# Security of IoT Application Layer Protocols: Challenges and Findings
## 3 Application Layer Protocols  
As already discussed, communication protocols at the application layer are a fundamental component of the IoT ecosystem since they are at the basis of all the interactions among IoT devices and among IoT devices and cloud/edge infrastructure [17; 18; 19]. The typical functions implemented by these protocols deal with messaging and service discovery. In particular, messaging refers data sharing and exchanges among devices, while discovery refers to detecting devices and services being offered. Table 1 summarizes the main characteristics of the seven standard protocols analyzed in this paper, namely five messaging protocols (i.e., MQTT, CoAP, AMQP, DDS and XMPP) and two service discovery protocols (i.e., mDNS and SSDP). As can be seen, the protocols differ for many aspects, such as architectural and interaction models and transport protocols. Some protocols use centralized, i.e., client/server, architectures, while others are based on fully distributed architectures. For example, for protocols such as MQTT and AMQP, the broker plays the server role and interacts with clients by receiving and forwarding messages. Message exchanges are in general implemented according to publish/subscribe or request/response models. Similarly, service discovery can be based on request/response or query/response models. It is also worth noting that some protocols offer fully reliable data transfer since they are built on top of the TCP transport protocol, while others--built on top of UDP--are loss-tolerant. In particular, service discovery protocols are based on UDP, whereas messaging protocols on TCP. The choice of the application protocol depends on the nature of the IoT systems and their requirements. MQTT and CoAP are particularly suitable for services requiring data collection (e.g., sensor updates) in constrained environments. On the contrary, AMQP, DDS and XMPP address specific service requirements, namely business messaging, instant messaging and online presence detection and real-time exchanges, respectively. In terms of service discovery, mDNS and SSDP are the protocols of choice for IoT environments. Concerning security services, the solutions that ensure integrity and confidentiality of the exchanges and provide authentication and authorization mechanisms are very diverse. Messaging protocols generally support standard as well as custom security services, whereas service discovery protocols do not support any built-in security service. Therefore, the implementation of appropriate security solutions is left to developers. As shown in Table 2, encryption mechanisms are available in all messaging protocols. For example, confidentiality is ensured by standard services such as TLS and DTLS, whereas authentication and authorization mechanisms are based on standard (i.e., SASL) or custom solutions. It is important to outline the lack of security in the protocol design. Moreover, security services are generally considered optional and must be explicitly enabled by developers. In turn, developers tend to neglect these services in the implementation and configuration of their applications. Additionally, end-to-end encryption is often too expensive to cope with the constrained capabilities (e.g., bandwidth, computing power) of many IoT devices. Therefore, as we will discuss in the rest of the paper, devices