As it was already repeatedly marked, IoT grows before the eyes, and together with it and the number of problems in the sphere of safety. For support of last, the complex of protocols of security is always necessary for the support of due protection of IoT devices.

The IoT protocols will play a vital role in the complete finite implementation of technology. They form a basis for a data stream between sensors and the outside world. They are necessary also for effective system operation and practical use of the MAC protocol and the appropriate routing protocol. For different domains several MAC protocols with access patterns, available to the user, to TDMA (without the conflicts) were offered, to CSMA (a low performance of traffic) and FDMA (without the conflicts, but requires additional diagrams in nodes). Any of them is not accepted as the standard, and with a large number of available devices search of a method of uniform functioning of all devices will be more and more problematic that of course will demand further researches ^[1].

The personal sensor can fall out of operation for several reasons; therefore, the network shall be self-setting up and allow routing in several ways. Routing protocols with several transitions are used on the mobile ad hoc networks and in terrestrial WSN. They are generally subdivided into three categories: oriented on the data-oriented on location and hierarchical and again based on different application domains. The electric power is a pacing factor for the existing routing protocols. In the case of IoT, it is necessary to mark that the trunk will be available, and the number of transitions to scenarios with several transitions will be restricted. In such scenario, the existing routing protocols shall be sufficient in implementation with little changes ^[2].

There are some obvious things which can be made for the integration of safety into IoT: the most obvious is the support of the web interface of the device. Simple things, such as check that names of users and passwords were by default changed during initial setup very much help. And changes shall not allow uses of weak passwords. Perhaps, it is necessary to consider such measures as the lock of the accounting entry after three-five abortive attempts of login. Attention shall be paid to passwords outside original changes of settings. Check of network traffic for support of the fact that codes of input do not go to cleartext is a reasonable step, and it also belongs to any diagrams of recovery of the password. Besides, for sensitive areas, such as accounting entries of the administrator, two-factor authentication can be required.

The web interface study for protection against the general attacks, such as Cross-Site Scripting, cross-website fake of requests and SQL injection also shall be carried out by the development of reliable protocols. These attacks are harmful if they are successful, but they are also relatively unaffected by the nature that does them preventable in case of successful configuring of protocols ^[3].

Many protocols were developed at all levels of a stack of International Organization for Standardization (ISO) to ensure the functioning of IoT devices. From exchange protocols messages, such as protocol of restrictions (CoAP), to highly expanded routing protocols, such as routing protocol for low-power and Lossy Networks (RPL). The importance for the understanding of these protocols is that they were developed taking into account saving the electric power and also with low requirements to computation and memory that, certainly, is extremely important by operation with IoT.

Solutions of Safety by IP

Internet exchange of keys (IKEv2)/IPsec and the protocol of identification of a host (HIP) is at the level or higher than the level of a network in the OSI model. Both protocols can execute the authenticated exchange of keys and set up the IPsec conversion for safe delivery of payload capacity.

The expanded authentication protocol (EAP) represents the authentication framework supporting several methods of authentication. EAP works directly on the level of the transmission channel and, therefore, does not require IP deployment. It supports repeated detection and repeated transmission but does not allow fragmentation of packets. The protocol for the support of authentication for network access (PANA) represents the transport layer of the network layer for EAP, which provides authentication of network access between clients and network infrastructure. In the terms, EAP PANA is the bottom level of EAP by UDP, which is executed between the peer-to-peer EAP node and an authenticator of EAP.

On the Internet and, therefore, in IoT, safety at the network layer is ensured by a set of IP safety (IPsec). IPsec in the transport mode provides open protection utilising services of authentication and repeated protection in addition to confidentiality and integrity. By operation at the network layer of IPsec, it can be used with any transport layer protocol, including TCP, UDP, HTTP and CoAP. IPsec provides confidentiality and integrity of payload capacity of IP with use of the Encapsulated Security Payload (ESP) protocol and integrity of title of IP plus payload capacity with the use of the protocol of title of authentication (AH). IPsec is mandatory in the IPv6 protocol that means that already IPv6 devices by default have the support of IPsec which can be included at any time. Being the solution of the network layer, security policies of IPsec are shared by all applications started by the specific machine.

However, being mandatory in IPv6, IPsec is one of the most suitable options of the safety of E2E in IoT ^[4]:

• the limited node uses 6LoWPAN for addressing and CoAP as the protocol application layer;
• the easy node uses IPv6 for addressing and HTTP as the protocol of level of application;
• the limited node is already authenticated through the gateway (GW);
• there is a trust relationships policy providing safe communication in the limited network domain (and, in particular, between GW and CD);
• the gateway is an authorised representative.

It is possible that the finite node will set up a connection of a transmission mode of IPsec-ESP with the IoT device, moving processes of generation of the main session and authentication from the IoT node on the entrusted gateway. The ESP mode, which provides data encryption and authentication, allows setting open safe connection between two peer-to-peer nodes by the encoding of payload capacity, having left IPv6 titles untouched. Cryptographic keys are generated and exchange according to the IKE protocol with the use of the diagram of exchange of keys of Elliptic Curve Diffie Hellman. Employing these mechanisms of the logician of key generation and authentication moves from the IoT node to the relevant GW, thereby exempting the IoT device from the computing loading connected to the generation of cryptography data.

WirelessHART

WirelessHART is a rather safe protocol and provides several protection levels. All traffic is protected, payload capacity is ciphered, and all messages undergo authentication, as from single-hop-basis, and at the end. WirelessHART requires that all devices were supplied with a secret key of Join and also the network identifier to join a network.

WirelessHART, though is limited by a resource, represents a bidirectional network of rather powerful devices and the central manager of a network and the controller has. WirelessHART, now the single WSN standard developed first of all for automation of industrial production and control is well developed for other aspects, except safety. The provided safety extends according to the specifications of WirelessHART.

For support of safe communication, the set of different security keys is used. The new device is supplied with Join key before he tries to join a wireless network. The key of combining is used for authentication of the device for the specific WirelessHART network. After the program successfully joined a network, the manager of a network will provide it with the correct keys of a session and a network for further communication. The actual creation and key management are processed by the manager of the safety of “Plant wide” who is not specified to WirelessHART, but keys are distributed to network devices by means of the manager of a network. The key of a session is used by the network layer for authentication of open communication between two devices (for example, the field device and the gateway). Different keys of a session are used for each conjugate communication (for example, the Field device for the gateway, the Field device for the manager of a network, etc.). At the level of the transmission channel, the network key for authentication of messages on the basis of one transition is used. The known network key is used when the device tries to be connected to a network that is before it received the correct network key. Keys are turned on the basis of procedures of the safety of installation of automation of the process.

Three types of keys are used: Master key, a key of Link and Network key. We will compare a Master key with a connection key in WirelessHART, and it is necessary for the association to a network ^[5]. The key of the link is used for open encoding and will provide the maximum level of safety at the price of higher requirements to storage. The network key is distributed between all devices and, thus, provides a lower level of safety though taking into account smaller requirements to storage in devices. All keys can be set at the plant or are transmitted from the trust centre (which is in the network coordinator) or by air, or through the physical interface. For commercial application, the confidential centre can control the association of new devices and periodically update a network key.

6LoWPAN

6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) is the name of a concluded working group in the Internet area of the IETF. The 6LoWPAN concept originated from the idea that “the Internet Protocol could and should be applied even to the smallest devices, and that low-power devices with limited processing capabilities should be able to participate in the Internet of Things.

The 6LoWPAN group has defined encapsulation and header compression mechanisms that allow IPv6 packets to be sent and received over IEEE 802.15.4 based networks. IPv4 and IPv6 are the workhorses for data delivery for local-area networks, metropolitan area networks, and wide-area networks such as the Internet. Likewise, IEEE 802.15.4 devices provide sensing communication-ability in the wireless domain. The inherent natures of the two networks, though, are different. Requirements to safety 6LoWPAN RFC4919 defines the requirements list of safety for 6LoWPAN which are generally directed to the protection of messages against ultimate users to a network of sensors. Requirements list:

• confidentiality: only authorised users can get information access;
• authentication: data undertake only from the untrusted sources;
• integrity: data retrieved remain invariable in transmission time;
• freshness: consider like this, and a key not to reproduce old messages;
• accessibility: guarantees that data can be available by transmission;
• reliability: operation support, despite abnormal conditions;
• fail safety: provides the acceptable security level even in case some nodes;
• energy efficiency: reduce control expenses to increase network service life;
• support: possibility of dissemination of different information.

These requirements require a combination of different systems of protection.

Cryptography Methods

Ciphering messages before transmission, cryptographic solutions are aimed at three-fold protection: only of the authenticated user who has the correct key can decrypt and read messages; contents of integrity shall not change in transmission time and confidentiality. Nobody can understand the message without the key.

Cryptography techniques for 6LoWPAN shall be developed more for adaptation to the prevailing restrictions in devices 6LoWPAN, such as low power and low calculation capacity. It is connected to the fact that not optimised mechanisms of cryptography will consume more resources and, therefore, to reduce the lifetime of a network. The key used in cryptography techniques also shall not be too short; otherwise, malefactors will be able easily to break. As 6LoWPAN is a combination of WSN and the Internet, it is natural to use these two network cryptography mechanisms to the safety of this network. WSN uses AES (Advanced Encryption Standard) for support of level of communication link with several operation modes, the majority of which do not provide integrity. For the protection of open safety of the network layer of IPsec (Internet Protocol Security), it is used with the transport and tunnel modes. Earlier the cryptography mechanism with a public key was read too heavy for application in WSN. Nevertheless, the last researches showed how to combine RSA (asymmetrical encoding of Rivest-Shamir-Adelman) and ECC (an elliptic curve of cryptography) with several modes for adaptation to network scenarios.

Exchange of a key – one more problem which shall be considered in case of implementation of protocols. For exchange of keys on a network exchange of keys of the Internet with IPsec (protection of the internet protocol) is offered. Nevertheless, the exchange of keys of the Internet is not considered the acceptable decision because of its large messages of signalling that is unsuitable for small packet size 802.15.4 and the requirement for energy efficiency. WSN used several key methods of distribution, such as redistribute and key pool; however, they lack scalable opportunities. It is also necessary to analyse threat for a key at the time of bootstrap loading when the opponent is among other nodes, without requiring authentication.

Though researches show considerable improvement in the use of cryptography for 6LoWPAN, the network still should overcome a set of problems. The cryptography is also used only in case of protection 6LoWPAN from the external attacks but has no opportunity to find and eliminate the internal attacks. It is connected to the fact that the cryptography cannot find malefactors using legal keys but behaves with malice aforethought. Thus, the network safety using only cryptography is feeble in case of the attacks directed to network productivity, such ​​ as DoS or the battery, and the resource attacks, such as jamming and switch-off.

Therefore the cryptography cannot ensure complete safety for 6LoWPAN. It is necessary to implement IDS for monitoring of any harmful behaviour of a network to prevent the early attacks of safety to reduce its consequences. IDS – an effective method of detection of any malefactor which bypasses the line of protection of cryptography and ensures normal network functioning.

The cryptography combination as a first line and IDS as protection of the second line can protect a network from the majority of threats. The missions of IDS consist of tracing and giving the alarm about any possible risks and transferring them to cryptography to restart the process of manipulation for the elimination of malefactors. IDS can cope with all threats.

Problems of Detection of Invasions of IPv6

IDS from IPv6 protects the boundary router from any threats sending packets from IPv6 to WSN to begin WSN attack. It is easy to solve the majority of problems in parts of WSN regarding IPv6 because the boundary router usually is implemented with the strong by protection and not – resource restriction, and, besides, the threats proceeding from the IPv6 network it is, much less, than threats in a sensor network, For Example, the boundary router is the most suitable line item to define, there is a network where exactly. The problem with extraction of functions is also not restricted, as regarding WSN, because of the high throughput of the boundary router ^[6]. The single problem on which it is necessary to concentrate is to select the suitable IDS methods for early detection and detection of threats.

Again three types of methods can be applied: misuse, anomaly and specification. The direction of misuse is still not favourable because attack signatures are not defined. There are three methods: Anderson Darling algorithm, an algorithm of entropy and the PAT calculator (the predetermined types of attacks) for detection of abnormal behaviour. The selected function of data is cards with disks from overflowing preventing algorithms when queues are filled. To reduce the speed of false alarm, they bring the found these anomalies in the qualifier of templates which checks the predetermined attack type on the saved buffer. The threshold is also selected for safety warning generation as soon as it is found which will be transferred by the qualifier. This system requires many computing loadings with three checking modules and another appropriate part to reduce detection speed. The author did not explain why they decided to analyse only data which are discarded from the buffer. Doing it, they probably assumed that data which were transferred to the buffer are harmless while in fact there is no warranty. Nevertheless, the main architecture of this system can be applied with the use of different methods of detection to the best decision.