SecuPAN: A Security Scheme to Mitigate Fragmentation-Based Network Attacks in 6LoWPAN
0 likes109 views
The document presents a security scheme called SecuPAN to mitigate fragmentation-based network attacks in 6LoWPAN. It proposes using cryptographically generated IPv6 addresses to prevent spoofing, adding nonce and MAC fields to packet fragments for integrity and freshness verification, and a reputation-based buffer management system to protect devices from buffer exhaustion attacks. The scheme was evaluated and shown to improve packet delivery ratio, end-to-end delay, throughput and energy efficiency while enhancing security against replay, alteration, spoofing, and duplication attacks.
SecuPAN: A Security Scheme to Mitigate Fragmentation-Based Network Attacks in 6LoWPAN
- 1. SECuRE and Trustworthy Computing Lab Authors Mahmud Hossain, Yasser Karim, and Ragib Hasan SECuRE and Trustworthy computing Lab (SECRETLab) University of Alabama at Birmingham Presenter: Mahmud Hossain http://secret.cis.uab.edu IoT SecuPAN: A Security Scheme to Mitigate Fragmentation-Based Network Attacks in 6LoWPAN
- 2. SECuRE and Trustworthy Computing Lab 2 The Internet of Things (IoT) A programmable world Everyday objects are interconnected Objects are smart enough to make decision
- 3. SECuRE and Trustworthy Computing Lab Source: Zinnov Zones (2016) IoT Forecasts and Market Estimates 3 Estimation of connected things by 2020 20.8 billion (Gartner) 26.3 billion (Cisco) 28 billion (Ericson) 34 billion (Business Insider) Source: ZStatista (2018)
- 4. SECuRE and Trustworthy Computing Lab Protocols for IoT network IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN) Zigbee Bluetooth Z-Wave Sigfox Wi-Fi 4
- 5. SECuRE and Trustworthy Computing Lab 6LoWPAN: Protocol Stack IEEE 802.15.4 IPv6 5
- 6. SECuRE and Trustworthy Computing Lab Fragmentation in 6LoWPAN Maximum Transmission Unit (MTU) size 127 octets(bytes). IPv6 packets are usually larger than 127 octets. (Maximum 1280 octets) 6
- 7. SECuRE and Trustworthy Computing Lab Vulnerabilities of 6LoWPAN Fragmentation Mechanism Fragment authentication Fragment freshness verification Payload integrity verification Source IP-Address validation 7
- 8. SECuRE and Trustworthy Computing Lab Threat Model Capability of Target and Malicious Devices Resource Constrained Location Within Radio Range (Mallory) Via Gateway (Eve) Via Internet (Malice) Extract key materials Memory Probing 8
- 9. SECuRE and Trustworthy Computing Lab Threat Model Network External Attacks Attackers conduct activity from outside via Internet. No resource limitation Attackers can easily send large number of packets which are further broken into fragments. Gateway can prevent such attack by employing an authenticated tunnel, such as IPsec. Secure rate limiting mechanisms for large packets from authenticated sources. 9
- 10. SECuRE and Trustworthy Computing Lab Threat Model Network Internal Attacks 10 Replay Alteration Spoofing Duplicate Buffer exhaustion
- 11. SECuRE and Trustworthy Computing Lab SecuPAN : Proposed Solutions Nonce field in the FRAG1 header. MAC-based scheme. Cryptographic datagram-tag and cryptographically generated IPv6 address (CGA-IPv6). Reputation-based buffer management mechanism. 11
- 12. SECuRE and Trustworthy Computing Lab Proposed Datagram Tag, Nonce & MAC fields 12 Crypto Datagram Tag 16 bits. MAC (N || Hash (Payload added to FRAG1) Nonce 16 bits. MAC field 32 bits. MAC (Hash (Payload added to FRAGN)) Ensures fragments integrity and freshness.
- 13. SECuRE and Trustworthy Computing Lab Cryptographic IPv6 Address Assignment A CGA is an Internet Protocol Version 6 (IPv6) address that contains a host identifier computed from a cryptographic hash function. In our proposed solution, a Border Router in a 6LoWPAN network assigns a CGA-IPv6 address to joining device. Prevent address spoofing. 13
- 14. SECuRE and Trustworthy Computing Lab Secure Transfer of Packet Fragmentations Public Key Retrieval Secure Fragmentation 14
- 15. SECuRE and Trustworthy Computing Lab Operational Model 15 Verify Crypto Datagram Tag MACK (N) =? Hash Yes
- 16. SECuRE and Trustworthy Computing Lab SecuPAN : Secure Management of Reassembly Buffer A reputation point based buffer management scheme Reputation point, 𝑟𝑗 is defined as follows: 𝑟𝑗 = min 𝑟𝑗 + 1 2 , 1 max 𝑟𝑗 − 𝑏𝑢𝑓𝑗 𝑟𝑗 1 − μ 𝑗 , 0.1 Here, 𝜇 𝑗 = 𝑇𝑜𝑡𝑎𝑙 𝑏𝑦𝑡𝑒𝑠 𝑟𝑒𝑐𝑒𝑖𝑣𝑒𝑑 𝑇𝑜𝑡𝑎𝑙 𝑙𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑐𝑘𝑒𝑡 and 𝑏𝑢𝑓𝑗 = 𝑇𝑜𝑡𝑎𝑙 𝑎𝑙𝑙𝑜𝑐𝑎𝑡𝑒𝑑 𝑝𝑜𝑟𝑡𝑖𝑜𝑛 𝑜𝑓 𝑡ℎ𝑒 𝑏𝑢𝑓𝑓𝑒𝑟(𝑏𝑢𝑓𝑎) 𝑇𝑜𝑡𝑎𝑙 𝑠𝑖𝑧𝑒 𝑜𝑓 𝑡ℎ𝑒 𝑏𝑢𝑓𝑓𝑒𝑟 A receiver allocates 𝑏𝑢𝑓𝑎 for a fragmented packet as: 𝑏𝑢𝑓𝑎 = 𝑝 + 𝑞, 𝑝 = 𝑟𝑗 ∗ 𝑑𝑎𝑡𝑎𝑔𝑟𝑎𝑚_𝑠𝑖𝑧𝑒, 𝑎𝑛𝑑 𝑞 = 𝑝 + 8 𝑚𝑜𝑑 8 Packet discard policy: Uncertainty Point ucP = 𝑓 𝑟 +𝑡𝑟+𝑛𝑠 𝑟 𝑠 16 If a sender sends all the fragments. If the receiver fails receiving all the packet fragments before time expires
- 17. SECuRE and Trustworthy Computing Lab Experimental Setup 17
- 18. SECuRE and Trustworthy Computing Lab Evaluation 18 Packet Delivery Ratio (buffer reservation) Effective Packet Number
- 19. SECuRE and Trustworthy Computing Lab Evaluation 19 End to End Delay Throughput Energy Consumption for Communications
- 20. SECuRE and Trustworthy Computing Lab Security Analysis Replay Nonce field Alteration MAC field Spoofing CGA-IPv6 Duplication MAC field Buffer exhaustion Reputation point based system 20
- 21. SECuRE and Trustworthy Computing Lab Conclusion Fragmentation mechanism enables vulnerabilities in 6LoWPAN. Proposed a security mechanism based on Cryptographically Generated IPv6 Address to mitigate impersonation attacks. MAC-based fragmentation scheme to verify authenticity and integrity of packet fragments. Reputation-based buffer management scheme to protect resource-limited devices from buffer overflow. 21
- 22. SECuRE and Trustworthy Computing Lab Thank You 22 SECRETLab@UAB Phone: 205.934.8643 Fax: 205.934.5473 Web: http://secret.cis.uab.edu/ Mahmud Hossain Email: mahmud@uab.edu