# Security of IoT Application Layer Protocols: Challenges and Findings
## 4 Messaging Protocols
### Mitigations  
The CoAP standard provides some general mitigation measures to cope with the types of threats and attacks discussed in the previous section. In particular, the standard strongly encourages the adoption of DTLS for securing CoAP nodes.  
In the literature, several works focus on the identification of specific mitigation measures for different scenarios (see, e.g., [43; 44; 45; 46; 47; 48; 49; 50; 51; 52; 53; 54]). In detail, the mitigations proposed by these works mainly focus on two aspects:  
1. Access control mechanisms;
2. Secure communication.  
In the framework of access control, a collection of general use cases for authentication and authorization in constrained environments is presented in [53]. The report identifies the main authorization problems arising during the life cycle of a device and provides a guideline for implementing effective solutions. [PERSON] et al. [50] developed a service-level access control on low-power devices. The proposed approach is based on the authentication of CoAP nodes and the usage of tickets to grant access to resources.  
Another mitigation measure presented in the literature deals with secure node bootstrapping. This process is particularly important and its misconfiguration could compromise the entire network. In fact, it allows a node to collect the information necessary to join a CoAP-enabled network as an authenticated node. In this framework, [PERSON] et al. [44] propose a three-step process to bootstrap a new node. The process starts with a discovery phase where the new node is detected. This node is then provided with keys to establish a secure communication channel. Finally, these keys are used to perform the actual configuration of the node itself.  
In the framework of secure communication, [PERSON] et al. [47] describe and compare the DTLS libraries supported by the CoAP implementations typically encountered in industrial IoT environments. The paper outlines the need to keep an eye to new security developments because of their relevance, especially in these environments. [PERSON] et al. [55] compare the security services provided by IPSec and DTLS. This study shows that although both protocols have strengths and weaknesses, in general their overhead could be significant and drain resources of constrained devices. Several papers addressed these issues by focusing on the design of lightweight solutions to secure the communication channel between clients and servers. A header compression scheme for DTLS that leverages the 6 LoWPAN standard is proposed in [52], while the problem of reducing the number of DTLS handshakes is addressed in [49]. More specifically, this work presents a group-oriented handshake between a CoAP client and a group of CoAP servers that reduces the total computational requirements of the DTLS protocol.  
Improvements of the DTLS protocol have also been studied from the perspective of the cryptographic algorithm. In particular, as shown in [43; 45], the integration of DTLS over CoAP based on Elliptic Curve Cryptography helps in minimizing the computation overhead and ROM occupancy.  
In summary, our analysis has shown that DTLS ensures confidentiality in CoAP environments. Nevertheless, lightweight solutions are to be sought to cope with the capabilities of constrained devices.