SUPnP: Secure Access and Service Registration for UPnP-Enabled Internet of Things

Golam Kayas; Mahmud Hossain; Jamie Payton; S. M.Riazul Islam

doi:10.1109/JIOT.2021.3058699

SUPnP: Secure Access and Service Registration for UPnP-Enabled Internet of Things

Golam Kayas^* (Corresponding Author)
, Mahmud Hossain
, Jamie Payton
, S. M.Riazul Islam

^*Corresponding author for this work

Computing Science

Research output: Contribution to journal › Article › peer-review

4 Citations (Scopus)

5 Downloads (Pure)

Abstract

The service-oriented nature of the Universal Plug-and-Play (UPnP) protocol supports the creation of flexible, open, and dynamic systems. As such, it is widely used in Internet-of-Things (IoT) deployments. However, the protocol's service access mechanism does not consider security from the first principles and is therefore vulnerable to various attacks. In this article, we present an in-depth analysis of the service advertisement, discovery, and access methods of the UPnP protocol stack and identify security issues in an IoT network. Our analysis shows that adversaries can perform resource exhaustion, buffer overflow, reflection, and amplification attacks by exploiting the vulnerabilities of the UPnP protocol. To address these issues, we propose a capability-based security model for UPnP to ensure secure discovery, advertisement, and access of the UPnP services that considers the resource limitations of IoT devices. Our analysis shows the effectiveness of the proposed model against potential attacks, and our experimental evaluation highlights the feasibility of implementing our Secure UPnP (SUPnP) protocol in a network of IoT devices, incurring minimal network and performance overhead.

Original language	English
Article number	9352973
Pages (from-to)	11561-11580
Number of pages	20
Journal	IEEE Internet of Things Journal
Volume	8
Issue number	14
Early online date	11 Feb 2021
DOIs	https://doi.org/10.1109/JIOT.2021.3058699
Publication status	Published - 15 Jul 2021

Bibliographical note

Funding Information:
This work was supported in part by the U.S. National Science Foundation under Grant CNS-1828363, and in part by the Sejong University Research Faculty Program under Grant 20212023.

Funding

Manuscript received December 24, 2020; accepted January 27, 2021. Date of publication February 11, 2021; date of current version July 7, 2021. This work was supported in part by the U.S. National Science Foundation under Grant CNS-1828363, and in part by the Sejong University Research Faculty Program under Grant 20212023. (Golam Kayas, Mahmud Hossain, Jamie Payton, and S. M. Riazul Islam contributed equally to this work.) (Corresponding author: Golam Kayas.) Golam Kayas and Jamie Payton are with the Department of Computer and Information Science, Temple University, Philadelphia, PA 19122 USA (e-mail: [email protected]; [email protected]).

Keywords

Access
discovery
Internet of Things (IoT)
network attacks
registration
security
Universal Plug and Play (UPnP)

Access to Document

10.1109/JIOT.2021.3058699Licence: Unspecified

Kayas_etal_IEEEIOTJ_SUPnP_Secure_Access_AAM
© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript, 5.7 MBLicence: Unspecified

Cite this

@article{30103ce0b9004186858fea11fb4315e0,

title = "SUPnP: Secure Access and Service Registration for UPnP-Enabled Internet of Things",

abstract = "The service-oriented nature of the Universal Plug-and-Play (UPnP) protocol supports the creation of flexible, open, and dynamic systems. As such, it is widely used in Internet-of-Things (IoT) deployments. However, the protocol's service access mechanism does not consider security from the first principles and is therefore vulnerable to various attacks. In this article, we present an in-depth analysis of the service advertisement, discovery, and access methods of the UPnP protocol stack and identify security issues in an IoT network. Our analysis shows that adversaries can perform resource exhaustion, buffer overflow, reflection, and amplification attacks by exploiting the vulnerabilities of the UPnP protocol. To address these issues, we propose a capability-based security model for UPnP to ensure secure discovery, advertisement, and access of the UPnP services that considers the resource limitations of IoT devices. Our analysis shows the effectiveness of the proposed model against potential attacks, and our experimental evaluation highlights the feasibility of implementing our Secure UPnP (SUPnP) protocol in a network of IoT devices, incurring minimal network and performance overhead.",

keywords = "Access, discovery, Internet of Things (IoT), network attacks, registration, security, Universal Plug and Play (UPnP)",

author = "Golam Kayas and Mahmud Hossain and Jamie Payton and Islam, \{S. M.Riazul\}",

note = "Funding Information: This work was supported in part by the U.S. National Science Foundation under Grant CNS-1828363, and in part by the Sejong University Research Faculty Program under Grant 20212023. ",

year = "2021",

month = jul,

day = "15",

doi = "10.1109/JIOT.2021.3058699",

language = "English",

volume = "8",

pages = "11561--11580",

journal = "IEEE Internet of Things Journal",

issn = "2327-4662",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

number = "14",

}

TY - JOUR

T1 - SUPnP

T2 - Secure Access and Service Registration for UPnP-Enabled Internet of Things

AU - Kayas, Golam

AU - Hossain, Mahmud

AU - Payton, Jamie

AU - Islam, S. M.Riazul

N1 - Funding Information: This work was supported in part by the U.S. National Science Foundation under Grant CNS-1828363, and in part by the Sejong University Research Faculty Program under Grant 20212023.

PY - 2021/7/15

Y1 - 2021/7/15

N2 - The service-oriented nature of the Universal Plug-and-Play (UPnP) protocol supports the creation of flexible, open, and dynamic systems. As such, it is widely used in Internet-of-Things (IoT) deployments. However, the protocol's service access mechanism does not consider security from the first principles and is therefore vulnerable to various attacks. In this article, we present an in-depth analysis of the service advertisement, discovery, and access methods of the UPnP protocol stack and identify security issues in an IoT network. Our analysis shows that adversaries can perform resource exhaustion, buffer overflow, reflection, and amplification attacks by exploiting the vulnerabilities of the UPnP protocol. To address these issues, we propose a capability-based security model for UPnP to ensure secure discovery, advertisement, and access of the UPnP services that considers the resource limitations of IoT devices. Our analysis shows the effectiveness of the proposed model against potential attacks, and our experimental evaluation highlights the feasibility of implementing our Secure UPnP (SUPnP) protocol in a network of IoT devices, incurring minimal network and performance overhead.

AB - The service-oriented nature of the Universal Plug-and-Play (UPnP) protocol supports the creation of flexible, open, and dynamic systems. As such, it is widely used in Internet-of-Things (IoT) deployments. However, the protocol's service access mechanism does not consider security from the first principles and is therefore vulnerable to various attacks. In this article, we present an in-depth analysis of the service advertisement, discovery, and access methods of the UPnP protocol stack and identify security issues in an IoT network. Our analysis shows that adversaries can perform resource exhaustion, buffer overflow, reflection, and amplification attacks by exploiting the vulnerabilities of the UPnP protocol. To address these issues, we propose a capability-based security model for UPnP to ensure secure discovery, advertisement, and access of the UPnP services that considers the resource limitations of IoT devices. Our analysis shows the effectiveness of the proposed model against potential attacks, and our experimental evaluation highlights the feasibility of implementing our Secure UPnP (SUPnP) protocol in a network of IoT devices, incurring minimal network and performance overhead.

KW - Access

KW - discovery

KW - Internet of Things (IoT)

KW - network attacks

KW - registration

KW - security

KW - Universal Plug and Play (UPnP)

UR - https://www.scopus.com/pages/publications/85100848453

UR - https://par.nsf.gov/biblio/10296662-supnp-secure-access-service-registration-upnp-enabled-internet-things

U2 - 10.1109/JIOT.2021.3058699

DO - 10.1109/JIOT.2021.3058699

M3 - Article

AN - SCOPUS:85100848453

SN - 2327-4662

VL - 8

SP - 11561

EP - 11580

JO - IEEE Internet of Things Journal

JF - IEEE Internet of Things Journal

IS - 14

M1 - 9352973

ER -

SUPnP: Secure Access and Service Registration for UPnP-Enabled Internet of Things

Abstract

Bibliographical note

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this