A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Network Layer <s> Real-world deployments of wireless sensor networks (WSNs) require secure communication. It is important that a receiver is able to verify that sensor data was generated by trusted nodes. It may also be necessary to encrypt sensor data in transit. Recently, WSNs and traditional IP networks are more tightly integrated using IPv6 and 6LoWPAN. Available IPv6 protocol stacks can use IPsec to secure data exchange. Thus, it is desirable to extend 6LoWPAN such that IPsec communication with IPv6 nodes is possible. It is beneficial to use IPsec because the existing end-points on the Internet do not need to be modified to communicate securely with the WSN. Moreover, using IPsec, true end-to-end security is implemented and the need for a trustworthy gateway is removed. In this paper we provide End-to-End (E2E) secure communication between IP enabled sensor networks and the traditional Internet. This is the first compressed lightweight design, implementation, and evaluation of 6LoWPAN extension for IPsec. Our extension supports both IPsec's Authentication Header (AH) and Encapsulation Security Payload (ESP). Thus, communication endpoints are able to authenticate, encrypt and check the integrity of messages using standardized and established IPv6 mechanisms. <s> BIB001 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Network Layer <s> The vision of the Internet of Things considers smart objects in the physical world as first-class citizens of the digital world. Especially IP technology and RESTful web services on smart objects promise simple interactions with Internet services in the Web of Things, e.g., for building automation or in e-health scenarios. Peer authentication and secure data transmission are vital aspects in many of these scenarios to prevent leakage of personal information and harmful actuating tasks. While standard security solutions exist for traditional IP networks, the constraints of smart objects demand for more lightweight security mechanisms. Thus, the use of certificates for peer authentication is predominantly considered impracticable. In this paper, we investigate if this assumption is valid. To this end, we present preliminary overhead estimates for the certificate-based DTLS handshake and argue that certificates - with improvements to the handshake - are a viable method of authentication in many network scenarios. We propose three design ideas to reduce the overheads of the DTLS handshake. These ideas are based on (i) pre-validation, (ii) session resumption, and (iii) handshake delegation. We qualitatively analyze the expected overhead reductions and discuss their applicability. <s> BIB002 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Network Layer <s> Security and privacy are among the most pressing concerns that have evolved with the Internet. As networks expanded and became more open, security practices shifted to ensure protection of the ever growing Internet, its users, and data. Today, the Internet of Things (IoT) is emerging as a new type of network that connects everything to everyone, everywhere. Consequently, the margin of tolerance for security and privacy becomes narrower because a breach may lead to large-scale irreversible damage. One feature that helps alleviate the security concerns is authentication. While different authentication schemes are used in vertical network silos, a common identity and authentication scheme is needed to address the heterogeneity in IoT and to integrate the different protocols present in IoT. We propose in this paper an identity-based authentication scheme for heterogeneous IoT. The correctness of the proposed scheme is tested with the AVISPA tool and results showed that our scheme is immune to masquerade, man-in-the-middle, and replay attacks. <s> BIB003
Network layer is responsible for transmitting and processing the sensors data. Since it carries a large amount of data, it is highly prone to security attacks such as DoS, Man in the middle, DDoS attacks etc. Raza et al. BIB001 proposed a mechanism that supports End to End secure communication between the Internet and IP sensor networks. The proposed work features IPsecâȂŹs Authentication Header (AH) and Encapsulation Security Payload (ESP) that enables the endpoints to authenticate, encrypt and check the integrity of the messages using traditional IPv6 mechanisms. Zhang et al.  proposed a lightweight algorithm to prevent against DDoS attacks over IoT network environment. The author has tested the algorithm against different groups of network nodes such as working node, attacker node, monitoring node and legitimate user node. The author also describes that thereâȂŹs only one chance for an attackerâȂŹs request to be served after that the packets will be dropped and the request is sent to the attacking list in the second attempt. The results showed that the proposed algorithm is capable of preventing and detecting Distributed Denial of Service attacks compared to the other existing systems. Salman et al. BIB003 discussed authentication techniques as one of the feature that would mitigate the security issues in IoT. They proposed identitybased authentication scheme to address the heterogeneity in IoT and to integrate the different protocols in IoT by applying the concept of Software Defined Networking (SDN) on IoT devices. The effectiveness of this scheme was tested using AVISPA tool and the evaluation showed that the scheme is immune to masquerade attack, man-in-the-middle attack, and replay attack. Santos et al.  introduced a mutual authentication architecture that allows resource constrained devices to use Datagram Transport Layer Security (DTLS) for secure communication between the internet BIB002 investigated the assumption of using certificates and lightweight security solutions for peer authentication in the IoT. The author also analysed the preliminary overhead reduction and discuss their applicability for the certificate-based DTLS handshake. The author designed three main ideas to reduce the overheads of the DTLS handshake which are based on session resumption, pre-validation and handshake delegation. The authors 44 46 have proposed different solutions against DoS, replay, man-in-the-middle and other attacks in the network layer. The author  has tested the algorithm in different group of working nodes and are capable of detecting and preventing Distributed Denial of Service (DDoS) attacks whereas the author 46 make use of mutual authentication architecture that allows resource constrained devices to use Datagram Transport Layer Security (DTLS) to prevent DoS attacks. The authors 44 46 make use of DTLS to provide authentication service in the network layer. The author in BIB003 introduced two new main mechanisms i.e. Optional Handshaking Delegation and the Transfer of Session that prevents DoS attacks whereas the author 47 designed three main ideas to reduce the overheads of the DTLS handshake which are based on session resumption, pre-validation and handshake delegation.