5 research outputs found
Security and Privacy Issues in Wireless Mesh Networks: A Survey
This book chapter identifies various security threats in wireless mesh
network (WMN). Keeping in mind the critical requirement of security and user
privacy in WMNs, this chapter provides a comprehensive overview of various
possible attacks on different layers of the communication protocol stack for
WMNs and their corresponding defense mechanisms. First, it identifies the
security vulnerabilities in the physical, link, network, transport, application
layers. Furthermore, various possible attacks on the key management protocols,
user authentication and access control protocols, and user privacy preservation
protocols are presented. After enumerating various possible attacks, the
chapter provides a detailed discussion on various existing security mechanisms
and protocols to defend against and wherever possible prevent the possible
attacks. Comparative analyses are also presented on the security schemes with
regards to the cryptographic schemes used, key management strategies deployed,
use of any trusted third party, computation and communication overhead involved
etc. The chapter then presents a brief discussion on various trust management
approaches for WMNs since trust and reputation-based schemes are increasingly
becoming popular for enforcing security in wireless networks. A number of open
problems in security and privacy issues for WMNs are subsequently discussed
before the chapter is finally concluded.Comment: 62 pages, 12 figures, 6 tables. This chapter is an extension of the
author's previous submission in arXiv submission: arXiv:1102.1226. There are
some text overlaps with the previous submissio
Securing IP Mobility Management for Vehicular Ad Hoc Networks
The proliferation of Intelligent Transportation Systems (ITSs) applications, such as
Internet access and Infotainment, highlights the requirements for improving the underlying
mobility management protocols for Vehicular Ad Hoc Networks (VANETs). Mobility
management protocols in VANETs are envisioned to support mobile nodes (MNs), i.e.,
vehicles, with seamless communications, in which service continuity is guaranteed while
vehicles are roaming through different RoadSide Units (RSUs) with heterogeneous wireless
technologies.
Due to its standardization and widely deployment, IP mobility (also called Mobile IP
(MIP)) is the most popular mobility management protocol used for mobile networks including
VANETs. In addition, because of the diversity of possible applications, the Internet
Engineering Task Force (IETF) issues many MIP's standardizations, such as MIPv6 and
NEMO for global mobility, and Proxy MIP (PMIPv6) for localized mobility. However,
many challenges have been posed for integrating IP mobility with VANETs, including the
vehicle's high speeds, multi-hop communications, scalability, and ef ficiency. From a security
perspective, we observe three main challenges: 1) each vehicle's anonymity and location
privacy, 2) authenticating vehicles in multi-hop communications, and 3) physical-layer
location privacy.
In transmitting mobile IPv6 binding update signaling messages, the mobile node's Home
Address (HoA) and Care-of Address (CoA) are transmitted as plain-text, hence they can
be revealed by other network entities and attackers. The mobile node's HoA and CoA
represent its identity and its current location, respectively, therefore revealing an MN's HoA
means breaking its anonymity while revealing an MN's CoA means breaking its location
privacy. On one hand, some existing anonymity and location privacy schemes require
intensive computations, which means they cannot be used in such time-restricted seamless
communications. On the other hand, some schemes only achieve seamless communication
through low anonymity and location privacy levels. Therefore, the trade-off between the
network performance, on one side, and the MN's anonymity and location privacy, on the
other side, makes preservation of privacy a challenging issue. In addition, for PMIPv6
to provide IP mobility in an infrastructure-connected multi-hop VANET, an MN uses a
relay node (RN) for communicating with its Mobile Access Gateway (MAG). Therefore,
a mutual authentication between the MN and RN is required to thwart authentication
attacks early in such scenarios. Furthermore, for a NEMO-based VANET infrastructure,
which is used in public hotspots installed inside moving vehicles, protecting physical-layer
location privacy is a prerequisite for achieving privacy in upper-layers such as the IP-layer. Due to the open nature of the wireless environment, a physical-layer attacker can easily
localize users by employing signals transmitted from these users.
In this dissertation, we address those security challenges by proposing three security
schemes to be employed for different mobility management scenarios in VANETs, namely,
the MIPv6, PMIPv6, and Network Mobility (NEMO) protocols.
First, for MIPv6 protocol and based on the onion routing and anonymizer, we propose
an anonymous and location privacy-preserving scheme (ALPP) that involves two complementary
sub-schemes: anonymous home binding update (AHBU) and anonymous return
routability (ARR). In addition, anonymous mutual authentication and key establishment
schemes have been proposed, to authenticate a mobile node to its foreign gateway and
create a shared key between them. Unlike existing schemes, ALPP alleviates the tradeoff
between the networking performance and the achieved privacy level. Combining onion
routing and the anonymizer in the ALPP scheme increases the achieved location privacy
level, in which no entity in the network except the mobile node itself can identify this
node's location. Using the entropy model, we show that ALPP achieves a higher degree of
anonymity than that achieved by the mix-based scheme. Compared to existing schemes,
the AHBU and ARR sub-schemes achieve smaller computation overheads and thwart both
internal and external adversaries. Simulation results demonstrate that our sub-schemes
have low control-packets routing delays, and are suitable for seamless communications.
Second, for the multi-hop authentication problem in PMIPv6-based VANET, we propose
EM3A, a novel mutual authentication scheme that guarantees the authenticity of both
MN and RN. EM3A thwarts authentication attacks, including Denial of service (DoS), collusion,
impersonation, replay, and man-in-the-middle attacks. EM3A works in conjunction
with a proposed scheme for key establishment based on symmetric polynomials, to generate
a shared secret key between an MN and an RN. This scheme achieves lower revocation
overhead than that achieved by existing symmetric polynomial-based schemes. For a PMIP
domain with n points of attachment and a symmetric polynomial of degree t, our scheme
achieves t x 2^n-secrecy, whereas the existing symmetric polynomial-based authentication
schemes achieve only t-secrecy. Computation and communication overhead analysis as well
as simulation results show that EM3A achieves low authentication delay and is suitable
for seamless multi-hop IP communications. Furthermore, we present a case study of a
multi-hop authentication PMIP (MA-PMIP) implemented in vehicular networks. EM3A
represents the multi-hop authentication in MA-PMIP to mutually authenticate the roaming
vehicle and its relay vehicle. Compared to other authentication schemes, we show that our
MA-PMIP protocol with EM3A achieves 99.6% and 96.8% reductions in authentication
delay and communication overhead, respectively.
Finally, we consider the physical-layer location privacy attacks in the NEMO-based
VANETs scenario, such as would be presented by a public hotspot installed inside a moving
vehicle. We modify the obfuscation, i.e., concealment, and power variability ideas and
propose a new physical-layer location privacy scheme, the fake point-cluster based scheme,
to prevent attackers from localizing users inside NEMO-based VANET hotspots. Involving
the fake point and cluster based sub-schemes, the proposed scheme can: 1) confuse
the attackers by increasing the estimation errors of their Received Signal Strength (RSSs)
measurements, and 2) prevent attackers' monitoring devices from detecting the user's transmitted
signals. We show that our scheme not only achieves higher location privacy, but
also increases the overall network performance. Employing correctness, accuracy, and certainty
as three different metrics, we analytically measure the location privacy achieved by
our proposed scheme. In addition, using extensive simulations, we demonstrate that the
fake point-cluster based scheme can be practically implemented in high-speed VANETs'
scenarios
Modeling Security and Cooperation in Wireless Networks Using Game Theory
This research involves the design, development, and theoretical demonstration of models resulting in integrated misbehavior resolution protocols for ad hoc networked devices. Game theory was used to analyze strategic interaction among independent devices with conflicting interests. Packet forwarding at the routing layer of autonomous ad hoc networks was investigated. Unlike existing reputation based or payment schemes, this model is based on repeated interactions. To enforce cooperation, a community enforcement mechanism was used, whereby selfish nodes that drop packets were punished not only by the victim, but also by all nodes in the network. Then, a stochastic packet forwarding game strategy was introduced. Our solution relaxed the uniform traffic demand that was pervasive in other works. To address the concerns of imperfect private monitoring in resource aware ad hoc networks, a belief-free equilibrium scheme was developed that reduces the impact of noise in cooperation. This scheme also eliminated the need to infer the private history of other nodes. Moreover, it simplified the computation of an optimal strategy. The belief-free approach reduced the node overhead and was easily tractable. Hence it made the system operation feasible. Motivated by the versatile nature of evolutionary game theory, the assumption of a rational node is relaxed, leading to the development of a framework for mitigating routing selfishness and misbehavior in Multi hop networks. This is accomplished by setting nodes to play a fixed strategy rather than independently choosing a rational strategy. A range of simulations was carried out that showed improved cooperation between selfish nodes when compared to older results. Cooperation among ad hoc nodes can also protect a network from malicious attacks. In the absence of a central trusted entity, many security mechanisms and privacy protections require cooperation among ad hoc nodes to protect a network from malicious attacks. Therefore, using game theory and evolutionary game theory, a mathematical framework has been developed that explores trust mechanisms to achieve security in the network. This framework is one of the first steps towards the synthesis of an integrated solution that demonstrates that security solely depends on the initial trust level that nodes have for each other
IP Mobility Support in Multi-hop Vehicular Communications Networks
The combination of infrastructure-to-vehicle and vehicle-to-vehicle communications, namely the multi-hop Vehicular Communications Network (VCN) , appears as a promising solution for the ubiquitous access to IP services in vehicular environments.
In this thesis, we address the challenges of multi-hop VCN, and investigate the seamless
provision of IP services over such network. Three different schemes are proposed and analyzed. First, we study the limitations of current standards for the provision of IP services, such as 802.11p/WAVE, and propose a framework that enables multi-hop communications and a robust IP mobility mechanism over WAVE. An accurate analytical model is developed to evaluate the throughput performance, and to determine the feasibility of the deployment of IP-based services in 802.11p/WAVE networks. Next, the IP mobility support is extended to asymmetric multi-hop VCN. The proposed IP mobility and routing mechanisms react to the asymmetric links, and also employ geographic location and road traffic information to enable predictive handovers. Moreover, since multi-hop communications suffer from security threats, it ensures that all mobility signalling is authenticated
among the participant vehicles. Last, we extend our study to a heterogeneous multi-hop
VCN, and propose a hybrid scheme that allows for the on-going IP sessions to be transferred along the heterogeneous communications system. The proposed global IP mobility scheme focuses on urban vehicular scenarios, and enables seamless communications for in-vehicle networks, commuters, and pedestrians.
The overall performance of IP applications over multi-hop VCN are improved substantially
by the proposed schemes. This is demonstrated by means of analytical evaluations, as well as extensive simulations that are carried out in realistic highway and urban vehicular scenarios. More importantly, we believe that our dissertation provides useful analytical
tools, for evaluating the throughput and delay performance of IP applications in multi-hop vehicular environments. In addition, we provide a set of practical and efficient solutions for the seamless support of IP tra c along the heterogeneous and multi-hop vehicular network, which will help on achieving ubiquitous drive-thru Internet, and infotainment traffic access in both urban and highway scenarios
Distributed anomaly detection models for industrial wireless sensor networks
Wireless Sensor Networks (WSNs) are firmly established as an integral technology that enables automation and control through pervasive monitoring for many industrial applications. These range from environmental applications and healthcare applications to major industrial monitoring applications such as infrastructure and structural monitoring. The key features that are common to such applications can be noted as involving large amounts of data, consisting of dynamic observation environments, non-homogeneous data distributions with evolving patterns and sensing functionality leading to data-driven control. Also in most industrial applications a major requirement is to have near real-time decision support. Accordingly there is a vital need to have a secure continuous and reliable sensing mechanism in integrated WSNs where integrity of the data is assured. However, in practice WSNs are vulnerable to different security attacks, faults and malfunction due to inherent resource constraints, openly commoditised wireless technologies employed and naive modes of implementation. Misbehaviour resulting from such threats manifest as anomalies in the sensed data streams in critically compromising the systems. Therefore, it is vital that effective techniques are introduced in accurately detecting anomalies and assuring the integrity of the data. This research focuses on investigating such models for large scale industrial wireless sensor networks. Focusing on achieving an anomaly detection framework that is adaptable and scalable, a hierarchical data partitioning approach with fuzzy data modelling is introduced first. In this model unsupervised data partitioning is performed in a distributed manner by adapting fuzzy c-means clustering in an incremental model over a hierarchical node topology. It is found that non-parametric and non-probabilistic determination of anomalies can be done by evaluating the fuzzy membership scores and inter-cluster distances adaptively over the node hierarchy. Considering heterogeneous data distributions with evolving patterns, a granular anomaly detection model that uses an entropy criterion to dynamically partition the data is proposed next. This successfully overcomes the issue of determining the proper number of expected clusters in a dynamic manner. In this approach the data is partitioned on to different cohesive regions using cumulative point-wise entropy directly. The effect of differential density distributions when relying on an entropy criterion is mitigated by introducing an average relative density measure to segregate isolated outliers prior to the partitioning. The combination of these two factors is shown to be significantly successful in determining anomalies adaptively in a fully dynamic manner. The need for near real-time anomaly evaluation is focused next on this thesis. Building upon the entropy based data partitioning model that is also proposed, a Point-of-View (PoV) entropy evaluation model is developed next. This employs an incremental data processing model as opposed to batch-wise data processing. Three unique points-of-view are introduced as the reference points over which point-wise entropy is computed in evaluating its relative change as the data streams evolve. Overall this thesis proposes efficient unsupervised anomaly detection models that employ distributed in-network data processing for accurate determination of anomalies. The resource constrained environment is taken in to account in each of the models with innovations made to achieve non-parametric and non-probabilistic detection