Page 2 Lecture Notes in Computer Science 2865 Edited by G. Goos ...

Preventing Replay Attacks for Secure Routing in Ad Hoc Networks 145is not focused on one route any more [15][17]. But still some precious resourcesare wasted in the permitted range. If these attacks are performed frequently, theloss can be remarkable.In [11](Awerbuch et. al.), a confirmation for each data packet is required fromthe receiving node. By limiting the number of missed data packets, the routewith poor quality will result in an investigation. It can detect the existence ofwormhole only after the degradation has been detected and it still needs tofind another route to go over from the beginning. Our proposal can preventwormholes from being formed.4 Our Proposal4.1 OverviewIt is important to note that the authentication of neighbors in AODV is weak.The neighboring mechanism in AODV is that each node adds a new neighborto its neighbor list whenever it hears a “reliable enough” signal no matter whosends the signal. A malicious node can send this signal by simply recordingpackets, spoofing the MAC address (or not, if there is no MAC address mappingmechanism set up) to impersonate other nodes.The weak neighbor authentication gives room to perform the above two replayattacks. The basic idea of our solution is to measure the Round Trip Time(RTT) between two nodes to decide if they are true neighbors. For the RREQFlooding attack (Fig.1), when B receives an RREQ, if it could check that thispacket could not be originated from direct neighbor nodes by looking at thevalue of RTT to the node, it would discard the request.For the wormhole attack (Fig.2), the situation is more complicated. Thewormhole attack has three scenarios if proper authentication mechanism hasbeen used to discriminate between outsiders and insiders; thus outsiders cannotparticipate in the operation of the network because they do not have legitimateidentifications: (1) M1 and M2 are both outsiders; (2) M1 is a colluding insiderand M2 is an outsider or vice versa; (3) M1 and M2 are both insiders. In scenario(1), since M1 and M2 are all transparent nodes the RREQ received by Z canonly come from A. In scenario (2), if M1 is an outsider and M2 selects not tohide (of course it will not hide because in that way Z would receive RREQ fromA and would know the existence of wormhole from RTT), it is also possiblefor Z to receive RREQ forwarded by M2 or by M1 in the second case. If theyexchange keys, then the case will be the same as in following scenario. In scenario(3), Z may receive from A, M1 or M2. If M1 and M2 are all outsiders(1) thenby measuring RTT to A, node Z would know the existence of a wormhole. Forscenario (2)(3), node Z would receive RTT replies from any node as long as theyappear valid. Except those approaches detecting wormhole after QoS(Quality ofService) degrades, current approaches cannot detect this type of attack yet.The proposal involves sending a verification message to un-trusted neighborsfor which a node receives RREQ for the first time. An un-trusted neighboris a neighbor that is not assured to be within transmission range. From the