Chapter 6: Securing neighbor discovery

Transcription

1 Securit and Cooperation in Wireless Networks the wormhole attack; centralized and decentralized wormhole detection mechanisms; 007 Levente Buttán and Jean-Pierre Hubau Introduction man wireless networking mechanisms require that the nodes be aware of their neighborhood a simple neighbor discover protocol: ever node broadcasts a neighbor discover request each node that hear the request responds with a neighbor discover repl messages carr node identifiers neighboring nodes discover each other s ID an adversar ma tr to thwart the eecution of the protocol prevent two neighbors to discover each other b jamming create a neighbor relationship between far-awa nodes b spoofing neighbor discover messages (can be prevented b message authentication techniques) b installing a wormhole (cannot be prevented b crptographic techniques alone) /

2 What is a wormhole? a wormhole is an out-of-band connection, controlled b the adversar, between two phsical locations in the network the adversar installs radio transceivers at both ends of the wormhole it transfers packets (possibl selectivel) received from the network at one end of the wormhole to the other end via the out-of-band connection, and re-injects the packets there into the network notes: adversar s transceivers are not regular nodes (no node is compromised b the adversar) adversar doesn t need to understand what it tunnels (e.g., encrpted packets can also be tunneled through the wormhole) it is eas to mount a wormhole, but it ma devastating effects on routing 6. The wormhole attack / Effects of a wormhole at the data link laer: distorted network topolog (a) (b) (c) (d) (e) (f) at the network laer: routing protocols ma choose routes that contain wormhole links tpicall those routes appear to be shorter flooding based routing protocols (e.g., DSR, Ariadne) ma not be able to discover other routes but onl through the wormhole adversar can then monitor traffic or drop packets (DoS) 6. The wormhole attack /

3 Wormholes are not unique to ad hoc networks access control sstem: gate equipped with contactless smart card reader contactless smart card wormhole contactless smart card emulator fast connection smart card reader emulator user ma be far awa from the building 6. The wormhole attack 5/ Classification of wormhole detection methods centralized mechanisms data collected from the local neighborhood of ever node are sent to a central entit based on the received data, a model of the entire network is constructed the central entit tries to detect inconsistencies (potential indicators of wormholes) in this model can be used in sensor networks, where the base station can pla the role of the central entit decentralized mechanisms each node constructs a model of its own neighborhood using locall collected data each node tries to detect inconsistencies on its own advantage: no need for a central entit (fits well some applications) disadvantage: nodes need to be more comple 6/

4 Statistical wormhole detection in sensor networks each node reports its list of believed neighbors to the base station the base station reconstructs the connectivit graph (model) a wormhole alwas increases the number of edges in the connectivit graph this increase ma change the properties of the connectivit graph in a detectable wa (anomal) detection can be based on statistical hpothesis testing methods (e.g. the χ -test) 6.. Centralized approaches 7/ Eamples a wormhole that creates man new edges ma increase the number of neighbors of the affected nodes distribution of node degrees will be distorted 5 number of nodes node degree a wormhole is usuall a shortcut that decreases the length of the shortest paths in the network distribution of the length of the shortest paths will be distorted number of shortest paths path length 6.. Centralized approaches 8/

5 Multi-dimensional scaling the nodes not onl report their lists of neighbors, but the also estimate (inaccuratel) their distances to their neighbors connectivit information and estimated distances are input to a multidimensional scaling (MDS) algorithm the MDS algorithm tries to determine the possible position of each node in such a wa that the constraints induced b the connectivit and the distance estimation data are respected the algorithm has a certain level of freedom in stretching the nodes within the error bounds of the distance estimation let us suppose that an adversar installed a wormhole in the network if the estimated distances between the affected nodes are much larger than the nodes communication range, then the wormhole is detected hence, the adversar must also falsif the distance estimation distances between far-awa nodes become smaller this will result in a distortion in the virtual laout constructed b the MDS algorithm 6.. Centralized approaches 9/ Eamples in D: a b c d e f g wormhole a g b f c e d connectivit graph reconstructed virtual laout in D: wormhole 6.. Centralized approaches 0/

6 Packet leashes packet leashes ensure that packets are not accepted too far from their source geographical leashes each node is equipped with a GPS receiver when sending a packet, the node puts its GPS position into the header the receiving node verifies if the sender is reall within communication range temporal leashes nodes clocks are ver tightl snchronized when sending a packet, the node puts a timestamp in the header the receiving node estimates the distance of the sender based on the elapsed time and the speed of light d est < v light (t rcv t snd + t ) note: v light t must be much smaller than the communication range / TESLA with Instant Ke-disclosure (TIK) idea: authentication dela of TESLA can be removed in an environment where the nodes clocks are tightl snchronized MAC packet K time at sender t s τ mac τ pkt t s + τ mac + τ pkt time at receiver t r τ mac t r + τ mac t s - t + τ mac + τ pkt MAC packet K b the time the sender reveals the ke, the receiver has alread received the MAC securit condition: t r < t s t + t pkt note: t must be ver small or otherwise packets must be ver long /

7 Mutual Authentication with Distance-bounding (MAD) MAD allows precise distance estimation without snchronized clocks / Using position information of anchors anchors are special nodes that know their own positions (GPS) there are onl a few anchors randoml distributed among regular nodes two nodes consider each other neighbors onl if the hear each other and the hear more than T common anchors anchors put their location data in their messages transmission range of anchors (R) is larger than that of regular nodes (r) wormholes are detected based on the following two principles:. a node should not hear two anchors that are R apart from each other. a node should not receive the same message twice from the same anchor /

8 Principle A D ' R A R A O A O ' O hears anchors in A and in A O P is the probabilit that it hears two anchors that are further awa from each other than R the probabilit that there is at least one anchor in an area of size S is (- e -λ*s ), where λ* is the densit of anchors P (-e -λ*s )(-e -λ*s O), where S is the size of A and S O is the size of A O this lower bound is maimum when S = S O 5/ Principle A D R A O O A O when and O are closer than R, the discs A and A O overlap if there is an anchor in the intersection A O, then the messages of that anchor is heard twice b first directl and then from transceiver D who receives it from O through the wormhole the probabilit P of detection is equal to the probabilit that there is at least one anchor in A O P = -e -λ*s O 6/

9 Wormhole detection with directional antennas when two nodes are within each other s communication range, the must hear each other s transmission from opposite directions if nodes and communicate through a wormhole, then this condition is not alwas satisfied: but this doesn t alwas work: v 7/ Using verifiers the idea v if and were real neighbors and heard in zone, then ever node in s zone would be a neighbor of if the are not real neighbors, then there ma be a node v in s zone that is not a neighbor of (v and don t hear each other from opposite directions) such a v can be used b as a verifier 8/

10 Conditions for being a verifier v if node hears v in the same zone in which it hears, then ma hear both and v through the wormhole for a valid verifier v, must hear v and from different zones (i.e., Z v Z must hold) v if v hears in the same zone in which hears (i.e., Z v = Z ), then the ma both hear through the wormhole s transceiver if, in addition, happens to hear the other transceiver of the wormhole in zone Z, then can establish neighbor relationships with both and v for a valid verifier v, v must hear from a zone different from the one in which hears (i.e., Z v Z must hold too). 9/ Using verifiers the mechanism accepts as a neighbor if the hear each other from opposite zones there s at least one valid verifier v such that and v hear each other from opposite zones how does this detect wormholes? let us assume that hears through the wormhole one end of the wormhole is near to, the other end is in zone Z let us further assume that v is a valid verifier first condition (Z v Z ) is satisfied hears v directl (since hears v from a zone different from Z ) hears both and v through the wormhole second condition (Z v Z ) is satisfied and v cannot hear each other from opposite zones let s assume that Z v = Z v we know that hears both and v through the wormhole Z = Z v in addition, we know that Z = Z (otherwise would not consider as a potential neighbor) Z v = Z v = Z = Z Z v = Z (contradicts the second condition) no valid verifier v eists such that and v hear each other from opposite zones will not accept as a neighbor 0/

11 Summar a wormhole is an out-of-band connection, controlled b the adversar, between two phsical locations in the network a wormhole distorts the network topolog and ma have a profound effect on routing wormhole detection is a complicated problem centralized and decentralized approaches statistical wormhole detection wormhole detection b multi-dimensional scaling and visualization packet leashes distance bounding techniques anchor assisted wormhole detection using directional antennas man approaches are based on strong assumptions tight clock snchronization GPS equipped nodes directional antennas wormhole detection is still an active research area 6. Summar /