基于时间自动机的物联网网关安全系统的建模及验证

doi:10.11959/j.issn.1000-436x.2018042

Abstract

Abstract:

The Internet of things (IoT) is a multiple heterogeneous network,and its perception layer is often faced with various security threats.As the bridge between the perception layer and the network layer,the IoT gateway should have the security management function to prevent the security issue from spreading to the upper layer.According to the current security deficiencies in IoT gateway,a universal IoT gateway security system was proposed based on the IoT gateway middleware technology.Various security protocols or algorithms can be embedded in IoT gateway security system,and the modeling and analysis can help the design and implementation of IoT gateway.The formal modeling and verification of the IoT gateway security system was performed by timed automata.The results show that the IoT gateway security system satisfies the security properties of confidentiality,availability,authenticity,robustness,integrity and freshness.

Key words: IoT gateway, security system, middleware, timed automata, model checking

CLC Number:

TP393

Guoqing WANG,Lei ZHUANG,Ruimin WANG,Yu SONG,Kunli ZHANG. Modeling and verifying based on timed automata of Internet of things gateway security system[J]. Journal on Communications, 2018, 39(3): 63-75.

Figures/Tables 16

References 21

[1]	王良民, 熊书明 . 物联网工程概论[M]. 北京: 清华大学出版社, 2011: 45-52.
	WANG L M , XIONG S M . The introduction of IoT engineering[M]. Beijing: Tsinghua University PressPress, 2011: 45-52.
[2]	钱志鸿, 王义君 . 物联网技术与应用研究[J]. 电子学报, 2012,40(5): 1023-1029.
	QIAN Z H , WANG Y J . IoT technology and application[J]. Acta Electronica Sinica, 2012,40(5): 1023-1029.
[3]	MORABITO R , BEIJAR N . A framework based on SDN and containers for dynamic service chains on IoT gateways[C]// The Workshop on Hot Topics in Container Networking and Networked Systems. 2017: 42-47.
[4]	SATHYADEVAN S , VEJESH V , DOSS R ,et al. Portguard an authentication tool for securing ports in an IoT gateway[C]// IEEE International Conference on Pervasive Computing and Communications Workshops. 2017: 624-629.
[5]	SCHRICKTE L F , MONTEZ C B , OLIVEIRA R S D ,et al. Design and implementation of a 6LoWPAN gateway for wireless sensor networks integration with the internet of things[J]. International Journal of Embedded Systems, 2016,8(5/6): 380-390.
[6]	陈琦, 韩冰, 秦伟俊 ,等. 基于 Zigbee/GPRS 物联网网关系统的设计与实现[J]. 计算机研究与发展, 2011,48(s2): 367-372.
	CHEN Q , HAN B , QIN W J ,et al. Design and implementation of the IoT gateway based on Zigbee/GPRS protocol[J]. Journal of Computer Research and Development, 2011,48(s2): 367-372.
[7]	ZHANG L , ALHARBE N R , ATKINS A S . A self-adaptive distributed decision support model for Internet of things applications[J]. Transactions of the Institute of Measurement and Control, 2017,39(4): 404-419.
[8]	罗俊海, 周应宾, 邓霄博 . 物联网网关系统设计[J]. 电信科学, 2011,27(2): 105-110.
	LUO J H , ZHOU Y B , DENG X B . Design for gateway system in Internet of things[J]. Telecommunications Science, 2011,27(2): 105-110.
[9]	CHEN H C , YOU I , WENG C E ,et al. A security gateway application for end-to-end M2M communications[J]. Computer Standards ＆ Interfaces, 2016,44(C): 85-93.
[10]	MIN D , XIAO Z , SHENG B ,et al. Design and implementation of heterogeneous IoT gateway based on dynamic priority scheduling algorithm[J]. Transactions of the Institute of Measurement and Control, 2014,36(7): 924-931.
[11]	CONDRY M W , NELSON C B . Using smart edge IoT devices for safer,rapid response with industry IoT control operations[J]. Proceedings of the IEEE, 2016,104(5): 938-946.
[12]	LI F , WAN Z , XIONG X ,et al. Research on sensor-gateway-terminal security mechanism of smart home based on IoT[C]// IoT Workshop 2012,CCIS 312. 2012: 415-422.
[13]	石希, 陈震, 汪东升 ,等. 物联网汇聚安全网关关键技术研究[J]. 信息网络安全, 2012(6): 85-89.
	SHI X , CHEN Z , WANG D S ,et al. A research of the key technology of the aggregative security gateway of Internet of things[J]. Netinfo Security, 2012(6): 85-89.
[14]	SERDAROGLU K C , BAYDERE S . WiSEGATE:wireless sensor network gateway framework for Internet of things[J]. Wireless Networks, 2015,22(5): 1-17.
[15]	罗娟, 顾传力, 李仁发 . 基于角色的无线传感网络中间件研究[J]. 通信学报, 2011,32(1): 79-86.
	LUO J , GU C L , LI R F . Researches on role-based middleware in wireless sensor networks[J]. Journal on Communications, 2011,32(1): 79-86.
[16]	杨光, 耿贵宁, 都婧 ,等. 物联网安全威胁与措施[J]. 清华大学学报(自然科学版), 2011,51(10): 1335-1340.
	YANG G , GENG G N , DU J ,et al. Security threats and measures for the Internet of things[J]. Journal of Tsinghua University (Science and Technology), 2011,51(10): 1335-1340.
[17]	王浩, 郑武, 谢昊飞 ,等. 物联网安全技术[M]. 北京: 人民邮电出版社, 2016: 5-17.
	WANG H , ZHENG W , XIE H F ,et al. IoT security technology[M]. Beijing: Posts ＆ Telecom PressPress, 2016: 5-17.
[18]	ALUR R , DILL D L . A theory of timed automata[J]. Theoretical Computer Science, 1994,126(2): 183-235.
[19]	DAVID A , OLIVER M M . From HUPPAAL to UPPAAL:a translation from hierarchical timed automata to flat timed automata[R]. BRICS Report Series RS-01-11,Department of Computer Science,University of Aarhus, 2001.
[20]	YIN A , WANG S . A novel encryption scheme based on timestamp in gigabit ethernet passive optical network using AES-128[J]. Optik, 2014,125(3): 1361-1365.
[21]	BEHRMANN G , DAVID A , LARSEN K G . A tutorial on UPPAAL[M]// Formal Methods for the Design of Real-Time Systems. Springer Berlin Heidelberg, 2004: 200-236.

Metrics

Recommended 0

No Suggested Reading articles found!

名称	说明
通信信道攻击	消息的截取、篡改、重放及注入，攻击者通过长时间占据信道导致合法通信无法传输
拒绝服务攻击	污水池（sinkhole）攻击、虫洞（wormhole）攻击、洪泛攻击等，DoS攻击会耗尽节点资源，使节点丧失运行能力
节点捕获	网关等关键节点被攻击者控制，可能导致通信密钥、广播密钥、配对密钥等被泄露，进而威胁网络的通信安全
假冒攻击	恶意节点假冒合法节点发起女巫（sybil）攻击，利用多身份与其他节点通信，并配合其他攻击手段达到攻击目的
路由协议攻击	通过欺骗、篡改或重发路由信息，攻击者可创建路由循环，形成虚假错误消息，增加端到端时延，耗尽关键节点能源等

状态位置	含义	状态位置	含义
Start	启动安全系统	CheckCategory	检查终端类别
Configuration	读取网关配置信息	Connect	连接感知汇聚节点
Authentication	统一身份认证	ReadCache	解析汇聚节点缓存信息
WaitAC	等待认证信息返回	CheckAP	检查轮询周期完成标识
CheckGS	检查网关状态	UpdateKey	密钥更新
CheckTS	检查终端状态	WaitKMS	等待密钥管理系统工作
IntrusionDetection	入侵检测	SelfMonitoring	发出自组织监控命令
WaitIDS	等待入侵检测系统处理完成	WaitNode	等待节点数据返回
Idle	空闲状态	CheckRF	检查返回标识
Restart	网关重新启动	Clear	清除控制状态
EnterMiddle	进入中间层轮询模块	MonitoringInfo	准备提交监控信息至顶层主模块
WaitData	等待中间层返回监控信息	ReadConInfo	读取执行设备配置信息
CheckData	检查是否有监控信息返回	DeviceControl	发出设备控制命令
Verify	数据是否异常	WaitDevice	等待设备状态返回
WaitHE	等待异常处理	Keep	令设备在合法时间内运行一段时间
DataAnalysis	解析监控信息	RetrieveData	发出取回监控信息命令
Record	记录监控信息或轮询失败的信息	Failure	轮询失败
CheckPolling	当前轮询周期是否完成	End	该逻辑流程结束

同步通道	含义
StartIDS	开始进行入侵检测
FinishIDS	入侵检测完成
StartAC	开始进行身份认证
FinishAC	身份认证完成
StartMiddle	开始执行中间层轮询模块
FinishMiddle	中间层轮询模块执行完成
StartKMS	开始进行密钥管理
FinishKMS	密钥管理完成
HandlingException	开始进行异常处理
Return	异常处理完毕返回
Decryption	解密
DReturn	解密完成
Encryption	加密
EReturn	加密完成

变量	含义
c	全局时钟
x,y,z	KMS时钟，中间层时钟，IDS时钟
Category	类别标识：1-网关，2-感知终端，3-执行终端
GatewayStatus	网关认证合法状态
TerminalStatus	终端认证合法状态
SubmitData	监控信息提交至顶层标识位
AlreadyPolling	轮询周期完成标识位
PollingSuccess	轮询成功标识位
AuthenticationFlag	认证标识
KMSType	密钥管理功能类别：1-更新密钥，2-验证密钥
KeyUpdateFlag	密钥更新标识
KeyVerificationFlag	密钥验证标识
ReturnFlag	返回标识
ExceptionLevel	数据异常等级：0-无异常，1-容错机制，2-人工干预

性质	验证时间/s	内存消耗/KB	验证结果
机密性	0.034	9 096	满足该性质
可用性	0.001	9 116	满足该性质
真实性	0.001	9 116	满足该性质
顽健性	0.060	9 508	满足该性质
完整性	0.034	9 504	满足该性质
新鲜性	0.062	9 516	满足该性质

Modeling and verifying based on timed automata of Internet of things gateway security system

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 16

References 21

Related Articles 15

Metrics

Recommended 0

[1]	Shun WANG,Ye DU,Zhen HAN,Jiqiang LIU. Locality-guided based optimization method for bounded model checker [J]. Journal on Communications, 2018, 39(3): 181-190.
[2]	Jing YANG,Dan FAN,Yu-qing ZHANG. Adjusted automata learning algorithm for security protocol adaptive model checking [J]. Journal on Communications, 2015, 36(Z1): 266-276.
[3]	Ning XI,Jian-feng MA,Cong SUN,Di LU,Tao ZHANG. Composable information flow verification for service chain based on model checking [J]. Journal on Communications, 2014, 35(11): 23-31.
[4]	. Composable information flow verification for service chain based on model checking [J]. Journal on Communications, 2014, 35(11): 3-22.
[5]	Juan LUO,Chuan-li GU,Ren-fa LI. Researches on role-based middleware in wireless sensor networks [J]. Journal on Communications, 2011, 32(1): 79-86.
[6]	Xiao-feng CHEN,Deng-guo FENG. Model checking of trusted cryptographic module [J]. Journal on Communications, 2010, 31(1): 59-64.
[7]	Yuan-bo GUO,Wei LIU,Shun YUAN,Rui-peng ZHOU. Design and implementation of an intrusion-tolerant application server middleware [J]. Journal on Communications, 2009, 30(10A): 97-102.
[8]	Ji-min SUN,Yu-long SHEN,Yu SUN,Si-dong ZHANG. Architecture to connect sensor networks with Internet and services provided [J]. Journal on Communications, 2008, 29(4): 85-89.
[9]	Xia LIU,Tian-long GU,Rong-sheng DONG,Yun-chuan GUO. Design and analysis of a novel fair payment protocol in mobile environments [J]. Journal on Communications, 2007, 28(4): 32-37.
[10]	He HUANG,Su-zhen YAO. Access control model based on dynamic rules [J]. Journal on Communications, 2007, 28(11A): 14-17.
[11]	Jia-jing LI,Tao WEI,Jian MAO. Method of model checking x86 executables for temporal security vulnerabilities [J]. Journal on Communications, 2007, 28(11A): 98-102.
[12]	Yin-zhuang LI,Jian-hua ZHANG,Yong-ping XIAO. Designing Bluetooth-UPnP software bridge [J]. Journal on Communications, 2006, 27(11A): 273-276.
[13]	Chun-yu MIAO,Mei-lin SHI,Jin-lei JIANG. MOM-S: message-oriented middleware based on Web service [J]. Journal on Communications, 2006, 27(11): 96-100.
[14]	Shu-peng WANG,Xiao-chun YUN,Xiang-zhan YU,Ming-zeng HU. Design and implementation of a kind of disaster tolerance middleware [J]. Journal on Communications, 2005, 26(7): 68-75.
[15]	Zhi WANG,Min YANG,Bo YU,Chuan-shan GAO. MonitorView: a unified framework for managing telecom business operations support systems [J]. Journal on Communications, 2005, 26(1): 80-86.