Scribd Logo
Upload

Welcome to Scribd!

  • 14 views

    ROLL RPL Security IETF 77 Status

    Uploaded by

    Maha lakshmi
    This document discusses the status of drafts related to providing security for RPL routing. It proposes mechanisms to authenticate and protect RPL control messages from outsider attacks, including using AES128 CCM* encryption and digital signatures. There are still open issues to address around insider attacks, key distribution, and integrating security with other protocol layers. The goal is to satisfy security needs for enterprise applications without overburdening consumer and commercial use cases.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd

    ROLL RPL Security IETF 77 Status

    Uploaded by

    Maha lakshmi
    14 views11 pages
    This document discusses the status of drafts related to providing security for RPL routing. It proposes mechanisms to authenticate and protect RPL control messages from outsider attacks, including using AES128 CCM* encryption and digital signatures. There are still open issues to address around insider attacks, key distribution, and integrating security with other protocol layers. The goal is to satisfy security needs for enterprise applications without overburdening consumer and commercial use cases.

    Original Description:

    Iot

    Original Title

    roll-5

    Copyright

    © © All Rights Reserved

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses the status of drafts related to providing security for RPL routing. It proposes mechanisms to authenticate and protect RPL control messages from outsider attacks, including using AES128 CCM* encryption and digital signatures. There are still open issues to address around insider attacks, key distribution, and integrating security with other protocol layers. The goal is to satisfy security needs for enterprise applications without overburdening consumer and commercial use cases.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    14 views11 pages

    ROLL RPL Security IETF 77 Status

    Uploaded by

    Maha lakshmi
    This document discusses the status of drafts related to providing security for RPL routing. It proposes mechanisms to authenticate and protect RPL control messages from outsider attacks, including using AES128 CCM* encryption and digital signatures. There are still open issues to address around insider attacks, key distribution, and integrating security with other protocol layers. The goal is to satisfy security needs for enterprise applications without overburdening consumer and commercial use cases.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 11

    ROLL RPL Security

    IETF 77 status

    draft-sdt-roll-rpl-security

    Kris Pister, pister@eecs.berkeley.edu


    Security Design Team

    Slide #1 IETF 77 – Roll WG – March 2010


    Status
    • Drafts:
    – draft-tsao-roll-security-framework-02
    – draft-sdt-roll-rpl-security-00
    – draft-struik-roll-rpl-security-design-
    00
    • Related:
    – Draft-oflynn-6lowapp-bootstrapping-00

    Slide #2 IETF 77 – Roll WG – March 2010


    Scope
    • Routing Security
    – Provide mechanisms to protect RPL {DIS,
    DIO, DAO, “flow label”} from outsider attack
    • Later or out of scope
    – Policy
    – Key distribution
    – Insider attack
    – Relationship to other security (L2, L4, …)
    Range of RPL Applications
    • Toys
    – No security ok?
    • Consumer/commercial
    – Perception of risk varies widely
    • Enterprise-critical
    – Appropriate paranoia

    • Need to satisfy “enterprise-critical” without


    driving away “consumer/commercial”
    “Protect”
    • DIO, DIS, DAO, flow label
    – Packets are not modified during transport
    – Participant IDs are authentic
    – Retransmissions are detected
    – Content optionally encrypted
    Mechanisms
    • AES128 CCM*
    • Where to draw the “MUST support” line?
    – 1) no security
    – 2) shared instance-wide key
    – 3) shared pair-wise keys
    – 4) digital signatures
    Authentication
    Proposed 4 levels
    • No authentication
    • Pre-configured, instance-wide join key
    • Pre-configured join key(s) with access
    control list at LBR
    • Public key certificate
    Implementation
    • Still several options for where to put security
    material
    – DIS, DIO, DAO
    • Sub-option
    • “security-field-present” bit
    – Flow label
    • Hop-by-hop option (hui-6man-rpl-option)
    – TLV or “security present” bit
    – 0 1 2 3
    – 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    – +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    – | Option Type | Opt Data Len |
    – +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    – | (sub-TLVs) |
    – +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    March 22, 2010

    Example Packet format (1)


    RPL Control Message
    octets: 1 1 2 variable RPL Type Description
    Type Code Checksum Message Body 0x00 DODAG Information Solicitation
    0x01 DODAG Information Object
    0x02 Destination Advertisement Object
    0x03 Reserved    
    bits: 0-2 3 4-7
    RPL Type Security Reserved
    Code field

    Security bit indicates whether packet is secured, and auxiliary security header
    is present.

    Slide 9
    March 22, 2010

    Example packet format (2)


    Auxiliary Security Header (cont’d)
    octets: 1 1/4 0/1/9 1/2/4?

    Security
    Control
    Counter Key Identifier MIC - Only present if security field set
    Auxiliary Security Header

    Security control field: indication as to which security services enabled


    – Granularity: specific combinations of data confidentiality & data integrity

    Counter field: indication of non-repeating value used in crypto construct


     Compression option provided (if devices have clock on board and timeliness
    possible)

    Key Identifier field: indication as to which key was used to secure packet
     Granularity: peer-to-peer key, group key, network-wide key, {signature key}

    MIC: message integrity code

    Slide 10
    Summary
    • Can provide simple, standard, lightweight
    mechanisms to protect routing information
    – Min 2B? per data packet (flow label)
    – Typ 5B? per DIS/DIO/DAO
    • Still lots of detail work to do
    • Open issues
    – Insider attack: LBR consistency checking?
    – Error/alarm messages

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy