Performance vs. Security Trade-Offs in RANETs based on Hybrid Quantitative Network Models

Transcription

1 HET-NETs 2013 Conference Performance vs. Security Trade-Offs in RANETs based on Hybrid Quantitative Network Models Guzlan M.A. Miskeen 1,2, Demetres D. Kouvatsos 2 and Esmaeil Habibzadeh 2,3 1 University of Sebha, Libya 2 University of Bradford, England 3 IUST - Iran University of Science and Technology {G.M.A.Miskeem, D.Kouvatos, E.habibzadeh}@brad.ac.uk 12 th of Nov T03-1

2 Outline Performance and Security Tradeoffs Concepts Security and Tradeoffs Modeling Tools Robotic Ad Hoc Networks (RANETs): Related Concepts Trade-off Modeling in Literature The Proposed Hybrid Framework Simulation Experiments Final Remarks & Conclusions Extensions for Futurework T03-2

3 Performance and Security Tradeoffs Concepts Performance is the degree to which a system accomplishes its designated functions within given constraints, such as speed, accuracy, or memory usage. [IEEE ] Security service is the collection of mechanisms implemented to reduce the risk associated with threats of stored & exchanged data in communication networks. Performance and Security Trade-off Either security is compromised for better overall performance or vice versa & it can be quantified and evaluated using quantitative tools such as QNs and GSPNs thus leading to the trade-off optimisation. T03-3

4 Performance and Security Tradeoffs Concepts The performance-related security can be modelled and evaluated, considering : 1- Modelling performance and security accurately using effective quantitative modelling tools (e.g., QNs and GSPNs which have various features in terms of simplicity and modelling power); 2- Defining /introducing suitable metrics for both performance and security as well as appropriate combined metrics [WOL10]. Security Metrics Since security can be seen as a process, security metrics can be expressed as: 1. Time of security failure occurrence/time between security failures; 2. Probability of being in a certain condition, e.g., probability of the encryption key to be valid. For MANETs, encryption key length (and the corresponding encryption time) can be seen as a metric. T03-4

5 Trade-off Evaluation Under Bursty Traffic Condition When the security mechanism is activated, how to quantify the corresponding degradation of performance under bursty traffic conditions? Traffic burstiness can be captured using Generalised Exponential (GE) distribution, which can give the upper performance bounds. GE distribution is expressed with [KOU88]: λ & C 2 F(t) = P(W t)= 1-a e -aλt, t 0 a = C 2 = Var W E 2 W When C 2 =1, GE r.v. exponential r.v GE can be seen as a limiting case of H2, with tuning parameter k with the same λ & C 2 [KOU88]; When: k +, H 2 GE. 2 C 2 +1, α 1 (k) α 2 (k) 1-a = C2 1 C 2 +1 a= 2 C 2 +1 a λ = υ 1 (k) υ 2 (k) (a) k + 2 λ C 2 +1 aυ (b) T03-5

6 QNs QNs are concise graphical description of service centres, queues and their disciplines and routing amongst these nodes; Used Scheduling strategies such as First-Come-First-Served (FCFS) and Head-of-the- Line (HoL) priority rules with either infinite or finite capacity queues Key QNs Advantages & Limitations Advantages Powerful for modelling hardware contention and scheduling strategies; Robust exact / approximate algorithms for calculating performance measures for multiple class QNs with or without blocking. Limitations Not suitable, in general, for modelling synchronization, simultaneous resource possession, security control and software contention; T03-6

7 GSPNs They are credible modelling tools for the qualitative/quantitative analysis of complex system involving software contention, blocking and synchronisation. A PN is composed of two types of nodes: Places, p and transitions, t: A place: accommodates customers called tokens which defines GSPN state; A transition: represent event that changes the system s state; Arcs: are the links between places and transitions. Operation Rules Input place p 1 Output place p 2 Token Transition t 1 Firing Fig. A SPN Components Key GSPNs Advantages & Limitations Advantages Have great descriptive power Allow easy modelling of blocking, synchronization, simultaneous resource possession, security control and software contention. Fig. B SPN Enabling and firing Limitations The solution of GSPNs for large systems, is computationally very expensive due to exponentially growth of the state space. T03-7

8 RANETs: Related Concepts RANETs is an infrastructure-less networks at which MANETs is used as underlying technology; Robots can be tele-operated (controlled by a human being) or autonomous (work without human interaction); Robots among the RANET might be heterogeneous in terms of sensory skills, mobility and robot s architecture. The main five components of any robot are: Controller, Sensing Unit, Power Unit, Transmission Unit, Actuators. RANETs Encryption Protocols: provide confidentiality (via encryption) and/ or integrity to the exchanged data; however, they add extra bits which require more processing time! T03-8

9 The Main Concept QNs & GSPNs Models An Appropriate (detailed) Network Model A Proper Bursty Traffic Flow Model GE Distribution Suitable performance and Security metrics Performance & Security Metrics DES (Hybrid Petri Queuing Networks Simulator (HPQNS) Quantitative Methodology of Performance Degradation and Associated Trade-offf in RANETs Under Bursty Traffic Conditions T03-9

10 Previous studies Security & Mobility Modelling Modelling Approach Explicit modelling of Security (Security processing delay) in MANETs by QNs [Saleh05] λ Processing Server S 1 S 2 Security Server Application Context & Modelling Level A MANET s node runs WEP encryption protocol (Node-level) security and forwarding service times are modelled explicitly by Hypo2 in the queueing model. Performance and/or Security Metrics Performance Metrics: mean throughput & packet loss M/Hypo2/1 Total Service Time Mobility Modelling in MANETs by G-QNs [Bhatia07]. λ, C a 2 β On Off α GI/G/1 (G-Queues) indicates node s mobility subject to IPP with α & β transition rates( the model is made at Network-level ) Performance Metric: mean marginal endto-end delay. T03-10

11 Previous studies Performance & Security Trade-off Modelling Tools Modelling Approach Wolter s model [Wolter10] GSPN to trade-off between the system throughput and the system being secure. It provides Explicitly Detailed- Modelling of Security Processing & Control. Szczerbicka s Model [Szczerbicka92] (modelling Performability (i.e., the ability of a system to perform). The Concept of Combined QNs and GSPNs has been introduced by Balbo [Balbo88]. Modelling Level & Application Context Combined GSPN performance-security model (at Node-level) for an abstract communication system to evaluate & simultaneously optimise performance and security trade-off using CPSMs [Wolter10]. Trade-off between performance & Reliability for a communication channel at (Network-Level). Features of combining QNs and GSPNs This combination was introduced to overcome the limitations in modelling power of QN and the state space explosion in GSPNs when modelling large systems). Combining & exploiting the best features of both QNs and GSPNs to provide an effective. In the context of DES, adopting combined QNs & GSPNs will help in reducing the time required to update transitions status after each firing event in a pure GSPN model. Performance and/or Security Metrics Performance Metric: Throughput. Security Metrics: Probability of system being secure, unsecure, or recovering. Analysis Approach: Free Simulation Package Limitations: Traffic burstiness was not included. Security sub-model can be extended further. Combining QNs and GSPNs Performance Metric: ratio between mean throughput of correctly transmitted jobs and the throughput of all transmitted jobs. Analysis Approach: mathematical model based on GSPN Limitations: Traffic burstiness was not included. Customised model. T03-11

12 Employing the Quantitative Methodology in (RANETs) Proposed Models, Application Context, Adopted Modelling Approach & Evaluation Tool) WEP & SS (Security processing is Explicitly Modelled by G-QNs [KOU12] λ, C a 2 β On Off α p 1-p µ 1, C s 2 µ 2, C s 2 WEP Processing Transmission The Proposed Hybrid G-GSPNs & QNs Framework (Explicit & Detailed-Modelling of Security processing and Control, mobility, Power consumption & intra/inter-robot communications) with associated two Extended CPSMs). Modelling Level & Performance and/or Security Metrics Network-Level Incoming traffic is lost when the gate is Off, i.e., the node is disconnected from the network. Performance Metric: mean marginal end-to-end delay. Security Metrics: N/A Limitation: Security processing delay in WEP node was only parameterised through the mean rate and SCV (due to the limited modelling power of QNs thus security control was not explicitly reflected!) This was the motivation to propose framework in which by replacing QN security node is replaced by detailed GSPN one). Network-Level Extended CPSM ( based on CPSM proposed by Wolter) GSPNs QN T03-12

13 The Proposed Hybrid QNs and GSPNs Framework Hybrid Node # 1 GSPN QN Hybrid Node # 3 Hybrid Node # 4 It models, at node-level, for each node Hybrid Node #2 GSPN QN GSPN QN by explicitly modelling: security GSPN QN processing and control with mobility,power consumption using GSPN; QNs reflect intra -robot (component- Security Model Hybrid Performance Model to-component) communication & inter -robot transmissions. The main feature is to model more effectively the performance & security behaviour of RANET node & subject GSPN Arrivals_1 Arrivals_2 Reconnect Off Security Processing Disconnect Encrypt co Arrivals_3 Intra Robot Component to Component Communication QN HoL Discarded traffic Inter Robot-to-Robot Transmission QN_Dep_1 QN_Dep_2 to other robots extended CPSMs. On Life-time L Reduce Power Mobility and Traffic Model Recharge N Extend life-time (via recharging) The Hybrid G-GSPN-QN T03-13

14 Case Study Control data directly from tele-operator (through GSPN) Control data forwarded by other nodes (through GSPN) Arrivals_3 Video data from robot s camera FCFS GSPN_Dep_1 GSPN_Dep_2 Sensor (camera) HoL Controller Intracommunications Inter-robot Transmission communications FCFS Unit QN_Dep_1 FCFS Actuator Sending back the video data to tele-operator via to other relay nodes Robot s Mechanical response to the control data (moving to a new position) QN model for intra and inter robot communications Communication between the robot and tele-operator can be directly or via intermediate mobile nodes; Video transmission can be delayed due to the transmission media and encryption protocol s computations which might prevent the Timely control of the robot; Therefore, investigating a balanced trade-off in will reduce transmission delay while preserves reasonable security level and video quality. T03-14

15 Extended CPSMs Selected performance metrics, which are compatible in scale of magnitude e.g., Utilisation U and PLP are used to resolve the issue in Wolter s CPSM to facilitate investigating and optimising RANET s performance vs. security trade-offs. Definition of the Extended CPSMs These CPSMs are defined in terms of the model in the Figure, as following: 1. CPSM1 = U + P(Valid Encryption Key) Arrivals Encryption Encrypt Send Valid Encryption key Rekey Fail 2. CPSM2= PLP in encryption place +P(Undetected Broken Key). Detected broken key Detect Undetecte d broken key T03-15

16 Discrete Event Simulation (DES) DES, implemented in java, has been used for its flexibility, simplicity & ability to analyse complex systems since it overcomes queueing theory s limitation and it model reality in greater detail; A system s model can be constructed and the required measurements are calculated over time to obtain performance metrics of interest; DES is used to generate GE random variable as well as simulating QNs and GSPNs. Hybrid Petri Queuing Networks Simulator (HPQNS) has been developed to evaluate the trade-off in RANETs T03-16

17 Input parameters of hybrid QN and GSPSN Parameter Value Arrivals Encrypt Fail (time to key breaking) Undetected Broken key Rekey Send 8 messages per sec 0.01 to 0.34 step 0.01 sec 1.25, 25, 50, 100, 600 to step 500 sec 12 sec SCV of inter-arrival times 1, 50, 100 Capacity of Encryption place and Send queue buffer 36 sec 10 messages per sec 100 T03-17

18 Results CPSM1 and Corresponding Components CPSM2 and Corresponding Components PLP P(Undetected Broken Key) CPSM Utilisation (QN) P(Valid Encryption Key) CPSM Encryption Time (sec) CPSM1 = Utilisation + P(Valid Encryption Key) Encryption Time (sec) CPSM2 = PLP in encryption place +P(Undetected Broken Key) T03-18

19 SCV Impact on CPSM1 SCV Impact on CPSM2 Maximum Utilisation & Security for SCV= Minimum PLP & Key Breaking for SCV=1 CPSM2-SCV-1 CPSM2-SCV-50 CPSM2-SCV Maximum Utilisation & Security for SCV=100 CPSM-SCV-1 CPSM-SCV-50 CPSM-SCV Minimum PLP & Key Breaking for SCV= Encryption Time (sec) Encryption Time (sec) SCV Max- CMPS1 Optimised Encryption Time (sec) SCV Min- CMPS2 Optimised Encryption Time (sec) T03-19

20 Final Remarks & Conclusions This study contributes in quantifying and predicting performance degradation at node level- in RANETs caused due to volume incoming traffic in conjunction with security computations by the use of GE and exploiting the Extended CPSMs to facilitate investigating and optimising the trade-offs; The proposed framework reflects the behaviour of security mechanisms as well as intra-and inter- robot communications which enables capturing the robot s heterogeneity (in terms of the robot architecture and application); The impact of increasing the burstiness of input traffic increases the encryption time required for simultaneous optimisation of (Extended CPSM). performance and security T03-20

21 Future work: The Extended Model Arrivals GSPN encrypt Re-encrypt Request Three scenarios are considered, to include the protection (or reduction) of information leakage when the system is non-secure: (1) system becomes unsecure by a real attack; (2) system erroneously considered under attack (false positive); (3) system being under unrecognised attack (false negative). More advanced security protocols can be investigated utilising the proposed hybrid framework. Re-encrypt Request* Temp Pass Recover Restoring QN All messages are transmitted by QN after being (or seems to be) successfully encrypted. Secure Detect Fail1 Insecure Detect* Fail2 Recover by Default Mis-function Insecure* Unrecognized Attack Net-CPSM1&Net-CPSM2(at network- level) of N hybrid nodes can be expressed as: Net_CPSM1= U i N i=1 + N N i=1 P i((system in secure state) N Net_CPSM2= N PLP i i=1 + N N i=1 P i (system in detected broken key) N Furthermore, Aggregate CPSMs & Marginal CPSMs for R arrival classes in the hybrid network can be determined in a similar way. T03-21

22 The conversion from a security state to another is caused by enabling and firing the following transitions: Transitions Pass: messages are passed to QN after being encrypted using a valid key. Detect*: The system recover from non- real attack. Fail1: the system fails by a real attack. Recover: The system recover from non- real attack. Detect: when the integrity check discovers that the encryption key is compromised, it will inform/ alarm the system. Re-encrypt Request *:Any messages is suspected to be encrypted with invalid key (but in reality it is valid, i.e. false positive detection) has to be re-encrypted. Recover: the system recover from a real attack by performing the rekeying process. Mis-function: the possibility of the system being secure whilst it is under a real attack ( so fail3 leads to unrecognized attack state) Re-encrypt Request: Fail2: The Any encrypted system fails by messages with invalid a non- real key has to be reencrypted. attack Recover by Default*: the system recovers from non- real attack, by performing rekeying process after a particular number of messages (or given period of time). Places ( representing the security status of the model) Secure: A system is secure (encrypted messages are allowed to pass to the QN to be transmitted). Temp: Temporary buffer in which all encrypted messages are further checked whether they have been encrypted by a valid key or not. Insecure: the system becomes non-secure by a real attack (compromised key) Insecure*: The system is secure but is considered non-secure due to error occurrence (false positive) (inability to detect a broken key). Unrecognized Attack: The system is non- secure but was considered secure by error (false negative), i.e., inability to detect the key is compromised T03-22

23 Key References G. Balbo, S. C. Bruell, and S. Ghanta, "Combining queueing networks and generalized stochastic petri nets for the solution of complex models of system behavior," IEEE Trans. on Computers, vol. 37, no. 10, pp , H. Bhatia, R. Lening, S. Srivastava, and V. Sunitha, "Application of QNA to analyze the queueing network mobility model of MANET," Technical Report, Dhirubhai AmbaniI institute of Information & Communication Technology (DAIICT), Gandhinagar, India, D. D. Kouvatsos, "A maximum entropy analysis of the G/G/1 queue at equilibrium," The Journal of the Operational Research Society, vol. 39, no. 2, pp , D. D. Kouvatsos, "Entropy maximisation and queueing network models," Annals of Operations Research, vol. 48, no. 1, pp , M. Saleh and I. Al Khatib, "Performance of secure ad hoc sensor networks utilizing IEEE b WEP," in Proc. of Systems Communications, Montreal, Que., Canada, 2005, pp H. Szczerbicka, "A combined queueing network and stochastic Petri net approach for evaluating the performability of fault-tolerant computer systems," Performance Evaluation, vol. 14, pp , H. Szczerbicka and P. Ziegler, "Simulation with active objects: an approach to combined modelling," Simulation Practice and Theory, vol. 1, no. 6, pp , K. Wolter and P. Reinecke "Performance and security trade-off," in Formal Methods for Quantitative Aspects of Programming Languages, Computer science Lecture Notes, vol. 6154, A. Aldini, M. Bernardo, A. Di Pierro, and H. Wiklicky, Eds. Berlin, Heidelberg: Springer 2010, pp T03-23

24 Acronyms CDF Cumulative Distribution Function CPSM Combined Performance and Security Measure DES Discrete-Event Simulation FCFS First-Come-First-Served G-QNs Gated QNs G- Queue Gated-Queue G-GSPN_QN Gated-Generalised Stochastic Petri Nets_ QNs GE Generalised Exponential GSPNs Generalised Stochastic Petri Nets HoL Head-of-the-Line IPP Interrupted Poisson Process MANETs Mobile Ad Hoc Networks MTTF Mean Time To Security Failure PDF Probability Density Function PNs Petri Nets PLP Packet Loss Probability PFQN Product-Form Queueing Networks RANETs Robotic Ad Hoc Networks QNs Queueing Networks QoS Quality-of-Service SCV Squared Coefficient of Variation SPNs Stochastic Petri Nets SS Selective Security WEP Wired Equivalent Privacy T03-24

25 T03-25

26 Wolter s GSPN Model It provides Explicitly Detailed-Modelling of Security Processing & Control by GSPNs. Combined GSPN performance-security model for an abstract communication system to evaluate & simultaneously optimise the trade-off between performance & security using CPSMs. Send Transition Throughput Probability of the system being secure CSPM Throughput of the transition Send + Probability of system to be secure state. Generate Queueing Encrypt Processing Send 1.5 Secure Recover Fail 1 N Insecure Performance Model Finite Capacity Restoring Security Model Fig. A GSPN for RANETs [WOL10] Detect 0.5 CPSM=Throughput+P(Secure) Throughput P(Secure) Encryption Time (sec) Fig. B CPSM proposed by Wolter [WOL10] This model investigates how to choose an appropriate encryption key length in terms of its corresponding encryption time ( the longer the key size the longer the encryption time!). Remarks: Throughput is very large compared with probability values! which dominates the overall value of the CPSM). T03-26

27 Szczerbicka s Combined QN and GSPN Model Trade-off model between performance &Reliability for a data processing system transmits jobs to a remote facility via a transmission channel that is broken and corrected and thus number of jobs are re-transmitted. The higher channel s failure rates the lower the system s throughput: (i.e., too many jobs to reprocess by the limited capacity system! jobs entering CPU to be served again channel is correct Sending rate send CPU Channel breaking rate Rate of correction Rate of channel Perturbations pert Data processing system with 2 local I/O facilities QN Local I/O channel is broken The state of transmission channel (broken or corrected) jobs that complete service by CPU GSPN- overall model Fig. The Combined QN and GSPN proposed by zczerbicka s T03-27