# From Bottom of Sea to Space: Quo Vadis IoT? So What About Security?
## 3 Security Challenges and Mechanisms
### IoT in the Sky
#### Internet of Aerial Vehicles
The authentication method used is a multi
signature smart contract. This allows for authentication of terminals by using consortium blockchain. To securely transmit data, the parties negotiate a session key for communication. The method was analysed to prove its effectiveness and efficiency. * Encryption The need for real-time data is useful in some types of drones. Instead of storing information on the server, it is sent directly to the user. For this to happen, there needs to be a high level of privacy. In [203], the authors propose a robust authenticated key management protocol. The scheme uses a high level Authenticated Encryption with Associated Data (AEAD) along with ECC and SHA-1. The scheme validates a user and allows for the creation of a session key for secure communication with the drone. A random oracle model is used to validate that the session key is secure. Compared to related authentication key management schemes, the proposed scheme has lower storage costs, overhead, and computational costs. Encryption in drones can be used in the creation of session keys to create secure channels for communication. In the process of creating this secure channel, it is important to maintain the anonymity of the drone and the user. The authors of [204] propose that in any session, there should be a focus on pseudonymity and unlinkability. If a protocol only used pseudonymity, then when communication is analyzed, the user's privacy could be breached. If a protocol only takes into account unlinkability, then a stolen drone could have its session key stolen. On the basis of these principles, the authors propose a system of first key agreement. The protocol works by first sending the drone a pseudonym, being used for the session, to the user. The user then decrypts the pseudonym using the password that the user obtains when registering the drone. The user then sends their pseudonym to the server. The server then creates two session keys sent to the drone with the user's pseudonym. Once decrypted, the drone sends the session key to the user to decrypt and verify with the server, which allows for an authenticated connection. Through testing of efficiency, the authors found that their protocol was more inefficient than other schemes, but when looking at other methods with key exchange protocols providing full forward secrecy, it was one of the most efficient in terms of computational costs. Internet of Unmanned Aerial Vehicles (UAVs) A UAV is a remotely controlled aerial vehicle. The Internet of UAVs has been studied in some recent research works [205]. It has found its applications in object tracking and similar areas [206]. The recent literature highlights the following security challenges and mechanisms with respect to the Internet of UAVs: * Security Mechanisms * Malware Detection Advanced persistent threat (APT) has become one of the biggest threats to security in recent years. The IoT tends to have less secure structures than most systems, so APT is an especially egregious threat, especially for UAVs. If malware is inserted into a UAV, it is able to then communicate with a command and control center (C&C) which is responsible for communication with the drone. The current ideology behind malware detection is through the monitoring of behaviors when communicating with the C&C. This would typically work, but APT uses a low traffic mode that allows it to mix in normal communication to confuse the malware detection system. The authors of [207] propose a way of detecting this attack. APT attacks use domain name systems (DNS) to locate C&C centers and will log information on the DNS logs each time. The logs can be observed for signs of malware. With this information, the authors proposed a malware detection scheme using string matching and Fourier transformation. To preprocess the data, the authors convert DNS time stamps of DNS requests into strings. Then to monitor the requests, the authors use a trained random forest model to identify suspicious activity in the logs and to alert to compromised UAVs.