Page 2 Lecture Notes in Computer Science 2865 Edited by G. Goos ...

Preventing Replay Attacks for Secure Routing in Ad Hoc Networks 143the overhead caused by flooding the whole network. The packets are flooded ina small area (a ring) first defined by a starting TTL (time-to-live) in the IPheaders. After RING TRAVERSAL TIME, if no RREP has been received, theflooded area is enlarged by increasing the TTL by a fixed value. The procedureis repeated until an RREP is received by the originator of the RREQ, i.e., theroute has been found [2].Nodes in the network avoid their packets from being replayed by incrementinga sequence number and RREQ ID for each new packet. From the descriptionin the last paragraph, we can observe that the RREQ’s only exist within anarea. The nodes outside the area will never know the freshest sequence numbersand RREQ ID’s. It is trivial to simply record the RREQ of one node and thenbroadcast it in another area of the network. If the area where the packets arebroadcast to has up-to-date information, the packets will be simply discarded.If the information is out-of-date, the packets will provoke extra unnecessaryrounds of route discoveries. By performing this attack massively, a denial ofservice attack can be launched.This attack is illustrated in Fig.1. At time t0, attacker M overhears the RREQfrom A. At time t1, M replays the RREQ to B. Because B has not heard thefreshest RREQ, it will start processing the RREQ so an unnecessary round ofroute discovery is launched in the area.Fig. 1. RREQ Flooding AttackWormhole Attack. Wormhole attack has been described in [16]. Here weoutline it just for a review. In this kind of replay attack, a tunnel is formedbetween two nodes through which attackers can transmit packets in a speedfaster than the normal hop-by-hop propagation through legitimate wireless linksby using long range directional wireless links or even wired links.Figure 2 illustrates this attack. Node A wants to find out a route to nodeB. It broadcasts an RREQ which first reaches X and M1 (an attacker-could betransparent to the network). While X relays RREQ to its neighbors W and Y,M1 tunnels this request to M2 (another attacker) using a fast link. M2 broadcaststhis RREQ to Z, which in turn relays it to B. Since this is faster than thevalid route, the valid RREQ is suppressed, and this route is shorter, the maliciousroute A-M1-M2-Z-B is selected. Furthermore, if nodes near A are about to