Assistente AI
Trascrizione
00:07:484Alessandro Brighente: Hello, so this is the
00:18:220Alessandro Brighente: kind of lecture industrial systems just for you to know, because the course is named after cps and IoT, basically, we should deal with the IoT stuff so we'll just conclude how the stocksnet works. Right? So
00:34:879Alessandro Brighente: what we had last time is that we are dealing with the
00:40:410Alessandro Brighente: computing machines right? We didn't yet understand how we get to the modification of the the physical behavior
00:50:20Alessandro Brighente: of the the industrial processes and the form of the Phs, right? So good. So
00:58:190Alessandro Brighente: we infected computing machines, right laptops or computers, servers whatever
01:05:410Alessandro Brighente: general with both computers. And now, we want to infect Psc's in particular, we want to modify the the software that runs. And the Psc right? Because that's the thing that basically monitors the behavior of the turbines and centrifuge. And report this data back to the controllers right? And to the devices that allow for checking, whether everything is safe and sound and not going to explode. Basically
01:35:270Alessandro Brighente: good. So we want to modify these Psc's. And we want to modify specific libraries. Right? We have specific pieces of code that we want to modify.
01:48:605Alessandro Brighente: So as we mentioned during the last lecture. We are targeting specific implementation of Ps, right? In particular, we are targeting this is a user, the step 7 software. And since we know we are using this kind of controllers, we target a library. Just call the S. 7 Otb blah blah thing in there, right? It's a Dll file
02:12:432Alessandro Brighente: and this is what performs the actual communication. With the with the Psc, right? So it's communicating between the machine that is used program Psc, and the the Psc itself. So what we would like to do with the success is to replace these dll find with something that we control. Right? Something that is a modified version of this Dll file.
02:41:850Alessandro Brighente: So what is the aim of these modified Dll file. So here we have what we want to do right? And what Saxon actually can do. So we want to monitor the the Psc blocks being written and read the from the Psc right? So the the block of code, the the functions that the Psc
03:00:840Alessandro Brighente: is actually implementing. We want to impact it by with our own block, right? So specific functions or calls that we want to make asap
03:12:620Alessandro Brighente: and master the fact that the Psc is infected. Right? This is very important. We want, the the system not to realize that this specific data file has been compromised, or that there is a malicious one in the in the Psc.
03:27:440Alessandro Brighente: How do we do this? Well, the the main way of not being detected is reporting fake data to the monitoring system. Right? So it means that through these malicious blocks we should receive data from the, from the sensors, for instance, and somehow block them, modify them or report fake values back to the to the monitor.
03:49:900Alessandro Brighente: Okay. So here's some very high level
03:58:730Alessandro Brighente: vision on how these different components interact with one another. Right? So here we have the step, 7 software. Here, we have the Dl, 5 that, we say we want to modify. And here is the the Psc, right? So here you have a sequence where you want to request a whole block from the. So you call this Dll. 5, which has a specific function in here, which is the reader function
04:25:974Alessandro Brighente: we pull the for the Sdi to do we record it back to the and again back to the
04:32:860Alessandro Brighente: software? Right? So here we have the call block, right? So we want to be in here. We want to replace this thing in here with with something malicious that that we control.
04:44:740Alessandro Brighente: And how do we do this? Well, the the way in which Saxon decided to to implement this thing
04:51:840Alessandro Brighente: is to exactly create a copy of these, file right and name it after the the the original one, and
05:01:900Alessandro Brighente: rename
05:04:160Alessandro Brighente: the original one. It is. answer in here. Right? So keep it as a copy in the
05:11:300Alessandro Brighente: hey?
05:12:680Alessandro Brighente: In memory. Right? So we're not be leaving this this one but we replace it with something. So in here we have being either an exact copy of the original file. The malicious one is performing exactly the same computations that the the original one can do right. So some of the functionalities are preserved the only thing that changes is that somehow we're implementing it's like a minute, right? So we are
05:39:266Alessandro Brighente: receiving all the the information or the request from the step 7, we can make calls towards the Plc. And then, when we receive information back from the Plc. We can sort of modify and send it back to the step. 7 software, right? Because we are actually in the middle. Right? So it means that somehow we are doing what we we mentioned last time. Right? So we want to intercept all the
06:02:757Alessandro Brighente: all the calls that are made to the and all the responses that the provide back to the software right? Because this is where exactly we need to be in order to report fake values to the, to the monitoring system implemented in there,
06:18:730Alessandro Brighente: in the in the subset, and and the forward
06:24:360Alessandro Brighente: good. So here's a description of the figure, right? So to keep it simple, right? So what can we do? Instead of having multiple files all of the same size and and shape, we can decide to just implement the malicious functionalities in the in the replace, the 5 right? So we have the malicious one. It's just implementing the main demental attack and not re-implementing all the functions
06:51:90Alessandro Brighente: of the original Dll file. Right? For that. We can just call the original Dll file.
06:55:600Alessandro Brighente: And so we have it here. So whenever the the malicious Dll file receives instruction for someone issue sorry from some legitimate action that the original Dll file is is performing. You can simply forward the these requests to the Dll file, which is implementing the function
07:15:960Alessandro Brighente: which may communicate the the looks like it's a legitimate. We only implementing here the functions of which we actually want to modify some correct those.
07:33:55Alessandro Brighente: We we want to provide fake data back to the step 7 and software.
07:37:990Alessandro Brighente: Okay? So here.
07:39:917Alessandro Brighente: here's a description of this in particular. If you look at the implementation of the success you have these 16 known for worded, but intercept them experts.
07:52:280Alessandro Brighente: Right? So these are routines that you can use to read. Write the and enumerate code blocks in the in the plc, okay, so good. Now, we have our malicious component in here, right? Our man in the middle component that can forward the request and respond back to the step 7 software on behalf of the Plc.
08:18:310Alessandro Brighente: And of course, in the
08:23:260Alessandro Brighente: in the PC, we have different types of blocks, right? So blocks we means, we mean, different pieces of software, either pieces of information that. Represent what is happening in the PC, so here you have examples of types of block, we have data blocks which contain product specific data. You have system data blocks information on how the PC is configured. Organization blocks and deployments of programs. Right
08:53:36Alessandro Brighente: then the function blocks that contain the code that needs to be executed by the Psc, right? So we have these different types of the information that again represents somehow the the state of the S.
09:06:530Alessandro Brighente: Good. So
09:09:430Alessandro Brighente: we need the some routines to be executed by the Malaysian software without the the system in able to to understand that right? And that's why we have these forwarded instructions at least as we've seen before.
09:27:680Alessandro Brighente: Good. So this is what we want to do. And this is how it will
09:34:50Alessandro Brighente: would behave. But then the point is, how does the the infection process actually work? Right? So in here we have some malicious pieces of cold in
09:45:860Alessandro Brighente: in the software. But this does not provide us information on how we actually attack the decent features right?
09:53:305Alessandro Brighente: So if we look at the the the different implementation nuances of we see that we have implementation, that target specific versions of the software in the Pcs.
10:05:700Alessandro Brighente: And some other version. Right? So, for instance, in here, you have these cpus 6 es, 7, 3, 15, dot 2, 3, 15 refers to the specific implementation of the the Controller software.
10:22:870Alessandro Brighente: And when we target this specific implementation, we have some infection sequences right? And these infection sequences work for these specific implementation are A or B right in total, we have 3 different main infection sequences, A, B and C,
10:40:91Alessandro Brighente: where we have that A and B
10:42:550Alessandro Brighente: look very similar and target the same traffic
10:46:918Alessandro Brighente: instead. The sequence C is targeting is very different from A and B, and it's targeting a different version of the software. By the way, we will look at the sequencer, A and B, and not C, because, although it's implemented, it's has not been used right? It's there. If you look at the code, it's there. But it's not something that has actually been used.
11:13:30Alessandro Brighente: Good. So
11:14:620Alessandro Brighente: once we have our malicious Dll in that, we can propagate. Thanks to the methodology we've seen. Sometimes the 0 we have these Dll malicious Dll file, which starts 2 specific threads.
11:31:910Alessandro Brighente: Right? So we have the
11:36:190Alessandro Brighente: 1st right in here, which runs the routine to infect the the something that runs every 15 min repeatedly.
11:45:730Alessandro Brighente: And the second routine. Here is the one that queries that the Psc. Is for a specific code block to check whether everything is successful. Right? So again, this is the 1st step. If this is successful, means that we can run either A or B.
12:06:767Alessandro Brighente: Then we ask for a specific block.
12:11:460Alessandro Brighente: Good. So why do we ask for a specific blocks? And what do we do and what we do, we want to do
12:18:900Alessandro Brighente: in the end.
12:21:580Alessandro Brighente: Okay, so here you have the the 1st part, right? The the infection thread A and B, and you have basically some of the blocks that you want to receive. Right? So here you have the the infection. You want to receive these dpsb block right, which are useful to receive profit. Bus frames, right profits, frames that contain information
12:46:594Alessandro Brighente: so profit. Bus is one of these bus based protocols that you have an industrial control system, right? Basically reports information on sensor values. For instance.
12:55:970Alessandro Brighente: right? So this is where you get the information on how fast the sound diffusion are, are spinning, for instance.
13:04:820Alessandro Brighente: Okay, so
13:08:800Alessandro Brighente: good. We we have these code blocking here, and we want to replace it with something that we control. Right? So we want to replace it with the
13:17:727Alessandro Brighente: a malicious block which is in.
13:21:980Alessandro Brighente: And
13:26:40Alessandro Brighente: then it's like that.
13:30:460Alessandro Brighente: Okay? So we want to perform these substitution. Right? So why do we want to? To perform the substitution? Well, because if we can substitute this block. It means that we can report back malicious information from the profits protocol, right? So we can report back malicious information on the physical process of the system. At the same time we we should ensure that this is not detected. Right?
13:57:390Alessandro Brighente: So how does this thing work? Why, why, it cannot be detected. Well, because you have a certain point when you infected the machine. What Saxon is doing is recording some data, and it waits for a certain amount of time. We'll see that in a couple of slides, but basically waits for a sufficient amount of time to record as much as possible information on the
14:23:120Alessandro Brighente: legitimate operational values of the system. Right? It's recording information. And once it has sufficient information, this is what it replays back to the to the monitor. Right? So these data will look like normal because they have been captured during the normal operation of the industrial system. Right? So you would not detect anything weird in state data that has been legitimately observed. And it's just played by myself.
14:52:940Alessandro Brighente: Right? So this is what is happening in here.
15:01:200Alessandro Brighente: So in order to to to insert the malicious code in here. What success does is these 3 steps in here. Right? So it increases the size of the original block device. Malicious code at the beginning of the block. And it inserts the original, or we we the one code after the malicious code. So what does?
15:29:200Alessandro Brighente: It's me, you know, means that if this is my block, call right, the say there is ignit one.
15:38:960Alessandro Brighente: I will just allocate more memory right after my malicious phone here and leave the
15:48:310Alessandro Brighente: the the legitimate one in this space here. Okay, so we keep all the the call file, or both the malicious one and the and the legitimate one
16:00:120Alessandro Brighente: so this is one of the organization law, right? Obi-one, and then it also, in fact, will be 35, right? Which acts as a watchdog, right? So it observes what everyone is doing and can solve its execution. When needed.
16:28:110Alessandro Brighente: Good. So, yeah, these are basically the how do we
16:36:168Alessandro Brighente: get the information? Right? So the fact that we should store some of the information, as I mentioned before, right? So we observe how the legitimate communication happened. What are the legitimate values that we receive from from the from the sensors. And we store these information.
16:55:510Alessandro Brighente: Okay, I just wanted to go today.
17:00:460Alessandro Brighente: Okay.
17:01:650Alessandro Brighente: with. So this is the final state machine that implements what is doing right? So you see, we have 6 states in here.
17:11:800Alessandro Brighente: And this is the the first.st
17:15:740Alessandro Brighente: This point, right? We start from from here.
17:20:30Alessandro Brighente: All right. So we see that we have different arrows that connect the different States. Those highlighted in blue are those that have actually been used by stockset the the dashed
17:33:150Alessandro Brighente: honestly said. There's something that
17:35:970Alessandro Brighente: have been implemented but they've not been been actually used them. So they're there. But they, they still didn't find any specific
17:47:130Alessandro Brighente: implementation not being used right? So you see that between these states, we have certain conditions that need to be met in order to transition from one state to the other right? And you see that basically these these transitions are based on timings. Right? So we should wait a certain amount of time in each state to the next one.
18:12:440Alessandro Brighente: Good. So
18:14:670Alessandro Brighente: what happens in the the different States? Right? We said, we start from State one. So the the 1st one
18:24:330Alessandro Brighente: is, we monitor the the blocker. Dpsb.
18:30:910Alessandro Brighente: right? So we we want to understand whether we are in the specific target system, whether we? We can actually one with the with the attack.
18:41:640Alessandro Brighente: Right? And how do we do that? Well, we monitor what is happening on the system right? We collect information. We collect all the measurements, and we wait for a certain amount of time. And this allows us to. To be sure about the information that we collect.
19:01:160Alessandro Brighente: Right? So when we have a sufficient information, and there's a threshold for that. We transition to to the second state.
19:10:670Alessandro Brighente: Good. So in state 2, we start a timer. Okay? Again, here we collect data. And we wait for for 2 h. Okay, so this is just something that that we do as a
19:29:670Alessandro Brighente: I'm saying, we just want to wait for a certain amount of time, basically right? So not to
19:36:596Alessandro Brighente: to to be detected basically by the by the system
19:44:400Alessandro Brighente: good. So when we transition to the to the next stage. We have states 3 and 4,
19:51:400Alessandro Brighente: where we generate the semi fixed network frames
19:55:802Alessandro Brighente: to the slaves in the profits, right to the, to the actual sales to the, to the actuators. And then we have in there.
20:04:540Alessandro Brighente: Okay, so this depends on the data that we recorded before, right? As we mentioned before. We want the the attack to have a system that looks like they may want. So we just send them the the the original data
20:23:100Alessandro Brighente: then, after a certain amount of time, again, we transition to state 5
20:30:662Alessandro Brighente: where we reset the sum of the the variables. Right? So we reset the, for instance, the registers of the the sensors. And we that's basically where we provide the the malicious information to the, to the set users right?
20:49:700Alessandro Brighente: So how do we provide these managers information? Well, we know that these centrifuges, in particular, those that were used in the in the plant that was infected have a certain operational
21:02:120Alessandro Brighente: frequency page.
21:03:750Alessandro Brighente: right? So it goes between a couple of intervals, and what success is doing is providing the the comment to go at the Max speed and at the lowest possible speed very often and very fast. And then this causes stress on the centrifuges. Okay? And this is what is happening here in state. 5.
21:30:700Alessandro Brighente: Okay, so here you have a
21:32:890Alessandro Brighente: the description again, of the States. Here. The important part is what we send in these at the frames right? Which are the instruction for the frequency converted drives. Right? So it means that we provide an information like a certain amount of Hertz at which we want the centrifies to speed.
21:53:950Alessandro Brighente: And this is something. We provide this number. And then a certain point, someone should translate it into values that we should put to the to the registers of the the Esc, for instance.
22:05:880Alessandro Brighente: And that's what happens. The the conversion between the the binary information and the speed that we want to set and the actual electric
22:16:100Alessandro Brighente: signal. And let's the center feature speed.
22:21:900Alessandro Brighente: Okay? So yeah, the name of these devices is the frequency cover the drives.
22:28:620Alessandro Brighente: Okay. And as we mentioned before, we want to to provide fake values for this in particular. To change the operational range very fast. And
22:38:715Alessandro Brighente: very, very often.
22:41:360Alessandro Brighente: Okay. So here you have some numbers on these frequencies. See, here you have,
22:49:67Alessandro Brighente: the the operational frequency and normal operational frequency. Right? So when everything is working properly you have the operational frequency between these numbers and what is doing is providing either this number or this number at a very high pitch. Right? So it's like 8 or 7, and then 1210, and there's no in between. Just go from the low to high. Very. Very often.
23:35:980Alessandro Brighente: yeah. So these are just the some description on. Why, you you're waiting for a certain amount of time in the different States. But just if you want to read it, it's it's here, and here you have a a summary of what is happening right? So this is the actual infection process. So this summary is based on the the timings observed from the actual success events. So you see that we have,
24:04:420Alessandro Brighente: from actions that take quite long. Right? So we have 13
24:10:893Alessandro Brighente: days here and you have the infection. Then you you stop that. We resume the normal operation, and then you record the information for 27 days.
24:24:660Alessandro Brighente: and then again the the infection of the Psc's, and then driving them towards
24:33:340Alessandro Brighente: of stressful state, then normal operation again, and then blah blah, right? This is something that happens.
24:41:80Alessandro Brighente: The repetition right on a certain basis is defined by the the way Stocksnet behaves right. Why do we have this? Because if you bring the incentive uses to stressor for a certain amount of time
24:54:965Alessandro Brighente: and then resume the normal operation, you just avoid being detected right? Because at a certain point the whole process would work just fine to understand if you wouldn't be doing exactly what they're supposed to to do.
25:10:320Alessandro Brighente: Okay. So this was just to give you summary
25:16:80Alessandro Brighente: on what is happening in here.
25:58:310Alessandro Brighente: hey? So then, yeah, let me let me.
26:03:380Alessandro Brighente: Let's move to a different topic in here. So we'll be talking about IoT security privacy, right? This.
26:10:770Alessandro Brighente: actually the the actual second part of the course.
26:14:916Alessandro Brighente: Why do we talk about IoT security, privacy, and what we will, we see for the IoT security privacy. When we talk about internet of things. Right? So the 1st thing is, what is the things? Well, we have a a group of physical devices.
26:36:330Alessandro Brighente: right? So physical devices which are keep with the same communication capabilities. Right? They they can collect and exchange information so they they can communicate with one another, and in particular they can communicate with one another over the the Internet, right? So when we talk about Internet of things, just because these devices can communicate through the Internet
27:00:996Alessandro Brighente: the results the result, the product right, the the IoT devices come from many different fields.
27:10:560Alessandro Brighente: Right? So we have a embedded system, and the 1st form of IoT if you want is a an embedded system. That is a meta system started to to be
27:23:690Alessandro Brighente: have the need to be interconnected. Right? So we move to wireless sensor networks, where we have a very simple devices with very low capabilities that can exchange information with one another. Then you have automation also. Here you have, and also need to take their own decisions right on how? Which data to collect and when to collect, how to exchange that
27:46:810Alessandro Brighente: and control system right? This IoT may help you
27:51:518Alessandro Brighente: in collecting the information that you need for for control system.
27:57:480Alessandro Brighente: Alright. So.
27:59:760Alessandro Brighente: You see that due to the fact that we have these different fields contributing to IoT we have many different security issues that arise from either the network, either the devices, either the software. And so we have different components that that contribute to the the security of the IoT
28:23:330Alessandro Brighente: in particular. What we'll focus in on in this course is the the networking part. So how do IoT networks work like? So what the
28:38:140Alessandro Brighente: how do they exchange information? How do we organize an it network? And then on the embedded devices side? Right? So we have devices which have certain constraints in terms of memory, computation, power, resources that they can use. And we want to be to be able to secure these devices. And how do we do that? Well, we need to to ensure the integrity of the software that they
29:05:190Alessandro Brighente: are running.
29:07:730Alessandro Brighente: So here, just for reference. You have a taxonomy of IoT, right? So what is using the different layers of an IoT network? Right? So you see that you have the perception layer for processing communication, middleware and applications. And these are the different layers we go from there. There again. It's it's like what we've seen from the
29:30:480Alessandro Brighente: for us kind of system, right? We have the part of the perception where you have actually the sensor. Right? So you have a one meter education. Blah blah!
29:44:668Alessandro Brighente: Then you have some of the via sensor. All the information you have, the pre-processing module where you do your computation communication. And here you have the different kind of protocols and networks that you can implement for. IoT devices right? You have neft communication, wireless sensor network and the the the different layers and protocols here. For this you see that you have Bluetooth, low power Wi-fi
30:12:994Alessandro Brighente: then the information that you collect through communication is passed to the the Middleware, right? So where you have some of the logic that you work in the mentor. What you want to do with this data? And how so to have that?
30:27:620Alessandro Brighente: Whether it's publisher, subscriber, or whatever you want to do here. And then you have the application right? What actually, this data is used for? Is it something for for monitoring? Is it for supply chain? It is, is it for home automation? Right? So do you need to only receive data from the active devices? Do you want to provide comments to these
30:51:150Alessandro Brighente: these devices? Right?
30:55:276Alessandro Brighente: So here you have just a bit of a general architecture for IoT networks. Right? So, as we mentioned before, we have devices, the things where you have the sensing and communication capabilities, then these devices usually communicate with the gateway. And which is this data
31:16:160Alessandro Brighente: aggregation system which collects data process data and brings them to the the cloud where you have the applications that you actually run right? So where you consume the data that you collect through the through the devices.
31:31:710Alessandro Brighente: Okay? So in the cloud, of course, you have these applications, then you have storage. You have event queuing. You have your messaging system
31:39:420Alessandro Brighente: based on what you actually want to do with your notes?
31:43:490Alessandro Brighente: Good. So
31:46:900Alessandro Brighente: What does or how does the the network architecture look like?
31:52:867Alessandro Brighente: Well, what we can expect from an IoT network is super to to include a large number of devices right? Ideally, we have many devices in there, and all of these devices, again, are characterized by
32:12:390Alessandro Brighente: small amount of resources, and in terms of memory in terms of computational power, and also in terms of power itself. Right? We don't vision to have devices that are connected to the, to the power supply, right from sockets from the wall. No, we have a lot of devices that are battery powered right? So all the power that they that they have comes from
32:35:260Alessandro Brighente: from about itself.
32:36:800Alessandro Brighente: Good. So we have a a large number of devices, which means that we would like to use the ipv. 6 for addressing like, we want to to be able to address a large number of devices, and remember that these devices are connected over the the right. So we have different standards for this.
32:55:148Alessandro Brighente: One of them is a 6 ipv. 6 over low power, wireless personal networks.
33:06:600Alessandro Brighente: And so which includes a lot of the the information that characterizes the IoT right low power. We don't want to consume a lot of power to implement a wireless communication which is not wired, and we have devices that can be deployed wherever and they need to be able to communicate. And this one is particular for personal Internet, right? We have small sized network where these devices should communicate
33:31:200Alessandro Brighente: one another.
33:33:220Alessandro Brighente: Then we have another standard in here, right? So these 6 open operates on top of I 3, 48 or 2 dot 15 port
33:42:173Alessandro Brighente: which is a low rate defined for low rate personal networks.
33:47:780Alessandro Brighente: I love it again because we don't expect these devices. Communicate that
33:56:459Alessandro Brighente: at high rate. Right? They don't have that much data to report. It's not like they're streaming some some videos. Or they need to to access some infotainment platform. No, they are usually collecting sensory data, right? Or they're turning on and off a light or an led that you have in your house. So they don't really need a huge
34:18:889Alessandro Brighente: data rate. Right? And this is good because it means that they can consume less power. The less data you transmit the the less power you consume. Usually the the communication module in this device is the is the model that consumes the most power right? So the fact of being low rate means that you can save some power.
34:36:624Alessandro Brighente: We have another version of the it 8 0, 2, 15 dot 4 which is the the e in here, which is used for industrial networks
34:47:559Alessandro Brighente: where we have these 60 in here we get back on the the piece part is really important because it's related to time. Slot the channel, hoping right? This mechanism that is used to prevent interference among devices.
35:03:390Alessandro Brighente: And then on top of everything, you have a data transfer and data transfer that is provided by other protocols. Again, you have either constrained application protocol it's got in here. You have 0 and fewer you have. Mqtt, right? So higher layer protocols
35:20:110Alessandro Brighente: actually with the just quotation of the information.
35:24:100Alessandro Brighente: So we start with the the 8 dot, 2 dot 15 dot 4,
35:29:00Alessandro Brighente: which is these low rate personality to standard, and in particular it refers to the low layer lower layers of the communication right? So we are talking about the physical and the medium access control.
35:44:44Alessandro Brighente: The physical layer defines the
35:47:810Alessandro Brighente: like the casinus that you use in order to convey information. The master's control allows you to have access to the resources of the communication.
35:56:270Alessandro Brighente: Good. So what we use the other scheme that we use in a 2 dot, 15 dot 4 we have 64 beta for the node id to identify the node and 16 bits for the network id, and so the network is identified by 16 bits. And the basic channel access model is kind of sense. Multiple access with collision avoidance. Right? This. Sma, Ca, scheme.
36:25:899Alessandro Brighente: Very, very, very, very short description of Csm, a. Ca, what you do is to check whether the channel is occupied right, whether the transmission is going on. If not. You send an Rts package stands for request to send and wait for the clear to send Cps package right. If you receive the cps, then you can start your communication.
36:51:910Alessandro Brighente: So you have the distinction between data packets and acknowledgement packets.
36:56:770Alessandro Brighente: Okay, so here you have the format of these this tunnel in here. You have the the format for the data packet, and you have the format for the acknowledgement packet, and you have indications you see here you have flags in both of the the formats which tell you whether, the security in these packages enabled or not.
37:20:255Alessandro Brighente: And then you see that you have some basic form of checks. And if you look at the data package, it's really something that you've seen I guess many times you have a destination address source data pail. Right? So the classical structures that you have
37:39:460Alessandro Brighente: in networking protocols.
37:41:390Alessandro Brighente: Good. So what about the security of the 8 0, 2 dot 15 dot 4
37:48:576Alessandro Brighente: so we're talking about the Link Layer security protocol. Right? So we have low layers. It's not like a application layer so the security services that we required are for right? So these 4 basic services which are access control message integrity message, confidentiality and replay protection.
38:12:68Alessandro Brighente: Okay, so access control, we want to check who has the the rights. If you want to have access to the resources of the network, and not that everyone can can send whatever package they want, and our network can make it look like legitimate
38:28:625Alessandro Brighente: Integrity, protection. You mean that no one can modify the the packet in transit right when they are sent. Message confidentiality. It means that those that are not part of the network cannot read the content of the packet and replay protection means that if I am the talker I cannot capture the packet and replay the at later times and make it look like legitimate
38:50:190Alessandro Brighente: So we have a a certain
38:53:720Alessandro Brighente: stack security stack that we can use certain products that we can use, and certain security parameters that we can use right? So through parameters such as in the key lens, for instance. But what happens is that if you if you buy a device and ha have these communication standard implemented, that the security is not enabled by default. Right? So if you just deploy your network you should know that you're you have no security means in in there.
39:23:340Alessandro Brighente: Good. So we said, we have different security
39:31:190Alessandro Brighente: algorithms that we can use. Right? So you have these security suits that you see here for 8 or 2, 15, or 4 you have either the option, no security. Right is the the 1st one, and then that comes by default. You have encryption only, and some you assume we are, aes Cpr
39:49:340Alessandro Brighente: authentication. Only Aescbc marker and creation authentication. A sccm.
39:55:870Alessandro Brighente: Okay, so you have these different implementation of as you can use to to to achieve different security levels if you want or security requirements.
40:09:761Alessandro Brighente: Depending on the size of the the mark that you that, you use them.
40:16:908Alessandro Brighente: You have different nuances of these algorithms, right? Because you have 4, 8, or 16 Byte map fields.
40:28:600Alessandro Brighente: Okay, when I talk about the Aes, is it something that you've already seen? Or
40:43:160Alessandro Brighente: okay?
40:47:840Alessandro Brighente: So I can just skip all this stuff? Right?
40:50:770Alessandro Brighente: Yeah. Great
40:56:510Alessandro Brighente: to me right?
41:01:470Alessandro Brighente: Still, you're welcome to me. It's no problem.
41:08:480Alessandro Brighente: Okay?
41:12:830Alessandro Brighente: So you have these these different seats that implement the
41:21:961Alessandro Brighente: requirements that you might have right. So now the thing is, how do we get to? To share keys? Right? That the keys is something that you need in order to be able to and create in the packets that belong to the same network. Right? So we talk about keying models. But we talk about key models for the break.
42:02:610Alessandro Brighente: Okay, we are having longer and longer breaks.
42:10:440Alessandro Brighente: Not. True enough.
42:19:750Alessandro Brighente: Good. So how?
42:22:140Alessandro Brighente: How then? We so we need keys, right keys, because that's how we provide authentication encryption. That's how we conceive messages
42:32:20Alessandro Brighente: in our network. Now, the question is given that we have a very large network where we have potentially hundreds of devices connected to the to the same IoT network. How do we want to distribute keys, or how many keys do we want to have?
42:48:340Alessandro Brighente: How do we manage keys? Right? So we have many not many. But let's say 3 major keying models. Right? So the 1st option is, okay, let's have a network wider share key. And so just one key and used by all of the devices. And this is wonderful from a deployment point of view.
43:09:750Alessandro Brighente: And so it means that every time you want to connect a new device.
43:14:940Alessandro Brighente: If you are the owner of the network, you know exactly the key that it's supposed to use. You. No need to update anything. You just need to provide that key to the to the device. And we just right away start using that for communication.
43:27:330Alessandro Brighente: And then you're good, can communicate potentially with all of the devices that are in its
43:32:260Alessandro Brighente: beach right that part of the network.
43:35:330Alessandro Brighente: On the other hand, from a security point of view, these might not be so good. Right? Because compromising a single device means that you have access to the key.
43:44:790Alessandro Brighente: and then access to the key means that you can
43:47:830Alessandro Brighente: have access to all of the all the devices, and it's really bad good. So
43:54:100Alessandro Brighente: let's find another way. Well, the other way might be pairwise thing, right? So it means that a device has a key that you can use with another device in in the network.
44:10:510Alessandro Brighente: Okay? So
44:13:660Alessandro Brighente: these from a security point of view. It's better right? Because if I compromise one key, I can only compromise a single communication link one between the device and the other device associated with that key. But from a deployment point of view.
44:33:910Alessandro Brighente: this is really good bad, somehow. Right? Because it means that we need to
44:41:360Alessandro Brighente: to add a new node to the network. And these new nodes should establish a key with all the other devices that belong to the network if we want to communicate with them. Right? So if so, 1st thing is the problem of the computational complexity I need as to establish connection and change these these keys with the
45:03:200Alessandro Brighente: N minus one devices. If I am in a network of N nodes. And then the problem is manually right. I need to store N minus one
45:13:640Alessandro Brighente: other ease of
45:20:00Alessandro Brighente: and it's bad, right? We said that we have limited resources. So we cannot do our
45:25:40Alessandro Brighente: how many kids? I mean we can. So how many keys that we want as long as we have memory, but then we don't have memory for other tasks that the the node should be doing right. So yeah, good from a security point of view. But not that much from a complexity point of view.
45:42:100Alessandro Brighente: Good. So the 3rd option. The the 3rd mode is a group key. Right? So what do we mean when we talk about group key? Well, it's an in between between the 2 modes that we've seen before. Right? So it's not like we have a network wide key, but we have a key that belongs to a specific group of users.
46:05:970Alessandro Brighente: Right? So it's like, Imagine your network cluster nodes into different groups. And each of this group is associated with a single key. Okay, so this has the benefit that we do not need the
46:18:640Alessandro Brighente: that many keys to be stored in our memory. Has the benefit of the reduced complexity. Right? We need the the key for the group which we belong to, and if one of the devices is compromised, it means that the group that it belongs to is compromised right, because we have the key for that specific group, not for the whole network.
46:41:523Alessandro Brighente: Okay, so we can reason about the these E exchanges.
46:53:104Alessandro Brighente: Then
46:54:740Alessandro Brighente: how do we pair devices? Right? So how do we exchange these keys? Right? So how these devices can enter a new network and get the their security context and the key that they use for their communications.
47:11:640Alessandro Brighente: Alright, so
47:13:940Alessandro Brighente: we have traditional approaches right where? We haven't a trusted gateway, right? So the 1st thing that the that the user on the new node does is to communicate with this trusted gate, establish a secure connection with that, and receiver its key
47:30:840Alessandro Brighente: right? So
47:33:850Alessandro Brighente: You might have a a situation in which the node is provided with a secure key that you can use to talk with the trust gateway to receive the key they need. So, or sometimes you need to to press some buttons on the trusted devices to enable the paving mode. Right? So that's something that you might have experience some time. But then the problem is that these gateway is a is a single point of failure. Right? So
48:00:605Alessandro Brighente: we want to move to something more decentralized. We do not want to rely only on one devices for only one device for the security of our network.
48:13:680Alessandro Brighente: So what we what we would like to do is use something called the context based pairing. Right? So we would like devices to be let's say devices are part of the same context to have a shared secret that they can use in order to drive their kids right. So all the devices that belong to
48:37:990Alessandro Brighente: a single room, for instance, might be part of the same group, and therefore experience some situations that help them. Generating a key that only these devices could have generated.
48:52:280Alessandro Brighente: Right? So this would be nice because it limits the the human interaction side. We don't need to rely on someone pressing a button on the gateway.
49:02:650Alessandro Brighente: Right?
49:05:920Alessandro Brighente: good! That's all nice. It's kind of hard to achieve at this point? Right? How do we ensure that all devices experience the same
49:14:980Alessandro Brighente: situation? Right? How do or what are the events that we use in order to derive these skills right?
49:25:620Alessandro Brighente: At the same time, if these events, let's say that we are able to identify relevant events right? Something that triggers a behavior on a device. And let's say that we generate a single bit for each of these events. So
49:37:560Alessandro Brighente: in order to have a piece that are sufficiently longer. We will need to wait for days, maybe right? So, days for these events to happen will generate these different mix, and we don't want pairing to happen over a month. Right? We would like it for it to to happen in kind of a short time, right? Something at least comparable to what we have with the our centralized
50:01:950Alessandro Brighente: approach.
50:04:10Alessandro Brighente: Right? So this is something that we'll see in the next lecture how to get to design this group. Painting
50:12:600Alessandro Brighente: approaches. But before I go into that, let's take a look at another standard in here. So we have. Zigbee.
50:20:880Alessandro Brighente: Okay, Zigbee is among the the protocols that are the most famous for IoT networks. Right? So we build on top of the 802 dot 15 dot 4 we've seen before for creating personal networks, and Zigbee stays on top of that.
50:36:518Alessandro Brighente: Usually we use it before home automation medical devices and small scale and networks. And process this is because it has a shorter range. It's between 10 and 100 meters in line of sight. It means that you have no blockage between the the transmitting and receiving device like this.
50:56:530Alessandro Brighente: Actually another side best ways to achieve longer distances. But in order to that, you need a mesh network, right? It means that
51:10:530Alessandro Brighente: actually have multiple communication. If device A wants to communicate with the device B, but there's a wall in between.
51:18:590Alessandro Brighente: Maybe we cannot reach that, please.
51:21:440Alessandro Brighente: It's kind of long. So node a communicates with the node c, which stands for words, the message, but it requires multihope mesh network.
51:36:320Alessandro Brighente: We have 3 types of devices in network. Right? So we have the zigbee coordinator, the router, and the the end device. So we can imagine the the zigbee network as a tree, right? So where the the coordinator is the the root of the network.
51:54:190Alessandro Brighente: And what it does is to originate actually the network. So it's the the trusted node at the center part on the network, and that contains, for instance, the the key is needed to establish secure connection. And so when we want to add a new device. We need to talk with the Zb coordinator.
52:14:221Alessandro Brighente: Then at the lower layer we have this degree router which is an intermediate devices need is needed to pass data between different nodes.
52:26:100Alessandro Brighente: This is usually based power. It means that it's connected to. It's not something battery powered because it needs to be there. If you lose the router that we we lose part of the communication ability of the network, and then we have the Vn devices which are these battery powered.
52:45:170Alessandro Brighente: The actual IoT notes right? So they they feel devices something interesting is that they need to periodically wake up right? They wake up only when, whenever they have something saying so it means they are not always on. This saves some some power of these devices, right? So
53:02:370Alessandro Brighente: it just communicate when they need it.
53:06:580Alessandro Brighente: In terms of security.
53:08:680Alessandro Brighente: We have the keys and modes that we've seen for 2 15 before, because it's the the basic layers also for zv and what we need in here as an assumption is to trust the initial installation of keys right? So the devices need to have keys that they use to communicate with the coordinator such that they can establish up security
53:34:380Alessandro Brighente: on this.
53:43:120Alessandro Brighente: Okay, so yeah, just a summary of what the Zb
53:49:300Alessandro Brighente: has in terms of of capabilities. So at the application you have the keyboard
54:00:673Alessandro Brighente: service with both the Zp coordinator application on the network side you have frames that use appropriately. Key according to their routing capabilities. Right? The routes have been established by the router and the Mac layer. You have a single hope, reliable communication. And then you need to rely on the security specified by upper layer
54:27:480Alessandro Brighente: network and application layers in here.
54:39:760Alessandro Brighente: Yeah, I would say.