# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 2 Related Works  
Many works in the literature propose security systems at different protocol stack layers and in different network typologies, showing cryptography performance analysis. This section is dedicated to an overview of some of the most important contributions related to VPNs and ONs. In [1], a novel experimental WAN solution, Software-Defined Wide Area Network (SD-WAN), is proposed, entirely based on secure tunnels, implemented by the Generic Routing Encapsulation (GRE) tunneling protocol [2]. The effectiveness of the proposal is validated through two SD-WAN testbeds, covering a very long distance (from northeast to south Italy). The authors demonstrated the SD-WAN can ensure rapid recovery and resilience in the event of network failures, by leveraging an innovative Berkeley Packet Filtering (BPF)-based monitoring technique. The authors demonstrated also that SD-WAN has several advantages in terms of recovery time and high performance with respect to other solutions (e.g., Multi-Protocol Label Switching--MPLS). Reference [3] assesses a network layer-based VPN, which facilitates secure encrypted communication between remote LANs worldwide by employing Internet Protocol (IP)tunnels over a shared medium, like the Internet. The primary focus of the authors lies in demonstrating the efficiency of various VPNs, backed by several studies on contemporary practices, followed by an analysis of the Wireguard protocol. The authors of [4] provide a comprehensive analysis of MACVLAN and IPvlan modes, focusing on their architecture characteristics and their utility in enabling container communication across diverse network segments within complex application scenarios. The proposed work details the setup of container Overlay Networks in both single-machine and multi-machine environments, offering insights into the intricacies of these modes. Through the evaluation of key network indicators such as round-trip time (RTT), bandwidth, and jitter, using tools like Ping and Iperf, the research assesses the end-to-end communication performance of containers. The experimental results indicate that IPvlan mode demonstrates superior network performance compared to MACVLAN, presenting a more extensive and adaptable application scenario for container Overlay Networks. This finding highlights the significance of selecting the appropriate network mode based on specific performance and scalability requirements within containerized environments. The detailed contribution given in [5] presents a comprehensive approach to studying VPNs in general. It emphasizes that understanding VPN technology necessitates consideration of the values and motivations of individuals within organizations. A significant discovery highlights the divergent perceptions and interpretations of the terms VPN, _security_, and _privacy_ among corporate employees. In Ref. [6], attention is focused on the widespread utilization of Secure Socket Layer (SSL)-VPN to ensure both authentication and data confidentiality between the client (typically a web browser) and the server (SSL server). In Refs. [7, 8], VPN technology is extensively examined. Specifically, these works delve into the vulnerabilities and suboptimal performance experienced under heavy loads by web browser-based SSL VPNs, which are limited to supporting only Windows operating systems. The authors of [9] justify the selection of the IPvSec-IKEv2 suite over other potential implementations such as SSL/TLS VPN or SSH Tunnel by emphasizing the security of the IP communication layer. This choice is motivated by the desire for _transparency_ for layers above IP within IPvSec-IKEv2, as well as the ability to promptly update encryption in the event of a compromise in the data channel. In the study detailed in [10], the use of IPvSec for creating VPNs tailored to _e-business_ requirements is evaluated. A Linksys router, operating both as an access point and a VPN concentrator, is employed, with OpenSWAN serving as a system daemon.