There has been a rapid growth in the Internet of Things (IoT) in the last few years, with an ever-increasing number of physical devices being connected to the Internet at an unprecedented rate; recent forecasts suggest the number of IoT devices will reach over 30 billion in the early 2020s.
Typically, each IoT device can consist of a sensor, actuator, communication infrastructure and a processing unit with some software (firmware). Such devices can be small, often resource-constrained and typically embedded in other real-world objects. They are heterogeneous with different operating systems and connectivity capabilities ranging from wireless to mobile networks. So when it comes to their security and management, they can pose significant and somewhat unique challenges.
Leveraging SDN’s features
As part of an ISIF Asia funded project, we at the University of Newcastle in Australia have developed a secure IoT architecture by leveraging the underlying features supported by Software Defined Networks (SDN).
Our SDN-based secure IoT architecture uses policies to control and manage IoT devices, services and network entities such as switches and gateways.
Typically an IoT device will either sense data and send it to a remote location or receive data and perform some limited actions on it. The data being sent and received from the devices is forwarded by gateways to other devices and entities in the network.
Another major security challenge is concerned with secure access to devices. As many of these devices have limited computational resources, there is a need for security solutions that are lightweight and can achieve fine-grained access control with efficient management. The issue of authorized access to data is critical as the data is used to make sensitive decisions. By inserting or manipulating data from the IoT device the attacker can adversely impact the decisions being made.
Identification and authentication of IoT devices is often a prerequisite to authorized access. This involves secure provisioning of IoT devices to ensure that appropriate registration and authentication of IoT devices are achieved at the setup time. Once again, there is a need for lightweight protocols. Secure identification of IoT devices is vital to the establishment of trusting IoT devices.
The operation of our architecture can be viewed in two phases.
In the first phase, new IoT devices that are connected to the network are first authenticated. This is done using a lightweight authentication protocol, as the IoT devices are resource-constrained. This process will, in turn, make the network domain and services visible to authenticated IoT devices.
The second phase determines whether any network service request from authenticated IoT devices is authorized, that is, whether it satisfies the specified security policies. If the service request is permissible, then the security architecture provides an appropriate security token to the IoT device. The IoT device uses this token for further communication in the network.
In the implementation of the architecture, we have developed two security applications to perform the above-mentioned authentication and authorization services. These applications run in the SDN controller and enable secure management of the IoT devices in the network infrastructure.
We are planning to put the code of the SDN IoT security architecture in Github in the near future. In the meantime, you can read more about the project, including papers and reports we’ve published, on our research centre webpage ACSRC.
Protecting against Mirai and Man-in-the-Middle attacks
As part of our study, we’ve used the security architecture to show how it can protect IoT infrastructures from various security attacks. We’ve shown that our architecture helps to prevent well-known attacks such as Mirai, which first injects malware into IoT devices and then launches a coordinated DDoS attack using these infected devices.
We’ve also shown that our architecture can counteract attacks such as spoofing or masquerading and Man-in-The-Middle (MiTM) attacks.
During a MiTM attack, the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. With our security architecture, an attacker, who is not an insider, will not be able to bypass the authentication phase. On the other hand, if the attacker is an insider and is able to pass the authentication phase, they will be restricted by the security policies in the authorization service.
Also, at the end of the authentication phase, each IoT device has established a secret key, which is used to encrypt the data flows. This creates a secure channel that the IoT device can use to protect its credentials. Hence, the attacker is unable to steal the credentials.
A novel feature of the proposed architecture is its ability to specify path-based security policies, which is a distinct advantage of using SDN. Furthermore, SDN enables secure management of both authentication and authorization in an integrated fashion, which makes the proposed solution suitable for practical applications.
Next step: 5G
The next stage of this project is to extend the proposed architecture for IoT devices using 5G networks.
5G promises a more IoT friendly ecosystem supporting multiple IoT devices across different domains with greater data speeds and lower latency. This extended security architecture will combine the use of network function virtualization (NFV) technology to provide authentication functions at the edge devices with the SDN controller-based security policy-driven authorization enabling secure management of distributed applications over 5G networks.
This project was awarded one of the 2017 ISIF Asia Network Operations Research Grants. These grants were established to support the development of an independent Internet research community in the Asia Pacific. Learn more about the grant and other ISIF awards at isif.asia.
Vijay Varadharajan is the Director of Advanced Cyber Security Engineering Research Centre (ACSRC) and Global Innovation Chair in Cyber Security at the University of Newcastle, Australia.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.