(Im)Possibility of Denial-of-Service Attacks on Network Layer in Wireless Mesh Networks

Myunghan Yoo, Kwangjo Kim*

*Dept. of Information and Communications Engineering, KAIST.

Abstract

Wireless Mesh Networks (WMNs), which are the most promising network technologies in the research areas have a lot of killer applications such as traffic information and access of the Internet on the road. However, due to the essential characteristics of wireless networks, networks are more vulnerable than wired networks. e.g. anybody having a wireless network interface card can overhear messages sent through the air.

The Denial-of-Service (DoS) attack is one of the hottest issued attacks in the computer networking. An adversary has objectives disturbing service providers to serve their services by some reasons, such as the lack of bandwidth, disk space or a processor which processes unnecessarily uncountable queries, that information is not delivered because of jamming attacks in the networks, etc.

Actual DoS attacks are possible on all layers of the OSI 7 layers model. However, we examine and discuss DoS attacks on only network layer since DoS attacks on physical layer, link/medium access control (MAC) layer is influenced by physical capacity and on other layers are same as performed DoS attacks in wired network. The DoS attacks on network layer are to modify routing information.

In this paper, we examine existing attacks on wireless networks and analyze them. Finally, we describe countermeasures and problems of currently studied countermeasures.

Introduction

Wireless Mesh Networks (WMNs) appears, since pure Ad-hoc networks have difficulty that it is implemented in the real commercial world, except some special environment such as military fields or industrial sites. Most of the users may want to connect to the Internet to get useful services such as traffic on the roads or navigation information during driving a car, real time streaming multimedia, delicious restaurant information around users, etc.

On the other hand, WMNs can provide people who have conventional devices such as laptops, PDAs, UMPCs, Smart phones, cell phones, and even Desktops. WMNs consist of two nodes: mesh routers and mesh clients. Mesh routers are commonly Access Points (APs) which have low mobility or are stationary as backbone infrastructure, and mesh clients can directly connect to mesh routers with wireless network interface cards (WNICs) or through Ethernet.

However, due to natural characteristics of wireless communications, more diverse attacks, such as easy eavesdropping and modifying routing information, are possible than wired communications. In the case of Denial-of-Service (DoS) attacks, we will examine and discuss in this paper later, of course the objectives are same as wired Internet’s one, but types of attacks are totally different from wired Internet.

The rest of this paper is organized as follows. In Section II, we introduce the concept of DoS attacks, In Section III, we examine and discuss DoS attacks on network layer. And we will conclude in Section IV.

Background

According to [1], Denial-of-Service began since 2001. However, until now, there is no DoS attacks on wireless networks. Instead, DoS attacks have advanced to Distributed-Denial-of-Service (DDoS) attacks since wireless networks have been not that much spread as wired networks yet. However, many researchers are studying in wireless networks and attacks on them. At the finally, wireless networks will be larger than wired networks and attacks, especially DoS attacks, on wireless networks will be one of the most serious problems.

Denial-of-Service attacks literally mean that a victim is disturbed to provide its service, due to the lack of its capabilities, the broken data, or broken connections.  Thus, the objectives of DoS attacks are followings [1] :

1. Letting service provider consumes computational resources, throughput of link, disk space, and its processor.

2. Disrupting service provider’s configuration information, such as routing information.

3. Disrupting state information of connected hosts, such as unnecessary resetting of TCP sessions.

4. Disrupting physical network structures.

5. Disturbing provided service to the valid users at middle point.

However, the main targets of DoS attacks in wireless networks are different from wired networks. The main targets on wired networks are DNSs or servers of service providers. On the other hand, in the case of wireless networks, mesh routers are main targets of DoS attacks.

General security objectives include [2]: confidentiality, which keeps secret from all entities except eligible entities to read, authentication of entity proving the entity joining the communication and message corroborating the origin of information, data integrity checking modification of information from original one, availability allowing authorized entities to access communication, and non-repudiation prohibiting performing facts of transmission and receipts of messages. According to the aims of DoS attacks above mentioned, disruption of availability is mainly focused.

Therefore, providing simply high confidentiality with encryption algorithms, data integrity with message authentication code (HMAC), authentication with digital signature cannot totally prevent DoS attacks.  DoS attacks are possible for all layers of wireless network architecture compressed from OSI 7 layers model: physical layer and data-link layer (MAC layer) with  jamming attacks, network layer with modifying routing information to drop or to send packets to adversary, transport layer with opening unnecessarily sockets and application layer with customized attacks for application. However, in this paper, we will examine and discuss DoS attacks only on network layer and mitigations, since DoS attacks on physical layer are influenced by devices' capacity and DoS attacks on transport layer and application layer are same as wired networks.

DoS Attacks on Network Layer

In this section, we will introduce DoS attacks on network layer. This kind of attacks occur when constructing or updating routing path regardless of proactive routing algorithms, which maintain routing table before a node tries to periodically transmit packets and update, or reactive routing algorithms, that build the path every time when a node wants to send packets.

We will examine types of DoS attacks on network layer, and then mitigation of DoS attacks.

3.1 Types of DoS Attack on Network Layer

The types of DoS attacks on network layer are various, but most of the attacks are related to dropping packets.

3.1.1 Formation of Routing Loop

Firstly assumption is that a path is constructed from the node S as a sender to the node X as a destination through node B and C. And there is a path linking node A and C through node D. Node M is a malicious node as shown in Figure 1. (a). and can be located around each node, which node M can overhear and capture the messages such as path request (PREQ) or path reply (PREP) packets to establish a path, with mobility.

Figure  Formation of Routing Loop

Firstly, node M sends a PREP message, which indicates a better path via node A than via node C, to the B. Actually M sent the PREP message as node A by binding A’s MAC address. Thus, node B set its next hop to reach node X into node A, represented in Figure 1. (b). In same way, finally, node C will builds a link to node B in Figure 1. (c). Then, packets sent from node S to X cannot reach node X.

3.1.2 Dropping Packet Attacks

In a blackhole attack, a malicious node broadcasts a request packet which represents the shortest path. Then cheated nodes construct paths to the malicious node and when they try to send the packet to the malicious node, the malicious node drops all traffic [5, 6].

A grayhole attack has two types of attacks. First is called as a selective forwarding attack, which is the most difficult attack to detect selectively dropped packets or sent packets to an ordinary path or to an adversary’s storage [5]. The other attack is a grayhole attack which drop received packets randomly. Thus this attack does not have consistency.

3.1.3 Partition of Network Topology

A malicious node also can pervert the routing information to divide the network topology into some areas, which allow few node to participate and provide high throughput, by decreasing consumption of bandwidth from flooding route requests and sending other messages or by changing a route which passes a certain node having low capability of communication to another route [7, 8].

3.1.4 Modification of TTL

A malicious node can easily lower the TTL value in packets. Then the packet will be dropped before reach its destination. Raising the number of this kind of modified packet unnecessarily consumes the bandwidth of the network.

3.1.5 Rushing Attacks

An adversary floods modified path requests to whole of the network as an impersonated node. When normal nodes in the network configure route as requested, their requests seem to duplicates and they cannot construct the path [5].

There is a similar rushing attack that floods a number of valid route request and affects a large number of nodes in the network [7].

3.1.6 Wormhole Attacks

A wormhole attack [4] is the most studied attacks of DoS attacks. A wormhole attack is simply to modify the network topology with over two malicious nodes. Those malicious nodes are further away from each other than normal nodes, in the wireless network. However, those malicious nodes provide better link state than normal links through wire connection or single long-range directional wireless link. This effect is called as “tunnels” Therefore, normal nodes which want to transmit beyond multi-hop destination, but near one through those malicious nodes.

Analysis

We have examined several attacks. Table 1 shows comparison among DoS attacks. in the point of damage range, except rushing attacks and wormhole attacks, others influence only partial networks. By the way, Guaranteeing message confidentiality, message integrity, and node

authentication has little effect in mitigating DoS attacks. Thus, to solve detection difficulty "Medium" and "Hard" in Table 1, we think surveillance of neighbor nodes' behavior is needed since validating whether sending and receiving packets is properly done is hard by  guaranteeing security requirements only.

Table 1 Comparison to among attacks

Types of DoS attacks	Damage Range	Detection Difficulty	Countermeasure Effect
			Message Confidentiality	Message Integrity	Node Authentication	surveillance of Behavior
Formation of Routing Loop	Partial	Easy	×	×	○	○
Dropping Packet Attacks	Partial	Hard	×	×	×	○
Partition of Network Topology	Partial	Medium	×	×	×	○
Modification of TTL	Partial	Medium	×	×	×	○
Rushing Attacks	Whole	Medium	×	×	×	○
Wormhole Attacks	Whole	Hard	×	×	×	○

4.1 Detection and Mitigation

Most of the DoS attacks on network layer performed by external nodes can be defeated by secure routing protocol which provides the guarantee of high confidentiality, integrity and freshness of message and authentication of each node.

However, if an adversary compromises normal nodes, then we need to monitor nodes’ misbehaviour. Watchdog and Pathrater, proposed as security components of Dynamic Source Routing (DSR) which is a protocol used in Ad-hoc and multi hop WMNs [11, 13], cooperatively work to mitigate routing misbehavior [11]. Watchdog can identify malicious nodes but not distinguish misbehavior of node. The malicious node is not revoked and can still perform attacks.

Cooperation Of Nodes, Fairness In Dynamic Ad-hoc Networks (CONFIDANT) [7] also distinguishes and revokes malicious nodes by observing and being reported from other nodes. However, CONFIDANT cannot conclude if the node performs with malfunction and is mistakenly relocated.

Several papers insist that intrusion detection should be applied to all layers of the network, but they do not present specific way to implement their idea or the analysis of performance [11, 13]. In [13], every node in the network should perform monitoring the intrusion and respond. When a node an implicit one, it needs to cooperate with its neighbors in global intrusion detection system. But, only little information of how this cooperation proceeds is referred.

4.2.1 Countermeasure of Wormhole Attacks

As above mentioned in Section 3.1.6, a wormhole attack is the most popular research area among DoS attacks. Thus, in this section, we will examine representative scheme [4] for detection and mitigation.

For detecting the wormhole attack, a packet leash concept which inserts any information into a packet is introduced in [4]. Leash is divided into two categories: a geographical leash and a temporal leash. A geographical leash which requires geographical information of each nodes and loosely synchronized clock makes the sender ensure that the receipts of sent packets are within an expected range. A temporal leash that requires that all nodes must have tightly synchronized clocks makes the packet have life time floating the network. [4], although, mentions that geographical leashes take advantages over temporal leashes such as looser synchronized time among nodes and conjunction with a signature scheme which catch attacker, if attacker pretends to reside at multiple locations. However, geographic can leashes should be sent with a broadcast authentication mechanism used in less constrained network, which causes high computational and network overhead. Thus, it suggests a new protocol with temporal leashes, for efficiency.

Conclusion

In this paper, we examine the DoS attacks on WMNs. Unfortunately, there are only few papers which study in DoS attacks in WMNs, since WMNs is from both Ad-hoc and wireless LAN. Thus, most of the DoS attacks are able to be launched in WMNs. However, there is the difference from Ad-hoc, due to energy constraint. The attack to make node to waste energy is possible to be launched only for end user’s node, not for stationary mesh routers which have no constraint of energy.

In the near future, we think that we can suggest a framework for efficient establishment of IDS in wireless networks.

[References]

[1]http://en.wikipedia.org/wiki/Denial-of-service_attack

[2] A. Menezes, P. van Oorschot, and S. Vanstone, “Handbook of Applied Cryptography”, CRC Press, 1996.

[3] M. S. Siddiqui and C. S. Hong, “Security Issues in Wireless Mesh Networks”, 2007 International Conference on Multimedia and Ubiquitous Engineering (MUE'07), 2007.

[4] Y. C. Hu, A. Perrig and D. B. Johnson, “Wormhole Attatks in Wireless Networks”, 22nd Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM 2003), 2003.

[5] Y. C. Hu, A. Perrig, and D. B. Johnson, and “Ariadne: a secure on-demand routing protocol for ad hoc networks”, in Proceedings of the eighth annual international conference on Mobile computing and networking, September 23-28, 2002, Atlanta, Georgia, USA

[6] Y. C. Hu, A. Perrig and D. B. Johnson, “Efficient Security Mechanisms for Routing Protocols”, in Proceedings of the Tenth Annual Network and Distributed System Security Symposium (NDSS 2003), pp. 57-73, ISOC, San Diego, CA, February 2003

[7] S. Buchegger and J-Y. Le. Boudec, “Performance Analysis of the CONFIDANT Protocol: Cooperation Of Nodes-Fairness In Distributed Ad-Hoc Networks”, in Proceedings of IEEE/ACM Workshop on Mobile Ad Hoc Networking and Computing (MobiHOC).IEEE, June 2002.

[8] K. Wrona, “Distributed Security: Ad Hoc Networks & Beyond”, In Ad hoc networks security Pampas workshop, Ruhl, September 16-17, 2002

[9] Y. C. Hu, A. Perrig and D.B. Johnson, “Packet Leashes: A Defense against Wormhole Attacks in Wireless Ad Hoc Networks”, Technical report, Department of Computer Science, Rice University, December 2001.

[10] S. Marti, T.J. Giuli, K. Lai and M. Baker, “Mitigation Routing Misbehavior in Mobile Ad Hoc Networks”, presented in 6th International Conference on Mobile Computing and Networking (ACM MOBICOM.00), pp.255-265, August 2000.

[11] S. Buchegger and J.L. Boudec, “Cooperative Routing in Mobile Ad-Hoc Networks: Current Efforts Against Malice and Selfishness”, Mobile Internet Workshop, Germany, October 2002.

[12] S. Marti, T.J. Giuli, K. Lai and M. Baker, “Mitigation Routing Misbehavior in Mobile Ad Hoc Networks”, presented in 6th International Conference on Mobile Computing and Networking (ACM MOBICOM.00), pp.255-265, August 2000.

[13] Y. Zhang. W. Lee and Y.-A. Huang, “Intrusion Detection Techniques for Mobile Wireless Networks”, In Proceedings of MOBICOM 2000, pages 275-283, 2000.