A Security Scheme to Mitigate Fragmentation-Based Network Attacks in 6LoWPAN

1. SECuRE and Trustworthy
Computing Lab
Authors
Mahmud Hossain, Yasser Karim, and Ragib Hasan
SECuRE and Trustworthy computing Lab (SECRETLab)
University of Alabama at Birmingham
Presenter: Mahmud Hossain
http://secret.cis.uab.edu
IoT
SecuPAN: A Security Scheme to Mitigate
Fragmentation-Based Network Attacks in 6LoWPAN

2. SECuRE and Trustworthy
Computing Lab
2
The Internet of Things (IoT)
 A programmable world
 Everyday objects are
interconnected
 Objects are smart enough to
make decision

3. SECuRE and Trustworthy
Computing Lab
Source: Zinnov Zones (2016)
IoT Forecasts and Market Estimates
3
 Estimation of connected things by 2020
 20.8 billion (Gartner)
 26.3 billion (Cisco)
 28 billion (Ericson)
 34 billion (Business Insider)
Source: ZStatista (2018)

4. SECuRE and Trustworthy
Computing Lab
Protocols for IoT network
 IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN)
 Zigbee
 Bluetooth
 Z-Wave
 Sigfox
 Wi-Fi
4

5. SECuRE and Trustworthy
Computing Lab
6LoWPAN: Protocol Stack
 IEEE 802.15.4
 IPv6
5

6. SECuRE and Trustworthy
Computing Lab
Fragmentation in 6LoWPAN
 Maximum Transmission Unit (MTU) size 127 octets(bytes).
 IPv6 packets are usually larger than 127 octets. (Maximum 1280
octets)
6

7. SECuRE and Trustworthy
Computing Lab
Vulnerabilities of 6LoWPAN Fragmentation
Mechanism
 Fragment authentication
 Fragment freshness verification
 Payload integrity verification
 Source IP-Address validation
7

8. SECuRE and Trustworthy
Computing Lab
Threat Model
 Capability of Target and Malicious Devices
 Resource Constrained
 Location
 Within Radio Range (Mallory)
 Via Gateway (Eve)
 Via Internet (Malice)
 Extract key materials
 Memory Probing
8

9. SECuRE and Trustworthy
Computing Lab
Threat Model
 Network External Attacks
 Attackers conduct activity from outside via Internet.
 No resource limitation
 Attackers can easily send large number of packets which are further
broken into fragments.
 Gateway can prevent such attack by employing an
authenticated tunnel, such as IPsec.
 Secure rate limiting mechanisms for large packets from
authenticated sources.
9

10. SECuRE and Trustworthy
Computing Lab
Threat Model
 Network Internal Attacks
10
Replay
Alteration
Spoofing Duplicate
Buffer exhaustion

11. SECuRE and Trustworthy
Computing Lab
SecuPAN : Proposed Solutions
 Nonce field in the FRAG1 header.
 MAC-based scheme.
 Cryptographic datagram-tag and cryptographically generated
IPv6 address (CGA-IPv6).
 Reputation-based buffer management mechanism.
11

12. SECuRE and Trustworthy
Computing Lab
Proposed Datagram Tag, Nonce & MAC fields
12
 Crypto Datagram Tag 16 bits.
 MAC (N || Hash (Payload added to FRAG1)
 Nonce 16 bits.
 MAC field 32 bits.
 MAC (Hash (Payload added to FRAGN))
 Ensures fragments integrity and freshness.

13. SECuRE and Trustworthy
Computing Lab
Cryptographic IPv6 Address Assignment
 A CGA is an Internet Protocol Version
6 (IPv6) address that contains a host
identifier computed from a
cryptographic hash function.
 In our proposed solution, a Border
Router in a 6LoWPAN network assigns
a CGA-IPv6 address to joining device.
 Prevent address spoofing.
13

14. SECuRE and Trustworthy
Computing Lab
Secure Transfer of Packet Fragmentations
 Public Key Retrieval
 Secure Fragmentation
14

15. SECuRE and Trustworthy
Computing Lab
Operational Model
15
Verify Crypto Datagram Tag
MACK (N)
=? Hash
Yes

16. SECuRE and Trustworthy
Computing Lab
SecuPAN : Secure Management of
Reassembly Buffer
 A reputation point based buffer management scheme
 Reputation point, 𝑟𝑗 is defined as follows:
𝑟𝑗 =
min
𝑟𝑗 + 1
2
, 1
max 𝑟𝑗 −
𝑏𝑢𝑓𝑗
𝑟𝑗
1 − μ 𝑗 , 0.1
 Here, 𝜇 𝑗 =
𝑇𝑜𝑡𝑎𝑙 𝑏𝑦𝑡𝑒𝑠 𝑟𝑒𝑐𝑒𝑖𝑣𝑒𝑑
𝑇𝑜𝑡𝑎𝑙 𝑙𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑐𝑘𝑒𝑡
and 𝑏𝑢𝑓𝑗 =
𝑇𝑜𝑡𝑎𝑙 𝑎𝑙𝑙𝑜𝑐𝑎𝑡𝑒𝑑 𝑝𝑜𝑟𝑡𝑖𝑜𝑛 𝑜𝑓 𝑡ℎ𝑒 𝑏𝑢𝑓𝑓𝑒𝑟(𝑏𝑢𝑓𝑎)
𝑇𝑜𝑡𝑎𝑙 𝑠𝑖𝑧𝑒 𝑜𝑓 𝑡ℎ𝑒 𝑏𝑢𝑓𝑓𝑒𝑟
 A receiver allocates 𝑏𝑢𝑓𝑎 for a fragmented packet as:
𝑏𝑢𝑓𝑎 = 𝑝 + 𝑞, 𝑝 = 𝑟𝑗 ∗ 𝑑𝑎𝑡𝑎𝑔𝑟𝑎𝑚_𝑠𝑖𝑧𝑒, 𝑎𝑛𝑑 𝑞 = 𝑝 + 8 𝑚𝑜𝑑 8
 Packet discard policy: Uncertainty Point ucP =
𝑓 𝑟
+𝑡𝑟+𝑛𝑠
𝑟 𝑠
16
If a sender sends all the fragments.
If the receiver fails receiving all the packet
fragments before time expires

17. SECuRE and Trustworthy
Computing Lab
Experimental Setup
17

18. SECuRE and Trustworthy
Computing Lab
Evaluation
18
Packet Delivery Ratio
(buffer reservation)
Effective Packet Number

19. SECuRE and Trustworthy
Computing Lab
Evaluation
19
End to End Delay Throughput
Energy Consumption for
Communications

20. SECuRE and Trustworthy
Computing Lab
Security Analysis
 Replay
 Nonce field
 Alteration
 MAC field
 Spoofing
 CGA-IPv6
 Duplication
 MAC field
 Buffer exhaustion
 Reputation point based system
20

21. SECuRE and Trustworthy
Computing Lab
Conclusion
 Fragmentation mechanism enables vulnerabilities in
6LoWPAN.
 Proposed a security mechanism based on Cryptographically
Generated IPv6 Address to mitigate impersonation attacks.
 MAC-based fragmentation scheme to verify authenticity and
integrity of packet fragments.
 Reputation-based buffer management scheme to protect
resource-limited devices from buffer overflow.
21

22. SECuRE and Trustworthy
Computing Lab
Thank You
22
SECRETLab@UAB
 Phone: 205.934.8643
 Fax: 205.934.5473
 Web: http://secret.cis.uab.edu/
Mahmud Hossain
 Email: mahmud@uab.edu