Denial of service mitigation approach for IPv6‐enabled smart object networks

Abstract

Denial of service (DoS) attacks can be defined as any third-party action aiming to reduce or eliminate a network's capability to perform its expected functions. Although there are several standard techniques in traditional computing that mitigate the impact of some of the most common DoS attacks, this still remains a very important open problem to the network security community. DoS attacks are even more troublesome in smart object networks because of two main reasons. First, these devices cannot support the computational overhead required to implement many of the typical counterattack strategies. Second, low traffic rates are enough to drain sensors' battery energy making the network inoperable in short times. To realize the Internet of Things vision, it is necessary to integrate the smart objects into the Internet. This integration is considered an exceptional opportunity for Internet growth but, also, a security threat, because more attacks, including DoS, can be conducted. For these reasons, the prevention of DoS attacks is considered a hot topic in the wireless sensor networks scientific community. In this paper, an approach based on 6LowPAN neighbor discovery protocol is proposed to mitigate DoS attacks initiated from the Internet, without adding additional overhead on the 6LoWPAN sensor devices.Wireless sensor networks are a subtype of smart object networks, where the devices can interact with their environment by sensing and controlling physical parameters, such as temperature, humidity, and solar radiation. A single network may comprise hundreds of smart devices working together to accomplish a common task. Self-organization, fault-tolerance, and self-optimization are the main characteristics of smart object networks [2]. Currently, there are already many technologies that can be used to connect smart objects [3], most of them based on the standard IEEE 802.15.4 layer two protocol [6] but some being proprietary, such as ZigBee [7] and WirelessHART [8]. Nevertheless, these solutions are not compatible with IP protocol and consequently require complex gateways to connect them to the Internet. The aim is that, in a near future, users can access the information collected by smart objects from the Internet, using regular devices and standard protocols. To reach this aim, a new paradigm is necessary to enable smart objects to be accessed from the Internet where all devices and networks are IP-enabled, independently of their physical and media access control (MAC) layer protocol [1]. The support of Internet protocol (IP) in all smart devices will also simplify the application development because tools in use on regular computing for commissioning, configuring, managing, and debugging can be used or adapted. Initially, the IP protocol stack was considered too heavy to run on small power and resource constrained devices. Meanwhile, the scientific community, together with the industry, started to rethink many misconceptions about the use of IP in all devices and now the IPv6 protocol is considered the most consens...

Network Admission Control Solution for 6LoWPAN Networks

“…Eavesdropping, packet replay, tampering and spoofing are examples of attacks against the secrecy and authenticity. Denial of service can be targeted at the different protocol layers and is the main example of an attack against the network availability [7]. In the stealthy attacks, the main objective is to make a legitimate node to accept fake data generated by the attacker and the compromised legitimate node can also be used to intensify the spreading of false data through all other legitimate nodes.…”

“…However, they can also be used to perform security attacks, because third party nodes can easily join the network [6]. WSN exhibit a large number of vulnerabilities, which make them even more vulnerable to security attacks than unconstrained IP networks [7][8]. To circumvent this issue, several security mechanisms have been proposed, some of them defined to address particular well-known attacks [9].…”

Internet-of-Things security: Denial of service attacks

“…Etiket saldırılarındaysa saldırganlar kötücül etiketleri IoT ortamına yerleşirmekte ve kullanıcıları istemedikleri yerlere ya da Internet sitelerine yönlendirmektedirler [19]. Dügümü Fiziksel Veri Bagı 6LoWPAN Agİletim Uygulama Parazit yapma [12] Çerçeve çakıştırma [13] Parçalama [14], [15] Çukur [10], [16] Taşkın [13] Çapraz protokol [17] Dügüm yineleme [11] Zaman penceresi [18] Seçerek yönlendirme [10], [11] Senkronizasyon [13] Prokol işleme [17] Etiket [19] Taklit/degiştirme [20] URI işleme [17] Çok kimliklilik [11], [21] Vekil sunucu [17] Solucan deligi [11], [22] Önbellekleme [17] Seviye [23], [24] Versiyon numarası [25], [26] Yerel onarım [10], [17], [23] Hello taşkını [11] Tablo I: IoT Protol Yıgını Katmanlarına Göre DoS/DDoS Saldırıları ele geçirme ya da yineleme saldırılarındaysa saldırgan fiziksel bir dügümü kopyalayarak IoT agında birden fazla noktaya yerleştirmeye çalışır. Bu sayede mesajların hedefledikleri yerler yerine kopya dügümlere gitme olasılıgı artar ve önemli mesajlar hedefe hiç ulaşamayabilir.…”

“…Çerçeveleri çakışmaya zorlayan bu saldırılar kaynakların tükenmesine neden olmakta ve dügümler arasında adil kaynak kullanımını bozmaktadır [13]. IoT MAC katmanı zaman aralıkları saldırılarında ise saldırgan garantili zaman aralıklarının ag koordinatörü ile kurulması esnasındaki gerekli mesaj alışverişini sekteye ugratmaya çalışmaktadır [18].…”

A Network Access Control Framework for 6LoWPAN Networks

“…Eavesdropping, packet replay, tampering and spoofing are examples of attacks against the secrecy and authenticity. Denial of service (DoS) is the main example of an attack against the network availability and can be targeted at the different layers of the networking stack [9,10]. In the stealthy attacks, the main goal is to make a legitimate node to accept false data values generated by the attacker and, in this way, the compromised legitimate node can also be used to amplify the dissemination of false data through all other legitimate nodes.…”