## 1 Introduction  
Low power wireless personal area networks (LoWPAN) [1] comprise devices compliant with the IEEE 802.15.4 [2] standard and are widely used in embedded applications such as environmental monitoring, smart-grids, surveillance, industrial and home automation. These applications often require a large number of small devices to cover large areas and must operate unattended for years equipped with small batteries. Many of the IEEE 802.15.4 compliant devices are characterized by small size, power constraints, small computing and storage resources and by reduced radio ranges and throughput. Self-organization, fault-tolerance, and self-optimization are the main characteristics of LoWPAN networks [2]. Initially, the IP protocol stack was considered too complex to be supported by IEEE 802.15.4 devices. Meanwhile, the scientific community, together with the industry, started to rethink many of the misconceptions about the use of IP protocol stacks in resource-constrained devices [3]. Now, the IPv6 protocol is the most consensual solution to connect LoWPAN networks to the Internet facilitating the design and deployment of applications [4]. However, IPv6 was not designed to be used in such devices and, therefore, an adaptation layer was introduced between the link layer and the network layer. This adaptation layer, proposed by IETF 6 LoWPAN Working Group [1], enables the transmission of IPv6 datagrams over IEEE 802.15.4 links by providing header compression (to reduce overhead), fragmentation (to support the IPv6 minimum MTU requirement) and support for layer-two forwarding (to deliver IPv6 datagram over multiple radio hops). Although the standard IPv6 neighbor discovery protocol [5] might work on 6 LoWPAN networks, it exhibits high overhead and includes no security support. The lightweight secure neighbor discovery optimizations for 6 LoWPAN protocol (the LSEND protocol) [6, 7] was proposed to circumvent these problems. LoWPAN networks exhibit a large number of vulnerabilities, which make them even more prone to security attacks [8, 9, 10, 11, 12] than traditional IP networks. In fact, a single LoWPAN network can scale up to thousands of nodes without any fixed infrastructure and these nodes are often installed in harsh and unattended environments. Moreover, the addition of new nodes makes the network topology dynamic and complex to manage. Several security mechanisms have been proposed, some of them defined to address some particular well-known attacks [13]. Besides protecting the network from well-known attacks, it is also important that security mechanisms be able to withstand attacks that have not been identified before [14]. If a malicious node is prevented from becoming attached to the network, it cannot communicate with any network element and, therefore, it cannot launch any type of security attack. Therefore, one way of reaching this goal is to control, at the network access level, which nodes can be attached to the network and to enforce their security compliance. Besides the security advantages, such methodology also makes the network more manageable, while increasing its reliability and extending its lifetime [15]. This paper proposes a network access control security framework for 6 LoWPAN networks, that controls the access of nodes to the network, based on administrative authorization, and enforces security compliance to the authorized nodes. The proposed framework makes use of LSEND protocol (for secure neighbor discovery and key pairwise generation), RPL (for datagram routing), and Seltuge (for security compliant code dissemination). Unlike other access control mechanisms, this proposal includes an automatic remediation mechanism to enable nodes to become security compliant, if necessary, in order to have their access granted by the network. The remainder of this paper is organized as follows: Section 2 addresses the security support requirements for LoWPAN networks and reviews the current solutions.