Ad-HOc presentation
- 1. Routing Security in Ad Hoc Wireless Networks Presented by J.Jaffer Basha M.Elanthendral II Year – CSE Sree Sowdambika College of Engineering Aruppukottai
- 2. Wireless Networks Wireless networks provide rapid, access to information and computing, limiting the barriers of distance, time, and location for many applications ranging from collaborative, distributed mobile computing to disaster recovery
- 3. Ad Hoc Wireless Networks Collection of wireless mobile hosts forming a temporary network Every device has the role of router and actively participates in data forwarding. Communication between two nodes can be performed directly if the destination is within the sender’s transmission range, or through intermediate nodes acting as routers if the destination is outside sender’s transmission range.
- 4. Characteristics of Ad Hoc Wireless Networks Characteristics which differentiate Ad Hoc wireless networks from other networks are: Dynamic Network Topology Distributed Operations Limited Energy Resources
- 5. Routing Routing is an important operation for data exchange between wireless devices. Main routing responsibilities are exchanging the routing information, finding a feasible path between source and destination.
- 6. Routing Protocol The major requirements of a routing protocol are Minimum route acquisition delay Quick route reconfiguration in case of path breaks Loop-Free routing Distributed routing protocol Low control overhead Scalability with network size QoS support as demanded by the application Support of time sensitive traffic Security and Privacy.
- 7. Routing Protocols in Ad Hoc Wireless Networks The design of routing protocols should take these factors into consideration. Based on the routing information update mechanism, routing protocols in ad hoc wireless networks can be classified as Proactive (or table-driven) protocols Reactive (or on-demand) protocols Hybrid routing protocols.
- 8. Proactive Routing Protocols Nodes exchange routing information periodically to maintain accurate routing information. The path can be computed rapidly based on the updated information available in the routing table. The algorithm used is DSDV.
- 9. DSDV Finds shortest paths between nodes using Bellman-Ford algorithm. Each node maintains a routing table For each entry, the following fields are maintained: the destination address next hop on the shortest path to that destination a destination sequence number
- 10. DSDV Sequence numbers are used for preventing loop formation. Each entry in the routing table has a sequence number. If a node receives an update with a smaller sequence number, then that update is ignored. Path is adopted if it has a greater sequence number, or if it has the same sequence number but a lower metric.
- 11. DSDV Destination Next Metric Seq. Nr Install Time A A 0 A-550 001000 B B 1 B-102 001200 C B 3 C-588 001200 D B 4 D-312 001200 When a broken link is detected, the node creates a routing update with next odd sequence number and metric value of infinity.
- 12. Reactive Routing Protocol A route discovery mechanism is initiated only when a node does not know a path to a destination it wants to communicate with. Perform better with significantly lower overheads than proactive routing protocols Has two main operations Route discovery Route maintenance Various reactive protocols have been proposed Ad Hoc On-demand Distance Vector (AODV) Dynamic Source Routing (DSR)
- 13. DSR Is a source routing protocol, each data packet carries the source-destination path in its header. Using this information, intermediate nodes can determine who is the next hop this packet should be forwarded to. Every entry has an expiration time after which the entry is deleted in order to avoid stale information.
- 14. Each Route Request contains sequence number generated by source node, to prevent loop formation. An intermediate node checks the sequence number, and forwards the Route Request only if this message is not a duplicate. Receiving the Route Reply, the sender starts sending data to the receiver.
- 15. If a node detects a failure, it sends a Route Error message to the source. All routes that contain this hop are truncated. If the source does not have an alternative path to the destination, it has to re-initiate the path discovery mechanism.
- 16. DSR has several optimization techniques. Know a path to the destination to reply to the Route Request message instead of forwarding the request. Path discovery can use an expanding ring search mechanism when sending the Route Request messages in close destinations, thus avoiding broadcasting in the whole network.
- 17. Hybrid Routing Protocols Some routing protocols are hybrid of proactive and reactive mechanisms. examples of hybrid routing protocols: Zone Routing Protocol (ZRP) Core Extraction Distributed Ad Hoc Routing Protocol (CEDAR)
- 18. Zone Routing Protocol (ZRP) The network is divided in zones . The intra-zone routing protocol is a proactive routing protocol, the inter-zone routing protocol is a reactive routing protocol. When a node transmit data to a destination within the same zone, then this is done using the proactive routing protocol. If the destination is in another zone, then the source node border casts the Route Request until it reaches the destination zone. Node of the destination zone sends then back a Route Reply message. If a broken link is detected, the path reconstruction can be done locally
- 19. Security Attacks on Routing Protocol Secure system can be achieved by preventing attacks or by detecting them and providing a mechanism to recover for those attacks. Attacks on ad hoc wireless networks can be classified as Active attacks Passive attacks
- 20. Passive Attacks Intruder snoops the data exchanged without altering it. The goal of the attacker is to obtain information that is being transmitted. These attackers are difficult to detect, since the network is not disrupted Powerful encryption mechanism can alleviate these attackers.
- 21. Active Attack Attacker actively participates in disrupting network services. Attack by modifying packets or by introducing false information in the ad hoc network. Confuses routing procedures and degrades network performance. Active attacks can be divided into Internal Attack External Attack
- 22. Internal Attack From compromised nodes that were once legitimate part of the network. Since they are part of the network, they are much more severe and difficult to detect when compared to external attacks.
- 23. External Attack Carried by nodes that are not legitimate part of the network. Such attacks can be defended by using encryption, firewalls and source authentication.
- 24. Attacks using Impersonation An intruder consume another node resources or to disturb normal network operation. An attacker node achieves impersonation by misrepresenting its identity. This can be done by changing its own IP or MAC address to that of some other legitimate node. Some strong authentication procedures can be used to stop attacks by impersonation.
- 25. Impersonation Man-in-the-Middle Attack The attacker can impersonate the receiver with respect to the sender, and the sender with respect to the receiver. without having either of them realize that they have been attacked.
- 26. Attacks using Modification This attack disrupts the routing function by having the attacker illegally modifying the content of the messages. Misrouting Attack: A non-legitimate node sends data packet to the wrong destination. Detour Attack: The traffic is diverted to other routes that appear to be shorter and might contain malicious nodes which could create other attacks. Blackmail Attack: Causes false identification of a good node as malicious node.
- 27. Attacks using Fabrication An intruder generates false routing messages, such as routing updates and route error messages, in order to disturb network operation or to consume other node resources.
- 28. Security Mechanism and Solutions for Routing Protocol Message encryption and digital signatures are two important mechanisms for data integrity and user authentication. There are two types of data encryption mechanisms Symmetric Asymmetric Symmetric : Use the same key (the secret key) for encryption and decryption of a message Asymmetric : Use one key (the public key) to encrypt a message and another key (the private key) to decrypt it.
- 29. Message Authentication Code (MAC) is used. Cryptographic checksum, computed by the message initiator as a function of the secret key and the message being transmitted and it is appended to the message. The recipient re-computes the MAC in the similar fashion. If the MAC computed by the receiver matches the MAC received with the message then the recipient is assured that the message was not modified.
- 30. Secure Efficient Ad hoc Distance Vector Secure Efficient Ad hoc Distance Vector (SEAD) is a proactive routing protocol, based on the design of DSDV. SEAD routing tables maintain a hash value for each entry.
- 31. The key feature of the proposed security protocol is the use one-way hash chain function H. Each node computes a list of hash values h0, h1, ・ ・ ・ , hn, where hi = H(hi−1) and 0 < i ≤ n, based on an initial random value h0. If a node knows H and a trusted value hn, then it can authenticate any other value hi, 0 < i ≤ n by successively applying the hash function H and then comparing the result with hn.
- 32. To authenticate, a node adds a hash value to each routing table entry. For a metric j and a sequence number i, the hash value hn−i+j is used to authenticate the routing update entry for that sequence number Since an attacker cannot compute a hash value with a smaller index than the advertised value.
- 33. ARIADNE Design of ARIADNE is based on DSR. It assumes that sender and receiver share secret keys for message authentication. The initiator (or sender) includes a MAC computed with an end-to-end key and the target (or destination) verifies the authenticity and freshness of the request using the shared key. Pre-hop hashing mechanism, a one-way hash function that verifies that no hop is omitted, is also used in Ariadne. Provides a strong defense against attacks that modify and fabricate routing information.
- 34. Security Aware Routing (SAR) Is an on demand routing protocol based on AODV The initiator of the route in SAR includes a security metric in the route request. This security metric is the minimum trust level of the nodes that can participate in the route discovery. Only those nodes that have this minimum security level can participate in the route discovery. All other nodes that are below that trust level will drop the request packets.
- 35. SAR uses sequence numbers and timestamps to stop replay attacks. Threats like interception and subversion can be prevented by trust level key authentication. Modification and fabrication attacks can be prevented
- 36. Secure Routing Protocol (SRP) SRP defends against attacks that disrupt the route discovery process. Set up a security association without the need of cryptographic validation of the communication data by the intermediate nodes. SRP assumes that this SA can be achieved through a shared key KST between the source S and target T.
- 37. The SRP uses an additional header called SRP header to the underlying routing protocol packet. SRP header contains the following fields: the query sequence number QSEC query identifier number QID 96 bit MAC field Discard a route request message if SRP header is missing. Otherwise, forward the request towards destination after extracting QID, source, and destination address.
- 38. When the target T receives request packet, it verifies. If QSEC >=QMAX, the request is dropped. Otherwise it calculates the keyed hash of the request fields and if the output matches SRP MAC then authenticity of the sender and integrity of the request are verified. If the two routes match then S calculates the MAC by using the replied route, the SRP header fields, and the secure key between source and destination. If the two MAC match then the validation is successful and it confirms that the reply did came from the destination T.
- 39. Security Protocols for Sensor Network (SPINS) It provides important network services like data confidentiality two party data authentication data freshness Through Secure Network Encryption Protocol (SNEP) and secure broadcast through Micro Timed Efficient Stream Loss-tolerant Authentication (μTESLA). μTESLA an enhanced version of TESLA, uses symmetric cryptographic techniques for authentications and asymmetry cryptography only for the delayed disclosure of keys.
- 40. CONCLUSION Achieving a secure routing protocol is an important task that is being challenged by the unique characteristics of an ad hoc wireless network. In this paper we discuss security services and challenges in an ad hoc wireless network environment. The current security mechanisms, each defeats one or few routing attacks. Designing routing protocols resistant to multiple attacks remains a challenging task.
- 41. THANK YOU