1. Cross Layer Architectures for Wireless Ad Hoc Networks PIs: Mart Molle, Srikanth V. Krishnamurthy Students: Ioannis Broustis, Arun Saha

2. Specialized capabilities at the physical layer can offer enhanced performance. Layered approaches fail to effectively exploit these capabilities. Goals are to design, simulate and implement cross- layer architectures that exploit these capabilities. In particular, we focus on: Smart antenna-based networking Power heterogeneity, and how it affects protocols UWB-based networking How and why to exploit the physical layer to support message-based protocols for authenticating the location of a node Objectives of this Work

3. Relation to WHYNET Because our WHYNET funding is limited, we are supporting this work from multiple sources. We are also using some of the technologies developed from those other efforts. We are building a WHYNET testbed with Xbow Motes Plan to integrate testbed with UCLA via CENIC in the next year.

4. In this Presentation … Brief overview of cross-layer techniques for solving the “proof of location” problem in ad hoc networks Find the physical location of a node, relative to its neighbors, without trusting it Nodes may be lost, broken or malicious

5. Proof-of-Location Problem: Background Work GPS navigation system –Inverse problem to our question: One node privately calculates its own position –Geometry problem is equivalent to ours Cellular 9-1-1 service: –Cell towers find location of mobile handset Towers have perfect time synchronization, known static positions, are all trustworthy…

6. Previous work on Timed-Echo Protocols for “proof-of-proximity” problem Sastry, et al. combine a radio challenge with an ultrasound reply –Sound is slow enough to measure easily, but easy to cheat –Does not authenticate the identity of the respondent Waters and Felten use radio for all messages, cryptography to secure messages against ID fraud –Users carry an external tamper-resistant, trusted hardware device (i.e.," smart card”) –Processing delay in the smart card is significant, but assumed constant and publicly known to all participants –Timing accuracy requirements seem unrealistic

7. Previous work related to accurate timing measurements Kennell and Jamieson used timed challenge-response to verify the configuration of a remote computer –How do I guard against being misrouted to an imposter? Brumley and Boneh steal a server’s private encryption key one bit at a time by measuring the response time to a sequence of queries –Decryption algorithm is iterative, like long division –Some iterations are skipped if data and key are related Both schemes assume only millisecond timing accuracy –Equivalent to distance error of LA to Santa Barbara Pasxtor and Veitch developed exotic GPS-enhanced network timing equipment to measure 1-way network delays –Testing showed significant differences between actual and intended transmit time by a host –0.5 ms for real-time OS, >10 ms for standard Linux-based system

8. Our Work: Use cross-layer support from Physical Layer to resolve problems not fixable at Layer 2 –Man-in-the-Middle attacks: Detect an intruder who inserts himself between nodes –Proxy attacks: Detect a “cheater” who wants to hide his absence from the assigned post by relaying his messages through a dumb relay at that location

9. Distance/Timing measurements: 2 frequencies, GPS-like geometry A C D B

10. Principle of inter-linked challenges Challenge K carries data needed to compute an “offline” response to challenge K+1 Response info is cached at the physical layer transceiver before challenge K+1 arrives Actual reply message is generated by the physical layer and transmitted immediately –Simple bit-wise XOR of cached response info with incoming challenge

11. Principle of partial response Man-in-the-Middle cannot benefit from relaying challenges and responses between bonafide nodes –Each node pair generates a unique session key –Reply message contains a small number of randomly chosen bits from the full response, chosen via the session key –MiM will receive useless bits from response

12. Challenge-Response Timing Diagram

13. Cheat-Resistant Features of our Approach Cross-layer generation of response messages prevents a cheater from starting its early, or transmitting at a slightly higher data rate to send the message in less time –Important because time stamps are based on the end-of- message-reception event, not start-of-reception –Can’t be hurried because next bit of the reply cannot be generated until the corresponding bit of new challenge is received Partial-response stops a man-in-the-middle –Even by knowing and relaying the challenge, he gets only a useless (for him) the response

14. Future Work Implementation using Motes or 802.11 Robust solution of the geometrical problem –How to handle measurement errors? Kalman filtering –Byzantine algorithms to handle failures