Castor: Scalable Secure Routing for Ad Hoc Networks Wojciech Galuba, Panos Papadimitratos, Marcin Poturalski, Karl Aberer EPFL, Switzerland Zoran Despotovic, Wolfgang Kellerer Docomo Euro-Labs, Munich, Germany

Ad-hoc network routing challenges source destination

Ad-hoc network routing challenges source destination

Ad-hoc network routing challenges source destination Say this is costly, one of the paths fail, throwing bandwidth at the problem

Scale Mobility ? Security

Castor Continuously-Adapting Secure Topology-Oblivious Routing Secure route discovery Castor Secure data transmission Provides routes Avoids compromised nodes Evaluates routes Needs route redundancy Continuously-Adapting Secure Topology-Oblivious Routing Skip arrows

Topology-obliviousness The basic ideas of our approach To achieve what was on the prev slide we use Nodes only aware of their neighbors No routing information exchange no routes included in control traffic no routing table fragments exchanged

Flows instead of destinations An important feature of our protocol In-network state is maintained per-flow not per-destination Flow isolation  crucial for security

Castor – basic operation source destination PKTs contain the data payload ACKs follow the reverse path of PKTs

Local learning from failures v3 per-flow per-neighbor reliability estimator + + + - - v2 v1 v4 + + Locality: each node only aware of its neighborhood Autonomy: each node routes independently

Broadcast as a fallback v3 - - - v2 v1 v4 Autonomy: nodes independently decide wether to broadcast or unicast

Initial PKT flood source destination No reliability history  each node decides to broadcast the PKT ACKs are broadcasted back

Routing around failures source destination Failure  ACKs stop returning Local repair: on failure some nodes broadcast, most still unicast alternative route discovered without network-wide flood

Castor is failure agnostic Same recovery mechanism good for: Malicious PKT or ACK dropping Links broken by mobility Wider-area outages (e.g. jamming) Wormholes and tunnels

Trust model Untrusted cloud of intermediate nodes Security associations: Source to destination Neighbor to neighbor Simplest in the literature

Crucial property: flow state isolation v2 v5 v1 v4 v3 Isolate in-network states for the two flows Otherwise malicious flows could disrupt the benign flows node reliability v2 0.9 0.2 v3 0.6 0.95 v4 0.8 v5 0.1 Routing state at v1: In spite of the simple trust assumptions, still we can achieve th e

Ensuring flow isolation Flow authentication Nodes can recognize PKTs belonging to the same flow Only source can generate the next PKT ACK authentication Nodes can match ACKs to PKTs Only destination can generate correct ACK Achieved without public-key crypto

Evaluation 1Mbps 802.11b MAC 3 km x 3 km plane 1-20 m/s random waypoint mobility 5 flows, 4 packets/s, 100 nodes

Blackhole attack: adversary drops data packets - As the fraction of compromised nodes increases, Castor is able to maintain high levels of packet delivery rates, while the other protocols do not . - Higher granularity, per-link per-flow instead of per-route Blackhole attack: adversary drops data packets not control traffic

Bandwidth utilization under blackhole attack The bandwidth for proactive protocols is higher (SEAD and Sprout) For Castor the bandwidth consumption stays constant, despite the fact PKTs are 256 Bandwidth utilization under blackhole attack

Wormhole drops data packets, no mobility Complete recovery from wormholes

Scalability Mobility, 20% of balckholes Increasing the network size

Summary Simple PKT-ACK messaging Scalability Fast adaptation Security flow-control-ready applicable to other networks than MANETs Scalability No routing information exchanged Local repair, few network-wide floods Fast adaptation Security Failure agnosticism Flow state isolation

PKT – ACK pairing H xl h(h(h(b1)||x1)||x2) xl-1 h(h(b1)||x1) x2 h(b1) Root of the Merkle tree is the flow ID, used by the intermediate nodes for state isolation Source generates Merkle tree per-flow H Included in PKT xl h(h(h(b1)||x1)||x2) xl-1 h(h(b1)||x1) x2 h(b1) x1=h(b2) h(bw) b1=g(a1) b2=g(a2) bw=g(aw) a1 a2 an Included in ACK Included ecrypted in PKT, destination decrypts © 2009 EPFL, Docomo Euro-Labs

Time to recover from blackhole attack No mobility Time to recover from blackhole attack © 2009 EPFL, Docomo Euro-Labs