## 4 Security and Privacy Countermeasures and Solutions in EC-Based IoT  
This section explains the main strategies and solutions developed to countermeasure the security and privacy attacks and threats explained in the previous section. 1. _Packet filters_ protect network resources from unauthorized use, theft, destruction, or DoS attacks. There are two kinds of packet filter policies: one policy denies specific types of packets and accepts all others, and the second one accepts specific types of packets and denies all others. 2. _Firewalls_ can be applied as software, hardware appliance, or a router with access control lists (ACLs). Some types of firewalls are: static stateless packet filter firewalls that check packets individually and are optimized for speed and configuration simplicity, stateful firewalls that allow or deny traffic by tracking communication sessions, and proxy firewalls that inspect packets, have support for stateful tracking of sessions, and are able to block malicious traffic or unacceptable content [120]. 3. Effective techniques developed to tackle _countermeasures for malicious hardware/software injection_ are as follows: (1) side-channel signal analysis, which detects both hardware Trojans by implementing timing, power, and spatial temperature testing analysis, and malicious firmware/software installed on EC nodes/devices by detecting unusual behaviors of nodes/devices, for instance, a significant increase in their heat, execution time, or power consumption [92]; (2) trojan activation methods, which compare the outputs, behavior, and side-channel leakages of Trojan-inserted versus Trojan-free circuits to detect and model malicious attacks [92, 105]; and (3) circuit modification or replacing, which is also an effective solution against physical/hardware, Trojan, and side-channel attacks. This countermeasure includes [92]: (a) tamper-preventing and/or self-destruction--to prevent malicious attacks, EC nodes are physically embedded with hardware, or in the worst case, the EC nodes destruct themselves and/or erase their data; (b) minimizing information leakage--in this mechanism, random noise or delay is added to the data intentionally to implement a constant execution path code and to balance Hamming weights; and (c) embedding the physically unclonable function (PUF) into the circuit hardware--this enables device identification and authentication to detect Trojan attacks. 4. _Intrusion detection system (IDS)_ is the second line of defense to mitigate security threats by [8, 32, 92, 121]: (1) monitoring network operations and communication links; (2) reporting suspicious activities, for example, when predefined policies are breached or when invalid information is injected into the system; and (3) detecting routing attacks (e.g., spoofing or modification of information) and blackhole attacks. [PERSON] et al. [122] proposed an IDS architecture for EC-based IoT that integrates a trust evaluation mechanism using the EC platform and service template with balanced dynamics using the EC network. A more general EC IDS architecture has been proposed by [PERSON] et al. [123], showing an efficient, fair resource allocation in EC-based IoT systems. The hierarchical distributed intrusion detection system (HD-IDS) [124] based on the fog architecture is a hierarchical protection detection that deploys multiple IDSs in different network layers and performs detection by multiple layers collaboratively with traffic