Energy-efficient link-layer jamming attacks against wireless sensor network MAC protocols

ABSTRACT

A typical wireless sensor node has little protection against radio jamming. The situation becomes worse if energy-efficient jamming can be achieved by exploiting knowledge of the data link layer. Encrypting the packets may help to prevent the jammer from taking actions based on the content of the packets, but the temporal arrangement of the packets induced by the nature of the protocol might unravel patterns that the jammer can take advantage of, even when the packets are encrypted.

By looking at the packet interarrival times in three representative MAC protocols, S-MAC, LMAC, and B-MAC, we derive several jamming attacks that allow the jammer to jam S-MAC, LMAC, and B-MAC energy efficiently. The jamming attacks are based on realistic assumptions. The algorithms are described in detail and simulated. The effectiveness and efficiency of the attacks are examined. In addition, we validate our simulation model by comparing its results with measurements obtained from actual implementation on our sensor node prototypes. We show that it takes little effort to implement such effective jammers, making them a realistic threat.

Careful analysis of other protocols belonging to the respective categories of S-MAC, LMAC, and B-MAC reveals that those protocols are, to some extent, also susceptible to our attacks. The result of this investigation provides new insights into the security considerations of MAC protocols.

REFERENCES

• 1: Adamy, D. L. and Adamy, D. 2004. EW 102: A Second Course in Electronic Warfare. Artech House Publishers.
• 2: Akyildiz, I. and Kasimoglu, I. 2004. Wireless sensor and actor networks: Research challenges. Elsevier Ad Hoc Netw. 2, 4, 351--367.
• 3: I. F. Akyildiz , W. Su , Y. Sankarasubramaniam , E. Cayirci, Wireless sensor networks: a survey, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.38 n.4, p.393-422, 15 March 2002 [doi>10.1016/S1389-1286(01)00302-4]
• 4: Arisha, K., Youssef, M., and Younis, M. 2002. Energy-Aware TDMA based MAC for sensor networks. In IEEE Workshop on Integrated Management of Power Aware Communications Computing and Networking (IMPACCT'02).
• 5: Manuel Blum, Coin flipping by telephone a protocol for solving impossible problems, ACM SIGACT News, v.15 n.1, p.23-27, Winter-Spring 1983 [doi>10.1145/1008908.1008911]
• 6: Alvaro A. Cárdenas , Svetlana Radosavac , John S. Baras, Detection and prevention of MAC layer misbehavior in ad hoc networks, Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks, October 25-25, 2004, Washington DC, USA [doi>10.1145/1029102.1029107]
• 7: Chatterjea, S., van Hoesel, L., and Havinga, P. 2004. AI-LMAC: An adaptive, information-centric and lightweight MAC protocol for wireless sensor networks. In Proceedings of the DEST International Workshop on Signal Processing for Sensor Networks. IEEE Computer Society Press.
• 8: Dempster, A. P., Laird, N. M., and Rubin, D. B. 1977. Maximum likelihood from incomplete data via the EM algorithm. J. Royal Stat. Soci., Series B 39, 1, 1--38.
• 9: Deng, J., Han, R., and Mishra, S. 2006. Decorrelating wireless sensor network traffic to inhibit traffic analysis attacks. Elsevier Pervasive Mobile Comput. J., Special Issue on Security in Wireless Mobile Computing Systems 2, 2, 159--186.
• 10: El-Hoiydi, A. 2000. Aloha with preamble sampling for sporadic traffic in ad hoc wireless sensor networks. In IEEE International Conference on Communications. IEEE Press.
• 11: A. El-Hoiydi , J.-D. Decotignie , C. Enz , E. Le Roux, Poster abstract: wiseMAC, an ultra low power MAC protocol for the wiseNET wireless sensor network, Proceedings of the 1st international conference on Embedded networked sensor systems, November 05-07, 2003, Los Angeles, California, USA [doi>10.1145/958491.958531]
• 12: Oded Goldreich, Foundations of Cryptography: Basic Tools, Cambridge University Press, New York, NY, 2000
• 13: Jason L. Hill , David E. Culler, Mica: A Wireless Platform for Deeply Embedded Networks, IEEE Micro, v.22 n.6, p.12-24, November 2002 [doi>10.1109/MM.2002.1134340]
• 14: Hofmeijer, T., Jansen, S. D. P., and Havinga, P. 2004. DCOS, a real time, leight-weight data centric operating system. In Proceedings of the IASTED International Conference on Advances in Computer Science and Technology (ACST). 259--264.
• 15: Jamieson, K., Balakrishnan, H., and Tay, Y. 2003. Sift: A MAC protocol for event-driven wireless sensor networks. Tech. rep. MIT-LCS-TR-894, Massachusetts Institute of Technology.
• 16: Eun-Sun Jung , Nitin H. Vaidya, A power control MAC protocol for ad hoc networks, Proceedings of the 8th annual international conference on Mobile computing and networking, September 23-28, 2002, Atlanta, Georgia, USA [doi>10.1145/570645.570651]
• 17: Chris Karlof , Naveen Sastry , David Wagner, TinySec: a link layer security architecture for wireless sensor networks, Proceedings of the 2nd international conference on Embedded networked sensor systems, November 03-05, 2004, Baltimore, MD, USA [doi>10.1145/1031495.1031515]
• 18: Jerzy Konorski, Multiple Access in Ad-Hoc Wireless LANs with Noncooperative Stations, Proceedings of the Second International IFIP-TC6 Networking Conference on Networking Technologies, Services, and Protocols; Performance of Computer and Communication Networks; and Mobile and Wireless Communications, p.1141-1146, May 19-24, 2002
• 19: Kulkarni, S. S. and Arumugam, U. 2004. TDMA service for sensor networks. In Proceedings of the 3rd International Workshop on Assurance in Distributed Systems and Networks (ADSN).
• 20: Kyasanur, P. and Vaidya, N. 2003. Detection and handling of MAC layer misbehavior in wireless networks. In International Conference on Dependable Systems and Networks (DSN'03). IEEE Computer Society Press, 173--182.
• 21: Langendoen, K. and Halkes, G. 2005. Embedded Systems Handbook. CRC Press, Chapter Energy-efficient medium access control. To appear.
• 22: Yee Wei Law , Jeroen Doumen , Pieter Hartel, Survey and benchmark of block ciphers for wireless sensor networks, ACM Transactions on Sensor Networks (TOSN), v.2 n.1, p.65-93, February 2006 [doi>10.1145/1138127.1138130]
• 23: Law, Y., Hartel, P., den Hartog, J., and Havinga, P. 2005. Link-layer jamming attacks on S-MAC. In Proceedings of the 2nd European Workshop on Wireless Sensor Networks (EWSN'05). IEEE, 217--225.
• 24: Yee Wei Law , Lodewijk van Hoesel , Jeroen Doumen , Pieter Hartel , Paul Havinga, Energy-efficient link-layer jamming attacks against wireless sensor network MAC protocols, Proceedings of the 3rd ACM workshop on Security of ad hoc and sensor networks, November 07-07, 2005, Alexandria, VA, USA [doi>10.1145/1102219.1102234]
• 25: Jing Li , Georgios Y. Lazarou, A bit-map-assisted energy-efficient MAC scheme for wireless sensor networks, Proceedings of the 3rd international symposium on Information processing in sensor networks, April 26-27, 2004, Berkeley, California, USA [doi>10.1145/984622.984631]
• 26: Lin, G. and Noubir, G. 2002. Low power DOS attacks in data wireless LANs and countermeasures. Tech. rep., Northeastern University.
• 27: Lu, G., Krishnamachari, B., and Raghavendra, C. S. 2004. An adaptive energy-efficient and low-latency MAC for data gathering in wireless sensor networks. In 18th International Parallel and Distributed Processing Symposium (IPDPS'04) Workshop 12 13, 13.
• 28: Alan Mainwaring , David Culler , Joseph Polastre , Robert Szewczyk , John Anderson, Wireless sensor networks for habitat monitoring, Proceedings of the 1st ACM international workshop on Wireless sensor networks and applications, September 28-28, 2002, Atlanta, Georgia, USA [doi>10.1145/570738.570751]
• 29: David J. C. MacKay, Information Theory, Inference & Learning Algorithms, Cambridge University Press, New York, NY, 2002
• 30: Min, J. 1995. Analysis and design of a frequency-hopped spread-spectrum transceiver for wireless personal communications. Ph.D. thesis, University of California, Los Angeles.
• 31: Mysore, M., Golan, M., Osterweil, E., Estrin, D., and Rahimi, M. 2003. TinyDiffusion in the extensible sensing system at the James Reserve. http://www.cens.ucla.edu/~mmysore/Design/OPP.
• 32: Negi, R. and Perrig, A. 2003. Jamming analysis of MAC protocols. Tech. memo, Carnegie Mellon.
• 33: Nordic Semiconductor ASA. 2005. Single chip 433/868/915 mhz transceiver nrf905. Datasheet V1.2.
• 34: Noubir, G. 2004. On connectivity in ad hoc networks under jamming using directional antennas and mobility. In Wired/Wireless Internet Communications. Lecture Notes in Computer Science, vol. 2957. Springer, 186--200.
• 35: Guevara Noubir , Guolong Lin, Low-power DoS attacks in data wireless LANs and countermeasures, ACM SIGMOBILE Mobile Computing and Communications Review, v.7 n.3, July 2003 [doi>10.1145/961268.961277]
• 36: Pei, G. and Chien, C. 2001. Low power TDMA in large wireless sensor networks. In Proceedings of the Military Communications Conference (MILCOM'01), vol. 1. IEEE, 347--351.
• 37: Roger L. Peterson , David E. Borth , Roger E. Ziemer, An Introduction to Spread-Spectrum Communications, Prentice-Hall, Inc., Upper Saddle River, NJ, 1995
• 38: Poisel, R. A. 2 003. Modern Communications Jamming Principles and Techniques. The Artech House Information Warfare Library. Artech House.
• 39: Joseph Polastre , Jason Hill , David Culler, Versatile low power media access for wireless sensor networks, Proceedings of the 2nd international conference on Embedded networked sensor systems, November 03-05, 2004, Baltimore, MD, USA [doi>10.1145/1031495.1031508]
• 40: Pollin, S., Bougard, B., Mangharam, R., der Perre, L. V., Catthoor, F., Rajkumar, R., and Moerman, I. 2005. Optimizing transmission and shutdown for energy-efficient packet scheduling in sensor networks. In Proceedings of the 2nd European Workshop on Wireless Sensor Networks (EWSN'05). IEEE, 290--301.
• 41: Pottie, G. J. and Clare, L. P. 1999. Wireless integrated network sensors: Toward low-cost and robust self-organizing security networks. In Proceedings of the SPIE Conference on Sensors, C3I, Information, and Training Technologies for Law Enforcement, vol. 3577, 86--95.
• 42: Venkatesh Rajendran , Katia Obraczka , J. J. Garcia-Luna-Aceves, Energy-efficient collision-free medium access control for wireless sensor networks, Proceedings of the 1st international conference on Embedded networked sensor systems, November 05-07, 2003, Los Angeles, California, USA [doi>10.1145/958491.958513]
• 43: Reijers, N., Halkes, G., and Langendoen, K. 2004. Link layer measurements in sensor networks. In 1st IEEE International Conference on Mobile Ad Hoc and Sensor Systems (MASS'04). IEEE Computer Society Press.
• 44: RF Monolithics, Inc. 2002a. ASH Transceiver Software Designers Guide. RF Monolithics, Inc.
• 45: RF Monolithics, Inc. 2002b. TR1001: 868.35 MHz Hybrid transceiver. Datasheet.
• 46: RF Monolithics, Inc. 2004. ASH Transceiver Designers Guide. RF Monolithics, Inc.
• 47: D. Curtis Schleher, Electronic Warfare in the Information Age, Artech House, Inc., Norwood, MA, 1999
• 48: SEMTECH. 2006. AN1200.03 Application Note—Frequency Hopping. SEMTECH.
• 49: Ståhlberg, M. 2000. Radio jamming attacks against two popular mobile networks. In Proceedings of the Helsinki University of Technology Seminar on Network Security and Mobile Security, H. Lipmaa and H. Pehu-Lehtonen, Eds. Helsinki University of Technology.
• 50: Texas Instruments, Inc. 2001. MSP430x13x, MSP430x14x Mixed signal microcontroller. Datasheet.
• 51: Don J. Torrieri, Principles of Secure Communication Systems, Artech House, Inc., Norwood, MA, 1985
• 52: Torrieri, D. J. 1989. Fundamental limitations on repeater jamming of frequency-hopping communications. IEEE J. Select. Areas Commun. 7, 4, 569--575.
• 53: Tovmark, K. 2002. Chipcon application note AN014: Frequency hopping systems (rev. 1.0). Chipcon AS.
• 54: Tijs van Dam , Koen Langendoen, An adaptive energy-efficient MAC protocol for wireless sensor networks, Proceedings of the 1st international conference on Embedded networked sensor systems, November 05-07, 2003, Los Angeles, California, USA [doi>10.1145/958491.958512]
• 55: van Hoesel, L., Dulman, S., Havinga, P., and Kip, H. 2003. Design of a low-power testbed for wireless sensor networks and verification. Tech. rep. TR-CTIT-03-45, Centre for Telematics and Information Technology, University of Twente, The Netherlands.
• 56: van Hoesel, L. and Havinga, P. 2004. A Lightweight Medium Access Protocol (LMAC) for Wireless Sensor Networks: Reducing Preamble Transmissions and Transceiver State Switches. In Proceedings of the International Conference on Networked Sensing Systems (INSS).
• 57: van Lint, J. and Wilson, R. 2001. A Course in Combinatorics, 2nd ed. Cambridge University Press.
• 58: Vantran, K. 2003. WolfPack proves strength in numbers. DefenseLINK News.
• 59: Čagalj, M., Ganeriwal, S., Aad, I., and Hubaux, J.-P. 2004. On Cheating in CSMA/CA Ad Hoc Networks. Tech. rep. IC/2004/27, EPFL-IC.
• 60: Mario Cagalj , Srdjan Capkun , Jean-Pierre Hubaux, Wormhole-Based Antijamming Techniques in Sensor Networks, IEEE Transactions on Mobile Computing, v.6 n.1, p.100-114, January 2007 [doi>10.1109/TMC.2007.18]
• 61: Arvinderpal S. Wander , Nils Gura , Hans Eberle , Vipul Gupta , Sheueling Chang Shantz, Energy Analysis of Public-Key Cryptography for Wireless Sensor Networks, Proceedings of the Third IEEE International Conference on Pervasive Computing and Communications, p.324-328, March 08-12, 2005 [doi>10.1109/PERCOM.2005.18]
• 62: Anthony D. Wood , John A. Stankovic, Denial of Service in Sensor Networks, Computer, v.35 n.10, p.54-62, October 2002 [doi>10.1109/MC.2002.1039518]
• 63: Wenyuan Xu , Wade Trappe , Yanyong Zhang, Channel surfing: defending wireless sensor networks from interference, Proceedings of the 6th international conference on Information processing in sensor networks, April 25-27, 2007, Cambridge, Massachusetts, USA [doi>10.1145/1236360.1236423]
• 64: Wenyuan Xu , Wade Trappe , Yanyong Zhang , Timothy Wood, The feasibility of launching and detecting jamming attacks in wireless networks, Proceedings of the 6th ACM international symposium on Mobile ad hoc networking and computing, May 25-27, 2005, Urbana-Champaign, IL, USA [doi>10.1145/1062689.1062697]
• 65: Wenyuan Xu , Timothy Wood , Wade Trappe , Yanyong Zhang, Channel surfing and spatial retreats: defenses against wireless denial of service, Proceedings of the 3rd ACM workshop on Wireless security, October 01-01, 2004, Philadelphia, PA, USA [doi>10.1145/1023646.1023661]
• 66: Ye, W., Heidemann, J., and Estrin, D. 2002. An energy-efficient MAC protocol for wireless sensor networks. In Proceedings of the Annual Joint Conference of the IEEE Computer and Communication Society (Infocom). IEEE, New York, 1567--1576.
• 67: Wei Ye , John Heidemann , Deborah Estrin, Medium access control with coordinated adaptive sleeping for wireless sensor networks, IEEE/ACM Transactions on Networking (TON), v.12 n.3, p.493-506, June 2004 [doi>10.1109/TNET.2004.828953]
• 68: Honghai Zhang , Jennifer Hou, On deriving the upper bound of α-lifetime for large sensor networks, Proceedings of the 5th ACM international symposium on Mobile ad hoc networking and computing, May 24-26, 2004, Roppongi Hills, Tokyo, Japan [doi>10.1145/989459.989475]
• 69: Jerry Zhao , Ramesh Govindan, Understanding packet delivery performance in dense wireless sensor networks, Proceedings of the 1st international conference on Embedded networked sensor systems, November 05-07, 2003, Los Angeles, California, USA [doi>10.1145/958491.958493]
• 70: Zuniga, M. and Krishnamachari, B. 2004. Analyzing the transitional region in low power wireless links. In Proceedings of the 1st Annual IEEE Communications Society Conference on Sensor and Ad Hoc Communications and Networks (SECON). IEEE, 517--526.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Algorithms, Security

Keywords:
MAC protocols, clustering, denial-of-service attacks, expectation maximization, jamming