LPWAN Cyber Security Risk Analysis: Building a Secure IQRF Solution
Abstract
:1. Introduction
- (a)
- The FMEA method is used to conduct security risk analysis for IQRF networks.
- (b)
- Security risks in IQRF technology are identified, and further actions that can be used to protect IQRF networks from cyber attacks are addressed.
2. Related Work
3. The Used Approach and Experiment Design
3.1. FMEA/FMECA Approach
- Failure modes identify all possible failure modes of a cyber system.
- Failure effects identify resulting effects of the potential failures.
- Failure causes identify the possible causes for the failure modes.
- Employed controls identify the ways to detect, mitigate, or prevent failures.
- Risk evaluations assess the risk level associated with each of the failure modes based on a set of established criteria.
- Severity (Sev), encompassing the consequence of the failure when it happens in cyber systems. A low number corresponds to a low impact, while a high number corresponds to a high impact.
- Occurrence (Occ), defining the probability or frequency of a failure occurring during the expected lifetime of the cyber system. A low number is not likely to occur, while a high number is inevitable.
- Detection (Det), defining the probability of the failure being detected and acted upon before it happens. A low number is very likely to be detected, while a high number is not likely to be detected.
3.2. The Experiment Design
4. Security Analysis of IQRF Technology
4.1. Define System Elements and Functions
4.2. Identify Failure Modes
- Compromised End Nodes: Node compromise is one of the most common and detrimental attacks in WSNs. This is due to the pervasive nature of WSNs and the limitation in computational and storage capabilities of the deployed end devices. In fact, the end nodes can be installed in an environment where the attacker can have physical access or eavesdrop the network freely with no restrictions [37]. Hence, any malicious activity that occurs at or targets IQRF end nodes may cause a failure.
- Compromised Coordinator: IQRF networks require at least one coordinator. On analyzing the network setup shown in Figure 3, it is found that all communications between the end nodes pass through the coordinator node. In addition, this node plays the role of an interface for the end nodes to reach the gateway and then the internet. Therefore, any malicious activity that occurs at or targets the coordinator node can potentially cause a failure [38].
- Compromised Gateway: IQRF system uses a web interface, Webapp, that is used to access the IQRF GW-Daemon in order to manage the IQRF WSN by configuring nodes and running the joining process procedure. Moreover, the IQRF gateway connects the IQRF WSN to the internet. Hence, any malicious activity that occurs at or targets the IQRF gateway may also cause a failure. For instance, it is possible a hacker may try to steal the information exchanged between the IQRF gateway and the WSN or the information that is transmitted to internet by exploiting the gateway device vulnerabilities [39].
- Compromised Communication: Any malicious activity that occurs at or targets the communication paths between the different end nodes and the coordinator is another type of failure that needs to be considered. Sending a fake joining request, intercepting a packet, or jamming or replaying an attack can disrupt the communication [38,40].
4.3. Identify Existing Controls
- Access Encryption: this is an independent encryption that is always applied when joining the network.
- Network Encryption: all networking communications are encrypted.
- User Encryption: payload data packets can optionally be encrypted by a user specific key in the user application code to hide its content.
4.3.1. Joining a Node to an IQRF Network
4.3.2. Protection of Data Sent over IQRF Network
4.3.3. Optional User Encryption
4.4. Identify Effects of Failure Modes
- Revealing Sensitive Information: if IQRF technology is utilized for communicating sensitive information, then revealing such information and violating their confidentiality could be a possible objective of cyber attacks.
- Operational Impact: Attackers may target the service provided through the IQRF technology and aim to disrupt it in a manner similar to denial of service. This can target data availability and/or integrity, which may result in a financial impact as well as a possible safety impact if the IQRF technology is involved in safety-critical use case.
4.5. Identify Failure Causes
4.5.1. Weaknesses in Key Generation and Sharing
4.5.2. Weaknesses in Key Management
4.5.3. Failure during Joining the Network
4.5.4. Physical Attack
4.5.5. Message Integrity Code (MIC) Failure
4.5.6. Gateway Compromise
4.6. Evaluate Risks
4.7. Identify Actions
5. Discussion
6. Conclusions
Author Contributions
Funding
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Conflicts of Interest
References
- Masadeh, R.; AlSaaidah, B.; Masadeh, E.; Al-Hadidi, M.R.; Almomani, O. Elastic Hop Count Trickle Timer Algorithm in Internet of Things. Sustainability 2022, 14, 12417. [Google Scholar] [CrossRef]
- Mehmood, Y.; Ahmad, F.; Yaqoob, I.; Imran, M.; Adnane, A.; Guizani, S. Internet-of-Things-based smart cities: Recent advances and challenges. IEEE Commun. Mag. 2017, 55, 16–24. [Google Scholar] [CrossRef]
- Adefemi Alimi, K.O.; Ouahada, K.; Abu-Mahfouz, A.M.; Rimer, S. A survey on the security of low power wide area networks: Threats, challenges, and potential solutions. Sensors 2020, 20, 5800. [Google Scholar] [CrossRef] [PubMed]
- Chaudhari, B.S.; Zennaro, M.; Borkar, S. LPWAN technologies: Emerging application characteristics, requirements, and design considerations. Future Internet 2020, 12, 46. [Google Scholar] [CrossRef]
- Poursafar, N.; Alahi, M.E.E.; Mukhopadhyay, S. Long-range wireless technologies for IoT applications: A review. In Proceedings of the 2017 Eleventh International Conference on Sensing Technology (ICST), Sydney, Australia, 4–6 December 2017; IEEE: Piscataway, NJ, USA, 2017; pp. 1–6. [Google Scholar]
- Bouzidi, M.; Dalveren, Y.; Cheikh, F.A.; Derawi, M. Use of the IQRF technology in Internet-of-Things-based smart cities. IEEE Access 2020, 8, 56615–56629. [Google Scholar] [CrossRef]
- Bouzidi, M.; Gupta, N.; Dalveren, Y.; Mohamed, M.; Alaya Cheikh, F.; Derawi, M. Indoor Propagation Analysis of IQRF Technology for Smart Building Applications. Electronics 2022, 11, 3972. [Google Scholar] [CrossRef]
- Fujdiak, R.; Mlynek, P.; Malina, L.; Orgon, M.; Slacik, J.; Blazek, P.; Misurec, J. Development of IQRF technology: Analysis, simulations and experimental measurements. Elektron. Ir Elektrotechnika 2019, 25, 72–79. [Google Scholar] [CrossRef]
- Zafar, R.B. Real-Life Experiments Based on IQRF IoT Testbed: From Sensors to Cloud. Master’s Thesis, University of Agder, Kristiansand, Norway, 2018. [Google Scholar]
- Bouzidi, M.; Mohamed, M.; Dalveren, Y.; Moldsvor, A.; Cheikh, F.A.; Derawi, M. Propagation Measurements for IQRF Network in an Urban Environment. Sensors 2022, 22, 7012. [Google Scholar] [CrossRef]
- Park, S.H.; Park, J.K. IoT industry & security technology trends. Int. J. Adv. Smart Converg. 2016, 5, 27–31. [Google Scholar]
- Gu, X.; Zhang, Z. IoT security and new trends of solutions. In Introduction to Internet of Things in Management Science and Operations Research; Springer: Berlin/Heidelberg, Germany, 2021; pp. 55–76. [Google Scholar]
- Gritti, C.; Önen, M.; Molva, R.; Susilo, W.; Plantard, T. Device Identification and Personal Data Attestation in Networks. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. 2018, 9, 1–25. [Google Scholar]
- Chacko, S.; Job, M.D. Security mechanisms and Vulnerabilities in LPWAN. IOP Conf. Ser. Mater. Sci. Eng. 2018, 396, 012027. [Google Scholar] [CrossRef]
- Nurse, J.R.; Creese, S.; De Roure, D. Security risk assessment in internet of things systems. IT Prof. 2017, 19, 20–26. [Google Scholar] [CrossRef]
- Bouzidi, M.; Gupta, N.; Cheikh, F.A.; Shalaginov, A.; Derawi, M. A Novel Architectural Framework on IoT Ecosystem, Security Aspects and Mechanisms: A Comprehensive Survey. IEEE Access 2022, 10, 101362–101384. [Google Scholar] [CrossRef]
- IEC 60812: 2018; Failure Modes and Effects Analysis (FMEA and FMECA). IEC: Geneva, Switzerland, 10 August 2018.
- Ruijters, E.; Stoelinga, M. Fault tree analysis: A survey of the state-of-the-art in modeling, analysis and tools. Comput. Sci. Rev. 2015, 15–16, 29–62. [Google Scholar] [CrossRef]
- Ferdous, R.; Khan, F.; Sadiq, R.; Amyotte, P.; Veitch, B. Fault and Event Tree Analyses for Process Systems Risk Analysis: Uncertainty Handling Formulations. Risk Anal. 2011, 31, 86–107. [Google Scholar] [CrossRef]
- Domínguez, C.R.; Martínez, I.V.; Piñón Peña, P.M.; Rodríguez Ochoa, A. Analysis and evaluation of risks in underground mining using the decision matrix risk-assessment (DMRA) technique, in Guanajuato, Mexico. J. Sustain. Min. 2019, 18, 52–59. [Google Scholar] [CrossRef]
- Suddle, S. The weighted risk analysis. Saf. Sci. 2009, 47, 668–679. [Google Scholar] [CrossRef]
- Jan, N.; Nasir, A.; Alhilal, M.; Khan, S.; Pamucar, D.; Alothaim, A. Investigation of Cyber-Security and Cyber-Crimes in Oil and Gas Sectors Using the Innovative Structures of Complex Intuitionistic Fuzzy Relations. Entropy 2021, 23, 1112. [Google Scholar] [CrossRef]
- Wang, W.; Chen, X.; Li, Z.; Jia, J.; Zhang, M. Distributed filtering for nonlinear systems under Dempster–Shafer theory subject to malicious cyber attacks. Int. J. Robust Nonlinear Control 2022, 32, 5485–5500. [Google Scholar] [CrossRef]
- Musman, S.; Turner, A. A game theoretic approach to cyber security risk management. J. Def. Model. Simul.-Appl. Methodol. Technol.-JDMS 2018, 15, 127–145. [Google Scholar] [CrossRef]
- Sedjelmaci, H.; Hadji, M.; Ansari, N. Cyber security game for intelligent transportation systems. IEEE Netw. 2019, 33, 216–222. [Google Scholar] [CrossRef]
- Ali, B.; Awad, A.I. Cyber and physical security vulnerability assessment for IoT-based smart homes. Sensors 2018, 18, 817. [Google Scholar] [CrossRef]
- Oliveira, J.; Carvalho, G.; Cabral, B.; Bernardino, J. Failure mode and effect analysis for cyber-physical systems. Future Internet 2020, 12, 205. [Google Scholar] [CrossRef]
- Kandasamy, K.; Srinivas, S.; Achuthan, K.; Rangan, V.P. IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process. EURASIP J. Inf. Secur. 2020, 2020, 8. [Google Scholar] [CrossRef]
- Haseeb, J.; Mansoori, M.; Welch, I. Failure Modes and Effects Analysis (FMEA) of Honeypot-Based Cybersecurity Experiment for IoT. In Proceedings of the 2021 IEEE 46th Conference on Local Computer Networks (LCN), Edmonton, AB, Canada, 4–7 October 2021; IEEE: Piscataway, NJ, USA, 2021; pp. 645–648. [Google Scholar]
- Li, X.; Li, H.; Sun, B.; Wang, F. Assessing information security risk for an evolving smart city based on fuzzy and grey FMEA. J. Intell. Fuzzy Syst. 2018, 34, 2491–2501. [Google Scholar] [CrossRef]
- Mock, R.G.; Lopez de Obeso, L.; Zipper, C.; Schönenberger, M. Resilience assessment of internet of things: A case study on smart buildings. In Proceedings of the 26th European Safety and Reliability Conference (ESREL 2016), Glasgow, UK, 25–29 September 2016; Taylor & Francis: Abingdon, UK, 2017; pp. 2260–2267. [Google Scholar]
- Stamatis, D.H. Failure Mode and Effect Analysis: FMEA from Theory to Execution; Quality Press: Welshpool, Australia, 2003. [Google Scholar]
- Amro, A.; Gkioulos, V.; Katsikas, S.; Assessing Cyber Risk in Cyber-Physical Systems Using the ATT&CK Framework. Submitted for Review to ACM Transactions on Privacy and Security (TOPS). 2021. Available online: https://www.researchgate.net/publication/355203975 (accessed on 16 February 2022).
- Iadanza, E.; Zacchia, M.; Pennati, D.; Manetti, L.; Bocchi, L.; Gherardelli, M. Fuzzy FMECA Process Analysis for Managing the Risks in the Lifecycle of a CBCT Scanner. IEEE Access 2021, 9, 135723–135741. [Google Scholar] [CrossRef]
- Ben-Daya, M. Failure mode and effect analysis. In Handbook of Maintenance Management and Engineering; Springer: Berlin/Heidelberg, Germany, 2009; pp. 75–90. [Google Scholar]
- Sulc, V.; Kuchta, R.; Vrba, R. IQMESH implementation in IQRF wireless communication platform. In Proceedings of the 2009 Second International Conference on Advances in Mesh Networks, Athens, Greece, 18–23 June 2009; IEEE: Piscataway, NJ, USA, 2009; pp. 62–65. [Google Scholar]
- Pongaliur, K.; Xiao, L. Maintaining source privacy under eavesdropping and node compromise attacks. In Proceedings of the 2011 Proceedings IEEE INFOCOM, Shanghai, China, 10–15 April 2011; IEEE: Piscataway, NJ, USA, 2011; pp. 1656–1664. [Google Scholar]
- Olawumi, O.; Haataja, K.; Asikainen, M.; Vidgren, N.; Toivanen, P. Three practical attacks against ZigBee security: Attack scenario definitions, practical experiments, countermeasures, and lessons learned. In Proceedings of the 2014 14th International Conference on Hybrid Intelligent Systems, Kuwait, Kuwait, 14–16 December 2014; IEEE: Piscataway, NJ, USA, 2014; pp. 199–206. [Google Scholar]
- Simadiputra, V.; Surantha, N. Rasefiberry: Secure and efficient Raspberry-Pi based gateway for smarthome IoT architecture. Bull. Electr. Eng. Inform. 2021, 10, 1035–1045. [Google Scholar] [CrossRef]
- Lakshminarayana, S.; Karachiwala, J.S.; Chang, S.Y.; Revadigar, G.; Kumar, S.L.S.; Yau, D.K.; Hu, Y.C. Signal jamming attacks against communication-based train control: Attack impact and countermeasure. In Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks, Stockholm, Sweden, 18–20 June 2018; pp. 160–171. [Google Scholar]
- IQRF. IQRF OS User’s Guide [Online]; IQRF: Jicin, Czech Republic, 2022; pp. 4–28. [Google Scholar]
- Dworkin, M.J.; Barker, E.B.; Nechvatal, J.R.; Foti, J.; Bassham, L.E.; Roback, E.; Dray, J.F., Jr. Advanced Encryption Standard (AES); National Institute of Standards and Technology: Gaithersburg, MD, USA, 2001. [Google Scholar]
- Skovranek, J.; Pies, M.; Hajovsky, R. Use of the IQRF and Node-RED technology for control and visualization in an IQMESH network. IFAC-PapersOnLine 2018, 51, 295–300. [Google Scholar] [CrossRef]
- Asllani, A.; Lari, A.; Lari, N. Strengthening information technology security through the failure modes and effects analysis approach. Int. J. Qual. Innov. 2018, 4, 1–14. [Google Scholar] [CrossRef]
- Korzhuk, V.; Groznykh, A.; Menshikov, A.; Strecker, M. Identification of Attacks against Wireless Sensor Networks Based on Behaviour Analysis. J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl. 2019, 10, 1–21. [Google Scholar]
- Butun, I.; Pereira, N.; Gidlund, M. Security risk analysis of LoRaWAN and future directions. Future Internet 2018, 11, 3. [Google Scholar] [CrossRef]
- Tsai, K.L.; Leu, F.Y.; Hung, L.L.; Ko, C.Y. Secure session key generation method for LoRaWAN servers. IEEE Access 2020, 8, 54631–54640. [Google Scholar] [CrossRef]
- Seo, S.H.; Won, J.; Sultana, S.; Bertino, E. Effective key management in dynamic wireless sensor networks. IEEE Trans. Inf. Forensics Secur. 2014, 10, 371–383. [Google Scholar]
- CSDI SA. An Attack on CRC-32 Integrity Checks of Encrypted Channels Using CBC and CFB Modes; Core Security: Eden Prairie, MN, USA, 1998. [Google Scholar]
Ref. | Application | Aim | Approach |
---|---|---|---|
[29] | Honeypot systems in IoT | Identifying and mitigating the challenges in the deployment of honeypots for IoT | FMEA |
[30] | Smart city | Assessing the information security risk of smart city | FMEA based on the fuzzy set theory and the gray relational theory |
[31] | Smart buildings | Resilience assessment of two case studies on smart buildings | Coupled FRAM–FMEA |
Proposed work | IQRF networks | Conducting security risk analysis to protect IQRF networks from cyber attacks | FMEA |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Bouzidi, M.; Amro, A.; Dalveren, Y.; Alaya Cheikh, F.; Derawi, M. LPWAN Cyber Security Risk Analysis: Building a Secure IQRF Solution. Sensors 2023, 23, 2078. https://doi.org/10.3390/s23042078
Bouzidi M, Amro A, Dalveren Y, Alaya Cheikh F, Derawi M. LPWAN Cyber Security Risk Analysis: Building a Secure IQRF Solution. Sensors. 2023; 23(4):2078. https://doi.org/10.3390/s23042078
Chicago/Turabian StyleBouzidi, Mohammed, Ahmed Amro, Yaser Dalveren, Faouzi Alaya Cheikh, and Mohammad Derawi. 2023. "LPWAN Cyber Security Risk Analysis: Building a Secure IQRF Solution" Sensors 23, no. 4: 2078. https://doi.org/10.3390/s23042078