Wormhole Attacks Prevention

Dahill[8],Papadimitratos[9] and Hu[6] have separately introduced detail about Wormhole

attacks in wireless networks. Initial proposals to avoid wormhole attacks propose using secure

methods of bits over the wireless channel that can be recognize only by authorized nodes. This

only defends against outside of network attackers who do not own cryptographic keys.

Recently, researches are devoted to the study of prevention of inside attackers, it cannot be

19

cannot be prevented by cryptographic mechanisms alone

3.1.1 Distance or Time Limiting Detection Approaches

The concept behind this approaches are intuitive, it restricts the distance or the period that

packets can traverse between nodes in network. When node in network receives packets, it will

check the transmission range of nodes or the transmission time. If a packet traverses more than

a default value, this packet is perhaps being affected by malicious attacks or goes through the

wormhole tunnel. Hu, L. and Evans et al [6] proposed a general mechanism related to this

concept called “Packet Leashes”. It add the information to the packets, this information is

designed to restrict the packet’s maximum allowed transmission distance, we called the packets

are “Packet Leashes”. Two types of packet leashes were presented: Geographic Leashes and

Temporal Leashes. The first leashes, each node has to know its precise location and all nodes

have to know another node’s location information. Before sending a packet, each node adds the

information of its current location and time in the packet. When the receive node receives the

packet, it checks the packet by computing the distance to the sending node or the transmission

time of the traverse path. The receiving node can use this computing result to decide whether

the packet was transmitted through wormhole nodes. In Temporal Leashes, all nodes require

very tight time synchronization. Before sending a packet, each node attaches its current time to

20

the packet. When receiving the packet, the receiving node compares the temporal leash of the

packet to its time, and computes the distance to the sending node by assuming the propagation

speed is equal to the light speed. As a result, it can determine if the packet traveled an overlong

distance caused by wormhole attacks. The drawbacks of Packet Leashes are that all nodes in

network need accurate time and close time synchronism; and Geographic Leashes require extra

hardware such as GPS or location service to let each node obtain its precise location.

This method is the earliest proposed method to defend against wormhole attack. The idea

of this mechanism is very simple and ordinary. However, this method requires time

synchronization or accurate location information on each node to calculate the distance

between nodes.

3.1.2 Topology detection Approaches

These methods use geometric or topology information to detect wormhole attacks. If the

analyzed results of the collected information violate the predefine situation, wormhole attacks

may occur in the network. These methods do not require time synchronization, but need more

complicated processes and message exchanges to observe and collect the information of

packets. Lazos et al. [5] proposed a topology detection approach using cryptographic

mechanism called local broadcast keys (LBK). It based on keys only known within each real

21

neighbor nodes to prevent wormhole attacks. LBK does not need any time synchronization, but

require a few additional network nodes, the guard nodes, which know their location and own

broader transmission range than the regular nodes. While establishing LBKs, all guard nodes

broadcast their fractional keys and location information to the network; and then regular nodes

collect every fractional key they received. If two regular nodes share more than a threshold

number of fractional keys, they use these keys to generate a pair-wise key. Finally, every node

generates an LBK and unicast it to the nodes which it shares with same pair-wise key. After

establishing the LBKs, each node can only communicate with their real nodes. In addition,

Lazos et al. also provide a simple mechanism, called closet guard algorithm (CGA), which

adopts the observation that a regular node should not receive fractional keys from guard nodes

that are at a distance of more than two times of the transmission range of guard nodes, to

distinguish which guards are infected by wormhole attacks.

3.1.3 Graph Theoretic and Geometric Approaches

In Geometric approaches, the nodes have to send their neighbor list to their neighbors.

The neighbors are guards to each other and monitor the transmission of their neighbors.

Like[26], LITEWWORP is geometric method proposed by Khalil et al. In the LITEWORP,

each node can be server as a guard node, they define a malicious counter. When some

22

unreasonable actions of node are detected, the malicious counter increases. Once the

malicious counter on a particular neighbor is higher than a threshold, the neighbor revoke the

node from its neighbor list and trigger an isolation algorithm to isolate the node which is

thought as malicious. In their analysis, if the coverage of neighbors is not wide enough or too

many/less neighbors aggregate in a region, the performances both go down. The neighbors of

a node have to be kept in about 9~25 nodes, the system may work well above 90% detection

rate. However, the false alarm rates of LITEWORK are between 10% and 28% when the

neighbors number is about 17~29. As the result, we think only when the neighbors of a node

around 9 to 17, the scheme do work. And hence the nodes in LITEWORP have to monitor the

communication s of all neighbors, the energy consumption also be a problem.

3.1.4 Other Mechanisms and Protocols

Some Wormhole Attacks detection methods use the extra hardware or physical property to

detect attacks. In [6], Hu and Evans utilize directional antennas to prevent wormhole links.

Unlike our method, every node of the network is equipped with directional antennas and all

antennas should have the same orientation. Different directions called zones are sequentially

numbered and every node includes the transmitting zone at each message. A receiver hearing

information at a zone A verifies that the sender transmitted the message at the correct zone B,

23

where A, B are opposite zones. Based on information provided by neighbors that assist the

wormhole detection by acting as verifiers, every node discovers its neighbors. As pointed out

by the authors of [6], a valid verifier must exist in order for the wormhole to be detected, since

not all neighbors can act as verifiers. Finally, as noted by the authors of [6], this method can

only prevent single wormholes and does not secure the network against multiple wormhole

links [6].