https://iotauth.github.io/assets/js/166f5591.41c3faed.js

1"use strict";(self.webpackChunkiotauth_github_io=self.webpackChunkiotauth_github_io||[]).push([[74],{5103(e,s,n){n.r(s),n.d(s,{assets:()=>d,contentTitle:()=>c,default:()=>h,frontMatter:()=>l,metadata:()=>t,toc:()=>a});const t=JSON.parse('{"id":"sst-testbed","title":"SST Testbed","description":"Overview","source":"@site/docs/sst-testbed.md","sourceDirName":".","slug":"/sst-testbed","permalink":"/docs/sst-testbed","draft":false,"unlisted":false,"tags":[],"version":"current","frontMatter":{"id":"sst-testbed","title":"SST Testbed","sidebar_label":"SST Testbed"},"sidebar":"docs","previous":{"title":"IPFS File Sharing","permalink":"/docs/ipfs-file-sharing"},"next":{"title":"SHIELD","permalink":"/docs/shield"}}');var i=n(4848),r=n(8453);const l={id:"sst-testbed",title:"SST Testbed",sidebar_label:"SST Testbed"},c="SST Testbed",d={},a=[{value:"Overview",id:"overview",level:2},{value:"Background",id:"background",level:2},{value:"Workflow",id:"workflow",level:2},{value:"Supported attacks",id:"supported-attacks",level:2},{value:"Experimental results",id:"experimental-results",level:2},{value:"Prerequisites",id:"prerequisites",level:2},{value:"Clone and build",id:"clone-and-build",level:2},{value:"Run examples",id:"run-examples",level:2},{value:"Start Auth",id:"start-auth",level:3},{value:"1. Basic messaging (no attacks)",id:"1-basic-messaging-no-attacks",level:3},{value:"2. Replay attack",id:"2-replay-attack",level:3},{value:"3. DoS attacks (single client)",id:"3-dos-attacks-single-client",level:3},{value:"4. DDoS attacks (multiple clients)",id:"4-ddos-attacks-multiple-clients",level:3},{value:"CSV format reference",id:"csv-format-reference",level:2}];function o(e){const s={a:"a",blockquote:"blockquote",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.header,{children:(0,i.jsx)(s.h1,{id:"sst-testbed",children:"SST Testbed"})}),"\n",(0,i.jsx)(s.h2,{id:"overview",children:"Overview"}),"\n",(0,i.jsx)(s.p,{children:"SST Testbed is an open-source, extensible platform for evaluating the security and resilience of embedded, resource-constrained networked systems. It supports replay attacks and denial-of-service (DoS) attacks \u2014 including distributed (DDoS) variants \u2014 through configurable CSV input files and lightweight shell scripts."}),"\n",(0,i.jsxs)(s.blockquote,{children:["\n",(0,i.jsxs)(s.p,{children:["SST Testbed won ",(0,i.jsx)(s.strong,{children:(0,i.jsx)(s.a,{href:"https://2025.esweek.org/awards-2025/",children:"1st place"})})," in the ",(0,i.jsx)(s.a,{href:"https://embedded-research-competition.github.io/",children:"Embedded System Software Competition (ESSC)"})," at ",(0,i.jsx)(s.a,{href:"https://2025.esweek.org/",children:"ESWEEK 2025"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Publication:"}),' C. Beltran Quinonez, D. Kim, and H. Kim, "SST Testbed: An Experimental Platform of Attacks and Defenses for Networked Embedded Systems," in ',(0,i.jsx)(s.em,{children:"Proc. 2026 IEEE International Conference on Industrial Technology (ICIT)"}),", 2026. DOI: ",(0,i.jsx)(s.a,{href:"https://doi.org/10.1109/ICIT64854.2026.11490150",children:"10.1109/ICIT64854.2026.11490150"})]}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Source:"})," ",(0,i.jsx)(s.a,{href:"https://github.com/iotauth/sst-c-api/tree/main/examples/SST_Testbed",children:(0,i.jsx)(s.code,{children:"examples/SST_Testbed/"})})," in ",(0,i.jsx)(s.a,{href:"https://github.com/iotauth/sst-c-api",children:"iotauth/sst-c-api"})]}

1),"\n",(0,i.jsx)(s.h2,{id:"background",children:"Background"}),"\n",(0,i.jsx)(s.p,{children:"The growing prevalence of IoT devices introduces significant security challenges: constant connectivity and limited resources make them vulnerable to network-level attacks. SST Testbed addresses the lack of open-source security testbeds designed for constrained environments by providing a practical, reproducible environment for attack simulation and defense evaluation."}),"\n",(0,i.jsx)(s.p,{children:"SST Testbed builds on the Secure Swarm Toolkit (SST) C API. Auth acts as the Key Distribution Center (KDC), providing authentication and authorization services. The testbed can run entirely on workstations or be deployed to resource-constrained hardware such as Raspberry Pi boards without modifying attack logic."}),"\n",(0,i.jsx)(s.h2,{id:"workflow",children:"Workflow"}),"\n",(0,i.jsx)(s.p,{children:"The testbed workflow has five stages:"}),"\n",(0,i.jsxs)(s.ol,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Setup"})," \u2014 Specify the number of clients and attack type in an input CSV file; run ",(0,i.jsx)(s.code,{children:"clients_dos_setup.sh"})," to initialize the environment."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Generate Testbed"})," \u2014 ",(0,i.jsx)(s.code,{children:"graph_generator.js"})," produces the network topology; ",(0,i.jsx)(s.code,{children:"config_generator.js"})," creates per-entity config files (credential paths, Auth IP/port, Auth ID, entity name)."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Execution"})," \u2014 ",(0,i.jsx)(s.code,{children:"run_clients.sh"})," launches the specified number of clients and the server, each loading its config file."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Attack Simulation"})," \u2014 Clients carry out the attack scenarios defined in the CSV."]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.strong,{children:"Deployment"})," \u2014 Artifacts can run in simulation (ns-3) or be deployed directly to embedded devices."]}),"\n"]}),"\n",(0,i.jsx)(s.h2,{id:"supported-attacks",children:"Supported attacks"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Attack"}),(0,i.jsx)(s.th,{children:"Target"}),(0,i.jsx)(s.th,{children:"Mechanism"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"Replay"})}),(0,i.jsx)(s.td,{children:"Server"}),(0,i.jsx)(s.td,{children:"Manipulates the per-message sequence number to replay previous messages."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"DoSK"})}),(0,i.jsx)(s.td,{children:"Auth"}),(0,i.jsx)(s.td,{children:"Floods Auth with excessive session key requests, exhausting key-provisioning capacity."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"DoSM"})}),(0,i.jsx)(s.td,{children:"Server"}),(0,i.jsx)(s.td,{children:"Floods the server with a large volume of encrypted messages once a session is established."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"DoSC"})}),(0,i.jsx)(s.td,{children:"Server + Auth"}),(0,i.jsx)(s.td,{children:"Repeatedly connects to the server, consuming connection-table resources and triggering Auth key requests each time."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.strong,{children:"SYN flood"})}),(0,i.jsx)(s.td,{children:"Server"}),(0,i.jsx)(s.td,{children:"Sends TCP SYN packets without completing the handshake, filling the target's half-open connection table."})]})]})]}),"\n",(0,i.jsx)(s.p,{children:"All attacks except SYN flood are driven by CSV input files so scenarios are fully configurable without recompilation."}),"\n",(0,i.jsx)(s.h2,{id:"experimental-results",children:"Experimental results"}),"\n",(0,i.jsx)(s.p,{children:"The testbed was evaluated across three hardware configurations (workstation + Raspberry Pi 4B boards):"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Attack"}),(0,i.jsx)(s.th,{children:"Max latency increase"}),(0,i.jsx)(s.th,{children:"Min throughput"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"DDoS Key (DoSK, 100 attackers)"}),(0,i.jsx)(s.td,{children:"85\xd7"}),(0,i.jsx)(s.td,{children:"1.1% of baseline"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"DDoS Message (DoSM, 100 attackers)"}),(0,i.jsx)(s.td,{children:"301\xd7"}),(0,i.jsx)(s.td,{children:"~0% of baseline"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"DDoS Connect (DoSC, 100 attackers)"}),(0,i.jsx)(s.td,{children:"9.6\xd7, 90% connection failure rate"}),(0,i.jsx)(s.td,{children:"1.2% of baseline"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"DDoS SYN flood"}),(0,i.jsx)(s.td,{children:"6.0\xd7"}),(0,i.jsx)(s.td,{children:"17.3% of baseline"})]})]})]}),"\n",(0,i.jsx)(s.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(s.p,{children:["Same as the ",(0,i.jsx)(s.a,{href:"c-guide#prerequisites",children:"C Guide"}),", plus:"]}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Java 11 or newer (for Auth)"}),"\n",(0,i.jsx)(s.li,{children:"Maven (for Auth)"}),"\n",(0,i.jsx)(s.li,{children:"Node.js and npm (for graph/config generation)"}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"Install on Ubuntu:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"sudo apt-get update && sudo apt-get install -y \\\n    openjdk-11-jdk maven nodejs npm \\\n    openssl cmake build-essential pkg-config libssl-dev\n"})}),"\n",(0,i.jsx)(s.p,{children:"Install on macOS:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"brew install openjdk@11 maven node openssl cmake pkg-config\n"})}),"\n",(0,i.jsx)(s.h2,{id:"clone-and-build",children:"Clone and build"}),"\n",(0,i.jsxs)(s.p,{children:["Clone iotauth with submodules (sst-c-api 

1is a submodule at ",(0,i.jsx)(s.code,{children:"entity/c/"}),"):"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"git clone https://github.com/iotauth/iotauth.git\ncd iotauth\ngit submodule update --init\n"})}),"\n",(0,i.jsx)(s.p,{children:"Build the SST Testbed binaries:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"cd entity/c/examples/SST_Testbed\nmkdir build && cd build\ncmake ../\nmake\n"})}),"\n",(0,i.jsx)(s.p,{children:"For debug output:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"cmake -DCMAKE_BUILD_TYPE=Debug ../\nmake\n"})}),"\n",(0,i.jsx)(s.h2,{id:"run-examples",children:"Run examples"}),"\n",(0,i.jsx)(s.h3,{id:"start-auth",children:"Start Auth"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"cd auth/auth-server\nmvn clean install\njava -jar target/auth-server-jar-with-dependencies.jar \\\n    -p ../properties/exampleAuth101.properties\n"})}),"\n",(0,i.jsx)(s.h3,{id:"1-basic-messaging-no-attacks",children:"1. Basic messaging (no attacks)"}),"\n",(0,i.jsxs)(s.p,{children:["Optionally edit ",(0,i.jsx)(s.code,{children:"csv_files/basic_messages.csv"}),":"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"<sleep_ms>,<message>\n1000,hello from client\n500,another message\n"})}),"\n",(0,i.jsx)(s.p,{children:"Run the server and client:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"# Terminal 1\n./entity_server ../../server_client_example/c_server.config\n\n# Terminal 2\n./entity_client ../../server_client_example/c_client.config \\\n    ../csv_files/basic_messages.csv\n"})}),"\n",(0,i.jsx)(s.h3,{id:"2-replay-attack",children:"2. Replay attack"}),"\n",(0,i.jsxs)(s.p,{children:["Edit ",(0,i.jsx)(s.code,{children:"csv_files/replay_attack.csv"})," (third column is ",(0,i.jsx)(s.code,{children:"Replay"}),", fourth is sequence-number modification):"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"<sleep_ms>,<message>,Replay,seq--\n<sleep_ms>,<message>,REPLAY,seq++\n<sleep_ms>,<message>,replay,seq=12\n"})}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"./entity_client ../../server_client_example/c_client.config \\\n    ../csv_files/replay_attack.csv\n"})}),"\n",(0,i.jsx)(s.h3,{id:"3-dos-attacks-single-client",children:"3. DoS attacks (single client)"}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"DoSK"})," \u2014 flood Auth with key requests (fourth column = number of requests):"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"<sleep_ms>,<message>,DoSK,10000\n"})}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"DoSM"})," \u2014 flood server with messages (fourth column = number of messages):"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"<sleep_ms>,<message>,DoSM,10000\n"})}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"DoSC"})," \u2014 flood server with connections (fourth column = number of reconnects):"]}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{children:"<sleep_ms>,<message>,DoSC,10000\n"})}),"\n",(0,i.jsx)(s.p,{children:"Run with the corresponding CSV file:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"./entity_client ../../server_client_example/c_client.config ../csv_files/dos_attack_key.csv\n./entity_client ../../server_client_example/c_client.config ../csv_files/dos_attack_message.csv\n./entity_client ../../server_client_example/c_client.config ../csv_files/dos_attack_connect.csv\n"})}),"\n",(0,i.jsx)(s.h3,{id:"4-ddos-attacks-multiple-clients",children:"4. DDoS attacks (multiple clients)"}),"\n",(0,i.jsx)(s.p,{children:"First stop the single-client Auth and regenerate Auth databases for multiple clients:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"cd entity/c/examples/SST_Testbed/clients_dos_attack\n./clients_dos_setup.sh <num-clients> -p <password>\n# e.g., ./clients_dos_setup.sh 10 -p mypassword\n"})}

1),"\n",(0,i.jsx)(s.p,{children:"Then launch all clients simultaneously:"}),"\n",(0,i.jsx)(s.pre,{children:(0,i.jsx)(s.code,{className:"language-bash",children:"./run_clients.sh <num-clients> <csv-file>\n# e.g., ./run_clients.sh 10 ../csv_files/dos_attack_connect.csv\n"})}),"\n",(0,i.jsx)(s.p,{children:"Each client launches in its own terminal window and executes the attack in the CSV file simultaneously."}),"\n",(0,i.jsx)(s.h2,{id:"csv-format-reference",children:"CSV format reference"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Column"}),(0,i.jsx)(s.th,{children:"All scenarios"}),(0,i.jsx)(s.th,{children:"Attack-only"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"1"}),(0,i.jsx)(s.td,{children:"Sleep time before action (ms)"}),(0,i.jsx)(s.td,{children:"\u2014"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"2"}),(0,i.jsx)(s.td,{children:"Message to send"}),(0,i.jsx)(s.td,{children:"\u2014"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"3"}),(0,i.jsx)(s.td,{children:"\u2014"}),(0,i.jsxs)(s.td,{children:["Attack type: ",(0,i.jsx)(s.code,{children:"Replay"}),", ",(0,i.jsx)(s.code,{children:"DoSK"}),", ",(0,i.jsx)(s.code,{children:"DoSM"}),", ",(0,i.jsx)(s.code,{children:"DoSC"})," (case-insensitive)"]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:"4"}),(0,i.jsx)(s.td,{children:"\u2014"}),(0,i.jsx)(s.td,{children:"Attack parameter (seq modifier or repetition count)"})]})]})]})]})}function h(e={}){const{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(o,{...e})}):o(e)}},8453(e,s,n){n.d(s,{R:()=>l,x:()=>c});var t=n(6540);const i={},r=t.createContext(i);function l(e){const s=t.useContext(r);return t.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]);