A Network Access Control Framework for 6LoWPAN Networks

Abstract

Low power over wireless personal area networks (LoWPAN), in particular wireless sensor networks, represent an emerging technology with high potential to be employed in critical situations like security surveillance, battlefields, smart-grids, and in e-health applications. The support of security services in LoWPAN is considered a challenge. First, this type of networks is usually deployed in unattended environments, making them vulnerable to security attacks. Second, the constraints inherent to LoWPAN, such as scarce resources and limited battery capacity, impose a careful planning on how and where the security services should be deployed. Besides protecting the network from some well-known threats, it is important that security mechanisms be able to withstand attacks that have not been identified before. One way of reaching this goal is to control, at the network access level, which nodes can be attached to the network and to enforce their security compliance. This paper presents a network access security framework that can be used to control the nodes that have access to the network, based on administrative approval, and to enforce security compliance to the authorized nodes.

Network Admission Control Solution for 6LoWPAN Networks

“…However, the node resource constraints, the number of nodes and the absence of an organized communication infrastructure, makes the support of security services in WSN networks more challenging when compared with resource unconstrained networks [6]. Confidentiality, authenticity, integrity, availability, data freshness, robustness, and survivability are the most relevant security requirements in WSN networks [12].…”

“…These characteristics are useful in most situations because they minimize the configuration efforts and simultaneously increase the network robustness in case of failures or topology changes. However, they can also be used to perform security attacks, because third party nodes can easily join the network [6]. WSN exhibit a large number of vulnerabilities, which make them even more vulnerable to security attacks than unconstrained IP networks [7][8].…”

Distributed Database Management Techniques for Wireless Sensor Networks

“…Sensors can be placed anywhere there is data that should be co Co in llected, what makes information omnipresent. sequently, systems based on sensor networks are n creasingly common in many areas of the knowledge, giving rise to several flavors of WSNs [13], [14]. These numerous WSNs have allowed the development of many applications [15], [16], [17].…”

A Survey of Potential Security Issues in Existing Wireless Sensor Network Protocols

“…In the content chaining scheme receiving node uses cryptographic mechanisms to verify that received fragments belong to the same packet, while the split buffer approach promotes direct competition between legitimate nodes and an attacker in using deficient buffer resources. The authentication can be ensured by employing network access control framework described in [44]. The 6LoWPAN does not ensure end-to-end protection between an IP sensor node and the Internet which makes it vulnerable to eavesdropping/spoofing and man in the middle attacks.…”

“…Authentication attack Network access control framework [44] PS Provides the node identification, but only enables one border router; Not implemented yet; Man in the middle, Eavesdropping/spoofing IPsec (AH and EPS) [45] PS Provides end-to-end secure communication; Pre-shared keys mechanism is not very flexible; Botnet attack Bot analysis module [46] IDS Good detection rates for large number of nodes; Decreased network performance and large overhead; RPL Selective forwarding attack Lightweight Heartbeat [48] IDS It has to be combined with IPsec to detect attack; No defense is provided after the attack is detected; Resilient techniques [51] PS Improved delivery ratio, but an increase in energy consumption; Spoofed/altered inf., sinkhole, selective forwarding SVELTE [50] IDS SVELTEs overhead is small enough; The true positive rate is not 100% due to some false alarms; Sinkhole attack IDS solution [52] IDS IPsec and bidirectional communication are necessary. Parent fail-over & rank authentication [53] …”