1

ADVANCED TOPICS

Shambhu Upadhyayap y yComputer Science & Eng.University at BuffaloBuffalo, New York 14260

Shambhu Upadhyaya1

Mesh Networks and Security

Shambhu Upadhyaya2

2

What are Wireless Mesh Networks? Similar to Wi-Fi Networks Instead of multiple wireless hotspots (WHS) Instead of multiple wireless hotspots (WHS),

WMNs use one WHS and several transit access points (TAP), also called routers

Clients connect to TAPs, which connect wirelessly to the WHS either directly or multi-hopping over other TAPs

Shambhu Upadhyaya3

WMNs WMN provides reliability through redundancy It is a special case of wireless ad hoc networks Wireless mesh networks can be implemented

with various wireless technologies including 802.11 (802.11s), 802.15, 802.16

Examples MIT RoofNet (2001)( ) Quail Ridge WMN (QuRiNet) at Napa Valley, CA

(2004) Also useful in smart grid for automatic meter reading

Shambhu Upadhyaya4

3

Advantages/Disadvantages Advantages

The TAPs themselves are cheaper than WHS The TAPs themselves are cheaper than WHS Since TAPs communicate by wireless signals, they

do not require cabling to be run to add new TAPs• Allows for rapid deployment of temporary

networks• Disadvantages TAPs are often placed in unprotected locationsp p Lack of physical security guarantees Communications are wireless and therefore

susceptible to all the vulnerabilities of wireless transmissions

Shambhu Upadhyaya5

Three Security Challenges Posed by WMNs Securing the routing mechanism

WMNs rely on multi-hop transmissions over a WMNs rely on multi-hop transmissions over a predominantly wireless network

Routing protocol is very important and a tempting target Detection of corrupt TAPs

The TAPs are likely to be stored in unprotected locations, so they may be easily accessed by malicious entities and can be corrupted or stolen

Providing fairness The protocol needs to be designed to distribute

bandwidth between the TAPs in a manner fair to the users to prevent bandwidth starvation of devices far from the WHS

Shambhu Upadhyaya6

4

Fairness There are several ways in which bandwidth can

b di t ib t d TAPbe distributed among TAPs• What may be the best solution is to

distribute bandwidth proportional to the number of clients using a TAP

Shambhu Upadhyaya7

Attack Model Four simple types of attacks possible The first attack is removal and

replacement of the device easily detected by change of topology

Access the internal state of the device Modify internal state Clone TAPs

Other sophisticated attacks possible Blocking attacks, black hole, sybil, etc.

Shambhu Upadhyaya8

5

Access Internal State This is a passive attack and is difficult to

detect In this attack the attacker need not

disconnect the device from WMN Even the disconnection cannot be

detected The effect of the attack can be reduced

by changing the TAP data at regular intervals

Shambhu Upadhyaya9

Modify Internal State In this type of attack, the attacker

dif th ti l ithcan modify the routing algorithm This type attack also changes the

topology It can also be detected by WHS

Shambhu Upadhyaya10

6

Clone TAP In this type of attack the attacker is

bl t t li f th TAPable to create a replica of the TAP and place this in a strategic location in WMN

It also allows the attacker to inject some false data or to disconnect some parts of networksome parts of network

It can damage the routing mechanisms but can be detected

Shambhu Upadhyaya11

Jamming and Countermeasure The first diagram shows the attack by the

dadversary The second diagram shows the protection

measure for this attack after detection

Shambhu Upadhyaya12

7

Attacks on Multihop Routing in WMN Rational attack vs. malicious attack

A ti l tt k A rational attack Does only if misbehaving is beneficial in terms of

price, QoS, or resource saving For instance, force the traffic through a specific TAP

in order to monitor the traffic of a given mobile client or region

A malicious attack Involves partitioning the network or isolating the Involves partitioning the network or isolating the TAPs

For instance, the routes between WHS and TAPs are artificially increased leading to poor performance

Shambhu Upadhyaya13

Securing Multihop Routing Using secure routing protocols to

t tt k i t tiprevent attacks against routing messages

If the state of one or more TAPs is modified, the attack can be detected and the network reconfiguredDoS attacks can be prevented by DoS attacks can be prevented by identifying the source of disturbance and disabling it

Shambhu Upadhyaya14

8

Generalized WMNs Vehicular Networks is special case of

WMN h TAP t d bWMNs where TAPs are represented by cars and roadside WHS

Involves applications such as reporting events (accidents), cooperative driving, payment services and location based services

Multi-Operator WMNs include several operators and various devices: mobile phones, laptops, base stations and APs

Shambhu Upadhyaya15

Conclusion WMNs extend the coverage of WHS in

an inexpensive manner The three fundamental security issues

that have to be addressed in WMNs• Detection of corrupt TAPs• Defining and using a secure routingDefining and using a secure routing

protocol• Defining and implementing a proper

fairness metric

Shambhu Upadhyaya16

9

Reference Ben Salem, N.; Hubaux, J-P, "Securing wireless

h t k “ Wi l C i timesh networks ,“ Wireless Communications, IEEE, vol.13, no.2, pp.50,55, April 2006

Shambhu Upadhyaya17

Energy-Aware Computing

Shambhu Upadhyaya18

10

Issues in Sensor Networks Localization Synchronization In-network processing Data-centric querying Energy-aware computing

Shambhu Upadhyaya19

Energy Constraints Battery-powered devices

C i ti i h Communication is much more energy consuming than computation Transmitting 1 bit costs as much energy as running

1,000 instructions Gap is only going to be larger in the future

Load balancing Coordinated sleeping schedules Coordinated sleeping schedules Explore correlation in sensing data Power saving techniques integral to most

sensor networks

Shambhu Upadhyaya20

11

MAC Protocols for Sensor Networks Contention-Based: CSMA protocols (IEEE 802.15.4) Random access to avoid collisions IEEE 802.11 type with power saving

methods Scheduling-Based:

A i t i i h d l Assign transmission schedules (sleep/awake patterns) to each node

Variants of TDMA Hybrid schemes

Shambhu Upadhyaya21

MAC Protocol Examples PAMAS [SR98]:

Power-aware Medium-Access Protocol with Signaling Power aware Medium Access Protocol with Signaling Contention-based access Powers off nodes that are not receiving or forwarding packets Uses a separate signaling channel

S-MAC [YHE02]: Sensor Medium Access Control protocol Contention-based access

TRAMA [ROGLA03]:TRAMA [ROGLA03]: Traffic-adaptive medium access protocol Schedule- and contention-based access

Wave scheduling [TYD+04]: Schedule- and contention-based access

Shambhu Upadhyaya22

12

S-MAC Identifies sources of energy waste [YHE03]:

ll Collision Overhearing Overhead due to control traffic Idle listening

Trade off latency and fairness for reducing energy consumption

Components of S-MAC: A periodic sleep and listen pattern for each node Collision and overhearing avoidance

Shambhu Upadhyaya23

S-MAC: Sleep and Listen Schedules Each node has a sleep and listen schedule and

maintains a table of schedules of neighboringmaintains a table of schedules of neighboring nodes

Before selecting a schedule, node listens for a period of time: If it hears a schedule broadcast, then it adopts that

schedule and rebroadcasts it after a random delay Otherwise, it selects a schedule and broadcasts it

If a node receives a different schedule after selecting its schedule, it adopts both schedules

Need significant degree of synchronization

Shambhu Upadhyaya24

13

S-MAC: Collision and Overhearing Avoidance Collision avoidance: Within a listen phase, senders contending to

send messages to same receiver use 802.11 Overhearing avoidance: When a node hears an RTS or CTS packet,

then it goes to sleep All neighbors of a sender and the receiver

sleep until the current transmission is over

Shambhu Upadhyaya25

Routing Strategies Geographic routing:

d Greedy routing Perimeter or face routing Geographic localization

Attribute-based routing: Directed diffusion Rumor routing

G hi h h t bl Geographic hash tables Energy-aware routing:

Minimum-energy broadcast Energy-aware routing to a region

Shambhu Upadhyaya26

14

Energy-Aware Routing Need energy-efficient paths Notions of energy-efficiency:

Select path with smallest energy consumption Select paths so that network lifetime is maximized

When network gets disconnected When one node dies When area being sensed is not covered any more

Approaches:Approaches: Combine geographic routing with energy-awareness Minimum-energy broadcast

Shambhu Upadhyaya27

Minimum Energy Broadcast Routing Given a set of nodes in the plane Goal: Broadcast from a source to all nodes Goal: Broadcast from a source to all nodes In a single step, a node may broadcast within a range by

appropriately adjusting transmit power Energy consumed by a broadcast over range γ is

proportional to γα

Problem: Compute the sequence of broadcast steps that consume minimum total energy

Centralized solutions Centralized solutions NP-complete [ZHE02]

Shambhu Upadhyaya28

15

Three Greedy Heuristics In each tree, power for each node proportional

to αth exponent of distance to farthest child into αth exponent of distance to farthest child in tree Shortest Paths Tree (SPT) [WNE02]

“Node” version of Dijkstra’s SPT algorithm Minimum Spanning Tree (MST) [WNE02]

Maintains an arborescence rooted at source Broadcasting Incremental Power (BIP) [WNE02]

In each step, add a node that can be reached with minimum increment in total cost

SPT is Ω(n)-approximate, MST and BIP have approximation ratio of at most 12 [WCLF01]

Shambhu Upadhyaya29

References Feng Zhao and Leonidas Guibas, Wireless Sensor

Networks: An Information Processing Approach MorganNetworks: An Information Processing Approach, Morgan Kaufman, 2004

Jeffrey E. Wieselthier, Gam D. Nguyen, and Anthony Ephremides. 2002. Energy-efficient broadcast and multicast trees in wireless networks. Mob. Netw. Appl. 7, 6 (December 2002)

Shambhu Upadhyaya30

16

Advanced Metering Infrastructure ( )(AMI)

Shambhu Upadhyaya31

A Typical Smart Grid

Shambhu Upadhyaya32

17

Advanced Meter Reading Advanced Metering Infrastructure (AMI) or smart meters

(2-way)(2 way) Used for revenue accounting Wireless based

Many proprietary Moderate range, drive-by reading Mesh (Zigbee) and WiFi sometimes

About 50Million AMR/AMI installed (USA) Suggested standard: ANSI C12 18 Suggested standard: ANSI C12.18 Smart meters (at Microgrid level) provide information

needed to analyze energy usage and thus allow energy minimization algorithms to be implemented

Shambhu Upadhyaya33

Prospects for Smart Appliances Examples: smart refrigerator, smart dryer Two-way communication via Internet Logical extension of smart grid/buildings Technically possible for years but …

Hardware costs high; Installation may be complex; Standards lacking

Forms a SCADA or CPS system Security and privacy concerns high Benefits unclear Futuristic discussion mostly

Shambhu Upadhyaya34

18

Smart Metering Communication Zigbee is ideal for AMI Can network a no. of sensors and controllers in

a household Possibly in a mesh network Can operate in one of 3 frequency bands

Shambhu Upadhyaya35

Potential Concerns WiFi and Zigbee interference

Can be handled by separating the channels by 30MHz Can be handled by separating the channels by 30MHz

Security concerns of ad hoc and mesh networks apply Eavesdropping Traffic analysis Replay attacks

Additionally: Employee mistakes, equipment malfunctions, virus,

coordinated attacks from a state or terrorist groupcoordinated attacks from a state or terrorist group Privacy concerns

Smart meters collect personally identifiable info Cyber criminals could use them for identity theft

Shambhu Upadhyaya36

19

A Privacy Compromise Scenario Electricity use patterns could lead to disclosure

ld l k f Could leak info on customers When they’re at home (sleeping versus watching

television) When at work, or traveling

It might also be possible to discover what types of appliances and devices are present

Increases in power draw could suggest changes in b i tibusiness operations

Impacts Criminal targeting of home Business intelligence to competitors

Shambhu Upadhyaya37

Hacking Attacks and Mitigation Two-way communication between customers and utility companies

means more risk Two-way meters accessible to both users and enemies (use buggy

s/w) Smart meter is the pain point (may be hacked)

Simulation of a worm injected into a meter shows how it would spread how it can be used to cause power grids to surge or shut off

Common vulnerabilities exist, but no powerful devices to implement Devices do not have cycles to implement strong crypto solutions

Miti ti t h i Mitigation techniques Zigbee security (uses hierarchy of keys) Machine-to-machine strong authentication Encryption Data hashing, digital signing, etc.

This is an active research area today

Shambhu Upadhyaya38

20

References Darold Wobschall, University at Buffalo, 2012 M. Nabeel, J. Zage, S. Kerr, E. Bertino,

Cryptographic Key Management for Smart Power Grids, 2012, http://www.cerias.purdue.edu/apps/reports_and_papers/view/4591

Shambhu Upadhyaya39

Internet of Things ( )(IoT)

Shambhu Upadhyaya40

21

What is IoT? Loosely coupled decentralized system of smart objects Ubiquitous computing, 100B to be connected to theUbiquitous computing, 100B to be connected to the

Internet by 2020 After the WWW, IoT represents the most potentially

disruptive technological revolution What inspired IoT?

RFID, Short-range wireless communication Real-time localization Sensor networksSensor networks

What does it entail? Scientific theory Engineering design User experience

Shambhu Upadhyaya41

IoT Curriculum Universities have started building special curricula Open University in UK has developed a learning Open University in UK has developed a learning

infrastructure for collaborative learning in IoT Merging of the physical and digital realms (CPS) Physical objects become true actors on the Internet Huge increase in the number of internet-connected devices,

objects, sensors and actuators Huge increase in the amount and value of data (Big Data) Emergence of novel embedded device platforms below the level of

personal mobile devicespersonal mobile devices Novel applications in energy, transport, health, business and daily

life

Expectation is that MOOCs may take up the challenge Companies such as Cisco, IBM, Intel are engaging

Shambhu Upadhyaya42

22

Skills Set for IoT Algorithms Programming skills Distribution and collaboration

Ability to develop networked sensing apps Creative design Collaborative design Ethical issues Ethical issues

Privacy and security Computing in society

Shambhu Upadhyaya43

Typical Components of IoT iPod Nokia, Android cell phones Nintendo DS, Game Boy Advance Roomba 500 iRobot Sirius Satellite Radio Receivers Automobiles

Shambhu Upadhyaya44

23

IoT Protocol Details IEEE 802.15.4 is the standard for low

rate WPANs 802.15.4 handles the physical and

MAC layer but not upper layers Can be used with 6LoWPAN and

standard IP protocols to build astandard IP protocols to build a wireless embedded Internet 6LoWPAN is the low power IPv6 version

developed for small devices

Shambhu Upadhyaya45

Internet of Nano Things

Shambhu Upadhyaya46

24

Security Challenges in IoT Cryptographic security

Traditional tools may not be suitable due to limited processor speed andTraditional tools may not be suitable due to limited processor speed and memory

Key management Manual key management may not scale Limited user interfaces will make security deployment difficult

Credentialing Credentialing users and devices required may not scale due to the sheer size of the nework

Identity management A devise identity may need to be mapped to groups of users A devise identity may need to be mapped to groups of users Usability is also an issue Limited user interface

Privacy Sensitive information on health front “network guards” may be needed

Shambhu Upadhyaya47

References http://prezi.com/aordc8uod3rj/intern

et-of-things-presentation/ IEEE Computer, February 2013 I. Akyildiz and J. Jornet, The Internet

of Nano-Things, IEEE Wireless Communications 2010Communications, 2010

Shambhu Upadhyaya48