Shambhu Upadhyaya

Computer Science & Eng.

University at Buffalo
Buffalo, New York 14260

ADVANCED TOPICS
Shambhu Upadhyaya
1
Mesh Networks
and Security
Shambhu Upadhyaya
2
What are Wireless Mesh Networks?
Similar to Wi-Fi Networks
Instead of multiple wireless hotspots (WHS),
WMNs use one WHS and several transit access
points (TAP), also called routers
Clients connect to TAPs, which connect
wirelessly to the WHS either directly or
multi-hopping over other TAPs

Shambhu Upadhyaya
3
WMNs
WMN provides reliability through redundancy
It is a special case of wireless ad hoc networks
Wireless mesh networks can be implemented
with various wireless technologies including
802.11 (802.11s), 802.15, 802.16
Examples
MIT RoofNet (2001)
Quail Ridge WMN (QuRiNet) at Napa Valley, CA
(2004)
Also useful in smart grid for automatic meter reading
Shambhu Upadhyaya
4

Advantages/Disadvantages
Advantages
The TAPs themselves are cheaper than WHS
Since TAPs communicate by wireless signals, they
do not require cabling to be run to add new TAPs
Allows for rapid deployment of temporary
networks
Disadvantages
TAPs are often placed in unprotected locations
Lack of physical security guarantees
Communications are wireless and therefore
susceptible to all the vulnerabilities of wireless
transmissions

Shambhu Upadhyaya
5
Three Security Challenges
Posed by WMNs
Securing the routing mechanism
WMNs rely on multi-hop transmissions over a
predominantly wireless network
Routing protocol is very important and a tempting target
Detection of corrupt TAPs
The TAPs are likely to be stored in unprotected locations,
so they may be easily accessed by malicious entities and
can be corrupted or stolen
Providing fairness
The protocol needs to be designed to distribute
bandwidth between the TAPs in a manner fair to the
users to prevent bandwidth starvation of devices far from
the WHS

Shambhu Upadhyaya
6
Fairness
There are several ways in which bandwidth can
be distributed among TAPs
What may be the best solution is to
distribute bandwidth proportional to the
number of clients using a TAP

Shambhu Upadhyaya
7
Attack Model
Four simple types of attacks possible
The first attack is removal and
replacement of the device
easily detected by change of topology
Access the internal state of the device
Modify internal state
Clone TAPs
Other sophisticated attacks possible
Blocking attacks, black hole, sybil, etc.
Shambhu Upadhyaya
8
Access Internal State
This is a passive attack and is difficult to
detect
In this attack the attacker need not
disconnect the device from WMN
Even the disconnection cannot be
detected
The effect of the attack can be reduced
by changing the TAP data at regular
intervals
Shambhu Upadhyaya
9
Modify Internal State
In this type of attack, the attacker
can modify the routing algorithm
This type attack also changes the
topology
It can also be detected by WHS
Shambhu Upadhyaya
10
Clone TAP
In this type of attack the attacker is
able to create a replica of the TAP
and place this in a strategic location
in WMN
It also allows the attacker to inject
some false data or to disconnect
some parts of network
It can damage the routing
mechanisms but can be detected
Shambhu Upadhyaya
11
Jamming and Countermeasure
The first diagram shows the attack by the
adversary
The second diagram shows the protection
measure for this attack after detection
Shambhu Upadhyaya
12
Attacks on Multihop Routing in
WMN
Rational attack vs. malicious attack
A rational attack
Does only if misbehaving is beneficial in terms of
price, QoS, or resource saving
For instance, force the traffic through a specific TAP
in order to monitor the traffic of a given mobile client
or region
A malicious attack
Involves partitioning the network or isolating the
TAPs
For instance, the routes between WHS and TAPs are
artificially increased leading to poor performance




Shambhu Upadhyaya
13
Securing Multihop Routing
Using secure routing protocols to
prevent attacks against routing
messages
If the state of one or more TAPs is
modified, the attack can be detected
and the network reconfigured
DoS attacks can be prevented by
identifying the source of disturbance
and disabling it
Shambhu Upadhyaya
14
Generalized WMNs
Vehicular Networks is special case of
WMNs where TAPs are represented by
cars and roadside WHS
Involves applications such as reporting
events (accidents), cooperative driving,
payment services and location based
services
Multi-Operator WMNs include several
operators and various devices: mobile
phones, laptops, base stations and APs
Shambhu Upadhyaya
15
Conclusion
WMNs extend the coverage of WHS in
an inexpensive manner
The three fundamental security issues
that have to be addressed in WMNs
Detection of corrupt TAPs
Defining and using a secure routing
protocol
Defining and implementing a proper
fairness metric


Shambhu Upadhyaya
16
Reference
Ben Salem, N.; Hubaux, J-P, "Securing wireless
mesh networks , Wireless Communications,
IEEE, vol.13, no.2, pp.50,55, April 2006
Shambhu Upadhyaya
17
Energy-Aware
Computing
Shambhu Upadhyaya
18
Issues in Sensor Networks
Localization
Synchronization
In-network processing
Data-centric querying
Energy-aware computing
Shambhu Upadhyaya
19
Energy Constraints
Battery-powered devices
Communication is much more energy
consuming than computation
Transmitting 1 bit costs as much energy as running
1,000 instructions
Gap is only going to be larger in the future
Load balancing
Coordinated sleeping schedules
Explore correlation in sensing data
Power saving techniques integral to most
sensor networks

Shambhu Upadhyaya
20
MAC Protocols for Sensor
Networks
Contention-Based:
CSMA protocols (IEEE 802.15.4)
Random access to avoid collisions
IEEE 802.11 type with power saving
methods
Scheduling-Based:
Assign transmission schedules
(sleep/awake patterns) to each node
Variants of TDMA
Hybrid schemes
Shambhu Upadhyaya
21
MAC Protocol Examples
PAMAS [SR98]:
Power-aware Medium-Access Protocol with Signaling
Contention-based access
Powers off nodes that are not receiving or forwarding packets
Uses a separate signaling channel
S-MAC [YHE02]:
Sensor Medium Access Control protocol
Contention-based access
TRAMA [ROGLA03]:
Traffic-adaptive medium access protocol
Schedule- and contention-based access
Wave scheduling [TYD+04]:
Schedule- and contention-based access
Shambhu Upadhyaya
22
S-MAC
Identifies sources of energy waste [YHE03]:
Collision
Overhearing
Overhead due to control traffic
Idle listening
Trade off latency and fairness for reducing
energy consumption
Components of S-MAC:
A periodic sleep and listen pattern for each node
Collision and overhearing avoidance
Shambhu Upadhyaya
23
S-MAC: Sleep and Listen
Schedules
Each node has a sleep and listen schedule and
maintains a table of schedules of neighboring
nodes
Before selecting a schedule, node listens for a
period of time:
If it hears a schedule broadcast, then it adopts that
schedule and rebroadcasts it after a random delay
Otherwise, it selects a schedule and broadcasts it
If a node receives a different schedule after
selecting its schedule, it adopts both schedules
Need significant degree of synchronization
Shambhu Upadhyaya
24
S-MAC: Collision and
Overhearing Avoidance
Collision avoidance:
Within a listen phase, senders contending to
send messages to same receiver use 802.11
Overhearing avoidance:
When a node hears an RTS or CTS packet,
then it goes to sleep
All neighbors of a sender and the receiver
sleep until the current transmission is over
Shambhu Upadhyaya
25
Routing Strategies
Geographic routing:
Greedy routing
Perimeter or face routing
Geographic localization
Attribute-based routing:
Directed diffusion
Rumor routing
Geographic hash tables
Energy-aware routing:
Minimum-energy broadcast
Energy-aware routing to a region
Shambhu Upadhyaya
26
Energy-Aware Routing
Need energy-efficient paths
Notions of energy-efficiency:
Select path with smallest energy consumption
Select paths so that network lifetime is maximized
When network gets disconnected
When one node dies
When area being sensed is not covered any more
Approaches:
Combine geographic routing with energy-awareness
Minimum-energy broadcast
Shambhu Upadhyaya
27
Minimum Energy Broadcast
Routing
Given a set of nodes in the plane
Goal: Broadcast from a source to all nodes
In a single step, a node may broadcast within a range by
appropriately adjusting transmit power
Energy consumed by a broadcast over range is
proportional to

Problem: Compute the sequence of broadcast steps that
consume minimum total energy
Centralized solutions
NP-complete [ZHE02]
Shambhu Upadhyaya
28
Three Greedy Heuristics
In each tree, power for each node proportional
to
th
exponent of distance to farthest child in
tree
Shortest Paths Tree (SPT) [WNE02]
Node version of Dijkstras SPT algorithm
Minimum Spanning Tree (MST) [WNE02]
Maintains an arborescence rooted at source
Broadcasting Incremental Power (BIP) [WNE02]
In each step, add a node that can be reached with
minimum increment in total cost
SPT is (n)-approximate, MST and BIP have
approximation ratio of at most 12 [WCLF01]
Shambhu Upadhyaya
29
References
Feng Zhao and Leonidas Guibas, Wireless Sensor
Networks: An Information Processing Approach, Morgan
Kaufman, 2004
Jeffrey E. Wieselthier, Gam D. Nguyen, and Anthony
Ephremides. 2002. Energy-efficient broadcast and
multicast trees in wireless networks. Mob. Netw. Appl. 7,
6 (December 2002)
Shambhu Upadhyaya
30
Advanced Metering
Infrastructure
(AMI)
Shambhu Upadhyaya
31
A Typical Smart Grid
Shambhu Upadhyaya
32
Advanced Meter Reading
Advanced Metering Infrastructure (AMI) or smart meters
(2-way)
Used for revenue accounting
Wireless based
Many proprietary
Moderate range, drive-by reading
Mesh (Zigbee) and WiFi sometimes
About 50Million AMR/AMI installed (USA)
Suggested standard: ANSI C12.18
Smart meters (at Microgrid level) provide information
needed to analyze energy usage and thus allow energy
minimization algorithms to be implemented


Shambhu Upadhyaya
33
Prospects for Smart Appliances
Examples: smart refrigerator, smart dryer
Two-way communication via Internet
Logical extension of smart grid/buildings
Technically possible for years but
Hardware costs high; Installation may be complex; Standards lacking
Forms a SCADA or CPS system
Security and privacy concerns high
Benefits unclear
Futuristic discussion mostly
Shambhu Upadhyaya
34
Smart Metering Communication
Zigbee is ideal for AMI
Can network a no. of sensors and controllers in
a household
Possibly in a mesh network
Can operate in one of 3 frequency bands
Shambhu Upadhyaya
35
Potential Concerns
WiFi and Zigbee interference
Can be handled by separating the channels by 30MHz
Security concerns of ad hoc and mesh networks apply
Eavesdropping
Traffic analysis
Replay attacks
Additionally:
Employee mistakes, equipment malfunctions, virus,
coordinated attacks from a state or terrorist group
Privacy concerns
Smart meters collect personally identifiable info
Cyber criminals could use them for identity theft
Shambhu Upadhyaya
36
A Privacy Compromise Scenario
Electricity use patterns could lead to disclosure
Could leak info on customers
When theyre at home (sleeping versus watching
television)
When at work, or traveling
It might also be possible to discover what types of
appliances and devices are present
Increases in power draw could suggest changes in
business operations
Impacts
Criminal targeting of home
Business intelligence to competitors

Shambhu Upadhyaya
37
Hacking Attacks and Mitigation
Two-way communication between customers and utility companies
means more risk
Two-way meters accessible to both users and enemies (use buggy
s/w)
Smart meter is the pain point (may be hacked)
Simulation of a worm injected into a meter shows
how it would spread
how it can be used to cause power grids to surge or shut off
Common vulnerabilities exist, but no powerful devices to implement
Devices do not have cycles to implement strong crypto solutions
Mitigation techniques
Zigbee security (uses hierarchy of keys)
Machine-to-machine strong authentication
Encryption
Data hashing, digital signing, etc.
This is an active research area today
Shambhu Upadhyaya
38
References
Darold Wobschall, University at Buffalo, 2012
M. Nabeel, J. Zage, S. Kerr, E. Bertino,
Cryptographic Key Management for Smart
Power Grids, 2012,
http://www.cerias.purdue.edu/apps/reports_an
d_papers/view/4591

Shambhu Upadhyaya
39
Internet of Things
(IoT)
Shambhu Upadhyaya
40
What is IoT?
Loosely coupled decentralized system of smart objects
Ubiquitous computing, 100B to be connected to the
Internet by 2020
After the WWW, IoT represents the most potentially
disruptive technological revolution
What inspired IoT?
RFID, Short-range wireless communication
Real-time localization
Sensor networks
What does it entail?
Scientific theory
Engineering design
User experience
Shambhu Upadhyaya
41
IoT Curriculum
Universities have started building special curricula
Open University in UK has developed a learning
infrastructure for collaborative learning in IoT
Merging of the physical and digital realms (CPS)
Physical objects become true actors on the Internet
Huge increase in the number of internetconnected devices,
objects, sensors and actuators
Huge increase in the amount and value of data (Big Data)
Emergence of novel embedded device platforms below the level of
personal mobile devices
Novel applications in energy, transport, health, business and daily
life
Expectation is that MOOCs may take up the challenge
Companies such as Cisco, IBM, Intel are engaging

Shambhu Upadhyaya
42
Skills Set for IoT
Algorithms
Programming skills
Distribution and collaboration
Ability to develop networked sensing apps
Creative design
Collaborative design
Ethical issues
Privacy and security
Computing in society

Shambhu Upadhyaya
43
Typical Components of IoT
iPod
Nokia, Android cell phones
Nintendo DS, Game Boy Advance
Roomba 500 iRobot
Sirius Satellite Radio Receivers
Automobiles
Shambhu Upadhyaya
44
IoT Protocol Details
IEEE 802.15.4 is the standard for low
rate WPANs
802.15.4 handles the physical and
MAC layer but not upper layers
Can be used with 6LoWPAN and
standard IP protocols to build a
wireless embedded Internet
6LoWPAN is the low power IPv6 version
developed for small devices
Shambhu Upadhyaya
45
Internet of Nano Things
Shambhu Upadhyaya
46
Security Challenges in IoT
Cryptographic security
Traditional tools may not be suitable due to limited processor speed and
memory
Key management
Manual key management may not scale
Limited user interfaces will make security deployment difficult
Credentialing
Credentialing users and devices required
may not scale due to the sheer size of the nework
Identity management
A devise identity may need to be mapped to groups of users
Usability is also an issue
Limited user interface
Privacy
Sensitive information on health front
network guards may be needed


Shambhu Upadhyaya
47
References
http://prezi.com/aordc8uod3rj/intern
et-of-things-presentation/
IEEE Computer, February 2013
I. Akyildiz and J. Jornet, The Internet
of Nano-Things, IEEE Wireless
Communications, 2010

Shambhu Upadhyaya
48