Date post: | 17-Dec-2015 |
Category: |
Documents |
Upload: | milton-shaw |
View: | 214 times |
Download: | 0 times |
Transmission Time-based Mechanism to Detect Wormhole in
Ad-hoc Networks
Tran Van PhuongU-Security Group
RTMM Lab, Kyung Hee Uni, Korea2006.11.10
Copyright© 2006-2008 Company name . All rights reserved
Wormhole Attacks
Related Work
Motivation
Proposed Mechanism
Simulation Results
Evaluation & Conclusion
Content
Wormhole attack – two phase process: get as much data as possible, take advantage of these data.
2 malicious node which are able to tunnel packets to each other: out-of-band channel, encapsulation, …
One node overhear packets, tunnels to the other node which then replay into the network at that point.
More nodes want to send data via the wormhole link
Wormhole Attack (1)
The attack can also still be performed even if the network communication provides confidentiality and authenticity and even if the attacker has no cryptographic key.
Fig. Wormhole Attack
Wormhole Attack (2)
Hidden Attack:The attackers do not modify either the content or the header of packets. W1, W2 are invisible to other nodes.
S → A1 → B1 → DA1, B1: fake neighbors
Exposed Attack:The attackers do not modify the content of the packets but include themselves in the packet header following the route setup procedure.
S → A1 → W1 → W2 → B1 → DOther nodes know the existence of wormhole nodes but they do not know wormhole nodes are malicious
The main difference: neighborhoodHidden Attack creates many fake neighbors but Exposed Attack does not.
Related work (1)
Temporal packet leashes:The sender A puts a time stamp (sending time) into the header.The receiver B will estimate the distance between A & B based on the transmission time & speed of the packet.
D = (<receiving time> – <sending time>) * <transmission speed>If the distance is longer than maximum radio range -> reject communication.Require tightly synchronized clock
Geographical packet leashes:The sender A puts its location & the time of sending into the packet’s header.The receiver B will estimate the distance between A & B. Require every node to know its location
These two mechanisms are impractical with current technology
[1] Yih-Chun Hu, Adrian Perrig, David B. Johnson, Packet leashes: a defense against wormhole attacks in wireless networks, INFOCOM 2003.
Related work (2)Neighbor Authentication:
Round Trip Time: A node A send a special packet to node B, requiring immediate reply from node B. RTT between A & B is the delay time between A sending the packet & receiving reply.A node A will calculate every RTTs between A & its neighbors.RTT between A & its fake neighbors are much greater than RTT between A & its real neighbors.Can not detect exposed attack
2
1
w w
4
3
A
RTT1
RTT2
RTT4
RTT3
[2] Jane Zhen, Sampalli Srinivas, Preventing Replay Attacks for Secure Routing in Ad Hoc. Networks, ADHOC-NOW 2003, LNCS 2865, pp. 140-. 150, 2003
Fig 2. Round Trip Time Fig 3. Neighbor Authentication
Related work (3)
DelPHI: Delay Per Hop Indication:When a node A establishes a path to node B, A will search for all disjoint paths & calculates their lengths & RTTs.Per-Hop RTT = RTT / lengthUnder normal situation, Per-Hop RTTs should be similar between paths.Per-Hop RTT of wormhole paths will be higher.
[5] Hon Sun Chiu King-Shan Lui, Wormhole Detection Mechanism for Ad Hoc Wireless Networks, Wireless Pervasive Computing, 2006 1st International Symposium on, 2006
Motivation
Exposed Attacks
Hidden Attacks
Pinpoint Location
No special hardware required
Performance/Overhead
Packet Leashes (2003)
x x Low
Neighbor Authentication (2003)
x x x Medium High
Neighbor Number Test (2005)
x x Medium
SAM (2005) x x x Medium High
DelPHI (2006) x x x Medium
Ideal Mechanism x x x x High
To design a mechanism to detect both exposed & hidden attack, being able to pinpoint wormhole location, requiring no special hardware, having good performance.
Route Setup in AODV
When a route A wants to communicate with another node B and there’s no valid route in its routing table, A will broadcasts a Route Request.
An intermediate node which receives the RREQ for the first time will forward RREQ to all of its neighbors if there’s no valid route in its routing table.
When the destination get the RREQ, it will reply with a RREP in the reverse path.
RFC 3561 — Ad hoc On-Demand Distance Vector (AODV) Routing
Proposed Mechanism (1) We calculate all transmission times between two successive nodes along the path e
stablished between the source & the destination. Each intermediate node calculates the transmission time between it and the destina
tion, put the value into RREP & send back to the source node.
Time
S A B C D
Processing Time
Processing Time
TSREQ
TAREQ
TBREQ
TCREQTDREQ
TDREPTCREP
TBREP
TAREP
TSREP
RTTS,D
RTTA,D
RTTB,D
RTTC,D
RTTA,B
RTTB,C
RTTS,A
RTTC,D
Proposed Mechanism (2)
We define RTT of an intermediate node as the time between its sending the RREQ and receiving the RREP from the destination.
Each intermediate node will add its RTT into the RREP and forward to the next hop.
The source node will have all RTTs of intermediate nodes along the path from the source to the destination (RTTi – Round Trip Time of node i in the path).
Fig 8. A Path with a Wormhole link
Proposed Mechanism (3)
We set: Δi = RTTi – RTTi+1
Δi - the RTT between two successive nodes i & i+1 in the path
Under normal situation Δi are similar Under wormhole attack, Δi between fake neighbors are considerabl
y higher.
Threshold?
Fig 9. Delay Per Hop
RREP format
RREP format with extensions
Simulation Result
Size 1000m x 1000m
Number of nodes 50
Transmission range 250m
Node movement no
Background traffic light
Wormhole exposed
Simulation Parameters
False detection rate
Fig. Transmission Time between two wormhole nodes Fig. False positive rate & False negative rate
Detection rate
Fig 3. Detection rate & False positive rate
Evaluation (1)• N : number of nodes• L : length of the established route• E0 : number of bytes transmitted in each route request when there’s
no wormhole prevention mechanism• E1 : number of bytes transmitted in each route request when TTM is
deployed.
• In each route request in AODV, we have:E0 = 32N + 20L
• In our mechanism, the size of RREP will be: 20 + 4L (bytes). We have:E1 = 32N + L(20 + 4L)
In our simulation:• E0 = 1691.58878• E1 = 1775.47382
Overhead: 5.83%
Evaluation (2)
Memory used:
Intermediate nodes: 4.k (octets)
Source nodes: 4.k + 4.l (octets)
k – number of route request comes at the same time.l – route length
Conclusion
Proposed mechanism is able to detect both exposed & hidden attack, pinpoint wormhole location, require no special hardware, and have little overhead & good performance.
Exposed Attacks
Hidden Attacks
Pinpoint Location
No special hardware required
Performance/Overhead
Packet Leashes x x Low
Neighbor Authentication
x x x Medium High
DelPHI x x x Medium
Neighbor Number Test
x x Medium
SAM x x x Medium High
Proposed Mechanism x x x x High
References1. Yih-Chun Hu, Adrian Perrig, David B. Johnson, “Packet leashes: a defense against wormhole attacks
in wireless networks”, INFOCOM 2003.
2. Jane Zhen, Sampalli Srinivas, Preventing Replay Attacks for Secure Routing in Ad Hoc. Networks, ADHOC-NOW 2003, LNCS 2865, pp. 140-. 150, 2003.
3. Ning Song, Lijun Qian, Xiangfang Li, "Wormhole Attacks Detection in Wireless Ad Hoc Networks: A Statistical Analysis Approach," ipdps, p. 289a, 19th IEEE International Parallel and Distributed Processing Symposium (IPDPS'05) - Workshop 17, 2005.
4. L. Buttyán, L. Dóra, and I. Vajda, “Statistical Wormhole Detection in Sensor Networks, Second European Workshop on Security and Privacy in Ad Hoc and Sensor Networks (ESAS 2005), Visegrád, Hungary, July 13-14, 2005.
5. Hon Sun Chiu King-Shan Lui, Wormhole Detection Mechanism for Ad Hoc Wireless Networks, Wireless Pervasive Computing, 2006 1st International Symposium on, 2006
6. RFC 3561 — Ad hoc On-Demand Distance Vector (AODV) Routing
Questions & Comments