National Institute of Standards and Technology における超伝導研究及び生活

An ad hoc network is a group of wireless mobile computers (or nodes), in which individual nodes cooperate by forwarding packets for each other to allow nodes to communicate beyond direct wireless transmission range. Prior research in ad hoc networking has generally studied the routing problem in a non-adversarial setting, assuming a trusted environment. In this paper, we present attacks against routing in ad hoc networks, and we present the design and performance evaluation of a new secure on-demand ad hoc network routing protocol, called Ariadne. Ariadne prevents attackers or compromised nodes from tampering with uncompromised routes consisting of uncompromised nodes, and also prevents a large number of types of Denial-of-Service attacks. In addition, Ariadne is efficient, using only highly efficient symmetric cryptographic primitives.

/pdf/ariadne-a-secure-on-demand-routing-protocol-for-ad-hoc-57ex02ywre.pdf

Ariadne: a secure on-demand routing protocol for ad hoc networks

Sensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments, helping to protect and monitor military, environmental, safety-critical, or domestic infrastructures and resources, Denial-of-service attacks against such networks, however, may permit real world damage to public health and safety Without proper security mechanisms, networks will be confined to limited, controlled environments, negating much of the promise they hold The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult To identify denial-of-service vulnerabilities, the authors analyzed two effective sensor network protocols that did not initially consider security These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment

/pdf/denial-of-service-in-sensor-networks-1r5u4tlto6.pdf

Denial of service in sensor networks

We introduce TinySec, the first fully-implemented link layer security architecture for wireless sensor networks. In our design, we leverage recent lessons learned from design vulnerabilities in security protocols for other wireless networks such as 802.11b and GSM. Conventional security protocols tend to be conservative in their security guarantees, typically adding 16--32 bytes of overhead. With small memories, weak processors, limited energy, and 30 byte packets, sensor networks cannot afford this luxury. TinySec addresses these extreme resource constraints with careful design; we explore the tradeoffs among different cryptographic primitives and use the inherent sensor network limitations to our advantage when choosing parameters to find a sweet spot for security, packet overhead, and resource requirements. TinySec is portable to a variety of hardware and radio platforms. Our experimental results on a 36 node distributed sensor network application clearly demonstrate that software based link layer protocols are feasible and efficient, adding less than 10% energy, latency, and bandwidth overhead.

/pdf/tinysec-a-link-layer-security-architecture-for-wireless-2w93vaox2f.pdf

TinySec: a link layer security architecture for wireless sensor networks

This article reports the development and validation of a 10-item international Positive and Negative Affect Schedule (PANAS) Short Form (I-PANAS-SF) in English. A qualitative study (N = 18) and then an exploratory quantitative study (N = 407), each using informants from a range of cultural backgrounds, were used to identify systematically which 10 of the original 20 PANAS items to retain or remove. A same-sample retest study (N = 163) was used in an initial examination of the new 10-item international PANAS's psychometric properties and to assess its correlation with the full, 20-item, original PANAS. In a series of further validation studies (N = 1,789), the cross-sample stability, internal reliability, temporal stability, cross-cultural factorial invariance, and convergent and criterion-related validities of the I-PANAS-SF were examined and found to be psychometrically acceptable.

Development and Validation of an Internationally Reliable Short-Form of the Positive and Negative Affect Schedule (PANAS)

In a model-based intrusion detection approach for protecting SCADA networks, we construct models that characterize the expected/acceptable behavior of the system, and detect attacks that cause violations of these models. Process control networks tend to have static topologies, regular trac patterns, and a limited number of applications and protocols running on them. Thus, we believe that model-based monitoring, which has the potential for detecting unknown attacks, is more feasible for control networks than for general enterprise networks. To this end, we describe three model-based techniques that we have developed and a prototype implementation of them for monitoring Modbus TCP networks.

/pdf/using-model-based-intrusion-detection-for-scada-networks-wskt8bki0w.pdf

Using Model-based Intrusion Detection for SCADA Networks

Efforts toward automated detection and identification of multistep cyber attack scenarios would benefit significantly from a methodology and language for modeling such scenarios. The Correlated Attack Modeling Language (CAML) uses a modular approach, where a module represents an inference step and modules can be linked together to detect multistep scenarios. CAML is accompanied by a library of predicates, which functions as a vocabulary to describe the properties of system states and events. The concept of attack patterns is introduced to facilitate reuse of generic modules in the attack modeling process. CAML is used in a prototype implementation of a scenario recognition engine that consumes first-level security alerts in real time and produces reports that identify multistep attack scenarios discovered in the alert stream.

/pdf/modeling-multistep-cyber-attacks-for-scenario-recognition-3eare2n3tx.pdf

Modeling multistep cyber attacks for scenario recognition

Software-defined networks (SDNs) pose both an opportunity and challenge to the network security community. The opportunity lies in the ability of SDN applications to express intelligent and agile threat mitigation logic against hostile flows, without the need for specialized inline hardware. However, the SDN community lacks a secure control-layer to manage the interactions between the application layer and the switch infrastructure (the data plane). There are no available SDN controllers that provide the key security features, trust models, and policy mediation logic, necessary to deploy multiple SDN applications into a highly sensitive computing environment. We propose the design of security extensions at the control layer to provide the security management and arbitration of conflicting flow rules that arise when multiple applications are deployed within the same network. We present a prototype of our design as a Security Enhanced version of the widely used OpenFlow Floodlight Controller, which we call SE-Floodlight. SE-Floodlight extends Floodlight with a security-enforcement kernel (SEK) layer, whose functions are also directly applicable to other OpenFlow controllers. The SEK adds a unique set of secure application management features, including an authentication service, role-based authorization, a permission model for mediating all configuration change requests to the data-plane, inline flow-rule conflict resolution, and a security audit service. We demonstrate the robustness and scalability of our system implementation through both a comprehensive functionality assessment and a performance evaluation that illustrates its sub-linear scaling properties.

/pdf/securing-the-software-defined-network-control-layer-10tt1tre9e.pdf

Securing the Software Defined Network Control Layer.

An attractive target for a computer system attacker is the router. An attacker in control of a router can disrupt communication by dropping or misrouting packets passing through the router. We present a protocol called WATCHERS that detects and reacts to routers that drop or misroute packets. WATCHERS is based on the principle of conservation of flow in a network: all data bytes sent into a node, and not destined for that node, are expected to exit the node. WATCHERS tracks this flow, and detects routers that violate the conservation principle. We show that WATCHERS has several advantages over existing network monitoring techniques. We argue that WATCHERS' impact on router performance and WATCHERS' memory requirements are reasonable for many environments. We demonstrate that in ideal conditions WATCHERS makes no false-positive diagnoses. We also describe how WATCHERS can be tuned to perform nearly as well in realistic conditions.

/pdf/detecting-disruptive-routers-a-distributed-network-301tz5u1mp.pdf

Detecting disruptive routers: a distributed network monitoring approach

We study methods for reducing the cost of secure link state routing. In secure link state routing, routers may need to verify the authenticity of many routing updates, and some routers such as border routers may need to sign many routing updates. Previous work such as public-key based schemes are very expensive computationally or have certain limitations. This paper presents an efficient solution, based on a detection-diagnosis-recovery approach, for the link state routing update authentication problem. Our scheme is scalable to handle large networks, applicable to routing protocols that use multiple-valued cost metrics, and applicable even, when link states change frequently.

Steven Cheung

Papers

Using Model-based Intrusion Detection for SCADA Networks

Modeling multistep cyber attacks for scenario recognition

Securing the Software Defined Network Control Layer.

Detecting disruptive routers: a distributed network monitoring approach

An efficient message authentication scheme for link state routing