mitm-mitigation.cc File Reference

NS-3 simulation demonstrating Zero Trust principles using secure communication and policy enforcement. More...

#include "ns3/core-module.h"
#include "ns3/network-module.h"
#include "ns3/internet-module.h"
#include "ns3/point-to-point-module.h"
#include "ns3/applications-module.h"
#include "ns3/zt-certificate.h"
#include "ns3/zt-policy-engine.h"
#include "ns3/zt-encryption-utils.h"
#include "ns3/zt-logger.h"
#include "ns3/zt-tls-handshake.h"

Include dependency graph for mitm-mitigation.cc:

Go to the source code of this file.

Functions
void	ReceiveAtGateway (Ptr< Socket > socket)
	Receives an encrypted packet at the gateway and performs decryption and validation.
void	SendFromSensor (Ptr< Socket > socket, Address gatewayAddr, uint32_t nodeId)
	Simulates a sensor device sending an encrypted payload to the gateway after policy and handshake validation.
void	AttackerSpoof (Ptr< Socket > socket, Address gatewayAddr)
	Simulates an attacker sending a spoofed plaintext message to the gateway without encryption.
int	main (int argc, char *argv[])
	Main entry point for the simulation. Sets up network topology, installs security components, and executes events.

Variables
Ptr< ZtTlsHandshake >	handshake
	TLS handshake manager for establishing secure sessions.
Ptr< ZtPolicyEngine >	policyEngine
	Policy engine for authorization based on identity and roles.
CertificateAuthority	ca
	Certificate authority for signing identity certificates.
uint16_t	port = 9000
	UDP communication port used by gateway.

Detailed Description

NS-3 simulation demonstrating Zero Trust principles using secure communication and policy enforcement.

Definition in file mitm-mitigation.cc.

Function Documentation

AttackerSpoof()

void AttackerSpoof	(	Ptr< Socket >	socket,
		Address	gatewayAddr
	)

Simulates an attacker sending a spoofed plaintext message to the gateway without encryption.

Parameters

socket	The attacker's socket used to send the spoofed message.
gatewayAddr	The address of the gateway.

Definition at line 107 of file mitm-mitigation.cc.

{
  std::string fakeData = "temperature=99.9";
  socket->Connect(InetSocketAddress(InetSocketAddress::ConvertFrom(gatewayAddr).GetIpv4(), port));
  socket->Send(reinterpret_cast<const uint8_t *>(fakeData.c_str()), fakeData.size(), 0);
 
  ZtLogger::Log("ATTACKER", "Sent spoofed plaintext");
}

Here is the call graph for this function:

Here is the caller graph for this function:

main()

int main	(	int	argc,
		char *	argv[]
	)

Main entry point for the simulation. Sets up network topology, installs security components, and executes events.

Topology: Sensor <-> Gateway <-> Attacker
Demonstrates: Certificate signing, Zero Trust policy enforcement, secure TLS handshake, encrypted communication, and spoofing attempt.

Definition at line 122 of file mitm-mitigation.cc.

{
  NodeContainer nodes;
  nodes.Create(3);
  Names::Add("sensor", nodes.Get(0));
  Names::Add("gateway", nodes.Get(1));
  Names::Add("attacker", nodes.Get(2));
 
  InternetStackHelper stack;
  stack.Install(nodes);
 
  PointToPointHelper p2p;
  p2p.SetDeviceAttribute("DataRate", StringValue("5Mbps"));
  p2p.SetChannelAttribute("Delay", StringValue("2ms"));
  p2p.Install(nodes.Get(0), nodes.Get(1));
  p2p.Install(nodes.Get(2), nodes.Get(1));
 
  Ipv4AddressHelper ip;
  ip.SetBase("10.1.1.0", "255.255.255.0");
  Ipv4InterfaceContainer interfaces1 = ip.Assign(p2p.Install(nodes.Get(0), nodes.Get(1)));
 
  ip.SetBase("10.1.2.0", "255.255.255.0");
  Ipv4InterfaceContainer interfaces2 = ip.Assign(p2p.Install(nodes.Get(2), nodes.Get(1)));
 
  Ipv4GlobalRoutingHelper::PopulateRoutingTables();
 
  // Setup Zero Trust components
  policyEngine = CreateObject<ZtPolicyEngine>();
  policyEngine->AddAuthorized(0, "client");
  policyEngine->AddAuthorized(1, "server");
  policyEngine->SetCaPublicKey(ca.GetPublicKey());
 
  handshake = CreateObject<ZtTlsHandshake>();
  handshake->SetPolicyValidator([](uint32_t nodeId, std::string role) {
    return policyEngine->Authorize(nodeId, role);
  });
 
  ZtLogger::EnableTimestamps(true);
 
  // Gateway listener
  Ptr<Socket> recvSocket = Socket::CreateSocket(nodes.Get(1), TypeId::LookupByName("ns3::UdpSocketFactory"));
  recvSocket->Bind(InetSocketAddress(Ipv4Address::GetAny(), port));
  recvSocket->SetRecvCallback(MakeCallback(&ReceiveAtGateway));
 
  // Legitimate sensor send
  Ptr<Socket> sensorSock = Socket::CreateSocket(nodes.Get(0), TypeId::LookupByName("ns3::UdpSocketFactory"));
  Simulator::Schedule(Seconds(1.0), &SendFromSensor, sensorSock, InetSocketAddress(interfaces1.GetAddress(1), port), 0);
 
  // Attacker spoof
  Ptr<Socket> attackerSock = Socket::CreateSocket(nodes.Get(2), TypeId::LookupByName("ns3::UdpSocketFactory"));
  Simulator::Schedule(Seconds(1.5), &AttackerSpoof, attackerSock, InetSocketAddress(interfaces2.GetAddress(1), port));
 
  Simulator::Run();
  Simulator::Destroy();
  return 0;
}

Here is the call graph for this function:

ReceiveAtGateway()

void ReceiveAtGateway

(

Ptr< Socket >

socket

)

Receives an encrypted packet at the gateway and performs decryption and validation.

Parameters

socket

The receiving socket on the gateway node.

Definition at line 37 of file mitm-mitigation.cc.

{
  Ptr<Packet> packet = socket->Recv();
  uint32_t size = packet->GetSize();
  std::vector<uint8_t> buffer(size);
  packet->CopyData(buffer.data(), size);
  std::string encrypted(buffer.begin(), buffer.end());
 
  uint32_t selfId = 1;
  if (!handshake->HasSession(selfId)) {
    ZtLogger::Log("GATEWAY", "Rejected packet: no valid session with sender.");
    return;
  }
 
  std::string sessionKeyHex = handshake->GetSessionKey(selfId);
  std::string decrypted;
  try {
    decrypted = ns3::DecryptPayload(encrypted, ns3::HexDecodeKey(sessionKeyHex).BytePtr());
  } catch (...) {
    ZtLogger::Log("GATEWAY", "Decryption failed: corrupted or spoofed packet.");
    return;
  }
 
  if (decrypted.find("temperature") != std::string::npos) {
    ZtLogger::Log("GATEWAY", "Valid encrypted payload received from Sensor.");
    ZtLogger::Log("GATEWAY", "Valid encrypted payload received from Sensor: " + decrypted);
  } else {
    ZtLogger::Log("GATEWAY", "Rejected packet: payload failed validation.");
  }
}

Here is the call graph for this function:

Here is the caller graph for this function:

SendFromSensor()

void SendFromSensor	(	Ptr< Socket >	socket,
		Address	gatewayAddr,
		uint32_t	nodeId
	)

Simulates a sensor device sending an encrypted payload to the gateway after policy and handshake validation.

Parameters

socket	The socket used to send the encrypted message.
gatewayAddr	The address of the gateway node.
nodeId	The ID of the sensor node.

Definition at line 74 of file mitm-mitigation.cc.

{
  std::string cert = ca.SignIdentity(nodeId, "IoTDevice", std::time(nullptr) + 300);
  ZtLogger::LogCertIssued(nodeId, "IoTDevice", std::time(nullptr) + 300);
 
  if (!policyEngine->AuthorizeWithCert(nodeId, "IoTDevice", cert)) {
    ZtLogger::LogCertRejected("Sensor not authorized");
    return;
  }
 
  handshake->StartHandshake(socket->GetNode(), NodeList::GetNode(1), nodeId, 1);
 
  if (!handshake->HasSession(1)) {
    ZtLogger::Log("TLS", "Handshake failed with gateway");
    return;
  }
 
  std::string sessionKeyHex = handshake->GetSessionKey(1);
  std::string ivOut;
  std::string payload = "temperature=26.3";
  std::string encrypted = ns3::EncryptPayload(payload, ns3::HexDecodeKey(sessionKeyHex).BytePtr(), ivOut);
 
  ZtLogger::LogEncryption("[payload hidden]", ivOut);
 
  socket->Connect(InetSocketAddress(InetSocketAddress::ConvertFrom(gatewayAddr).GetIpv4(), port));
  socket->Send(reinterpret_cast<const uint8_t *>(encrypted.c_str()), encrypted.size(), 0);
}

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

ca

CertificateAuthority ca

Certificate authority for signing identity certificates.

Definition at line 28 of file mitm-mitigation.cc.

handshake

Ptr<ZtTlsHandshake> handshake

TLS handshake manager for establishing secure sessions.

Definition at line 22 of file mitm-mitigation.cc.

policyEngine

Ptr<ZtPolicyEngine> policyEngine

Policy engine for authorization based on identity and roles.

Definition at line 25 of file mitm-mitigation.cc.

port

uint16_t port = 9000

UDP communication port used by gateway.

Definition at line 31 of file mitm-mitigation.cc.