Wormhole Detection in Wireless Ad Hoc Networks

As mobile ad hoc network applications are deployed, security emerges as a central requirement. In this paper, we introduce the wormhole attack, a severe attack against ad hoc routing protocols that is particularly challenging to defend against. We show how an attacker can use the wormhole attack to cripple a range of ad hoc network routing protocols. In the wormhole attack, an attacker records packets (or bits) at one location in the network, tunnels them to another location, and retransmits them there into the network. Most existing ad hoc network routing protocols, without some mechanism to defend them against the wormhole attack, would be unable to find routes longer than one or two hops, severely disrupting communication. In this paper, we present the design of two protocols capable of detecting a wormhole attack at the receiver: the Slot Authenticated MAC protocol and the TIK protocol. Both protocols rely on tight time synchronization, which can be readily available through off-the-shelf hardware. These two protocols make different tradeoffs: the Slot Authenticated MAC is a simple, very resource-efficient approach based on a TDMA MAC, whereas TIK is a practical, novel approach that has somewhat higher network overhead and resource requirements, but features significantly reduced latency. The computational requirements of TIK are well within the range of existing handhelds computers. For example, in an 11Mbps wireless LAN, a Compaq iPaq 3870 PocketPC is capable of handling the maximum rate of cryptographic operations associated with TIK, using just 3% of its built-in memory and 18% of its CPU time.