# A Communication-Efficient Secure Routing Protocol for IoT Networks +
## 5 Comparison Methods
### Aran[10]  
Similar to SAODV, ARAN uses digital signatures. However, this protocol assumes that only nodes issued with a public key certificate [28] from a certificate authority server can join the network. By requesting a public key certificate when exchanging route information, ARAN guarantees that nodes exist on the route.  
This method sets a trusted certificate authority server \(\mathsf{T}\). \(\mathsf{T}\) issues and distributes public key certificates to each node. The public key certificate that node \(\mathsf{A}\) receives from \(\mathsf{T}\) is expressed as  
\[\mathsf{cert}_{\mathsf{A}}=(\mathrm{IP}_{\mathsf{A}},K_{\mathsf{A}+},t,e)K_{ \mathsf{T}-}, \tag{12}\]  
where \(\mathrm{IP}_{\mathsf{A}}\) is the IP address of node \(\mathsf{A}\), \(K_{\mathsf{A}+}\) is \(\mathsf{A}\)'s public key, \(t\) is a timestamp indicating the time at which the certificate was issued by \(\mathsf{T}\), and \(e\) is the certificate validity time. The certificate is distributed by \(\mathsf{A}\) and signed by \(\mathsf{T}\)'s private key. When source node \(\mathsf{S}\) establishes a route to destination node \(\mathsf{D}\), \(\mathsf{S}\) generates and broadcasts an RREQ packet to its neighboring nodes. This packet can be written as  
\[(\mathrm{RDP},\mathrm{IP}_{\mathsf{D}},\mathrm{Nonce_{S}})K_{\mathsf{S}-}, \mathsf{cert}_{\mathsf{S}}, \tag{13}\]  
where RDP is a packet identifier, \(\mathrm{IP}_{\mathsf{D}}\) is the IP address of the destination node \(\mathsf{D}\), and \(\mathrm{Nonce_{S}}\) is a nonce. This RREQ packet contains a signature with \(\mathsf{S}\)'s private key and a public key certificate issued by \(\mathsf{T}\). When this packet is received by \(\mathsf{S}\)'s neighbor node \(\mathsf{B}\), \(\mathsf{B}\) first verifies the signature using \(\mathsf{S}\)'s public key and then confirms that the certificate falls within the valid time. If both are verified, then \(\mathsf{B}\) establishes a reverse route to \(\mathsf{S}\). Then, \(\mathsf{B}\) forwards the received RDP to deliver it to the destination node \(\mathsf{D}\). At this time, \(\mathsf{B}\)'s signature and \(\mathsf{B}\)'s certificate are conveyed to the received packet as  
\[((\mathrm{RDP},\mathrm{IP}_{\mathsf{D}},\mathrm{Nonce_{S}})K_{\mathsf{S}-})K _{\mathsf{B}-},\mathsf{cert}_{\mathsf{S}},\mathsf{cert}_{\mathsf{B}}. \tag{14}\]  
When this packet is received by node \(\mathsf{C}\), which is a neighbor of \(\mathsf{B}\), the signatures of \(\mathsf{S}\) and \(\mathsf{B}\) are verified. If both are successful, \(\mathsf{C}\) establishes a reverse path toward \(\mathsf{S}\), then, in addition to \(\mathsf{B}\), forwards the RDP itself, thereby removing \(\mathsf{B}\)'s signature and certificate from the packet and using its own signature and certificate instead. This process is repeated until the RDP reaches \(\mathsf{D}\). After receiving the RDP, \(\mathsf{D}\) verifies the signatures of \(\mathsf{S}\) and the neighboring node, generates an RREP packet (denoted as REP in ARAN), and sends it back to \(\mathsf{C}\) using the reverse route established during the RDP exchange. The REP generated by \(\mathsf{D}\) is expressed as  
\[(\mathrm{REP},\mathrm{IP}_{\mathsf{S}},\mathrm{Nonce_{S}})K_{\mathsf{D}-}, \mathsf{cert}_{\mathsf{D}}, \tag{15}\]  
where REP is a packet identifier, \(\mathrm{IP}_{\mathsf{S}}\) represents the IP address of the source node \(\mathsf{S}\), and \(\mathrm{Nonce_{S}}\) is the nonce described in the RDP received from \(\mathsf{S}\). This REP is forwarded until it reaches node \(\mathsf{S}\), and the intermediate node writes the signature and verifies the signature generated by the destination. If \(\mathsf{S}\) successfully receives the REP and verifies \(\mathsf{D}\)'s signature and certificate, a path from \(\mathsf{S}\) to \(\mathsf{D}\) is successfully established.