## 4 Discussion
However, in a machine-to-machine communication case, as is the case of an IoT network, there is another important property that can be affected: availability. Let us consider a basic IoT network that is formed by a server, a channel, and a set of devices that send petitions and receive orders. A very common attack is the so-called Denial of Service (DoS), which consists of the impossibility, for instance, of the server to process and attend to the devices' requests. Given that the communication in this case is among machines, every determined request is given by a different code. Thus, the device encrypts the corresponding code by determining its request and sends it to the server. Then, the server decrypts the received message, and if the code is correct, the request is attended. Otherwise, the message is simply discarded in order to maintain efficiency. Thus, knowing the appropriate session key is crucial in order to correctly encrypt and decrypt the information. In the case of an IoT network, launching a DoS attack from a single malicious device is very difficult due to the very low capacity of the devices and the high quantity of energy that this attack would use. However, in this setting, what is more common are the so-called DDoS attacks, where a set of devices sends this malicious traffic. It is very often that these devices are part of a botnet, i.e., a set of devices that have been infected with malware and that can be controlled by a specific attacker. Thus, if the attacker knows the session key of an IoT network, then it is possible to create a botnet and make them send false requests, which are encrypted properly with the corresponding code and make the server collapse due to the impossibility of meeting so many requests. However, we can also attack the devices from the infected server in the following manner, producing a different type of attack. The server often sends commands to make the devices in its network execute some code. Then, the attacker could make the servers execute, for instance, ransomware that hijacks the information stored in the devices, making it impossible to access it when this ransomware, or any other type of malware that produces a harmful effect on the devices, is sent to the server. Other consequences of a lack of privacy in IoT environments can be found in [3] or [4] and references therein. One of the key issues nowadays in cybersecurity is authentication, which is the underlying problem in the protocol we are introducing in this paper. If there is a system that makes it possible to authenticate the source of the received messages, then an attacker will fail in this aim given that, when the incoming messages cannot be certified to be received from a trusted source, then they are simply discarded and so, this attack cannot be developed. In a network where the actors dispose of devices with enough computing and storage resources, the natural solution is to use the standard protocols for authentication. This means deploying a PKI in our network that uses certificates issued by a trusted entity that allows the receiver of any message to authenticate its source. Thus, the source will add some additional authenticating information to the message that can be verified by using the certificate issued by the trusted entity. However, this is not the case for environments such as an IoT network. As we have previously noted, these are composed mostly of light devices with very limited capabilities and that may even be powered by a battery [1]. Regarding computational capabilities, public key cryptography algorithms consume a lot of resources, and thus, this constitutes a challenge for this type of network [23]. Concerning storage capabilities, authentication protocols also require storing a list of revoked certificates and this is, again, a challenge given that the RAM is often in the order of tens of kilobytes in these light devices [11]. Alternatives to classical public key cryptography in IoT can be found in [4; 23; 24], both from a technology and algorithmic point of view.