1. Using Directional Antennas to Prevent Wormhole Attacks Lingxuan HuDavid Evans Department of Computer Science University of Virginia

2. Outline Problem Statement Background Protocol Experiment

3. Scenario Thousands of small, low-powered devices with sensors and actuators, communicating wirelessly High-power base station

4. Routing Tree Adapted from Chris Karlof and David Wagner's WSNPA slides

5. Routing Adapted from Chris Karlof and David Wagner's WSNPA slides

6. Wormhole Attack Tunnel packets received in one place of the network and replay them in another place The attacker can have no key material. All it requires is two transceivers and one high quality out-of- band channel Adapted from Chris Karlof and David Wagner's WSNPA slides

7. Disrupted Routing Most packets will be routed to the wormhole The wormhole can drop packets or more subtly, selectively forward packets to avoid detection Adapted from Chris Karlof and David Wagner's WSNPA slides

8. Impact of Wormhole — Experiment Base Station at CornerBase Station at Center How many routing paths are disrupted by a single wormhole?

9. Impact of Wormhole — Result

10. Possible Solutions Time –Signal is transmitted at speed of light Location –Location awareness Direction –Directional Antennas

11. Directional Antennas Operation Modes: Omni and Directional In Omni Mode: Nodes send signals with gain Go In Directional Mode: Capable of sending in specified direction Directional Gain Gd (Gd > Go)

12. Antenna Model The model is comprised of N antenna zones. The N zones may collectively cover the entire plane The zones are numbered 1 to N oriented clockwise starting with zone 1 facing east The channel is bidirectional. For, example, if A hears B from zone 1, then B will hear A in zone 4, which is the opposite zone East

13. Simple Neighbor Discovery A  RegionAnnouncement, done through sequential sweeping N  AInclude nonce and zone information in the message A  NCheck zone information and send back the nonce HELLO | ID A ID N | E KNA (ID A | R | zone (N, A))R A N

14. Detecting Wormhole A B Hello zone (A, B) = 4 zone (A, B) = 1 Wrong!

15. Sophisticated Wormhole AB Hello zone (A, B) = 1 zone (A, B) = 1Yes! Simple Neighbor Discovery can reduce the chance of successful wormhole attack to 1/6, but it is still unacceptable since a single wormhole can disrupt most routing paths. Possible Solution: Neighborhood coordination

16. V Verified Neighbor Discovery A  RegionAnnouncement, done through sequential sweeping N  AInclude nonce and zone information in the message A  NCheck zone information and send back the nonce N  RegionInquire the validity of neighbor A through verifiers V  N Send confirmation to N if all zone information is correct N  AAccept A as its neighbor and notify A HELLO | ID A ID N | E KNA (ID A | R | zone (N, A))R A N INQUIRY | ID N | ID A | zone (N, A) ID V | E KNV (ID A | zone (V, N)) ID N | E KAN (ID A | ACCEPT)

17. Verification Region 1.zone (B, A) ≠ zone (B, V) 2.zone (B, A) ≠ zone (V, A) v zone (B, A) = 4 zone (B, V) = 5 zone (B, A) = 4 zone (V, A) = 3

18. Verifier Analysis 1.zone (B, A) ≠ zone (B, V) 2.zone (B, A) ≠ zone (V, A) v v zone (B, A) = zone (B, V) zone (B, A) = zone (V, A)

19. Worawannotai attack A and B are just beyond the transmission range of each other There does have a valid verifier V in this case X simply retransmits messages between A and B, X doesn’t need to retransmit the message of V.

20. Strict Neighbor Discovery 1.zone (B, A) ≠ zone (B, V) 2.zone (B, A) ≠ zone (V, A) 3.zone (B, V) can not be both adjacent to zone (B, A) and adjacent to zone (V, A) Theorem: In strict neighbor discovery, if distance (A, B) > r, the verification region is empty Strict verification region

21. Cost Analysis Communication Overhead The typical secure link establishment includes announcement, challenge and response This protocol adds inquiry, verification and acceptance Connectivity Only accept a node as neighbor if it can be verified by at least one verifier, so may prevent some legitimate links from being established

22. Impact on Connectivity For a more typical network with omni density = 10. In verified protocol, 0.5% links are lost and no nodes are disconnected. In strict protocol, 40% links are lost and 0.03% nodes are disconnected. Verified Protocol, Omni density = 3Strict Protocol, Omni density = 3

23. Node Distance vs Connectivity Strict ProtocolVerified Protocol

24. Impact on Routing For verified protocol, the routing path length is nearly the same For strict protocol, the routing path length increases around 20%

25. Directional Errors Omni density = 3Omni density = 10 The error is modeled by disorienting nodes by a random angle in [-max, max] The disconnected nodes is little affected The lost links will increases as maximum directional error degree increases

26. Conclusion Wormhole attack is a powerful attack that can be conducted without any cryptographic breaks Directional antennas offers a promising approach to preventing wormhole attacks through neighborhood coordination

27. Discussion Design protocols to prevent more powerful wormhole attacks Or try to prove that some powerful wormhole is unpreventable if no assumption on time synchronization or location awareness is made. Mitigate replay attacks in other layers (routing, application)

28. References [1]L. Hu and D. Evans. Using Directional Antennas to Prevent Wormhole Attacks. Network and Distributed System Security Symposium, San Diego, 5-6 February 2004. [2]R. Ramanathan. On the Performance of Beamforming Antennas in Ad Hoc Network. MobiHoc 2001, October 2001. [3]Y. Hu, A. Perrig, and D. Johnson. Packet Leashes: A Defense against Wormhole Attacks in Wireless Ad Hoc Networks. INFOCOM 2003, April 2003. [4]C. Karlof and D. Wagner. Secure Routing in Sensor Networks: Attacks and Countermeasures. First IEEE International Workshop on Sensor Network Protocols and Applications, May, 2003.