## 6 Security Solutions
### Communication Security
#### 6.2.2 End-to-End Network Security
However, the ECDH-based key exchange can still be too heavy to be supported by a highly resource-constrained IoT device, such as an IoT device with 8 MHz CPU [24]. **Compressed DEX (HIP-Slimfit):** In [120], a packet compression layer (Slimfit) is proposed between the network and HIP-DEX layer to reduce communication overheads for exchanging HIP-DEX messages. The Slimfit layer compresses the outgoing HIP-DEX packets and sends them to the network layer. On the other hand, the Slimfit layer receives the incoming packets from the network layers, decompresses the packets, and forwards them to the HIP-DEX layer. Hence, the Slimfit layer reduces communication overheads for packet fragmentation, reassembly, and retransmission in the lossy networks. The packet processing time at the layers, such as the IPSec layer, located below the Slimfit layer, is also minimized as the Slimfit layer reduces the size of the packets. **HIP Pre-Shared Key (HIP-PSK):** The HIP-PSK [122] is a variant of HIP-DEX. The HIP-PSK does not use the ECDH key agreement; instead, it relies on a pre-shared key-based key exchange scheme. In the HIP-PSK, a trusted entity named Domain Manager (DM) allows legitimate devices to join an IoT network. Every IoT device of a smart system shares a secret key (PSK) with the DM. The DM authenticates a joining device based on its shared key and then provides the device with network-access credentials (NACs), such as such as Layer-2 keys and polynomial shares [123]. After successful authentication, the DM and device compute a session key using the CMAC [124] as \(K_{s}=CMAC(PSK|puzzle|solution)\). The DM uses the session key \(K_{s}\) to send the NACs to the device securely. After joining the network, devices use Host Identity Tags and NACs for authentication and session key establishment. Two communication devices use the AMIKEY key agreement [125] scheme to compute a session to encrypt messages. The HIP-PSK is lightweight compared to HIP-BEX and HIP-DEX because the computation-intensive cryptographic primitives, such as DH and ECDH key exchange, are removed. However, an adversary can allow malicious devices to join a network by compromising the DM. As such, the HIP-PSK is vulnerable to single-point-of-failure. Furthermore, an adversary can tamper with an IoT device to extract the pre-shared key to join a network and perform identity impersonation attacks. **Lightweight HIP (LHIP):** LHIP [126] does not implement any of the security mechanisms used by HIP-BEX and HIP-DEX. LHIP does not perform host authentication and message encryption to obtain simplicity and avoid cryptographic overheads. Although messages are exchanged in plain text between peers, the LHIP provides a minimal degree of security that uses hash chains to authenticate succeeding messages and can detect session hijacking. **Analysis and Comparison:** We analyze and compare the outcomes of HIP-based methods listed in Table 9 using the metrics defined in Table 7. It can be noted that we have excluded the HIP-BEX protocol in the comparative analysis because of its inherent inaptness at constrained devices: HIP-BEX is the most computationally expensive method among the available HIP-based schemes. We notice that the collaborative HIP schemes [118; 119] are potentially advantageous for IoT systems because of their low requirements of computation and memory. The collaborative schemes, however, raise congestion in the network due to additional communications among the collaborators themselves and between collaborators and IoT devices. Thus, these schemes eventually experience high communication overhead. The analysis reveals that HIP-DEX [121] can be adopted by IoT systems that are not computation limited, e.g., an IoT system which consists of relatively resource-rich smart nodes. Both the HIP-PSK [122] and Slimfit [120] are appropriate for IoT applications because they are efficient in terms of memory, computation, and communication requirements. Neither of them, however, offer any reasonable benefits regarding scalability and interoperability.