## 4 End to End Security Analysis on the Proposed IIoT Security Architecture
### Application Layer  
The application layer is a high abstraction level that leverages transport layer protocol, such as transmission control protocol (TCP) and user datagram protocol (UDP), to support data transfer and exchange between host-to-host client-server or peer-to-to-peer model. This section focuses on IIoT related session layer protocols includes Simple object access protocol (SOAP), representational state transfer hypertext transfer protocol (REST HTTP), data distribution service for real-time systems (DDS), message queue telemetry transport (MQTT), extensible messaging and presence protocol (XMPP), advanced message queuing protocol (AMQP), and constrained application protocol (CoAP) [111; 112; 113; 114]. The details of their security analysis are presented in Table 10.  
Message exchange pattern (MEP) of these protocols can be categorized into two groups, request/response pattern (SOAP, REST HTTP, XMPP, CoAP) and subscribe/publish pattern (DDS, MQTT, XMPP, AQMP). Request/response pattern is the most commonly used synchronous pattern, in which the client requests information from the service by sending a request message and expects a response message from the service within a defined timeout. Subscribe/publish pattern is an asynchronous pattern that broadcasts data regularly to subscribers interested in their data, providing better network scalability and greater dynamic network topology. Security mechanisms of these protocols are primarily dependent on transport layer security/secure socket layer (TLS/SSL) mechanism. Communication and data protection of MQTT, XMPP and AMQP are directly secured by using TLS/SSL. The communication of REST over an HTTP is encrypted with a TLS/SSL connection. The datagram transport layer security (DTLS) in CoAP is a stream-oriented TLS/SSL and inherits most of the featuresfrom TLS/SSL without any optimization for a constrained resource environment. SOAP enjoys a stronger security feature with its web service security (WS-Security). However, it spends much bandwidth in communicating metadata. As TLS/SSL mechanism only provides limited security assurance for confidentiality, integrity and authentication, these protocols are still vulnerable to application layer threats (e.g., SQL injection, invalidated object indirect reference, DoS Attack and cross-site request forgery), SSL stripping, and password-based attacks (e.g., brute force attack, dictionary attack and rainbow table attack). Conventional cryptographic techniques such as MD5, DES, SHA-1, and RSA are being used to bolster their security defences, despite the fact that these algorithms have been broken and demonstrated to be insecure. In the future, several issues such as lightweight cryptography, reliability of message communication, interoperability issues with heterogeneous nodes, and the scalability of public key infrastructure to handle a large scale of key management need to be addressed for further spurring IIoT development. \begin{table}
\begin{tabular}{p{14.2 pt} p{14.2 pt} p{14.2 pt} p{14.2 pt} p{14.2 pt} p{14.2 pt} p{14.2 pt} p{14.2 pt}} \hline
** \begin{tabular}{} \end{tabular} ** & \multicolumn{3}{c}{ \begin{tabular}{c} **Analysis of** \\ **Security** \\ **Requirement** \\ \end{tabular}  } & \multicolumn{3}{c}{**Deployed Security Countermeasures**} & \multicolumn{3}{c}{**Ongoing Challenges and Future Woks**} \\ \cline{3-8}  & **C** & **I** & **A** & **V** & & & & \\ \hline \hline \multirow{9}{*}{SOAP} & \multirow{9}{*}{Transport Protocol:} & \multirow{9}{*}{ \begin{tabular}{c} Transport Protocol: \\ HTTP (common use), \\ SMTP, TCP, UDP, \\ JMS; \\ Implement QoS; \\ Architecture; \\ Request/response \\ \end{tabular}  } & \multirow{9}{*}{ \begin{tabular}{c} Transport Protocol: \\ HTTP (common use), \\ SMTP, TCP, UDP, \\ JMS; \\ Implement QoS; \\ Architecture; \\ Request/response \\ \end{tabular}  } & \multirow{9}{*}{ \begin{tabular}{c} Password-based attacks on the weak \\ chosen password of username token \\ profile \\ \end{tabular}  } \\  & & \(\surd\) & \(\surd\) & \(\surd\) & \(\times\) & \(\bullet\) & \