260 likes | 407 Views
Witness-based Detection of Forwarding Misbehavior in Wireless Networks. Sookhyun Yang , Sudarshan Vasudevan, Jim Kurose University of Massachusetts Amherst. Outline. Introduction Witness-based detection: approach Witness-based detection: properties Detection accuracy with unreliable links.
E N D
Witness-based Detection of Forwarding Misbehavior in Wireless Networks Sookhyun Yang, Sudarshan Vasudevan, Jim Kurose University of Massachusetts Amherst
Outline Introduction Witness-based detection: approach Witness-based detection: properties Detection accuracy with unreliable links
Motivation • In a wireless ad-hoc network, an authenticated node on forwarding path can be compromised • Goal: verify that each node on data forwarding path is correctly forwarding packets • Control-plane verification: against routing control disruption • Data-plane verification: against forwarding misbehavior • This paper: witness-based detection to verify correct (data-plane) forwarding, identify source(s) of forwarding misbehavior.
Problem Statement data data data data ack ack ack ack Reliable hop-by-hop data forwarding in a wireless ad hoc network S A B C D Destination Source
Problem Statement data data data data ack ack ack ack Reliable hop-by-hop data forwarding in a wireless ad hoc network S A B C D Destination Source Question: How to verify that node B correctly forwards frame to C on S-A-B-C-D path? 5
Prior Work: Neighborhood Watch Node B’s transmission range Node A’s transmission range W data data A B C Witness node W overhears A and B, decides B’s forwarding correctness based on mismatch rate between incoming and outgoing data packets at B. Decision is error-prone so approach depends on long-term or cumulative observation for high accuracy!
Prior Work: Data-path-based Detection Data A B C ACK ACK Without witness nodes, upstream node A decides node B’s forwarding correctness based on node C’s ACK packet forwarded by node B. Decision is also error prone: node C can be compromised and a reverse path from node C to node A can be unreliable!
Outline Introduction Witness-based detection: approach Witness-based detection: properties Detection accuracy with unreliable links 8
Our Work: Witness-based Detection Node C’s transmission range Node B’s transmission range W Evidence Data A B C Evidence ACK W Evidence Upstream node A decides node B’s forwarding correctness based on “tamper-proof evidence” transmitted through diverse paths.
Tamper-proof Evidence H[ ] Message KB( ) |addr(C) M Node B says “I sent message M to node C.” Address of a data recipient, node C Private key of a data forwarder, node B • B-signed message checksum: • Timestamp t
Node C’s Evidence Generation W B C “ACK-based Evidence” KC( ) , tc B-Signed message checksum , H[M|addr(C)] Data = M | B-Signed message checksum Node C says “I received message M at tc from node B.”
Node W’s Evidence Generation 1. W generates “Data-based evidence”: KW(B-Signed message checksum, H[M|addr(C)], tW) Node W says “I overheard message M at tw from node B.” W B C ACK-based evidence Data = M | B-Signed message checksum W 2. W relays “ACK-based evidence: Node W says “I overheard node C saying it (node C) received message M at tc from node B”
Node A’s Decision Algorithm on Node B • Initially assume that once evidence is successfully generated, evidence does not fail to reach node A. • Lemma1: No evidence implies that node B does not correctly forward a data packet to node C. • Lemma2: Consistent evidence implies node B correctly forwards a data packet to node C. • For deriving whether evidence is consistent, upstream node A knows the correct checksum and message order. • If the checksum and message order of evidence do not have difference from node A’s, we call that evidence consistent.
Outline Introduction Witness-based detection: approach Witness-based detection: properties Detection accuracy with unreliable links 14
When Node B is Compromised W B C A compromised Packet drop: no evidence received at A
When Node B is Compromised W Inconsistent evidence compromised B C A ? Fake forwarding: inconsistent Data-based evidence received from witness node W and no ACK-based evidence from node C
What if Node W or C is Compromised? W compromised Inconsistent evidence Data packet B C A Consistent evidence • Badmouthing: W or C is compromised • W or C can generate fake inconsistent evidence for falsely accusing uncompromised node B. • If there is at least one uncompromised node, node A can receive consistent evidence from that node. • If there is no collusion, node A can recognize node W is compromised.
When Multiple Nodes Are Compromised W1 compromised Inconsistent evidence Inconsistent evidence B C A compromised W2 Consistent evidence • Node B is not compromised • If there is at least one uncompromised node, node A receives consistent evidence as well as inconsistent evidence.
When Multiple Nodes Are Compromised W1 compromised B C A compromised W2 • Node B is compromised • If node B and node W1 do not collude, consistent evidence cannot exist.
Outline Introduction Witness-based detection: approach Witness-based detection: properties Detection accuracy with unreliable links 20
Detection Accuracy in Lossy Links • With reliable links, witness-based detection has no detection errors. • Using an analytical model, we compare data-path-based detection with witness-based detection in lossy links. • ploss: the loss probability that a node fails to receive or overhear a packet from its one-hop neighbor • pc: the probability that a node is compromised • Λ: the expected number of witness nodes based on 2D-Poisson distribution • Metric • FPP (False Positive Probability) • FNP (False Negative Probability): Without collusion, FNP is equal to 0 in both detection schemes.
Detection Accuracy in Lossy Links Data-path-based detection pc=0.5 Consistent evidence can be lost in lossy links. As density of witness nodes (Λ) grows, FPP decreases by enhancing the availability of consistent evidence.
Detection Accuracy in Lossy Links When a link is reliable, case 2 (badmouthing) dominates FPP. When a link is unreliable, FPP by case 1 increases, but FPP by case 2 decreases.
Conclusion • Witness-based detection makes instantaneous decision more precise by using witness nodes, rather than longterm or cumulative observation. • Witness-based detection supports error-free detection under various threat scenarios in reliable links. • Using an analytical model, we showed that witness-based detection can support low FPP and no FNP even in the presence of lossy wireless links.
Open Questions Collusion Evaluation of Communication Overhead
Thank you! Q&A