Do we have the time for IRM?
Do we have the time for IRM?
复制标题
我们有时间进行 IRM 吗？
DOI：
10.1145/3288599.3295582
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Shah R
中科院分区：
文献类型：
--
作者：
Shah R
物联网部署等分布式传感器网络会产生大量测量数据。通常，运行在这些数据上的分析可以作为一种web服务提供，可以付费购买。分析生态系统中的一个主要关注点是确保数据的安全性。通常，公司提供信息权限管理（Information Rights Management， IRM）作为管理跨管理边界的数据的使用和访问权限问题的解决方案。IRM使个人和企业能够创建受限制的物联网数据，这些数据可以从组织流向个人控制-禁止复制，转发和允许定时过期。我们描述了我们对该功能的调查，并揭示了架构中的一个弱点——它依赖于准确的全局时间可用性。我们提出了一种放大的拒绝服务攻击，它攻击时间同步，可以阻止组织中的所有用户读取任何类型的受限数据，直到他们的软件被重新安装和配置。我们认为，建立在当前技术基础上的IRM系统过于脆弱，企业无法冒险广泛使用。我们还提出了利用软件定义网络的功能来应用简单的基于过滤器的方法来检测和隔离攻击流量的防御措施。
Distributed sensor networks such as IoT deployments generate large quantities of measurement data. Often, the analytics that runs on this data is available as a web service which can be purchased for a fee. A major concern in the analytics ecosystem is ensuring the security of the data. Often, companies offer Information Rights Management (IRM) as a solution to the problem of managing usage and access rights of the data that transits administrative boundaries. IRM enables individuals and corporations to create restricted IoT data, which can have its flow from organisation to individual control - disabling copying, forwarding, and allowing timed expiry. We describe our investigations into this functionality and uncover a weak-spot in the architecture - its dependence upon the accurate global availability oftime. We present an amplified denial-of-service attack which attacks time synchronisation and could prevent all the users in an organisation from reading any sort of restricted data until their software has been re-installed and re-configured. We argue that IRM systems built on current technology will be too fragile for businesses to risk widespread use. We also present defences that leverage the capabilities of Software-Defined Networks to apply a simple filter-based approach to detect and isolate attack traffic.