# Security of IoT Application Layer Protocols: Challenges and Findings
## 3 Application Layer Protocols
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Protocol**} & \multirow{2}{*}{**Standard**} & \multicolumn{3}{c}{**Function**} & \multicolumn{3}{c}{**Architectural**} & \multicolumn{2}{c}{**Interaction**} & \multirow{2}{*}{**Transport**} \\  & & & & **Model** & & & **Model** & & **Protocol** \\ \cline{3-8}  & & **Messaging** & **Discovery** & **c/s** & **Decentralized** & **Pub/Sub** & **Req/Resp** & **TCP** & **UDP** \\ \hline MQTT & OASIS & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & \\ \hline CoAP & IETF & \(\bullet\) & \(\circ\) & \(\bullet\) & & \(\circ\) & \(\bullet\) & \(\circ\) & \(\bullet\) \\ \hline AMQP & OASIS & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & \(\circ\) & \(\bullet\) & \\ \hline DDS & OMG & \(\bullet\) & \(\circ\) & & \(\bullet\) & \(\bullet\) & \(\circ\) & \(\bullet\) & \(\bullet\) \\ \hline XMPP & IETF & \(\bullet\) & \(\circ\) & \(\bullet\) & & \(\bullet\) & \(\bullet\) & \(\bullet\) \\ \hline mDNS & IETF & & \(\bullet\) & & \(\bullet\) & & \(\bullet\) & \(\bullet\) \\ \hline SSDP & UPnP & & \(\bullet\) & \(\bullet\) & & & \(\bullet\) & \(\bullet\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of the main characteristics of the most popular application layer protocols for IoT environments. The bullets refer to native features of the protocols, while the circles to additional features supported by the protocols. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Protocol**} & \multicolumn{2}{c}{**Authentication**} & \multicolumn{2}{c}{**Authorization**} & \multicolumn{2}{c}{**Confidentiality**} \\ \cline{2-5}  & **SASL** & **Custom** & **Custom** & **TLS** & **DTLS** \\ \hline MQTT & & \(\bullet\) & & \(\bullet\) & \\ \hline CoAP & & & & & \(\bullet\) \\ \hline AMQP & \(\bullet\) & & & & \(\bullet\) \\ \hline DDS & & \(\bullet\) & \(\bullet\) & \(\bullet\) & \(\bullet\) \\ \hline XMPP & \(\bullet\) & & \(\bullet\) & \(\bullet\) & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Summary of the security services supported by the messaging protocols. are frequently exposed to security risks specific of the protocols as well as to risks typically encountered in networked environments. In what follows, we offer a comprehensive analysis of these security issues. More specifically, for each protocol, our analysis considers the following aspects:  
* Potential threats and security attacks;
* Good practices and countermeasures to mitigate the attacks. The methodological approach followed in our study is based on the examination of the security specifications of the protocol standards and on the analysis of the CVEs collected in the National Vulnerability Database (NVD) over six years since 2014. In addition, we performed an extensive search and analysis of the literature as well as of the good practices proposed by public and private organizations, service providers and cybersecurity companies. In particular, we searched numerous websites and popular digital libraries and databases, such as ACM, IEEE, Springer, Google Scholar, Scopus.