Repository logo
 

Authentication Key Exchange and Attack Detection with SDN Controller for IoT Networks

Files

Thesis(6.5 MB)

Date

2022

Authors

Supervisor

Gutierrez, Jairo
Rehman, Saeed
Ghobakhlou, Akbar

Item type

Thesis

Degree name

Doctor of Philosophy

Journal Title

Journal ISSN

Volume Title

Publisher

Auckland University of Technology

Abstract

The system of global connectivity of sensing devices for monitoring and automation is known as Internet of Things (IoT). Adoption of this technology has made tremendous contribution to increase the productivity, efficient monitoring, and communication in various application domains. The numerous IoT applications have driven industry to adopt the technologies facilitating the IoT implementation for their specific use cases. The rapid adoption and diverse applications of IoT have presented novel use cases and challenges. To address these challenges, multiple vendors joined the race of IoT service provision. One of the challenges in IoT adoption is low powered long distance transmission that is addressed by Low Powered Wide Area Network (LPWAN) technologies. Another challenge is the limited computing power and storage that makes these devices resource-constrained and unable to utilise state of the art security mechanisms, making them vulnerable to attacks. To fulfil the requirements of minimal processing and long node lifetime, most of the IoT devices provide minimal security features. LPWAN technologies are no exception when it comes to security provision in communication security. LPWAN technologies follow a star topology where the nodes are deployed in remote locations, and they transmit data directly to an Internet facing gateway. The end devices in the networks often use commodity hardware to achieve low cost and do not provide physical security to the devices. In addition, the communication to the gateways is wireless. Given the state of the device and communication medium, they become an easy target for the attackers in the network. This thesis analyses the security features provided by various LPWAN technologies in detail and explains their security vulnerabilities. Based on the investigation, the requirement for better lightweight session key and attack detection mechanisms for LPWAN networks is identified. The research proposes a lightweight and security mechanism for nodes in LPWAN networks. Additionally, this study explores the applicability of Software Defined Networks (SDN) in the provision of security for LPWAN and embeds the SDN framework in the proposed security mechanism. The proposed security mechanism utilises an SDN controller as a centralised entity for key distribution and attack detection. The framework has four major components to achieve a secure security framework for LPWAN: key distribution for end nodes, node activation and session key mechanism, energy-aware adaptive encryption, and machine learning based attack detection using SDN. The proposed framework provides a lightweight session key mechanism and a robust SDN-based attack detection mechanism for LPWAN nodes. The framework targets energy-aware operations while providing efficient security to the network by shifting the computational tasks towards the computationally efficient end of the network by leveraging the star topology of LPWAN networks. The framework is validated using various simulation tools to verify its capabilities and operations. The correctness of the key calculation employed for the session key mechanism is verified using the Mininet-WiFi emulator and the session key process includes calculating the session keys on the server and end node using the public key information. Data flow security is verified for its protection against various attack models using the Scyther security analysis tool. In addition, the energy consumption of the session key mechanism is measured by implementing an energy model on top of the LoRaWAN protocol in the NS3 simulator. The simulation results verify that the data flow of the session key mechanism is not vulnerable to any attack model in the Scyther tool and is functioning correctly. On comparing the power consumption of the proposed session key mechanism with LoRaWAN protocol, it is confirmed that the session key mechanism has minimal impact on the end nodes. Furthermore, along with the session key mechanism, this research has proposed an attack detection strategy. This approach is employed/tested on the publicly available dataset, AWID-CLS which include samples of three types of wireless networks attacks: “Flooding”, “Injection”, and “Impersonation”. This thesis proposes a two-tier architecture for attack detection and profiling for the security of the network. The first tier uses a binary classifier to classify “attack” and “normal” traffic from entering the Internet facing network. The second tier of attack detection mechanism implements a consolidated voting mechanism to profile the attack on the network. The dataset is divided into train and test sets for training and testing purposes for machine learning classifiers, respectively. The prediction results on the test set show that the trained classifiers have high efficiency in detecting and profiling the attacks on the network. The application of the two-tier architecture provides a distributed approach for early detection of attacks on the gateway and redirects the malicious traffic before it can enter the IoT network.

Description

Keywords

Source

DOI

Publisher's version

Rights statement

Permanent link

https://hdl.handle.net/10292/15229

Collections

Doctoral Theses