A Network-Aware Internet-Wide Scan for Security Maximization of IPv6-Enabled WLAN IoT Devices
A Network-Aware Internet-Wide Scan for Security Maximization of IPv6-Enabled WLAN IoT Devices
复制标题
DOI：
10.1109/jiot.2020.3045733
复制
发表时间：
2021-05
影响因子：
10.6
通讯作者：
Shikhar Verma;Y. Kawamoto;N. Kato
中科院分区：
文献类型：
--
作者：
Shikhar Verma;Y. Kawamoto;N. Kato
尽管取得了前所未有的进步，但用于物联网（IoT）的无线局域网（WLAN）技术，诸如IEEE 802.11ah（即，WiFi-HaLow）容易受到严重的安全威胁，这是由于它们的计算和存储器资源受限，这限制了重量级入侵保护和安全协议的使用。为了解决这个问题，安全管理员（sec-admins）必须对物联网设备进行定期和全面的漏洞评估。互联网范围的端口扫描（IWPS）是第一步。然而，IEEE 802.11ah的介质访问控制机制专为异构物联网流量和低功耗操作而设计，在传统端口扫描流量的情况下会降低网络性能。此外，支持IPv6的物联网设备必须支持互联网安全（IPSec）协议，以确保数据的机密性、完整性和可用性。虽然端口扫描的目的是提高物联网安全性，但由此产生的网络性能可能会对IPSec服务产生不利影响。因此，在这项研究中，我们优化了IWPS，以最大限度地提高IEEE 802.11ah WLAN上的物联网安全性。为此，我们提出了新的数学模型来评估物联网的安全性，基于端口扫描网络性能和网络服务，从而为sec-admins导出最佳扫描速率。通过全面的数值分析验证了所提出的框架的有效性，这表明我们的方法在以最佳扫描速率探测物联网设备的同时，最大限度地降低了物联网设备的风险。
Despite unprecedented advancements, wireless local area network (WLAN) technologies for the Internet of Things (IoT), such as IEEE 802.11ah (i.e., WiFi-HaLow), are prone to serious security threats, owing to their constrained computational and memory resources, which limit the use of heavyweight intrusion protection and security protocols. To address this problem, security administrators (sec-admins) must perform regular and comprehensive vulnerability assessments of IoT devices. An Internet-wide port scan (IWPS) is the initial step. However, the medium access control mechanism of IEEE 802.11ah, designed specifically for heterogeneous IoT traffic and low-power operations, can degrade network performance in the case of traditional port-scan traffic. Moreover, Internet-security (IPSec) protocol support is mandatory for IPv6-enabled IoT devices to ensure data confidentiality, integrity, and availability. Although the objective of a port scan is to improve IoT security, the resultant network performance can adversely affect IPSec services. Therefore, in this study, we optimize the IWPS to maximize the IoT security over IEEE 802.11ah WLAN. To this end, we propose novel mathematical models to evaluate IoT security based on port-scan network performance and IPsec services, which derives an optimal scan rate for sec-admins. The effectiveness of the proposed framework is verified by comprehensive numerical analysis, which shows that our approach minimizes the risk to IoT devices while probing them at an optimal scan rate.