HIP-based RFID Networking Architecture

In order to separate a host's identity from its location on the Internet, the Host Identity Protocol (HIP) was developed by the Internet Engineering Task Force as a mobility management solution. HIP provides a solid basis to enable secured mobility and multihoming features. Several extensions and proposals have been introduced in recent publications to improve the micro‐mobility features of HIP. Moreover, many other publications have dealt with the efficiency of Network Mobility (NEMO) management with HIP. However, the HIP‐based micro‐mobility management solutions adapted to NEMO scenario do not cover all security aspects requirements and still suffer from security flaws. Therefore, in this paper, a number of potential threats in the typical HIP with Rendez Vous Server are identified. A new secure and efficient scheme for network mobility management is also proposed to overcome the outlined ones. The proposed solution ensures strong authentication between network entities, reduces Denial of Service attacks, secures against Domain Name Server spoofing, reply, and eavesdropping attacks, and ensures end‐to‐end confidentiality and integrity protection. To analyze the security properties of the proposed scheme, we have performed automated formal specification and evaluation with the help of both the Automated Validation of Internet Security Protocols and Applications and the Security Protocol Animator, which have proved that authentication and confidentiality goals are achieved. Hence, the scheme is effective when an intruder is present. Copyright © 2014 John Wiley & Sons, Ltd.

IP hosts and network infrastructure have historically been difficult to configure, but emerging networking protocols promise to enable hosts to establish IP networks without prior configuration or network services. Even very simple devices with few computing resources will be able to communicate via standard protocols wherever they are attached. Current IETF (Internet Engineering Task Force) standardization efforts, such as those in the Zeroconf Working Group, aim to make this form of networking simple and inexpensive. In this tutorial, I examine the background, current status and future prospects for zero-configuration networking.

Notes that cellular is the inevitable future architecture for the personal communication service system (PCS). This is important for wireless mobile communications and will eventually be integrated with the Internet. Recent initiatives to add mobility to the Internet and packet data services for the next generation cellular systems are being considered by many mobile service providers, and providing a seamless support for IP‐based packet switched services is an important issue. Mobile Internet Protocol version 6 (Ipv6) is a new version of the Internet Protocol that was standardized by the Internet Engineering Task Force (IETF). It supports mobility and is presently being standardized by the IETF Mobile IP Working Group. Discusses the current cellular support based on Ipv6 and points out the shortfalls of using Mobile IP. Highlights protocols especially for mobile management schemes which can optimize a high speed mobile station moving among small wireless cells.

Mobile Ipv6 (MIPv6) and fast handover (FHO) have been developed by the Internet Engineering Task Force (IETF) to address the IP mobility issues of roaming mobile devices, and to reduce handover latency due to link switching delay, movement detection and IP address configuration during MIPv6 operation, respectively. In an attempt to enhance the performance of MIPv6, the hop-by-hop local mobility management (HbH-LMAsP) localized mobility management (LMM) scheme was devised and proposed to IETF as an Internet draft. In this paper, simulations that were performed on MIPv6 and subsequently, on MIPv6 with the addition of the HbH-LMAsP functionality, were described. The results obtained based on registration delay, packet loss and the overhead computation, were analyzed and discussed. The improvements contributed by the HbH-LMAsP LMM scheme over the basic mobile IPv6 were shown to be significant. The discussion on load balancing was also covered.

The IPv6 routing protocol for low power and lossy networks (RPL) was accepted as the standard routing protocol for Internet of Things (IoT) by Internet engineering task force on March 2012. Since then, it has been used in different IoT applications. Though RPL considerably deals with IoT network requirements, there are still some open problems to solve, since it was not initially designed for IoT applications. In this paper, we address the problem of packet loss and power depletion in an RPL-based network under heavy and highly dynamic load. We address this problem in three steps: First, we present a context-aware objective function (CAOF), which computes the rank, considering the context of the node. CAOF also avoids thundering herd phenomenon by gradual shifting from a high rank value toward the real rank value. Second, we present a new routing metric, known as context-aware routing metric (CARF) which considers the status of remaining power and queue utilization of parent chain toward the root in a recursive manner while lessening the effect of upstream parents as it gets farther down the path. Through comprehensive evaluations, we show that this metric leads to a better decision about the proper parent in a network with high traffic dynamicity, rather than deciding merely based on the parent rank. Third, we present a new parent selection mechanism, which selects the best parent based on CARF and some other metrics while avoiding routing loops by a simple yet effective countermeasure. Evaluation results reveal improvements in network lifetime while decreasing packet loss in comparison with standard specification of RPL.

Recently, IETF (Internet Engineering Task Force) presented CoAP (Constrained Application Protocol) for the communication between sensor and actuator nodes in a constrained environment such as small amount of memory and low power. IETF CoAP protocol can convert easily, and can use to monitor or control infrastructure utilities through low-power sensor and actuator networks in IoT (Internet of Things) and M2M (Machine-to-Machine) environment. IETF CoAP protocol provides the special requirements of this constrained environment, especially considering energy, automation, and other IoT applications. In this paper, we design and implement a node registration and discovering based CoAP in IoT environment. The node is a CoAP node which is designed for working in constrained environment. For node registration in IoT, we used CoRE RD (Resource Directory) functionalities to register CoAP node’s information which works in IoT environment.

The Internet of Things (IoT) which creates a hyper-connected society is playing a major role in the 4th industrial revolution. The IoT is being leveraged across various fields of business globally and the number of IoT devices is causing serious security concerns. Since the firmware update of an IoT device is necessary for its lifecycle, secure firmware update of the IoT device is being brought as the first step in IoT security. The Internet Engineering Task Force (IETF) Software Updates for Internet of Things (SUIT) working group has started to specify a software update architecture for IoT devices. However, the current SUIT working group adopts a traditional client-server model to distribute firmware images, which potentially causes security risks. The current approach of the SUIT working group is unable to solve a targeting issue and an author-disappearing issue, which is suggested in this paper. Therefore, in this work, we introduce a distributed firmware update architecture based on the SUIT firmware update architecture applying blockchain. Our update architecture can prevent the issues we concern through the characteristics of blockchain, such as decentralization, transparency, and irreversibility. The blockchain network has registration nodes that process registration of manifest and firmware image files from authors, and retrieval nodes that process downloading manifest and firmware image files. The firmware image files are stored in a distributed file system and the hash values of firmware image chunks are stored on the blockchain with manifest files. The proposed architecture in this paper enables the irreversible downloads even in the author-disappearing state and tolerant to a single point of failure.

Internetwork bridge connects Ethernet and broadband networks

Internet of Things (IoT) can be defined as the interconnection through Internet of an unprecedented number of devices with the purpose of exchanging data. It stands as one of the most popular technologies for the following years and it is requiring substantial changes in the Internet protocols to meet its requirements. As the application layer is decisive for the quality of the connection, this paper analyzes the performance offered by one of the most popular protocols for the application layer in IoT: the Constrained Application Protocol (CoAP). This analysis aims to examine the features and capabilities of this protocol and to determine its feasibility to operate under constrained devices using security support. For this, a realistic network scenario is deployed to run the simulations and to measure bandwidth, consumption of resources (i.e., CPU cycles and bandwidth usage) and communication latency. Additionally, the trade-off between security and performance is discussed measuring the bandwidth overhead and the consumption increase associated to secure the communications. Different ciphering and authentication algorithms are tested, following the recommendations made by the Internet Engineering Task Force (IETF).

Distributed Denial of Service (DDoS) attacks have caused significant disruptions in the operations of Internet-based services. These DDoS attacks use large scale botnets, which often exploit millions of compromised Internet of Things (IoT) devices worldwide. IoT devices are traditionally less secure and are easy to be exploited. The extent of these exploitations has increased after the publication of the Mirai botnet source code on GitHub that provided a foundation for the attackers to develop and launch Mirai botnet variants. The Internet Engineering Task Force (IETF) proposed RFC 8520 Manufacturer Usage Description (MUD) so that an IoT device can convey to the network the level of network access it requires to accomplish its standard functionality. Though MUD is a promising effort, there is a need to evaluate its effectiveness, identify its limitations, and enhance its architecture to overcome its weakness and improve its efficiency. The latest Mirai variant malware is exploiting vulnerabilities of Internet of Things devices. As MUD does not consider identifying and patching vulnerabilities present in the device before the issuance of the MUD profile, a device can be compromised even in the presence of the Manufacturer Usage Description profile by exploiting either the configuration vulnerabilities or firmware vulnerabilities present in the device. This paper presents an evaluation study of the Manufacturer Usage Description (MUD), identifies its weaknesses, and proposed enhancements in its architecture. This research proposed a mechanism for identifying and eliminating the configuration vulnerabilities before creating the MUD profile for a device to minimize the attack surface. This research adopts the OWASP firmware testing methodology for discovering vulnerabilities in the firmware of WiFi home routers. The device is allowed to request the MUD profile only if the identified firmware vulnerabilities are low. The identified firmware vulnerabilities are patched in case the score of the identified firmware vulnerabilities is moderate or high. The device is allowed to request the MUD profile after the vulnerabilities are patched. The firmware vulnerabilities are shared with other peers using blockchain smart contracts. There is a possibility that the MUD URL might be pointing to a corrupted or malicious MUD profile hosted at the attacker file server due to the absence of an authentication mechanism in the MUD process. This research also proposed an authentication mechanism for device MUD profile, MUD file generator, and MUD file server. Implementation results show that proposed enhancements improve the security services provided by the Manufacturer Usage Description (MUD).

Domain Name System (DNS) is the system for the mapping between easily memorizable host names and their IP addresses. Due to its criticality, the Internet Engineering Task Force (IETF) has defined a DNS Security Extension (DNSSEC) to provide data-origin authentication. In this paper, we point out two drawbacks of the DNSSEC standard in its handling of DNS dynamic updates: 1) the on-line storage of a zone security key, creating a single point of attack for both inside and outside attackers, and 2) the violation of the role separation principle, which in the context of DNSSEC requires the separation of the roles of zone security managers from DNS name server administrators. To address these issues, we propose an alternative secure DNS architecture based on threshold cryptography. Unlike DNSSEC, this architecture adheres to the role separation principle without presenting any single point of attack. To show the feasibility of the proposed architecture, we developed a threshold cryptography toolkit based on the Java Cryptography Architecture (JCA) and built a proof-of-concept prototype with the toolkit. Our running results of the prototype on a representative platform show that the performance of our proposed architecture ranges from one to four times of DNSSEC’s performance. Thus, through small performance overhead, our proposed architecture could achieve very high level of security.

Threats, Detection and Mitigation of Rank Attack: A Survey

IP-based WSNs has been considered as the emerging solution to develop Internet of things. The Internet Engineering Task Force (IETF) has chattered and been standardized IPv6 routing protocol for Low-power and Lossy Networks (RPL). RPL is the routing protocol recommended for most Internet of Things (IoT) applications. However, RPL has some open issue when working with different network topologies and Media Access Control (MAC) protocols. This work shows how topologies and MAC protocols affect on the performance of RPL routing protocol. The performance results will be described in term of latency, packet delivery ratio and average power consumption.

Internet of Things (IoT) deployments mostly relies on the establishment of Low-Power and Lossy Networks (LLNs) among a large number of constraint devices. The Internet Engineering Task Force (IETF) provides an effective IPv6-based LLN routing protocol, namely the IPv6 Routing Protocol for Low Power and Lossy Network (RPL). RPL provides adequate protection against external security attacks but stays vulnerable to internal routing attacks such as a rank attack. Malicious RPL nodes can carry out a rank attack in different forms and cause serious network performance degradation. An experimental study of the impact of the decreased rank attack on the overall network performance is presented in this paper. In also besides, it is important to understand the main influencing factors in this context. In this study, several some many network scenarios were considered with varying network sizes, attacker properties, and topological setups. The experimental results indicate a noticeable adverse effect of the rank attack on the average PDR, delay, ETX, and beacon interval. However, such impact was varied according to network size, attacker position, attacker neighbor count, number of attack-affected nodes, and overall hops increase. The results give a practical reference to the overall performance of RPL networks under rank attacks.

Chapter 8 - IRC and Botnets