arxiv: v1 [cs.gt] 21 Jul 2017

Transcription

1 RSU II ommuniation Cyber attaks Otimal Seure Multi-Layer IoT Network Design Juntao Chen, Corinne Touati, and Quanyan Zhu arxiv: v1 [s.gt] 1 Jul 017 Abstrat With the remarkable growth of the Internet and ommuniation tehnologies over the ast few deades, Internet of Things (IoTs) is enabling the ubiquitous onnetivity of heterogeneous hysial devies with software, sensors, and atuators. IoT networks are naturally multi-layer with the loud and ellular networks oexisting with the underlaid devie-todevie (DD) ommuniations. The onnetivity of IoTs lays an imortant role in information dissemination for missionritial and ivilian aliations. However, IoT ommuniation networks are vulnerable to yber attaks inluding the denialof-servie (DoS) and jamming attaks, resulting in link removals in IoT network. Therefore, it is imortant to maintain the onnetivity of IoT networks and make them seure and resistant to maliious attaks. In this work, we resent a heterogeneous IoT network design roblem in whih a network designer an add links to rovide additional ommuniation aths between two nodes or seure links against failures by investing resoures. We haraterize the otimal strategy of the seure network design roblem by first roviding a lower bound on the number of links a seure network requires for a given budget of roteted links, and then develoing a method to onstrut networks that satisfy the heterogeneous network design seifiations. Case studies on the Internet of Battlefield Things (IoBT) are used to orroborate our results. I. INTRODUCTION Driven by the advanes in sensing, roessing, storage and loud tehnologies, Internet of Things (IoT) have witnessed a tremendous develoment with a variety of aliations, suh as virtual reality [1], intelligent suly hain [] and smart home [3]. In this Internet world, IoT devies are massively deloyed and onneted to ellular or loud networks. For examle, in smart grids, wireless sensors are adoted to ollet the data of buses and ower transmission lines. The olleted data an then be sent to a suervisory ontrol and data aquisition (SCADA) enter through ellular networks for grid monitoring and deision lanning uroses. Smart home is another examle of IoT aliation. Various devies and alianes in a smart home inluding air onditioner, lights, TV, tablets, refrigerator and smart meter are interonneted through the loud, imroving the quality of the living. IoT networks an be viewed as multi-layer networks with the existing infrastruture networks (e.g., loud and ellular networks) and the underlaid devie networks. The onnetions between different objets in the IoT network an be divided into two tyes. Seifially, the ommuniations between devies themselves are alled interlinks, while the J. Chen and Q. Zhu are with the Deartment of Eletrial and Comuter Engineering, Tandon Shool of Engineering, New York University, Brooklyn, NY 1101, USA. {j641,qz494}@nyu.edu C. Touati is with INRIA, F38330 Montbonnot Saint-Martin, Frane. orinne.touati@inria.fr Fig. 1: In IoBT networks, a team of UAVs and a grou of soldiers and ground vehiles exeute missions ooeratively. The agents in the battlefield share ritial information through devie-to-devie ommuniations. The and the ground network form a two-layer network whih faes yber threats, e.g., jamming attaks whih an ause link removals. devies ommuniate with the infrastruture through intralinks. The onnetivity of IoT networks lays an imortant role in information dissemination. On one hand, devies an ommuniate diretly with other devies in the underlaid network for loal information. On the other hand, devies an also ommuniate with the infrastruture networks to maintain a global situational awareness. In addition, for some IoT devies whih are sare of on-board omutational resoures suh as wearables and drones, they an outsoure heavy omutations to the data enters through loud networks, and hene extend the use of battery [4]. Vehiular networks is an illustrative examle for understanding the multi-tier feature of IoT networks. In an intelligent transortation network, vehile-to-vehile (VV) ommuniations enable two vehiles to ommuniate and exhange information, e.g., aidents, seed alerts, notifiations. In addition, vehiles an also ommuniate with roadside infrastrutures or units (RSU) that belong to one or several servie roviders for exhanging various tyes of data related to different aliations inluding GPS navigation, arking and highway tolls inquiry. In this ase, the vehiles form one network while the infrastruture nodes form another network. Due to the interonnetions between two networks, vehiles an share information through infrastruture nodes or by diret VV ommuniations. IoT ommuniation networks are vulnerable to yber attaks inluding the denial-of-servie (DoS) and jamming attaks. These adversarial behaviors disrut the ommuniations between different devies whih lead to link removals in IoT network. Therefore, to maintain the onnetivity of devies, IoT networks need to be made seure and resistant

2 to maliious attaks. For examle, VV ommuniation links of a ar an be jammed, and hene the ar loses the real-time traffi information of the road whih may further ause traffi delays and aidents eseially in the futuristi self-driving aliations. Hene, IoT networks should be onstruted in a tati way by antiiating the yber attaks. Internet of Battlefield Things (IoBT) is another examle of missionritial IoT systems [5]. As deited in Fig. 1, in IoBT networks, a team of unmanned ground vehiles (UAVs) serves as one layer of wireless relay nodes for a team of soldiers equied with wearable devies to ommuniate between themselves or exhange ritial information with the ommand-and-ontrol nodes. The and the soldier network naturally form a two-layer network in a battlefield whih an be susetible to jamming attaks. It is essential to design ommuniation networks that an allow the IoBT networks robust to natural failures and seure to yber attaks in order to kee a high-level situational awareness of agents in a battlefield. Due to heterogeneous and multi-tier features of the IoT networks, the required seurity levels an vary for different networks. For examle, in IoBT networks, the onnetivity of s requires a higher seurity level when they are more likely to be targeted by the adversary. Similarly, in vehiular networks, the ommuniation links between RSUs need a high-level rotetion when they antiiate more attaks than the vehiles do. Therefore, it is imerative to design seure IoT networks robust to link attaks and maintain the multi-layer network onnetivity with heterogeneous seurity requirements. To this end, we resent a heterogeneous IoT network design roblem in whih network links are vulnerable to maliious attaks or random failures. To enhane the seurity and the robustness of the network, an IoT network designer an add extra links to rovide additional ommuniation aths between two nodes or seure links against failures by investing resoures to rotet the links. The goal of the multi-tier network design is to make the network onnetivity resistant to link removal attaks by antiiating the worst attak behaviors. Different from revious works [7], [8] whih have foused on the seure design of single-layer networks, in our work, the network designer needs to take into aount the heterogeneous features of the IoT networks by imosing different seurity requirements on eah layer whih resents a new set of hallenges for network design. In this aer, we fous on a two-layer IoT network and aim to design eah network resistant to different number of link failures with minimum resoures. We haraterize the otimal strategy of the seure network design roblem by first develoing a lower bound on the number of links a seure network requires for a given budget of roteted links. Then, we rovide neessary and suffiient onditions under whih the bounds are ahieved and resent a method to onstrut an otimal network that satisfies the heterogeneous network design seifiations with minimum ost. Finally, we use IoBT as a ase study to illustrate the analytial results and obtain insights in designing seure battlefield networks. We onsider a ommon battlefield senario in whih the antiiates higher yber threats than the soldier network, and the number of UAVs is less than the number of soldiers. We observe that as the ost of forming a roteted ommuniation link beomes smaller, more seure onnetions are formed in the otimal IoBT. In addition, the designed network is resilient to the hange of agents in the battlefield. For examle, when a grou of soldiers joining in the battle, they only need to onnet to a set of neighboring omanions whih is onvenient to imlement. For the senario in whih soldiers leave the battlefield, the otimal network an be designed in a similar fashion, i.e., those who lose some degree of ommuniations should build u new onnetions with other neighbors to stay resistant to attaks. We also study in Setion IV the reonfiguration of the as nodes leave and join the network. Related works: A number of works have foused on the emerging ritial issue on IoT seurity [4], [5], [9], [10]. Our work addresses the seure design of IoT networks by onsidering the onnetivity measure through the lens of grah theory [7], [8]. Seifially, we model the IoT as a multi-layer network [11], [1] and design eah layer of network with heterogeneous seurity requirements. Organization of the aer: Setion II formulates the heterogeneous two-layer IoT network design roblem. Analytial results inluding the otimal network design strategies are resented in Setion III. Case studies of IoBT networks are rovided in Setion IV, and Setion V onludes the aer. II. HETEROGENEOUS TWO-LAYER NETWORK DESIGN PROBLEM Consider a two-layer IoT network with two sets of devies or nodes S 1 and S. Eah set of nodes is of a different tye. Let n 1 = S 1 and n = S be the number of nodes of tye 1 and resetively. We identify them to n = n 1 + n verties that are numbered from 1 to n. Thus, a node labeled i is of tye 1 if and only if i n 1. Eah set of nodes forms a subnetwork. Together with the interonnetion between the two set of nodes, the subnetworks form a two-layer network. In standard grah theory, an edge (or link) is an unordered air of verties: (i, j) 1, n. We reall that two verties (nodes) i 0 and i L are said onneted in a grah of nodes S 1 S and set of edges E if there exists a ath between them, i.e., a finite alternating sequene of nodes and distint links: i 0, i 0 i 1, i 1, i 1 i, i,..., i L 1 i L, i L, where i l S 1 S and i l 1 i l E for all 1 l L. We onsider in our framework that edges are vulnerable, either to maliious attaks or to random failures. To kee its network robust, a designer an thus invest (i) in redundany in the ath, i.e., using extra links so that two nodes an ommuniate through different aths, or (ii) in seuring its links against failures. We refer to these seial edges as roteted links, or (iii) in any ombination of (i) and (ii). More reisely, we onsider that for the designer the ost er link reated is and the ost er roteted link reated is

3 n 1(k 1+1)+n (k +1) n 1(k 1+1)+(k +1) (n 1+1)(k 1+1) Lower bound on number of non-roteted links A Sloe k+1 B Sloe (k+1)+(k k1) C Sloe k1+1 k n n 1 D Sloe k E n 1 + n n 1 + n 1 Fig. : Lower bound on the number of non roteted links as a funtion on the number of roteted links in the network. P. It is natural to have P. Let E NP E be the set of non-roteted links and E P E be the set of roteted links. In this work, we assume the rotetion is erfet, i.e., links will not fail under attaks if they are roteted. Therefore, an adversary does not have an inentive to attak roteted links. Hene it is suffiient to onsider attaks on a set of links E A E NP. Consider that the nodes have different ritiality levels (resetively k 1 and k for nodes of tye 1 and with k 1, k 0, E NP ). It means that the nodes should remain onneted or attainable through the failure of k 1 and k links resetively. More reisely, onsider a network of verties S 1 S and edges E P E NP. The designer needs to guarantee that: (a) if E A k 1, then all nodes remain attainable, that is: i, j S 1 S, there exists a ath in the grah ((S 1 S ), (E P E NP \E A )) between i and j. (b) if E A k, nodes of tye remain attainable, that is: i, j S, there exists a ath in the grah ((S 1 S ), (E P E NP \E A )) between i and j. We all suh networks (k 1, k )-resistant (with k 1 < k ). Then, given the system s arameters S 1, S, k 1, k, an otimal strategy for the designer is the hoie of a set of links E P E NP and roteted links E P : s D = (S 1 S, E P E NP ), s.t. E P 1, n, E NP 1, n, E P E NP =. suh that: (i) s D is (k 1, k )-resistant. (ii) s D is of minimal ost E P + E NP. Without loss of generality, we make the following assumtions: (A1) k 1 k. (A) n 1 1, n 1. III. OPTIMAL STRATEGIES In this setion, we rovide an analytial study of the designer s otimal strategy, that is to say to the otimal network design. To that end, we first develo, for given system s arameters S 1, S, k 1, k, P and, and for eah ossible number of roteted links a lower bound on the number of links that have any (k 1, k )-resistant network with roteted links (Setion III-A). Then, we study 3 imortant ases, namely when takes values 0, n 1 and n 1 +n 1, and give for eah of them suffiient onditions under whih the bounds are attained as well as a onstrution for an otimal network (Setion III-B). Based on this study, we an obtain the main theoretial result of this aer, whih is the otimal strategy for the designer, i.e. a (k 1, k )-resistant network with minimal ost (Setion III-C). We finally end this setion with an illustrative examle (Setion III-D). A. A Lower Bound on the Number of (Non-roteted) links Reall that the system arameters are S 1, S, k 1, k, P and (res. the set of nodes of ritiality level 1 and, the values of ritiality and the unitary ost of reating roteted and non-roteted links). We first address the question of a lower bound on the ost for the designer with an additional onstraint, whih is the number of roteted links of the network. Sine the ost is linear with the number of non-roteted links, it amounts to find a lower bound on the number of non roteted links that are required in any (k 1, k )-resistant network with roteted links. Proosition 1 (Lower bound on E NP ) Let s D be a (k 1, k )-resistant grah ontaining roteted links. Then, the number of non-roteted links of s D is at least of n 1(k 1 + 1) + (n )(k + 1) if n, (n )(k 1 + 1) if n 1 n 1 + n,

4 0 if = n 1 + n 1. This result is illustrated in Figure. Proof: Using the similar methodology of [8], we introdue the notion of ontration of network as follows. Let g = (S 1 S, E P E NP ) be a network. Given a link (i, j) E P, the network denoted by g (i, j) refers to the one obtained by ontrating the link (i, j); that is, by merging the two nodes i and j into a single node {i, j} (sometimes alled suernode), and making any node a adjaent to the (new) node {i, j} in g (i, j) if and only if a is adjaent to i or j in the network g. In other words, all links, other than those inident to neither i nor j, are links of g (i, j) if and only if they are links of g. Then ĝ, the ontration of network g is the (uniquely defined) network obtained from g by sequenes of link ontrations for all links in E P. We illustrate the ontration of a network g in Figure 3. This examle onsists of 5 nodes and roteted links (reresented in bold lines between nodes 1 and and between nodes 3 and 4). The link 1, is ontrated and thus both nodes 1 and in g are merged into a single node denoted by {1, } in ĝ. Similarly the link 3, 4 is ontrated. The resulting network thus onsists of node 5 and suernodes {1, } and {3, 4}. Sine g ontains a link between nodes 5 and 1 in g then nodes 5 and {1, } are onneted through a link in network ĝ. Similarly, sine nodes 1 and 3 are adjaent in g then suernodes {1, } and {3, 4} are adjaent in network ĝ (a) Network g = (N, E P E NP ) 5 {1, } {3, 4} (b) Network ĝ E P Fig. 3: Illustration of network ontration: the links (1, ) and (3, 4) are ontrated. Consider a network g having roteted links, and ĝ its ontration. Let ν 1 be the set of nodes of tye 1 of ĝ (and suernodes ontaining only nodes of tye 1), ν be the set of nodes of tye of ĝ (and suernodes ontaining only nodes of tye ), ν 0 be the set of suernodes of ĝ that ontains nodes of both tye 1 and. Note that if ν 1 + ν + ν 0 = 1, (that is, if there is a unique suernode ontaining all nodes of the network), then no non-roteted link is needed to ensure any level of (k 1, k )- resistany. Otherwise, for the network to be (k 1, k )-resistant, eah element of ν 1, ν and ν 0 must have a degree of (at least) k Further, if there exist more than 1 element not in ν 1, that is if ν 0 + ν, then eah of them should have a degree of (at least) k + 1. Thus, a lower bound on the number of non-roteted links in s D is ν 1 (k 1 +1) + (ν 0 +ν )(k +1) if ν +ν 0 > 1 A = 0 if ν 1 + ν + ν 0 = 1 (ν 1 + 1)(k 1 + 1) if ν 1 1 and ν +ν 0 = 1. Let us finally omment on the values of ν 0, ν 1 and ν. If no roteted link is used (that is = 0), then ν 1 = n 1, ν = n and ν 0 = 0 and ν 0 + ν 1 + ν = n 1 + n = n. Adding any rotetion allows to derease the total number of elements ν 1 + ν + ν 0 by 1. (Or to remain onstant if the link indue a loo in a roteted omonent of g). Thus ν 0 + ν 1 + ν n. Further, the number of elements of ν 1 is uer bounded by n 1 the number of nodes of tye 1. Similarly, ν n. Finally, sine n 1 1 then ν 1 + ν 0 1 and sine n 1 then ν + ν 0 1. Thus, for any, a lower bound on the number of nonroteted links in s D is given by min ν 1,ν,ν 0, A. (LP) ν 0+ν 1+ν n ν 1 n 1, ν n, ν 1+ν 0 1, ν +ν 0 1 To solve this otimization roblem, we onsider 3 ases. Case 1: First, assume that < n 1. From ν 0 +ν 1 +ν n, we get that ν 0 + ν > 1. Thus, (LP) redues to min ν 1,ν,ν 0, ν 0+ν 1+ν n ν 1 n 1,ν n ν 1+ν 0 1, ν +ν 0 1 ν 1 (k 1 + 1) + (ν 0 + ν )(k + 1). Sine k k 1 then the minimum is obtained when ν 0 +ν is minimized, that is when all rotetions involve nodes of tye. Thus, the lower bound is n1(k1+1)+(n )(k+1). This observation is illustrated by the blue line in Figure joining oints A and B. Case : Now, assume that n 1 n 1 + n. Then n n Therefore, for a given that is for a given minimal value of ν 0 + ν 1 + ν we an have either ν 0 + ν > 1 or ν 0 + ν = 1. Again, sine k k 1, the lower bound is (n )(k1+1). It is illustrated by the brown line in Figure joining oints C and D. Case 3: Finally, when = n 1, ν 0 + ν 1 + ν = 1, and thus no non-roteted link is needed, whih is reresented by oint E in Figure. B. Seial Values of We have studied in the revious subsetion for eah otential number of roteted links a lower bound on m() the minimum number of non roteted links for a network with sets S 1 and S to be (k 1, k )-resistant. The ost assoiated with suh network is P + m(). Sine the goal of the designer is to minimize its ost, we need to investigate the value of minimizing suh funtion. Looking at Figure, we note that the lot of a grah of equal ost (iso-ost) K is a line of equation K P. It is thus a line

5 of (negative) sloe P / that rosses the y-axis at oint K/. Reall also that the grah that shows m() as a funtion of is on the uer-right quadrant of its lower bound. Thus the otimal value of orresonds to the oint where an iso-ost line meets the grah m() for the minimal value K. From the shae of the lower bound drawn in Figure, the oints A, C and E are good andidates. We thus investigate in this subsetion the ondition under whih the lower bounds are reahed in these oints and what are some orresonding otimal grahs. Proosition For any value of, denote by s D a (k 1, k )- network with roteted links and the minimum number of non-roteted links. Eah s D n 1 ontains exatly 0 non-roteted link Eah s D n 1 ontains exatly (n1+1)(k+1) nonroteted links if and only if k n 1. If we have the following asumtions: (i) k 1 mod = 1, k (ii) n > k k 1 and that (iii) n 1+1 n 1, then eah s D n1 (k 1 + 1) + n (k + 1) 0 ontains exatly. Proof: We suessively show the 3 items of the roosition: (i) s D n 1 ontain exatly n 1 roteted links. It is thus ossible to onstrut a tree network among the nodes of S 1 S that onsists only of roteted nodes. Thus no non-roteted node is required and the lower bound an be reahed. (ii) Now, suose that = n 1. If k n 1, onstrut any tree roteted network on the nodes of S. Further, onstrut a (k 1 + 1)-Harary network (the definition of suh networks as well as a onstrutive method is given in [6]) on the nodes of S 1 {n 1 +1}, that is the nodes of the first tye and one node of the seond tye. Suh onstrution is ossible sine k 1 + n The total number of non roteted links is then exatly (n1+1)(k+1). Now if k 1 +1 > n 1 then suose that a network g ahieves the lower bound. Consider its assoiated ontrated network ĝ. Sine g ontains n 1 roteted links, then ĝ is suh that ν 0 + ν 1 + ν n From the shae of the lower bound funtion A, then neessarily ν 0 + ν = 1 and ν 1 = n 1. Thus all nodes of S needs to be onneted together by roteted links. Sine there are n suh nodes, then this requires at least n 1 roteted links, whih equals. Thus, there annot be any roteted link involving nodes of set S 1. In addition, eah of the n 1 nodes of S 1 needs to be onneted to at least k other nodes. Sine k > n 1, then (k 1 + 1) (n 1 1) reresents the number of nodes of S that needs to be onneted to any node of S 1. (Indeed, reall that in a omlete grah of m nodes, eah node has a degree of m 1). Thus the network admits at least n1(n1 1) + n 1 ((k 1 + 1) (n 1 1)) = n 1 (k 1 + 1) n1(n1 1). Thus the extra number of links (omared to the lower bound) required is: n 1 (k 1 + 1) n 1(n 1 1) = n 1 1 (k n) > 0 (iii) Finally, suose that = 0. Renumber the nodes aording to the following sequene: 1,,..., k 1 + 1, n, k ,..., k 1 + 1, n + 1, k 1 +,..., 3 k 1 + 1, n +,... Then, we build a (k 1 + 1)-Harary network. Note that sine k n +1 k n 1, then the last 1+1 indies of the sequene only ontain nodes of tye 1. Thus, by onstrution, note that there are no links between any two nodes of S. Then, onstrut a k k 1 -Harary network on the nodes of S. This is ossible sine n > k k 1. C. Otimal Strategy Based on the following roosition, we an assess the otimal strategy for the designer, deending on the arameters values in a wide range of situations. Let us briefly review and omment on the senarios they reresent: The number of nodes is relately large omared to the link failure risks (n k k 1 + 1, and n 1 k 1 + 1). Indeed, they reresent the fat that the nodes ould satisfy, alone, the neessary number of links to rotet the network without rotetions. Indeed, even a full grah with m nodes an rotet against (at most) m 1 link failures. The nodes of tye, i.e. the set of ritial nodes, requiring extra rotetion measures reresent a relatively k small subset of the network (n 1+1 n 1 ). Finally, the onstraints k 1 mod = 1 and n (k + 1) mod = 0 are resent only to simlify the roofs and the resentation of the resent aer. They do not, however, affet signifiantly the result. The different ases orresonding to k 1 mod = 0 or n (k + 1) mod = 1 an be studied in a similar fashion as in the revious study, the only differene being for ertain values of the arameters s D n may be an otimal strategy in a similar analysis as in [8]. Proosition 3 Suose that n 1 k 1 + 1, n k k 1 + 1, k n 1+1 n 1, k 1 mod = 1 and n (k + 1) mod = 0. Then: If P k k k1 n, then 1 SD 0 are otimal strategies. If k k1+1 n 1 P k +1+ k k1 n, then 1 SD n 1 are otimal strategies P k k1+1, then Sn 1 D are otimal strategies. n 1 Proof: From Proosition, under the roosition s assumtions, S0 D, Sn D 1 and Sn 1 D ahieve the lower bounds of Proosition. Consider Figure (. Note that the ) sloe of the line between A and C is 1 k k k1 n 1 and between C and E is ( 1 k k1+1 n 1 ).

6 From the roosition s assumtions and sine k k 1, the line between A and C has higher sloe than that between C and E. Thus, if the lines of iso-osts have a sloe higher than the sloe of the line (AC) then the minimum ost is obtained at A. Similarly, if the sloe is less than that of (CE) then the minimum ost is obtained at E. Otherwise, the minimum is obtained at C. Noting that the sloe of the lines of iso-osts is P / leads to the result. D. Examle We develo in this setion some otimal networks s D for all values of between 0 and n 1 + n 1 in the ase where: k 1 = 3, k = 5, n 1 = 7, n = 3. Figure 4 shows some onstrutions of networks. Nodes of tye 1 are reresented in white while nodes of tye are reresented with blak dots. Non-roteted links are drawn in normal lines while roteted links are reresented in thik lines. The subfigures 4((a)-(j)) reresent ossible onfigurations for growing from 0 to n 1 = 9 resetively. For eah subfigure, the ation gives the number of nonroteted links needed and omares it to the lower bound omuted in Proosition 1. Note that the bounds are reahed in the examle exet for the ases where the number of nodes is too low to onstrut roer Harary network, that is: When n 1 and n k k 1. (ase b, ν = k k 1 = ) When > n and 1 < n k 1 (ases g, h and i where ν 1 values 4, 3 and resetively). From Proosition 3, network deited in Figure 4a is otimal iff P 3.5, network deited in Figure 4 is otimal iff 16/7 P 3.5, network deited in Figure 4j is otimal iff P 16/7. Figure 4 also gives insight on the evolution of the grah in a otential dynami senario when evolves (due to the sytem onstraints or hange of osts). Indeed any time when a roteted network needs to be removed, the otimal strategy is to remove by order of referene: (i) (any) roteted link joining two nodes of tye 1, or if no suh link exists (ii) a link between a node of tye 1 and one of tye, and if no suh link exists (iii) one link between two nodes of tye. Then, the roteted link that has been removed is relaed by the roer number of non-roteted links. IV. CASE STUDIES In this setion, we use ase studies of IoBT to illustrate the otimal design rinials of seure networks with heterogeneous omonents. In a battlefield senario, the soldiers, unmanned ground vehiles (UGV) and unmanned aerial vehiles (UAV) exeute missions together. The realtime information sharing and ollaboration between different agents enabled by devie-to-devie (DD) ommuniations are ritial. To enhane the information transmission quality and situational awareness of eah agent in the battlefield, a seure and reliable ommuniation network resistant to maliious attaks is inevitable. The IoBT network designer determines the otimal strategy on reating links with/without rotetion between agents in the battlefield. The ground layer and aerial layer in IoBT generally fae different levels of yber threats, e.g., DoS and jamming attaks, whih aim to disrut the network ommuniations. In the following ase studies, we investigate the senario that the IoBT network designer antiiates more yber attaks on the than the soldier and UGV networks. To reate roteted DD ommuniation links, one method is to use moving target defense (MTD) [13]. Seifially, instead of using a single ommuniation hannel between agents whih is easy for attakers to omromise (unroteted link), the designer an reate multile hannels and use swithing strategies when one is down. Hene, the onnetion of two agents through multi-hannel tehnology an be seen as a roteted link. The ost ratio between forming a roteted link and a unroteted link is ritial in designing the otimal IoBT network. This ratio deends on the number of hannels used in reating a safe link though MTD. We will analyze various ases in the following studies. A. Otimal IoBT Network Design Consider an IoBT network onsisting of n 1 = 0 soldiers and n = 5 UAVs. The designer aims to design the ground network and the resistant to k 1 = 5 and k = 9 attaks, resetively. Hene the global IoBT network is (5, 9)-resistant. Based on Proosition 3, we have two ritial oints T 1 := (k k1+1 n 1 )/ = 3.15 and T := (k k k1 n 1 )/ = 5.5, at whih the toology of otimal IoBT network enounters a swithing. For examle, when a roteted link adots 3 hannels to revent from attaks, i.e., = 3, the otimal IoBT network is an s D 4 grah as shown in Fig. 5a. When a roteted link requires 5 hannels to be erfetly seure, i.e., = 5, then the otimal IoBT network is of s D 4 onfiguration whih is deited in Fig. 5b. In addition, if the yber attaks are diffiult to defend against (e.g., require 7 hannels to kee a link safe, i.e., = 7), the otimal IoBT network beomes an s D 0 grah as shown in Fig. 5. The above three tyes of otimal networks indiate that the smaller the ost of a roteted link is, the more seure onnetions are formed starting from the to ground network. B. Resiliene of the IoBT Network The numbers of UAVs, UGVs and soldiers an be dynamially hanging. To study the resiliene of the designed network, we first investigate the senario that a number of UGVs/soldiers join the battlefield whih an be seen as army bakus. As n 1 inreases, the threshold T 1 dereases slightly while T remains unhanged. Therefore, the otimal IoBT network kees with a similar toology exet that the newly joined UGVs/soldiers onnet to a set of their neighbors. To illustrate this senario, we resent the otimal network

7 (a) = 0 (oint A): = 3 links (b) = 1: 1 links (instead of 0) (bound NOT reahed) () = (oint C): reahed) 4 8 = 16 links (bound (d) = 3: 4 7 = 14 links (bound reahed) (e) = 4: 4 6 = 1 links (bound reahed) (f) = 5: 4 5 = 10 links (bound reahed) (g) = 6: 9 links (bound NOT reahed) (h) = 7: 3 4/ = 6 links (bound NOT reahed) (i) = 8: 4 links (bound NOT reahed) Fig. 4: Possible otimal networks for all values of. (j) = 9: 0 links (bound reahed) with n 1 = and = 5 in Fig. 6a, and all the other arameters stay the same as those in Setion IV-A. When n 1 dereases, the network remains almost unhanged exet those UGVs/soldiers losing ommuniation links build u new onnetions with neighbors. An illustrative examle with n 1 = 17 is deited in Fig. 6b. Another interesting senario is that when the number of UAVs n hanges due to baku aerial vehiles joining in and urrent vehiles leaving the battlefield for maintenane. When n inreases, then the threshold T 1 remains the same while T dereases. If the ost ratio lies in the same regime with reset to T 1 and T even though T dereases, then under T, the newly joined UAV will onnet with another UAV with a roteted link whih either reates an Sn 1 D or s D n 1 grah. Otherwise, if > T, the UAV first onnets to other UAVs and then onnets to a set of UGVs/soldiers both with unroteted links whih yields an s D 0 grah. When a number of UAVs leaving the battlefield, i.e., n, dereases, then T 1 stays the same and T will inrease under whih the ost ratio revious belonging to regime I ( T ) may hange to regime II ((T 1 T )). Note that regime swithing an also haen when n inreases. Therefore, the otimal IoBT network swithes from s D 0 to s D n 1 (for the inrease of n ase, the swithing is in a bakward diretion). For examle, when the network ontains n = 6 UAVs and = 5.4,

8 Two soldiers joining in Proteted link Unroteted link Proteted link Rewired links Zoom-in toology Benhmark (a) Two soldiers joining in (a) sd 4 IoBT networkbenhmark 1 Unroteted link Proteted link Unroteted link (b) Benhmark 3 (b) sd 4 IoBT network Benhmark (3,4,5,9,10,11) (15,16,17,18, 19,0) (6,7,8,1,13,14) (1,,5,6,7,8) The numbers refer to the UGVs/soldiers that UAV onnets to. (1,13,14,17,0) 9 Fig. 6: (a) and (b) show the otimal IoBT network reonfiguration 3 soldiers leavingresewhen two UGVs/soldiers join in and leave the battlefield, tively () sd 0 IoBT network 15 Benhmark 3 Fig. 5: (a) When N P = 3 < T1, the otimal IoBT network is an sd 4 grah with all roteted links. (b) When T1 < N P = 5 < T, D the otimal network is an s4 grah, where the is onneted with roteted links and the ground network with all unroteted links. () When NP = 7 > T3, the otimal IoBT D network adots an s0 onfiguration with all unroteted links. the ost of using roteted and unroteted links. We have shown a lower bound on the number of non-roteted links of the otimal network and develoed a method to onstrut networks that satisfy the heterogeneous network design seifiations. We have demonstrated the design methodology in the IoBT networks with a team of UAVs and a team of soldiers. It has been shown that the otimal network an reonfigure itself adatively as nodes enter or leave the system. In addition, the otimal IoBT network onfiguration may enounter a toologial swithing when the number of UAVs hanges to an extent. As art of the future work, we would investigate the method of network onstrution under different arameter regimes and extend the two-layer network roblem to a multi-layer one. R EFERENCES and the other arameters are the same as those in Setion IV-A, from Proosition 3, the otimal IoBT network is an sd 0 grah. However, Fig. 5b shows that the otimal network adots an sd 4 toology when n = 5. Therefore, by adding a UAV to the aerial layer, the otimal IoBT network swithes D from sd 4 to s0 in this senario. The interretation is that a smaller number of UAVs is easier for the aerial network to defend against attaks, and hene roteted links are used between UAVs instead of redundant unroteted links. V. C ONCLUSION In this work, we have studied a multi-layer seure network formation roblem for IoT networks in whih the network designer aims to form a two-layer ommuniation network with heterogeneous seurity requirements while minimizing [1] Ciso. [Online]. Available: htt:// internet-of-things/virtual-reality-demonstration.html. [] Z. Pang, et al. Value-entri design of the internet-of-things solution for food suly hain: value reation, sensor ortfolio and information fusion. Information Systems Frontiers 17. (015): [3] M. Wang, et al. An IoT-based aliane ontrol system for smart homes. in Proeedings of the Fourth International Conferene on Intelligent Control and Information Proessing (ICICIP). IEEE, 013. [4] Z. Xu, and Q. Zhu. Seure and resilient ontrol design for loud enabled networked ontrol systems. in Proeedings of the First ACM Worksho on Cyber-Physial Systems-Seurity and/or Privay. ACM, 015. [5] M. J. Farooq, and Q. Zhu, Seure and Reonfigurable Network Design for Critial Information Dissemination in the Internet of Battlefield Things (IoBT), in Proeedings of 15th International Symosium on Modeling and Otimization in Mobile, Ad Ho, and Wireless Networks (WiOt), Teleom ParisTeh, Paris, Frane, 017. [6] F. Harary. The maximum onnetivity of a grah. Proeedings of the National Aademy of Sienes of the United States of Ameria, 48(7):114, 196.

9 [7] M. Dziubiski, and S. Goyal. Network design and defene. Games and Eonomi Behavior 79 (013): [8] C. Bravard, L. Charroin, and C. Touati. Otimal design and defense of networks under link attaks. Journal of Mathematial Eonomis 68 (017): [9] L. Zhou, and H. C. Chao. Multimedia traffi seurity arhiteture for the internet of things. IEEE Network 5, no. 3 (011). [10] R. H. Weber. Internet of ThingsNew seurity and rivay hallenges. Comuter law & seurity review 6, no. 1 (010): [11] J. Chen, and Q. Zhu. Resilient and deentralized ontrol of multilevel ooerative mobile networks to maintain onnetivity under adversarial environment. in Proeedings of the 55th Conferene on Deision and Control (CDC), IEEE, 016. [1] J. Chen, and Q. Zhu. Interdeendent network formation games with an aliation to ritial infrastrutures. in Proeedings of the Amerian Control Conferene (ACC), IEEE, 016. [13] Q. Zhu, and T. Basar. Game-theoreti aroah to feedbak-driven multi-stage moving target defense. in Proeedings of International Conferene on Deision and Game Theory for Seurity, Sringer International Publishing, 013.