## 6 IoT Security Solutions
### PUF-Based  
[PERSON] et al. in [246] designed a novel on board unit (OBU) with three-level security layers. The architecture of OBU is divided into four areas which are (1) Area A: Core security area which is assumed to be secured, (2) Area B: Signal transmitting area which takes input from other areas, (3) Area C: External hardware devices access area which communicates with authenticated devices, and (4) Area D: External network access area where network interface cards and PUF are embedded. The authentication scheme works in three stages which are (1) Periodically updated session keys to authenticate external networks and devices, (2) PUF for authenticating multiprocessor and information from internal area B, and (3) Hardware isolation using FPGA logic gates. [PERSON] et al. developed a scheme using both ECC and PUF [247]. TA is responsible for registering each vehicle in the network. In the registration phase, a secret key is generated using ECC output and the Vehicle ID. Unlike other PUF-based technology, it uses one CRP for each vehicle. Each vehicle is registered to the cloud server. For authentication, the vehicle raises a request to RSU, and RSU validates vehicle ID using CRP with the help of the edge server and also checks timestamp difference. The secret, along with nonce and other parameters, are exchanged between the vehicle and RSU for completing authentication. It is required to have a secured channel between RSU and the edge server. [PERSON] et al. 's work considered an RSU gateway to serve several RSUs, and once the vehicle is authenticated with an RSU of an RSU gateway, the vehicle does not need to be authenticated with other RSUs of that RSU gateway [248]. A vehicle sends its crypto-identity, constructed using a secure hash of ID, secret PUF response, and a random nonce, to RSU for authentication purposes. Every RSU has a stored challenge like [PERSON] et al. to generate a response, and the RSU encrypts received messages from vehicles using generated response and sends it to the RSU gateway. RSU gateway verifies the response and extracts messages and shares with TA using a secret key. TA generates a token that contains the session key along with CRP so that vehicle can extract the session key using CRP. This session key is being used to communicate with other RSUs of the same RSU gateway. It is required to update the CRP of each vehicle with TA periodically. [PERSON] et al. also proposed a PUF-based authentication scheme in [249]. During registration, it stores a CRP in the server and the challenge to the device memory. For authentication, the device generates a response to the stored challenge and the server compares it with the stored response. Server verification is done by diving the response and computing with a nonce. If the device gets the same response it will then generate a new CRP and will share that with the server and the server will replace the previously stored CRP. A new temporary ID and session key will be generated. It could reveal the vehicle ID as it sends the ID in a message. There could be a server impersonation attack if an adversary asks for a response from the vehicle. In [250], [PERSON] et al. presented a PUF based security solution for IoMT. A PUF based on a hybrid ring oscillator was created for the authentication mechanism in this study. CRP was saved on the server, and the IoMT device was authenticated depending on the device's answer to the server's challenge. It can withstand client impersonation attacks, but it cannot withstand machine learning or server impersonation attacks. For secure communication in a smart grid, [PERSON] et al. [251] proposed an authentication scheme using PUF. PUF is generally used to avoid storage in device memory, but the framework needs to store in edge nodes. CRPs are used for control center verification in the last stage. The protocol is not free from physical attack, and the communication cost is high. [PERSON] et al. [252] used ECC and PUF to make reliable smart grid communication.