Selective Jamming/Dropping Insider Attacks in wireless mesh networks

1. Selective Jamming/Dropping Insider Attacks in wireless mesh networks • Presentation By • Pournima Balasubramaniam • Niteesha Bodapati • Mahalakshmi Chandra Sekaran

2. INTRODUCTION • Wireless Mesh Networks: Communication network with nodes organized in a Mesh topology. • Current Wi Fi infrastructure cannot extend the wireless connectivity beyond a limit. • To improve this, Wireless Mesh Networks come into picture.

3. ARCHITECTURE • Two tier architecture. • First Tier: Stations connected to Mesh access points • Second Tier: Peer-to -Peer network of MAPs which are interconnected by Mesh Point (Routers)

4. Attacks on WMN WMN’s are Vulnerable to External and Internal Attacks • External Attacks: ->Channel Jamming, Packet Replay, Packet Fabrication. -> Launched by foreign devices that are unaware of network secrets. • Internal Attacks: • Exploits knowledge of network secrets and protocol semantics • Targets critical network functions. Reasons for Vulnerability: • Cost:MP’s and MAP’s - relatively cheap • Static Design - susceptible to attacks • Multiple Hops : forces longer or inconsistent routes for packet forwarding

5. Selective Jamming Attacks • Types of selective jamming attacks : • Channel Selective Jamming • Data Selective Jamming Control channel -> reserved for broadcasting control information[network information, route discovery] ->restrains from interference in STA-MAP communication • Channel Selective Jamming - • Targets control channel whose location is known[secret information compromised by receivers (MAP/MP). • Launches DoS attacks.

6. Channel Selective Jamming Counter measures • Replication of control information • Control information broadcasted over multiple broadcast channels • If some targeted channels are jammed – required control information can be retrieved from other channels • Each node has partial information of broadcast channel locations -> only subset of channels is targeted. • Assignment of unique PN codes: • Dynamically changes location of broadcast channel based on physical location of communicating nodes[categorized into clusters] • Each cluster has a Cluster Head which assigns a unique PN hopping sequence to other nodes in cluster • PN codes helps in identifying Internal attacker. Eliminating broadcasting of secrets – Secrets - PN code have to be guessed by exploiter . ->PN code can only be guessed by brute force attack on public code book • Synchronization is established by sharing PN codes between communicating parties .

7. Data selective Jamming Target specific packets of high importance • Method 1: -Classification of packets before transmission [ through overhearing a few bytes of data] -Interfering with rest of packet transmission at receiver end • Method 2: Launches Attacks based on transmission Route patterns

8. Data selective Jamming Counter Measures: Encryption Strategies do not suffice – internal attacker still gets the broadcasted information Alternative schemes ->Scheme 1 - Commitment Scheme • Broadcasting Committed version of packets between communicating parties. – packet hidden • Only end-node is capable of de committing the packet. ->Scheme 2 - All or Nothing Transformation Scheme • Can be attacked only if entire data is available

9. Selective Dropping Attacks • Performed if jamming is not successful • Packet header is inspected – forwarded or Dropped • If attacker interrupts – gets access to drop packets randomly • Less Flexible approach • Why – Based on routes through which packets are transmitted.

10. Example of Selective dropping • Sender is throttled – How? Receiver ACK’s lost -> Sender Retransmits continually -> Causes Congestion

11. Counter measure for Selective Dropping • Mitigation of selective dropping: • Use multi path routes from source to destination (i.e) Avoid route where attacker exists • Identification of Selective droppers: • Two methods- • Reputation Systems: ->collection of First hand[neighbouring nodes] and second hand[communicating peers] information ->Flooding network with node behavioural information ->On demand requests for node behaviour

12. Counter measure for Selective Dropping- contd.. • ACK Based Systems ->Downstream sends ACK’s to upstream ->Monitors unicast Traffic • Credit Based Systems : -> node can drop highly important packets ->gains high credit Lack mechanisms for identifying misbehaving nodes

13. Conclusion • WMN’s are prone to external and internal attacks. This paper has provided the following solutions -> strategies that avoided an adversary’s attack ->replication of control info ; unique PN assignment ; elimination of secrets -> strategies that prevented an adversary’s attack -> commited Version ; AONT ->Mitigated selective dropping and its effects

14. Acknowledgements Selective Jamming/Dropping Insider Attacks in Wireless Mesh Networks Authors: Loukas Lazos, and Marwan Krunz Dept. of Electrical and Computer Engineering, University of Arizona, Tucson, Arizona