1. A Security Framework for ROLL draft-tsao-roll-security-framework-00.txt T. Tsao R. Alexander M. Dohler V. Daza A. Lozano

2. IETF 75 - ROLL WG, July 2009 2 of 13 Overview Objective Approach Security needs ROLL issues Threat, attacks, and counters ROLL security features Moving forward

3. IETF 75 - ROLL WG, July 2009 3 of 13 Objective Enumerate pertinent security issues in LLNs specific to routing Facilitate –Assessment of a routing protocol's security threats –Identification of the necessary features of a secured ROLL protocol –Provide a framework applicable to any generic routing protocol

4. IETF 75 - ROLL WG, July 2009 4 of 13 Approach (1/3) Four steps –Examine ROLL security issues –Analyze threats and attacks –Consider the countermeasures –Make recommendations for securing ROLL The basis –Identify the assets and points of access of routing –Evaluate their security needs based on the CIA model in the context of LLNs

5. IETF 75 - ROLL WG, July 2009 5 of 13 Approach (2/3) The CIA principles are widely employed to understand, uncover, and formulate security needs –Confidentiality concerns unauthorized disclosure –Integrity concerns unauthorized alteration –Availability concerns if information and resources are accessible when needed They can be limiting for certain applications –Other views include, e.g., non-repudiation

6. IETF 75 - ROLL WG, July 2009 6 of 13 Approach (3/3) Data flow diagram decomposition of routing

7. IETF 75 - ROLL WG, July 2009 7 of 13 Security Needs Routing/topology information –Integrity, confidentiality, and authorized use Neighbor discovery process –Not to undermine routing availability Routing/topology exchange process –Authentication, integrity, and confidentiality Communication channels and node resources –Availability Stored information, and routing and route generation processes –Confidentiality and Integrity

8. IETF 75 - ROLL WG, July 2009 8 of 13 ROLL Issues Limited energy reserve, memory, and processing resources Large scale of rolled out network Autonomous operations Certain types of networks may have highly directional traffic Unattended locations and limited physical security Support for mobility Support for multicast and anycast

9. IETF 75 - ROLL WG, July 2009 9 of 13 Threats, Attacks, and Counters Confidentiality –Routing exchange exposure –Routing information (routes and network topology) exposure Integrity –Routing information manipulation –Node identity misappropriation Availability –Routing exchange interference or disruption –Network traffic forwarding disruption –Communications resource disruption –Node resource exhaustion

10. IETF 75 - ROLL WG, July 2009 10 of 13 ROLL Security Features (1/2) Confidentiality –SHOULD provide payload encryption and privacy, e.g., when geographic information is used –MAY provide tunneling and load balancing Integrity –MUST verify the liveliness of both principals of a connection, message freshness, and message sequence and integrity Availability –MAY restrict neighborhood cardinality, randomly use multiple paths and/or destinations, set quotas to limit transmit or receive volume, and use geographic insights for flow control

11. IETF 75 - ROLL WG, July 2009 11 of 13 ROLL Security Features (2/2) Additional Considerations –If a LLN employs multicast and/or anycast, it MUST secure these protocols –MUST provide adequate physical tamper resistance to ensure the integrity of stored routing information. –MUST include a process for key and credential distribution; a LLN is encouraged to have procedures for their revocation and replacement

12. IETF 75 - ROLL WG, July 2009 12 of 13 Moving Forward (1/2) To consider constraints due to operations or application needs –Examples include ease of installation and protection of safety sensitive applications –Do these constraints necessarily translate to different ROLL security needs and strengths? –If so, do we solve it by different security levels, e.g., none, default, and high?

13. IETF 75 - ROLL WG, July 2009 13 of 13 Moving Forward (2/2) To consider integration of trust mechanisms –How is it relative to authentication? –Does it also address insider attacks? To consider routing in context –Link layer security needed for (D)DOS which also impedes ROLL –Heterogeneous devices of various configurations and the cascade vulnerability problem