# A Survey of Internet of Things (IoT) Authentication Schemes +
## 4 Taxonomy of IoT Authentication Schemes  
This section presents a taxonomy of IoT authentication schemes using various criteria selected based on the similarities and the main characteristics of these schemes [1,2]. As previously mentioned, the authentication can be applied at each of the three layers of the IoT architecture, which makes the diversity of the authentication techniques. These criteria are illustrated in Figure 2 and summarized as follows.  
1. _Authentication factor_ * Identity: An information presented by one party to another to authenticate itself. Identity-based authentication schemes can use one (or a combination) of hash, symmetric or asymmetric cryptographic algorithms. * Context: which can be: * Physical: Biometric information based on physical characteristics of an individual, e.g., fingerprints, hand geometry, retinal scans, etc. * Behavioral: Biometric based on behavioral characteristics of an individual, e.g., keystroke dynamics (pattern of rhythm and timing created when a person types), gait analysis (method used to assess the way we walk or run), voice ID (voice authentication that uses voice-print), etc.
2. _Use of tokens_ * Token-based Authentication: Authenticates a user/device based on an identification token (piece of data) created by a server such as OAuth2 protocol [65,66] or open ID [67].  
Figure 2: Taxonomy of IoT authentication schemes.  
Non-Token based authentication: Involves the use of the credentials (username/password) every time there is a need to exchange data (e.g., TLS/DTLS [12; 68; 69]).
3. _Authentication procedure_ * One-way authentication: In a scenario of two parties wishing to communicate with each other, only one party will authenticate itself to the other, while the other one remains unauthenticated. * Two-way authentication: It is also called mutual authentication, in which both entities authenticate each other. * Three-way authentication: Where a central authority authenticates the two parties and helps them to mutually authenticate themselves.
4. _Authentication architecture_ * Distributed: Using a distributed straight authentication method between the communicating parties. * Centralized: Using a centralized server or a trusted third party to distribute and manage the credentials used for authentication. Whether centralized or distributed, the authentication scheme architecture can be: * Hierarchical: Utilizing a multi-level architecture to handle the authentication procedure. * Flat: No hierarchical architecture is used to deal with the authentication procedure.
5. _IoT layer_: Indicates the layer at which the authentication procedure is applied. * Perception layer: Responsible for collecting, processing, and digitizing information perceived data by the end nodes in IoT platform. * Network layer: Responsible for receiving the perceived data from perception layer and processing it. * Application layer: Responsible for receiving data from the network layer, and then providing services requested by users.
6. _Hardware-based_: The authentication process might require the use of physical characteristics of the hardware or the hardware itself. * Implicit hardware-based: Uses the physical characteristics of the hardware to enhance the authentication such as Physical Unclonable Function (PUF) or True Random Number Generator (TRNG). * Explicit hardware-based: Some authentication schemes are based on the use of a Trusted Platform Module (TPM), a chip (hardware) that stores and processes the keys used for hardware authentication.