mdh.sePublikasjoner
Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Protecting Clock Synchronization: Adversary Detection through Network Monitoring
Mälardalens högskola, Akademin för innovation, design och teknik, Inbyggda system.ORCID-id: 0000-0003-2018-0996
Mälardalens högskola, Akademin för innovation, design och teknik, Inbyggda system.ORCID-id: 0000-0003-1959-7145
TTTech Computertechnik AG, Austria.
Mälardalens högskola, Akademin för innovation, design och teknik, Inbyggda system.ORCID-id: 0000-0001-6497-4099
Vise andre og tillknytning
2016 (engelsk)Inngår i: Journal of Electrical and Computer Engineering, ISSN 2090-0147, E-ISSN 2090-0155, artikkel-id 6297476Artikkel i tidsskrift (Fagfellevurdert) Published
Abstract [en]

Today, industrial networks are often used for safetycritical applications with real-time requirements. The architecture of such applications usually has a time-triggered nature that has message scheduling as a core property. Real-time scheduling can be applied only in networks where nodes share the same notion of time, i.e., they are synchronized. Therefore, clock synchronization is one of the fundamental assets of industrial networks with real-time requirements. However, standards for clock synchronization, i.e., IEEE 1588, do not provide the required level of security. This raises the question about clock synchronization protection. In this paper we identify a way to break synchronization based on the IEEE 1588 standard by conducting a man-in-the-middle (MIM) attack followed by a delay attack. MIM attack can be accomplished through e.g., Address Resolution Protocol (ARP) poisoning. Using AVISPA tool we evaluate the potential to perform an ARP poisoning attack. Next, an analysis of the consequences of introducing delays is made, showing both that the attack can, indeed, break clock synchronization and that some design choices, such as a relaxed synchronization condition mode, delay bounding and using knowledge of environmental conditions, can be made to make the network more robust/resilient against these kinds of attacks. Lastly, network monitoring is proposed as a technique to detect anomalies introduced by an adversary performing attacks targeting clock synchronization. The monitoring capabilities are added to the network using a Configuration Agent, which, based on data obtained from the network, is able to detect an attack. The main contribution of the paper is a detailed problem description and evaluation of a security vulnerability in IEEE 1588 against delay attacks together with an evaluation of several approaches as possible mitigation techniques for the attack.

sted, utgiver, år, opplag, sider
2016. artikkel-id 6297476
HSV kategori
Identifikatorer
URN: urn:nbn:se:mdh:diva-31363DOI: 10.1155/2016/6297476ISI: 000377485400001Scopus ID: 2-s2.0-84973312270OAI: oai:DiVA.org:mdh-31363DiVA, id: diva2:915710
Prosjekter
RetNet - The European Industrial Doctorate Programme on Future Real-Time NetworksTilgjengelig fra: 2016-03-30 Laget: 2016-03-30 Sist oppdatert: 2017-11-30bibliografisk kontrollert
Inngår i avhandling
1. Securing Clock Synchronization in Industrial Heterogeneous Networks
Åpne denne publikasjonen i ny fane eller vindu >>Securing Clock Synchronization in Industrial Heterogeneous Networks
2016 (engelsk)Licentiatavhandling, med artikler (Annet vitenskapelig)
Abstract [en]

Today, wireless solutions for industrial networks are becoming more and more appealing since they increase flexibility and enable the use of additional wireless sensors, but also bring such advantages as mobility and weight reduction. Wired networks, on the other hand, are reliable and, more importantly, already existing in most distributed control loops. Heterogeneous networks consisting of wireless as well as wired sub-networks are gaining attention as such networks combine the advantages of both approaches. However, wireless communication links are more vulnerable to security breaches because of their broadcast nature. For this reason, industrial heterogeneous networks require a new type of security solutions, since they have different system assets and security objectives. This thesis aims to secure industrial heterogeneous networks. Such networks have real-time requirements due to interaction with some physical process, and thus have a schedule with one or more deadlines for data delivery in order to comply with the timing requirements of the application. The necessity to follow the schedule implies that all network participants should share the same notion of time and be synchronized. This fact makes clock synchronization a fundamental asset for industrial networks. The first step towards developing a security framework for industrial heterogeneous networks with real-time requirements is therefore to investigate ways of breaching clock synchronization. Once the vulnerabilities of this asset have been identified, the next step is to propose solutions to detect malicious attacks and mitigate their influence. The thesis provides a vulnerability analysis of the asset synchronization based on the widely deployed IEEE 1588 standard, and identifies a possibility to break clock synchronization through a combination of a man-in-the-middle attack and a delay attack. This attack is appealing to an adversary as it can target any network requiring synchronization. Next, several mitigation techniques, such as a relaxed synchronization condition mode, delay bounding and using knowledge of existing environmental conditions, are identified, making the network more resilient against these kinds of attacks. Finally, a network monitor aiming to detect anomalies introduced by the adversary performing attacks targeting clock synchronization is proposed as a mean to detect the delay attack. 

sted, utgiver, år, opplag, sider
Västerås: Mälardalen University, 2016
Serie
Mälardalen University Press Licentiate Theses, ISSN 1651-9256 ; 232
HSV kategori
Forskningsprogram
datavetenskap
Identifikatorer
urn:nbn:se:mdh:diva-31376 (URN)978-91-7485-258-5 (ISBN)
Presentation
2016-05-18, Kappa, Mälardalens högskola, Västerås, 13:15 (engelsk)
Opponent
Veileder
Tilgjengelig fra: 2016-04-05 Laget: 2016-04-04 Sist oppdatert: 2018-01-10bibliografisk kontrollert

Open Access i DiVA

Fulltekst mangler i DiVA

Andre lenker

Forlagets fulltekstScopushttp://www.hindawi.com/journals/jece/2016/6297476/

Personposter BETA

Lisova, ElenaUhlemann, ElisabethÅkerberg, JohanDobrin, RaduBjörkman, Mats

Søk i DiVA

Av forfatter/redaktør
Lisova, ElenaGutiérrez, MarinaUhlemann, ElisabethÅkerberg, JohanDobrin, RaduBjörkman, Mats
Av organisasjonen
I samme tidsskrift
Journal of Electrical and Computer Engineering

Søk utenfor DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric

doi
urn-nbn
Totalt: 95 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf