Securing communication in 6LoWPAN with compressed IPsec

Abstract

Abstract-Real-world deployments of wireless sensor networks (WSNs) require secure communication. It is important that a receiver is able to verify that sensor data was generated by trusted nodes. It may also be necessary to encrypt sensor data in transit. Recently, WSNs and traditional IP networks are more tightly integrated using IPv6 and 6LoWPAN. Available IPv6 protocol stacks can use IPsec to secure data exchange. Thus, it is desirable to extend 6LoWPAN such that IPsec communication with IPv6 nodes is possible. It is beneficial to use IPsec because the existing end-points on the Internet do not need to be modified to communicate securely with the WSN. Moreover, using IPsec, true end-to-end security is implemented and the need for a trustworthy gateway is removed.In this paper we provide End-to-End (E2E) secure communication between IP enabled sensor networks and the traditional Internet. This is the first compressed lightweight design, implementation, and evaluation of 6LoWPAN extension for IPsec. Our extension supports both IPsec's Authentication Header (AH) and Encapsulation Security Payload (ESP). Thus, communication endpoints are able to authenticate, encrypt and check the integrity of messages using standardized and established IPv6 mechanisms.

A Survey of Potential Security Issues in Existing Wireless Sensor Network Protocols

“…The 6LoWPAN does not ensure end-to-end protection between an IP sensor node and the Internet which makes it vulnerable to eavesdropping/spoofing and man in the middle attacks. These can be prevented by IPsec which defines a set of protocols to enable the authentication and encryption of each IP packet at the network layer [45]. The most common attack in the category of threats arising from the Internet is the botnet attack where data is forged by the botnet network and the wrong data is sent to the user node.…”

“…Authentication attack Network access control framework [44] PS Provides the node identification, but only enables one border router; Not implemented yet; Man in the middle, Eavesdropping/spoofing IPsec (AH and EPS) [45] PS Provides end-to-end secure communication; Pre-shared keys mechanism is not very flexible; Botnet attack Bot analysis module [46] IDS Good detection rates for large number of nodes; Decreased network performance and large overhead; RPL Selective forwarding attack Lightweight Heartbeat [48] IDS It has to be combined with IPsec to detect attack; No defense is provided after the attack is detected; Resilient techniques [51] PS Improved delivery ratio, but an increase in energy consumption; Spoofed/altered inf., sinkhole, selective forwarding SVELTE [50] IDS SVELTEs overhead is small enough; The true positive rate is not 100% due to some false alarms; Sinkhole attack IDS solution [52] IDS IPsec and bidirectional communication are necessary. Parent fail-over & rank authentication [53] …”

Security of Internet of Things for a Reliable Internet of Services

“…If the routing path has a malicious node, then the security of the messages routed through this path cannot be guaranteed. In addition to this, IEEE 802.15.4 PHY and Link Layer Security works only in the IoT -Access Network Layer in our generic architecture and when messages leave this layer and enter the Internet, they are no more protected [40].…”

Policy-Controlled Authenticated Access to LLN-Connected Healthcare Resources

“…work on the 6LoWPAN), the pertinent cryptographic primitives are also adapted and improved accordingly. Such an example is the IPsec protocol and its variants that utilize header compression [44], [45], [46], which can provide similar levels of protection while preserving the valuable node resources.…”