## 2 Security on LoWPAN Networks
Some solutions were proposed to establish and manage cryptographic keys between nodes to enable authentication and encryption mechanisms [21] while others have been proposed to protect routing protocols [22]. Progress has been achieved on specialized secure services, such as secure localization, secure data aggregation and secure time synchronization [23, 24]. There are also many proposals of security mechanisms addressing only particular attacks or used in particular layers as security tools. However, the major disadvantage with single layer security approaches is that security mechanisms are introduced on each layer, which in most of the cases tends to overall solutions with waste of resources power and exaggerated delays on message forwarding. Recently, researchers are pursuing security-integrated systems instead of concentrating on particular attacks or layered based mechanisms. Some frameworks have been proposed to address simultaneously more than one security attack or to mitigate attacks using more than one security mechanism [25]. The most significant proposal is Security Protocols for Sensor Networks (SPINS) [26] which is composed by the Secure Network Encryption Protocol (SNEP) and micro-TESLA. SNEP provides data confidentiality and two-way data authentication with reduced overhead while micro-TESLA is a lightweight version of Time Efficient Streamed Loss-tolerant Authentication (TESLA) providing authenticated streaming broadcast. SPINS does not cover, though, some relevant security issues, such as compromised nodes detection, DoS attacks or network and traffic analysis issues. Moreover, SPINS assumes a static network topology ignoring the ad hoc and mobile nature of LoWPAN networks. In [27], the authors propose a framework to provide secure cluster formation, security key management scheme and secure routing. It includes three components: a security mechanism to provide secrecy for communications in LoWPAN, an efficient session key distribution mechanism and a centralized key revocation scheme. The proposed framework does not depend on a specific key mechanism scheme and can be used to support many security applications, such as secure group communications. Currently, the control of the access to the network is considered a critical security service in LoWPAN networks because it can be used to prevent malicious nodes from joining the network and launching internal attacks [15]. With such service, only eligible nodes can access the network, while queries from external attacker nodes are not answered or forwarded by regular nodes. In defining the recently proposed access control schemes, three main aspects can be distinguished: new node addition, authenticated querying and user authentication [14]. Query authentication schemes guarantee data origin authentication and data integrity while user authentication schemes are the basic solution used for the access control issue. New node addition schemes use mechanisms based on Elliptic Curve Cryptography (ECC) [28] to prevent malicious nodes from joining the network. Most of the secure network access systems provide node authentication and packet authentication, integrity verification and confidentiality. In [29], a self-certified elliptic curve Diffie-Hellman (ECDH) cryptosystem is used to establish a pairwise key between a new sensor node and a required Certificate Authority (CA) element, which can be implemented on regular nodes or on more powerful nodes such the border routers. The CA launches a two-way authentication procedure with the new node and establishes a pairwise key using the self-certified ECDH based protocol. The ECDH is used to guarantee nodes identification and to deliver a shared key to the new node. The shared key is the same for all nodes and is used to guarantee packet privacy and integrity. Note that the security of this scheme depends strongly on the secrecy of the shared key, _i.e._, it fails if a single node is compromised.