Computer network threat modelling

The paper discusses methods for constructing threat models of information systems and computer networks. The disadvantages of existing approaches are highlighted. The authors propose an approach to building a computer network model, as well as describing threats to information and the system. The proposed approach takes into account the identified shortcomings of existing solutions and is aimed at reducing the impact of the subjective opinion of an expert when compiling lists of threats.

Introduction
Continuous development of information technologies and, in particular, computer networks entails the emergence of new types of threats [1]. According to a study by Positive Technologies, in 2018, as part of an external penetration testing, the network perimeter of 92 percent of companies was breached [2]. Moreover, new technologies appear, such as the Internet of things, and the issues of ensuring their security cannot be ignored [3,4].
Ensuring network security plays a significant role for any organization, although the resources allocated to security can vary significantly. This affects not only the quality of technical equipment, but also the qualifications of specialists working in the organization. The professional level, as well as the subjective opinion of the expert when using existing approaches to describing threats, significantly affects the final result [5].
Thus, the task of developing an effective methodology for describing threats to information security is relevant. The main requirement for such a technique is to minimize the influence of a professional level and the subjective opinion of an expert assessing security.
Currently, the creation of such a technique is carried out at Tomsk University of Control Systems and Radioelectronics as part of the creation of a comprehensive approach to assessing the security of the information systems [6]. In the course of work, the following tasks were identified that needed to be solved: 1. It is necessary to analyze existing computer network models and approaches to building threat models used in compiling threat lists.
2. Develop a computer network model that allows to describe the structure of the system at a level of detail sufficient to compile a list of threats.
3. Develop a computer network threat model that takes into account the maximum possible number of threats.
4. Using the developed models, create a methodology that allows you to put these models into practice to determine lists of threats to real systems.

Literature Review
Existing approaches to identifying and classifying threats can in turn be classified in many ways. So, in [7] methods for constructing threat models are distinguished as based on a description of an attacker, a description of attacked resources, or a description of software. This classification includes the STRIDE threat model [8], privacy tools, attack trees, and attack libraries.
In [9], the authors consider the threat classification problem and various approaches to its solution. They divide the methods for classifying threats into two main groups: 1. Based on attack methods; 2. Based on the impacts of threats. We cannot ignore the fact that the concepts of "classification of threats" and "modeling of threats" in the context of different works can differ. By classification is meant a description of the characteristics of threats [9]. Threat modeling involves defining a list of security threats used to assess risks [10].
Threat classification methods are often used in the threat modeling process. If there is a classification, it is easier for a specialist to navigate the existing threats. This approach to threat modeling is considered high-level. However, using only the classification of threats, it is difficult to obtain a detailed list of threats that can be used to build a protection system. An example of such an approach is [11].
Approaches in which threats are described in detail are considered low-level. They can be based on the list of attacks [12,13] or the list of attack scenarios [14]. Some approaches come down to analysis of exploitation of vulnerabilities in the system [15]. The problem with low-level approaches is the frequent confusion of the concepts of threat, attack and vulnerability.
In [16], the authors proposed an approach that has the features of a high and low level approach. The work is aimed at describing the impact of the class of threats, and not the impact of the threat, since the threat changes over time. However, the presented version lacks formalization for its effective application in practice.
The lack of formalization is a problem in many works, which leads to the possibility of ambiguous interpretation of approaches. Existing works aimed at formalization consider attacks rather than threats [17]. For formalization, the mathematical apparatus of graph theory is usually used.
We should also mention the work related to threat modeling for IoT systems. Most approaches are based on considering possible attacks on the system. For example, Uzunov et al. rely in their studies on a two-level systematics of threats. The first level of taxonomy includes the following threats: Identity attacks, Network communication attacks, Network protocol attacks, Passing illegal data, Stored data attacks, Remote information inference, Loss of accountability, Uncontrolled operations. The second level of taxonomy includes Cryptography attacks, Countermeasure design, Configuration and administration. In [18], the authors put forward a basic systematics of threats to distributed systems and discuss patterns of specializations and concretizations, as well as build a separate taxonomy for peer-to-peer systems.
In [19], the analysis of threat models is aimed at creating a base of requirements for determining the conditions necessary for the successful implementation of attacks on the system and calculating the consequences. The authors of the article also determine the best practices for the design of secure sensor networks of SCADA systems.
Based on the analysis of work on modeling threats to information systems, a list of key shortcomings of existing approaches was compiled that need to be addressed: 1. Inconsistent description of threats within the same model. Within the framework of one threat model, at one level of abstraction, there can exist a generalized description of threats, as well as a description of particular cases that can be included in general.
2. Lack of separation of threats into those aimed at the system and aimed at information. None of them explicitly describe threats to the information system. All attention is paid to security threats of information processed in the information system.
3. Lack of repeatability. Significant influence of professional level and subjective opinion of an expert.
4. Each of the considered models can take into account certain threats that are not described in others.

Proposed approach
The approach to building a protection system based on protection against threats allows us to consider the structure of the protection system at the level of "Type of threat -Type of line of defense". Then the classification of methods and means of protection is reduced to the following types, presented in Figure 1: 1. Protection of information and its carriers from threats to confidentiality, integrity and availability; 2. Protection of information system elements, including software and hardware for information protection, and their settings from threats to confidentiality and integrity; 3. Protection responsible for monitoring the implementation of the rules for working with protected information and software and hardware protection.

Model of threats to information
On any of the elements of the elementary information flow, and therefore on the information, any of three types of unauthorized influence may be exerted: destruction, distortion, substitution. It should be noted that the information flow has two vertexes, and the impact can be exerted on any of them. With regard to confidentiality, by definition its violation does not imply a violation of integrity or accessibility, although it may lead to this. Confidentiality violation occurs when replacing any of the elements.
Thus, having analyzed all possible types of impact on the information flow, it is possible to build many classes of information threats, presented in table 1. Channel substitution 3.
Channel listening Classes of threats to the integrity and availability 1. Destruction of information at one of the vertexes Channel destruction 2. Distortion of information at one of the vertexes Channel distortion 3. Falsification of information Blocking information in channel

Model of threats to system
The approach proposed by the authors to construct a computer network model is described in detail in [20]. A computer network model based on attributive metagraphs allows you to describe computer network software components and all possible connections between them.
Only software elements of computer networks (software components of computer networks) and the relationships between them are considered. Software components in this case include application, system, and network software. Relationships are implied not only between elements located at the same level, but also indicating the nesting of one element in another. Application software operates within the operating systems that represent system software. In turn, operating systems operate within the framework of local area networks (or subnets) implemented through network software. Thus, three levels of software for computer networks are distinguished; for convenience, the levels are designated as software level, OS level, LAN level.
The proposed approach to the classification of threats and the developed threat model are based on elementary operations on metagraphs [20,21]. A computer network is considered as a structure of interacting elements (vertices of the graph) and the connections between them (edges of the graph). Threats are understood as an unauthorized change in the structure of a computer network (graph).
Threats to the integrity and confidentiality of computer network software are addressed. The basic operations on attributive metagraphs include: adding a vertex or edge; Removing a vertex or edge Changing the vertex or edge attribute.
Based on this, classes of threats to the integrity and confidentiality of a computer network are presented in Table 2.

Model of threats to protection system
Management of the information security system implies the regulation of the stages of the life cycle by compiling organizational documentation. In this case, by "organizational documentation" is meant not a document, but the rules fixed in it. Thus, typical threats are aimed at managing processes of information protection system components (firmware, regulatory documents and personnel) from the point of view of incorrect development or application of these rules. The approach to addressing threats to the management of protection systems is based on the Deming cycle, since this constant range of actions is aimed at improving processes. The Deming cycle presents an action algorithm consisting of the following stages: -design stage; -stage of implementation; -stage of control; -stage of adjustment. At each stage of the cycle, the corresponding threats to the control processes of the protection systems were considered and typical threats were identified (Table 3). Table 3. Typical threats arising at the stages of the life cycle of a protection system.

Conclusions
In the course of the analysis of existing approaches to the description of threats to information systems and, in particular, computer networks and the Internet of things, a list of shortcomings was drawn up that needed to be addressed. In this paper, in addition to the information and system threat models described in previous publications, a threat model for the protection system is added. The general approach to constructing a protection system based on the separation of protection mechanisms into information protection mechanisms, system protection mechanisms and protection control mechanisms is also briefly described. The approach proposed by the authors makes it possible to reduce the influence of the expert's professional level and his subjectivity in compiling lists of threats. Currently, this approach is used to describe threats to an automated system for commercial accounting of energy resources [22] and to describe threats to Internet of things systems [3]. The application of the proposed approach in both cases made it possible to identify threats that were previously missed by experts in the process of compiling threat models using other methods.


Wireless power transfer framework for minirobot based on resonant inductive coupling and impedance matching

Received Jun 27, 2019 Revised Nov 22, 2019 Accepted Dec 8, 2019 Minirobots which are under the field of miniature robotics, have a dimension of a few centimetres to even a few millimetres. Conventionally, these small sized robots are usually powered up by batteries. The batteries can take up a lot of space and result in a bulky system. Isolating the energy storage components from the robot itself can provide a good alternative to further down sized the robot. This can be done with the incorporation of wireless power transfer (WPT) technology. However, studies of small-size WPT are usually reported with poor efficiency. The objective of this paper is to present an efficient wireless power transfer framework for the minirobot by employing the resonant inductive coupling together with impedance matching technique. The theory and design process will be discussed. Then, a simple prototyping experiment was conducted to verify the proposed framework. Result showed 35% transfer efficiency had been achieved on a transmission distance of 0.5 cm. The proposed framework had also successfully powered a 4 watts minirobot prototype at about 16% transfer efficiency where its receiver coil was located 3.5 cm above the transmitter coil.

Minirobots which are under the field of miniature robotics, have a dimension of a few centimetres to even a few millimetres. Conventionally, these small sized robots are usually powered up by batteries. The batteries can take up a lot of space and result in a bulky system. Isolating the energy storage components from the robot itself can provide a good alternative to further down sized the robot. This can be done with the incorporation of wireless power transfer (WPT) technology. However, studies of small-size WPT are usually reported with poor efficiency. The objective of this paper is to present an efficient wireless power transfer framework for the minirobot by employing the resonant inductive coupling together with impedance matching technique. The theory and design process will be discussed. Then, a simple prototyping experiment was conducted to verify the proposed framework. Result showed 35% transfer efficiency had been achieved on a transmission distance of 0.5 cm. The proposed framework had also successfully powered a 4 watts minirobot prototype at about 16% transfer efficiency where its receiver coil was located 3.5 cm above the transmitter coil.

Impedance matching Minirobot Resonant inductive coupling Transfer efficiency Wireless power
This is an open access article under the CC BY-SA license.

INTRODUCTION
In the field of miniature robotics, a minirobot can have a dimension of only a few centimeters, millimeters or even nanometers. These mini sized robots are mainly being utilized to perform tasks in those environments which might be too narrow, too dangerous or too difficult for people to involve and get it done. Other than that, multiple miniature robots can be grouped into swarm robots to carry out microassembly. It is expected that these robots will play an important role in the future when the relevant technologies become mature to support them [1].
The miniaturization of the power source is one of the main bottlenecks for the development of these microscale mobile robots [2]. Existing technology such as battery, does not provide enough energy for these microrobots to operate for a reasonable amount of time [3]. Yet, a battery can easily take up most of its space and result in a bulky system without significantly improving its operation time [4][5][6]. Furthermore, chemical battery leakage can sometimes be dangerous. In addition, batteries are not eco-friendlier. Lately, scientists and engineers are working very hard to tackle this energy constraint problem. Instead of using battery as power source, they tried to replace it with a system that can harvest energy from the environment [7][8]. What if these robots can be powered up "wirelessly", "battery-less" and efficiently while staying to be safe and eco-friendlier? Wireless power transfer (WPT) makes this possible by supplying power without the need for current-carrying wires or batteries [9][10]. Thus, a microrobot will be able to operate safely for a longer period of time as long as it gets access to the power transmitter. Besides, this technique is very useful in developing waterproof devices, whereby the whole body of the device can be completely sealed up without having the consideration of replacing a dead battery. The wireless power transfer technology can be very beneficial not only to the research and development but also the design within the field of miniature robotics.
Wireless power was initially being invented by Nikola Tesla after 1890 [11]. He conducted a series of public demonstrations based on his wireless power transmission discoveries by applying his knowledge of near-field capacitive and inductive couplings [12]. Unfortunately, Tesla ended up not being able to make his finding a successful commercial product, but his discovery on wireless power had attracted considerable attention around the world. This technology was being brought to the research and development phases in searching for possible safe and efficient applications [13]. Nowadays, wireless power technology simultaneously emanates promising benefits to society, the economy, the environment, not to mention science and technology.
Wireless power transfer (WPT) can be categorized into two which are radiative (long-range transmission) using microwaves and light waves techniques and non-radiative (short range transmission) like magnetic inductive coupling, resonant inductive coupling and capacitive coupling technique [14,15]. While there are many forms of WPT technologies available, this study will only focus on resonant inductive coupling (associated with impedance matching) due to its better efficiency and longer transmission distance compared to other current non-radiative WPT techniques available as well as safety consideration compared to the radiative WPT techniques.  [16] Magnetic inductive coupling delivers energy based on the principle of magnetic field induction between two coils, which are the transmitter coil (L1) and the receiver coil (L2) [17]. Resonant inductive coupling is the combination of resonator and magnetic inductive coupling as shown by Figure 1. There are two additional resonant circuits, both are tuned at a particular resonant frequency so that energy can be exchanged with greater efficiency at a longer operating distance [18][19]. As a result, it is less susceptible to the variation on coil coupling between L1 and L2 as what happened in magnetic inductive coupling system. Consequently, the operation of the resonant inductive coupling is more robust in dealing with the issues of changes in orientation, alignment and distance between L1 and L2 in practice [20].
Even though this technique reported higher efficiency, the resonant circuits are generally bulkier, thus prevent its direct implementation on smaller size system. Reduction of the resonant circuits size will degrade its quality factor, hence lead to a lower reported power transfer efficiency [21]. To tackle the abovementioned problem on a miniature WPT system, impedance matching technique can be incorporated to further enhance the overall transmissible power. This is because impedance matching does allow maximum power transfer for a system with finite source and load impedances. This is analogous to a further tuning of the WPT system to extract as much power as possible from the source [22][23].
This paper presents a WPT framework in powering a minirobot within a vicinity distance of 10 cm. As compared to the conventional inductive coupling WPT system, the resonant inductive coupling associated with impedance matching technique is going to be employed to improve the overall power transfer efficiency. The organization of this paper is as follows. First, the overview of the proposed framework and the system block diagram will be described. Then, the concept of how to implement impedance matching into the proposed WPT framework to enhance the overall power transfer efficiency will be presented. After that, the experimental setup will be discussed. Finally, the obtained results will be verified and discussed.  Figure 2 (a) shows the proposed WPT framework which is used to power a minirobot on top of it. A transmitter circuit will be fit into a casing and then a minirobot will be able to operate when being placed on top of the casing. The WPT system can be further broken down into a few parts as illustrated in Figure 2 (b). AC power at a particular resonant frequency was used to excite the transmitter coil. Impedance matching circuits were incorporated in the transmitter and receiver circuitries. The resonating magnetic field will provide effective power exchange between the transmitter and receiver. The received power would be converted from AC to DC. It was then regulated to power up the load, which is the minirobot in this case. Figure 3 is the schematic representation of transmitter circuitry (on the left) and receiver circuitry (on the right). The labels are justified as follow:  L1 is the inductance of the transmitter coil while L2 is the inductance of the receiver coil.  RS denoted for the finite source impedance while RL is the finite load impedance.  C1 and C2 are the compensating capacitors, which are used to tune the coils L1 and L2 to operate at the same resonant frequency.  r1 and r2 are the internal power loss of the transmitter and receiver circuit, respectively.

Concept and theory
whereby 2 . The mutual inductance exists during the coupling between transmitter and receiver coil, defined as where k12 is the coupling coefficient between the transmitter coil, L1 and receiver coil, L2. The mutual reactance can then be expressed as . Next, applying Kirchhoff's Voltage Law: The transfer efficiency, S21 between the transmitter and receiver circuit is expressed as power received at receiver load over maximum transmissible power [16]: Quality factor of transmitter and receiver coil are defined as: , During resonance, | | | | thus, 1 The transfer efficiency, S21 in (5) can be determined by solving (3) and (4), and simplification by substituting (6) and (7) to result (8).
The (8) shows that the transfer efficiency is depending on the coil coupling (k12) quality factor ( , ), coil resistive loss (r1, r2) and finite source and load impedance (RS, RL). Unlike a transformer which employs magnetic core to improve the coil coupling, WPT is unable to do so because the L1 and L2 coils are loosely coupled and the magnetizing flux reduces exponentially with the increment of coil separation [24]. There is also no tuning can be done on the quality factor and coil resistive loss because they are fairly constant for a given WPT system. Hence, the adjustment of the source and load impedance provides the room to optimize a particular WPT system. Alike the concept of maximum power transfer, a proper selection of the source impedance, RS and load impedance, RL can maximize the power being transferred to the load, thus lead to an improvement in overall transfer efficiency [25,26].
To determine the optimal RS and RL values, taking the derivative of 0 and 0 then solving for the RS and RL, respectively.
A typical impedance matching network such as L-match, pi-match, or T-match can be employed here for either impedance up or impedance down transformation to transform the existing impedance values into the optimal value as shown by (9) and (10).

Coil construction
All the coils were constructed using enameled copper wire with a thickness of 1.2 mm. The transmitter coil was in flat spiral shape with an outer diameter of 38.5 cm and inner diameter of 1.8 cm. The coil had 18 turns and the gap between each turn is 1 cm. The measured inductance was 69.97 µH with a quality factor, = 94. The receiver coil was in cylindrical shape with a diameter of 60 mm. It was a 5 turns coil with a height of 6 mm. Its measured inductance was 2.76 µH and quality factor, = 139.

Frequency tuning
Both the transmitter coil and receiver coil were compensated with class 1 ceramic capacitor in series to form a resonant LC circuit at a resonant frequency of about 3 MHz. The capacitances of the compensating capacitor was determined by equation Since the exact calculated capacitance value was hard to be formed, the nearest capacitance value was chosen instead. Capacitors of 41 pF and 0.92 nF were connected to the transmitter coil and receiver coil respectively. The resonance frequency was once again verified by measuring the reactance value of the LC circuits at different frequencies. The reactance value was at the lowest during resonance.

Applying impedance matching
As discussed in the previous section, proper selection of RS and RL values can improve the overall power transfer efficiency of the designed WPT system. Since the VNA ports are having a fixed characteristic impedance of 50 Ω, impedance matching technique was used to transform this characteristic impedance to the optimal source impedance, and optimal load impedance, . It was done firstly by measuring the mutual inductance between the transmitter and receiver coils. Then, the coupling coefficient, k12 between the coils was determined according to the mutual inductance equation mentioned previously. After that, optimal source impedance, and optimal load impedance, were computed using (9) and (10). A pair of L match networks were employed here to transform the 50 Ω characteristic impedances to the desired optimal source and load impedances as shown in Figure 4 (a). L match network 1 was used to transform the 50 Ω source impedance from VNA port 1 to the desired while L match network 2 was used to transform the 50 Ω load impedance from VNA port 2 to the desired . Nearest inductance and capacitance values were chosen to form these L match networks. The experiment setup discussed in this section was displayed in Figure 4 (b). It was being assumed that the power loss across this L-match network was negligible.

Minirobot prototype
The minirobot prototype consisted of one Arduino Nano microcontroller and two 3 V miniature low power DC brush motors. The movement of the minirobot was controlled by individual PWM signals supplied to each of the motor. The received AC power from the receiver circuit was first converted into DC by the bridge rectifier. Then, utilizing the built-in voltage regulator in Arduino Uno, the supply voltage was regulated and used to power up the minirobot prototype. The schematic of the minirobot prototype is displayed in Figure 5. The dimension of the minirobot prototype was 5 cm in length (L), 7.5 cm in width (W) and 5.5 cm in height (H). Different views of the minirobot prototype were shown in Figure 6. The receiver coil was located 3.5 cm above the ground.

. Power requirement of minirobot
First, the power requirement of the minirobot was determined under different working conditions. There were five scenarios simulated to resemble the possible working condition of the minirobot prototype as being stated in following:  Idle condition: none of the motor was activated  Normal turning: only one motor was activated at 50% duty cycle.  Rapid turning: only one motor was activated at 100% duty cycle.  Normal Forward: Both motors was activated at 50% duty cycle.  Rapid forward: Both motors were activated at 100% duty cycle. The consumed power for each respective scenario was measured and tabulated in Table 1. The maximum power required by the minirobot is 4 W.

Resonant frequency of the coils
The resonant frequency of the constructed coil after compensated with class 1 ceramic capacitors was determined by the coil reactance measurement under frequency sweeping as depicted by Figure 7. During the resonance, both transmitter and receiver coils exhibited lowest reactance value. However, the resonant frequency of the transmitter coil was at about 3.2 MHz while the receiver coil was at 3.0 MHz. This imperfect frequency tuning was primarily attributed to non-ideal components used. Hence, the operating frequency of this WPT system could only lie between 3.0 -3.2 MHz and some performance degradation was expected in this design. Figure 7. Graph of reactance magnitude against frequency of transmitter coil L1 and receiver coil L2

WPT transfer efficiency
The transfer efficiency of the WPT system was indicated by the S21 parameters measured using VNA. Figure 8 (a) shows the transfer efficiency of the proposed design under varying operating frequency at a fixed distance of 0.5 cm. The maximum transfer efficiency obtained at this distance was 35% which occurred at the resonant frequency of 3.09 MHz. This frequency is the middle resonant frequency of the transmitter coil and the receiver coil. The transfer efficiency at varying distance up to 10 cm was measured and plotted in Figure 8 (b). The experiment was repeated up to three times to obtain the average and standard deviation. The transfer efficiency dropped accordingly with the distance increment. For example, when the receiver coil is 2.5 cm above the ground, the transfer efficiency is around 20%.
There were larger variations in transfer efficiency measurement when the receiver coil was placed closer to the transmitter coil, which was less than 2 cm. This was because the coil coupling was very sensitive to the coil alignment. Slight tilting in the receiver coil will result in some variation in the coupling coefficient. Besides that, the mutual inductance effect was significant at short distance which could effectively alter the inductance of the transmitter coil and receiver coil. This would result in a displaced resonant frequency and varied the transfer efficiency.

Power transferred to the minirobot
The designed WPT system was used to power the minirobot. The measured average power received by the minirobot was 4.06 ± 0.02 W. The average sending power was 25.13 ± 1.94 W. The transfer efficiency was around 16% at a transmission distance of 3.5 cm.
Since this study mainly aims to propose a WPT framework for powering a miniaturized system. So, the power loss across the other components, such as rectifier and regulator were all being neglected. The measured transfer efficiency was only dedicated to the WPT system, not the end-to-end efficiency.

CONCLUSION
This paper presented an efficient wireless power transfer (WPT) framework for the miniature robots. The novelty of this article lies with the incorporation of the impedance matching circuitry to improve the overall power transmission efficiency of the resonant inductive coupling WPT system for a minirobot. The proposed framework can be served as an alternative powering solution for a minirobot besides batteries or electrical wires due to its reliable transfer efficiency. The involving concepts and theories had been discussed thoroughly. Thereafter, the proposed framework was again verified by experiments. The maximum achievable transfer efficiency of this system was about 35% from the conducted experiment. The transfer efficiency was decreasing gradually with the increment of transmission range. The system also demonstrated a transfer efficiency of about 16% when transferring to a minirobot which has a receiver coil situated 3.5 cm above the transmitter coil.