its private key and the timestamp to avoid replay attacks. The device then decrypts the signature, solves the nonce with functional operation, signs the result with its private key and sends it back to the server. The server then checks the valid signature and the result of the functional operation to authenticate the device. The authors of [149] proposed a new authentication scheme for IoT system based on PUF. The scheme is based on generating a response of a challenge, then feeding the response to another PUF as a challenge. The two PUFs are connected using Linear Feedback Shift Register (LFSR). The main drawback of such design is its complexity, and the lack of security analysis. Machine learning attacks to create a model of PUF is not considered. The authors of [150] proposed a new authentication scheme for IoT systems based on blockchain called Bubbles-of-Trust. The idea is to divide the devices into virtual zones called bubbles in which they identify and trust each other (concept of grouping). Then, the communication (transaction) between different devices is controlled and validated by the public blockchain implemented using Ethereum. To provide authentication for IoT system integrated in cloud computing environment, the authors of [151] provided a lightweight two-factor authentication scheme based on one-way hashing and XOR operation. The authentication process is made up of three steps: registration, verification,and password renewal step. The computation cost of such scheme is considered and its efficiency is shown in resource-constrained environments. To ensure the security of IoT systems, the authors of [152] took advantage of PKI by using X.509 digital certificates to ensure the authentication of devices within the system. Such certificates can be used for device identification and also the device integrity. The authors of [153] proposed a model to addresses the IoT security issues. They used Object Naming service (ONS) to query the Domain Name Server (DNS) to search for information about a device using either its IP address or electronic product Codes (EPC).