# A Secure Internet of Things Smart Home Network: Design and Configuration
## 4 Demonstration
### Performance Evaluation  
In our simulation, our interest was to observe how long additional processing delay is introduced at the home gateway when our proposed access controls are activated. We simultaneously run two concurrent emulators to evaluate the end-to-end delay for two different cases.  
* Case 1: when the access control is activated
* Case 2: when the access control is deactivated  
All simulations are performed in the same network environment in terms of packet size, network bandwidth, transmission distance, hop counts, and the level of background traffic. This environment does not allow various delays such as transmission delay, propagation delay and queuing delay to affect the difference in end-to-end delays between the two cases. Therefore, if there is an observed difference, it can be considered to be an additional processing delay. We run a web browser at the IoT server to access the web server, www.jinsukbaek.com (accessed on 27 May 2021), notes: this website exists only in simulation, located in an external network. Our experiment was conducted over 15 different time frames. In each time frame, the IoT server attempts to connect to the web server 5 times, and we observe the maximum and average end-to-end delay of the five accesses to get a front web page of the web server. Since we could not find any difference on minimum end-to-end delay, the observed maximum and average end-to-end delay over time frames are shown in Figures 16 and 17, respectively.  
Although both the maximum and the average end-to-end delays between the two cases are showing a similar pattern, we can see that the average end-to-end delay shows a more consistent and stable performance over time frames. In both the maximum and the average end-to-end delays, we can see that case 1 introduces more end-to-end delay than case 2 in most time frames. This is because the IoT server must pass through the access-list 102 check list to contact the DNS server to get an IP address of the web server and its outbound HTTP request message should be checked against the access-list 102 if it is destined to the inside-subnet. However, case 1 does not always impose the extra delay in all time frames because the IP address of the web server can be cached in its local web browser while the destination IP address can also be saved in the home gateway's routing table.  
Figure 16: Maximum end-to-end delay between IoT server and web server.  
We also evaluated the end-to-end delay from a smart phone in an external network to IoT server for two cases. In the case 2, we only deactivated one rule from access-list 100 checking if HTTP or MQTT requests are destined to the inside-subnet. The NAT/PAT rule translating the gateway interface 20.20.20.1 to the corresponding IoT server address 192.168.1.2 with port overload is still applied since it is required for a normal network operation rather than security control. We could not find any meaningful difference between the minimum, maximum, and average end-to-end delay between the two cases. As we can see in Figure 18, one case does not outperform the other over time frames. The effect of the excluding one rule from access-list 100 is negligible. Furthermore, its performance depends on the underlying 4G cellular tower.  
The introduced average additional processing delays over 15-time frames are 6.13 ms in Figure 16, 2.4 ms in Figure 17, and 0.6 ms in Figure 18, respectively. When we consider today's state of the art routers' processing capability, our proposed secure configuration will not impose any significant performance degradation of network to achieve enhanced security.