A Survey on Wireless Security: Technical Challenges, Recent Advances and Future Trends

This paper examines the security vulnerabilities and threats imposed by the inherent open nature of wireless communications and to devise efficient defense mechanisms for improving the wireless network security. We first summarize the security requirements of wireless networks, including their authenticity, confidentiality, integrity and availability issues. Next, a comprehensive overview of security attacks encountered in wireless networks is presented in view of the network protocol architecture, where the potential security threats are discussed at each protocol layer. We also provide a survey of the existing security protocols and algorithms that are adopted in the existing wireless network standards, such as the Bluetooth, Wi-Fi, WiMAX, and the long-term evolution (LTE) systems. Then, we discuss the state-of-the-art in physical-layer security, which is an emerging technique of securing the open communications environment against eavesdropping attacks at the physical layer. We also introduce the family of various jamming attacks and their counter-measures, including the constant jammer, intermittent jammer, reactive jammer, adaptive jammer and intelligent jammer. Additionally, we discuss the integration of physical-layer security into existing authentication and cryptography mechanisms for further securing wireless networks. Finally, some technical challenges which remain unresolved at the time of writing are summarized and the future trends in wireless security are discussed.Comment: 36 pages. Accepted to Appear in Proceedings of the IEEE, 201

Communication Security in Wireless Sensor Networks

A wireless sensor network (WSN) usually consists of a large number of small, low-cost devices that have limited energy supply, computation, memory, and communication capacities. Recently, WSNs have drawn a lot of attention due to their broad applications in both military and civilian domains. Communication security is essential to the success of WSN applications, especially for those mission-critical applications working in unattended and even hostile environments. However, providing satisfactory security protection in WSNs has ever been a challenging task due to various network & resource constraints and malicious attacks. This motivates the research on communication security for WSNs. This dissertation studies communication security in WSNs with respect to three important aspects. The first study addresses broadcast/multicast security in WSNs. We propose a multi-user broadcast authentication technique, which overcomes the security vulnerability of existing solutions. The proposed scheme guarantees immediate broadcast authentication by employing public key cryptography, and achieves the efficiency through integrating various techniques from different domains. We also address multicast encryption to solve data confidentiality concern for secure multicast. We propose an efficient multicast key management scheme supporting a wide range of multicast semantics, which utilizes the fact that sensors are both routers and end-receivers. The second study addresses data report security in WSNs. We propose a location-aware end-to-end security framework for WSNs, in which secret keys are bound to geographic locations so that the impact of sensor compromise are limited only to their vicinity. The proposed scheme effectively defeats not only bogus data injection attacks but also various DoS attacks. In this study, we also address event boundary detection as a specific case of secure data aggregation in WSNs. We propose a secure and fault-tolerant event boundary detection scheme, which securely detects the boundaries of large spatial events in a localized statistic manner. The third study addresses random key pre-distribution in WSNs. We propose a keyed-hash-chain-based key pool generation technique, which leads to a more efficient key pre-distribution scheme with better security resilience in the case of sensor compromise

AUTENTIKASI JARINGAN SENSOR NIRKABEL UNTUK MENGHADAPI SERANGAN DoS BERBASIS PKC

Komunikasi broadcast pada jaringan sensor nirkabel (JSN) sangat efisien dan berdampak besar pada seluruh node sensor. Alasan tersebut mendasari pemanfaatan node sensor terutama pada proses diseminasi data, kode, pemeliharaan, menjalankan perintah atau query maupun sinkronisasi. Kondisi ini diikuti dengan rawannya keamanan yang dapat mengganggu ketersediaan komunikasi pada JSN. Oleh karena itu dibutuhkan proses autentikasi pengguna untuk memastikan apakah pengguna valid. Pemanfaatan digital signature untuk autentikasi memiliki keamanan yang tinggi akan tetapi harus diimbangi dengan komputasi yang tinggi. Kekurangan ini dimanfaatkan peretas untuk mengirimkan signature palsu dalam jumlah besar sehingga node sensor akan sibuk memverifikasi dan proses ini dikenal dengan serangan Denial of Service (DoS) berbasis Public Key Cryptography (PKC). Berbagai metode filter dikembangkan untuk mengatasi masalah ini. Mekanisme ini memiliki komputasi rendah dan bersifat mendampingi proses verifikasi signature bukan menggantinya. Skema puzzle merupakan salah satu filter dengan komputasi rendah namun dapat diandalkan dalam mengatasi serangan DoS berbasis PKC akan tetapi memiliki kelemahan pada delay yang tinggi dalam mencari solusi puzzle pada sisi pengirim. Berkembangnya berbagai aplikasi pendukung yang akan mengakses node sensor secara langsung meningkatkan keragaman dan skalabilitas pada JSN. Sedangkan node sensor memiliki keterbatasan dalam sumber daya terutama pada ruang penyimpanan dan kemampuan komputasi. Oleh karena itu, penelitian ini mengajukan skema puzzle dinamis pada JSN menggunakan Multiuser-Dynamic Cipher Puzzle (M-DCP) yang dilengkapi dengan TinySet. Skema ini bertujuan untuk mengurangi waktu pemrosesan dan dapat dimanfaatkan oleh banyak pengguna atau pengirim dengan kebutuhan ruang penyimpanan pada JSN yang rendah. M-DCP memanfaatkan fungsi ambang untuk membatasi jumlah iterasi hash. Hasil percobaan menunjukkan bahwa fungsi ambang eksponensial dapat menurunkan delay pada sisi pengirim hingga 94% dengan peluang ditemukannya solusi hingga 1-(1.738x10-13). Sedangkan pemanfaatan TinySet yang telah diregularisasi bisa menghemat ruang penyimpanan hingga 77% dibandingkan dengan Counting Bloom Filter (CBF). Pemanfaatan skema ini berdampak pada meningkatnya komputasi pada proses verifikasi. Peningkatan ini bernilai hingga 36% dibandingkan dengan Bloom Filter based Authentication (BAS) atau pada implementasinya membutuhkan waktu tidak lebih dari 0.5 detik. Performansi yang didapatkan diimbangi dengan meningkatnya keamanan terutama pada autentikasi, confidentiality dan ketahanan terhadap serangan DoS berbasis PKC. Hal ini dibuktikan dengan peningkatan kompleksitas serangan menggunakan brute force hingga 1.86x10137 trial yang didapatkan dari proses autentikasi menggunakan Elliptic Curve Digital Signature Algorithm (ECDSA), proses enkripsi menggunakan Rivest Cipher 5 (RC5) dan proses pembuatan puzzle menggunakan DCP. Kata kunci: autentikasi, DoS, jaringan sensor nirkabel, multiuser, skema puzzl

Efficient Gaussian Process Classification-based Physical-Layer Authentication with Configurable Fingerprints for 6G-Enabled IoT

Physical-Layer Authentication (PLA) has been recently believed as an endogenous-secure and energy-efficient technique to recognize IoT terminals. However, the major challenge of applying the state-of-the-art PLA schemes directly to 6G-enabled IoT is the inaccurate channel fingerprint estimation in low Signal-Noise Ratio (SNR) environments, which will greatly influence the reliability and robustness of PLA. To tackle this issue, we propose a configurable-fingerprint-based PLA architecture through Intelligent Reflecting Surface (IRS) that helps create an alternative wireless transmission path to provide more accurate fingerprints. According to Baye's theorem, we propose a Gaussian Process Classification (GPC)-based PLA scheme, which utilizes the Expectation Propagation (EP) method to obtain the identities of unknown fingerprints. Considering that obtaining sufficient labeled fingerprint samples to train the GPC-based authentication model is challenging for future 6G systems, we further extend the GPC-based PLA to the Efficient-GPC (EGPC)-based PLA through active learning, which requires fewer labeled fingerprints and is more feasible. We also propose three fingerprint selecting algorithms to choose fingerprints, whose identities are queried to the upper-layers authentication mechanisms. For this reason, the proposed EGPC-based scheme is also a lightweight cross-layer authentication method to offer a superior security level. The simulations conducted on synthetic datasets demonstrate that the IRS-assisted scheme reduces the authentication error rate by 98.69% compared to the non-IRS-based scheme. Additionally, the proposed fingerprint selection algorithms reduce the authentication error rate by 65.96% to 86.93% and 45.45% to 70.00% under perfect and imperfect channel estimation conditions, respectively, when compared with baseline algorithms.Comment: 12 pages, 9 figure

Satellite-Based Communications Security: A Survey of Threats, Solutions, and Research Challenges

Satellite-based Communication systems are gaining renewed momentum in Industry and Academia, thanks to innovative services introduced by leading tech companies and the promising impact they can deliver towards the global connectivity objective tackled by early 6G initiatives. On the one hand, the emergence of new manufacturing processes and radio technologies promises to reduce service costs while guaranteeing outstanding communication latency, available bandwidth, flexibility, and coverage range. On the other hand, cybersecurity techniques and solutions applied in SATCOM links should be updated to reflect the substantial advancements in attacker capabilities characterizing the last two decades. However, business urgency and opportunities are leading operators towards challenging system trade-offs, resulting in an increased attack surface and a general relaxation of the available security services. In this paper, we tackle the cited problems and present a comprehensive survey on the link-layer security threats, solutions, and challenges faced when deploying and operating SATCOM systems.Specifically, we classify the literature on security for SATCOM systems into two main branches, i.e., physical-layer security and cryptography schemes.Then, we further identify specific research domains for each of the identified branches, focusing on dedicated security issues, including, e.g., physical-layer confidentiality, anti-jamming schemes, anti-spoofing strategies, and quantum-based key distribution schemes. For each of the above domains, we highlight the most essential techniques, peculiarities, advantages, disadvantages, lessons learned, and future directions.Finally, we also identify emerging research topics whose additional investigation by Academia and Industry could further attract researchers and investors, ultimately unleashing the full potential behind ubiquitous satellite communications.Comment: 72 page

Security and Prioritization in Multiple Access Relay Networks

In this work, we considered a multiple access relay network and investigated the following three problems: 1- Tradeoff between reliability and security under falsified data injection attacks; 2-Prioritized analog relaying; 3- mitigation of Forwarding Misbehaviors in Multiple access relay network. In the first problem, we consider a multiple access relay network where multiple sources send independent data to a single destination through multiple relays which may inject a falsified data into the network. To detect the malicious relays and discard (erase) data from them, tracing bits are embedded in the information data at each source node. Parity bits may be also added to correct the errors caused by fading and noise. When the total amount of redundancy, tracing bits plus parity bits, is fixed, an increase in parity bits to increase the reliability requires a decrease in tracing bits which leads to a less accurate detection of malicious behavior of relays, and vice versa. We investigate the tradeoff between the tracing bits and the parity bits in minimizing the probability of decoding error and maximizing the throughput in multi-source, multi-relay networks under falsified data injection attacks. The energy and throughput gains provided by the optimal allocation of redundancy and the tradeoff between reliability and security are analyzed. In the second problem, we consider a multiple access relay network where multiple sources send independent data simultaneously to a common destination through multiple relay nodes. We present three prioritized analog cooperative relaying schemes that provide different class of service (CoS) to different sources while being relayed at the same time in the same frequency band. The three schemes take the channel variations into account in determining the relay encoding (combining) rule, but differ in terms of whether or how relays cooperate. Simulation results on the symbol error probability and outage probability are provided to show the effectiveness of the proposed schemes. In the third problem, we propose a physical layer approach to detect the relay node that injects false data or adds channel errors into the network encoder in multiple access relay networks. The misbehaving relay is detected by using the maximum a posteriori (MAP) detection rule which is optimal in the sense of minimizing the probability of incorrect decision (false alarm and miss detection). The proposed scheme does not require sending extra bits at the source, such as hash function or message authentication check bits, and hence there is no transmission overhead. The side information regarding the presence of forwarding misbehavior is exploited at the decoder to enhance the reliability of decoding. We derive the probability of false alarm and miss detection and the probability of bit error, taking into account the lossy nature of wireless links

Formal verification and access control approach of an IoT protocol

Dissertação (mestrado) - Universidade Federal de Santa Catarina, Centro Tecnológico, Programa de Pós-Graduação em Ciência da Computação, Florianópolis, 2017.Protocolos de Segurança estão na nossa rotina diária e exemplos distosão compras utilizando o cartão de crédito, eleição eletrônica, redes sem fio e etc. O primeiro objetivo deste trabalho é a verificação formal dos aspectos de segurança de um protocolo voltado para Wireless Sensor Networks (WSN). O Trustful Space-Time Protocol (TSTP) engloba a maioria das características necessárias para aplicações WSN como por exemplo controle de acesso, roteamento geográfico de pacotes, estimativa de localização, relógio precisamente sincronizado, canais de comunicação segura e um esquema de distribuição de chaves entre o gateway e os sensores. Após a análise formal do protocolo de distribuição de chaves do TSTP usando Proverif, nós encontramos duas falhas de segurança: uma relacionada ao componente de sincronização de tempo e outra relacionada ao método mac-then-encrypt empregado. Com as falhas encontradas nós propómos uma versão melhorada do protocolo de distribuição de chaves. O segundo objetivo é criar um esquema de controle de acesso sensível ao contexto para dispositivos Internet de Coisas(IoC) usando TSTP como canal de comunicação. O esquema da política foi projetado para um cenário Smart Campus e seu contexto. Aproveitamos os recursos do TSTP para adicionar dados de tempo e espaço como contexto para o nosso modelo. Após o desenho do modelo de política, descrevemos seu modelo simbólico e fizemos uma análise formal para ter certeza de que os valores das propriedades de contexto não foram adulterados.Abstract : Security protocols are included in our every day routine. A few examplesare credit card purchases, e-voting, wireless networks, etc. Thefirst goal of this dissertation is the formal verification of the securityaspects of a cross-layer, application-oriented communication protocolfor Wireless Sensor Networks (WSN). The Trustful Space-Time Protocol(TSTP) encompasses a majority of features recurrently needed byWSN applications like medium access control, geographic routing, locationestimation, precise time synchronization, secure communicationchannels and a key distribution scheme between sensors and the sink.After the security protocol analysis of TSTP?s key distribution protocolusing ProVerif we were able to find two security flaws: one related tothe time synchronization component and another being a bad approachrelated to a mac-then-encrypt method employed. With our findingswe propose an improved version of the key distribution protocol. Thesecond goal is to create a context-aware access control scheme for Internetof Things(IoT) devices using TSTP as a communication channel.The policy?s scheme was designed for a Smart Campus scenario andits context. We take advantage of TSTP?s features to add time andspace data as context for our model too. After the design of the policymodel, we described its symbolic model and we did a formal analysisto be sure that the context properties values were not tampered

Lightweight cryptographic protocols for mobile devices

Title from PDF of title page viewed June 30, 2020Dissertation advisor: Lein HarnIncludes bibliographical references (pages 146-163)Thesis (Ph.D.)--School of Computing and Engineering. University of Missouri--Kansas City. 2020In recent years, a wide range of resource-constrained devices have been built and integrated into many networked systems. These devices collect and transfer data over the Internet in order for users to access the data or to control these devices remotely. However, the data also may contain sensitive information such as medical records or credit card numbers. This underscores the importance of protecting potentially sensitive data before it is transferred over the network. To provide security services such as data confidentiality and authentication, these devices must be provided with cryptographic keys to encrypt the data. Designing security schemes for resource-limited devices is a challenging task due to the inherit characteristics of these devices which are limited memory, processing power and battery life. In this dissertation, we propose lightweight polynomial-based cryptographic protocols in three environments that encompass resource-constrained devices which are Wireless Sensor Network (WSN), Fog Computing, and Blockchain Network. With polynomial-based schemes, we guarantee high network connectivity due to the existence of a shared pairwise key between every pair of nodes in the network. More importantly, the proposed schemes are lightweight which means they exhibit low memory, processing and communication overheads for resource-constrained devices compared with other schemes. The only problem with polynomial-based schemes is that they suffer from node-captured attacks. That is, when an attacker captured a specific number of nodes, the attacker could compromise the security of the whole network. In this dissertation, we propose, for the first time, polynomial-based schemes with probabilistic security in WSNs. That is, when the attacker captured a specific number of sensor nodes, there is a low probability the attacker could compromised the security of the whole network. We show how we can modify system’s parameters to lower such attacks.Introduction -- Overview of cryptographical key distribution schemes -- Related work -- Wireless Sensor Networks (WSNS) -- Fog computing -- Blockchain Networks -- Conclusion and future wor