Page 2 Lecture Notes in Computer Science 2865 Edited by G. Goos ...

146 J. Zhen and S. Srinivasbeginning of forming the network, each neighbor is set as trusted because weassume that there is no replay attack in that moment due to the spontaneousnature of the ad-hoc network. From then on, nodes move around across differentnodes’ transmission range. Upon receiving a RREQ from an un-trusted node,or “neighbor”, a node will send a verification message and wait for the reply.Only after the node has approved the neighbor from its RTT value, the RREQ isforwarded continuously. It seems that this will increase the RREQ propagationdelay for several folds, but our analysis will show this is not the case becausethe RREQ is broadcast and the path going through the trusted nodes have lessresistance while verifications are being made on other paths.Because RTT is such a variable value depending on node capability andtraffic load, we measure the local average RTT as the threshold. A new RTTto an un-trusted neighbor will be compared with this threshold for accepting orrejecting. Basically, the threshold at a node equals the average RTT to its alltrusted neighbors.In order to attack successfully, the RREQ replay attack must be appliedon the nodes far away from the originator because nodes around the originatorhave the freshest information. And the wormhole attack can form more seriousharm when applied on larger range because this makes attackers have morecontrol on the traffic. This large straddle necessitates at least two attackers;otherwise, one attacker will have to use powerful signals which will be heard bya large group of the nodes. By comparing neighbor lists among them to findthe abnormal common neighbor, we would be able to detect this attack. Theinvolvement of two attackers increases the possibility of detecting replays bycomparing RTT times. Even though these attackers have powerful equipment,MAC delays depend only on local traffic. We assume that two attackers will makeRTT remarkablely different between attacked scenarios and normal situation.4.2 Verification ProcedureThe verification procedure used to measure RTT between two nodes sending/receiving RREQ is illustrated in Fig.3. We assume that we have an efficient wayto distribute a secret between each pair of nodes such that A and B share akey Kab. The random number is generated uniquely for each verification procedureto prevent replayed verification reply (VEF REP). IPa and IPb are IPaddresses of A and B. They are added to distinguish between the direction ofA-B and B-A, otherwise anyone hearing VEF REQ message can replay it backto forge a VEF REP. Even though IP addresses are public, without Kab, nodesother than B cannot forge VEF REP’s to A. Each packet must be signed orencrypted depending on its efficiency because we need a mechanism for A andB to authenticate each other.4.3 ThresholdWe base the calculation of RTT threshold value on the Hello message exchangein AODV protocol. According to the protocol, nodes are required to broadcast