Channel Surfing and Spatial Retreats: Defenses against Wireless Denial of Service

Transcription

1 Channel Surfing and Spatial Retreats: Defenses against Wireless Denial of Service Wenyuan Xu, Timothy Wood, Wade Trappe, Yanyong Zhang WINLAB, Rutgers University IAB 2004

2 Roadmap Motivation and Introduction Detection MAC Layer Detection PHY Layer Detection DoS Defenses Channel Surfing Spatial Retreat Conclusions Ongoing works 2

3 Jamming Style DoS Bob Hello Hi Alice 3

4 Jamming Style DoS Bob Hello Hi Alice Mr. X 4

5 w2 Jamming Style Hello Hi Alice and Bob are DoS attacked by malicious Mr. X. Bob Alice A story for the problem of wireless denial of service attack we focus on. Alice and Bob two communicating nodes, A and B. Mr. X an adversarial interferer X. Mr. X s insane behavior the jamming style DoS. People and nodes in wireless network both communicate via shared medium. Mr. X R X1 Jamming style DoS Attack: Behavior that prevents other nodes from using the channel to communicate by occupying the channel that they are communicating on A X 1 B X 2 5

6 Slide 5 w2 DoS: An attack on a system or portion of a system that results in at least the temporary inability of others to use the system for its intended purpose wenyuan, 9/22/2004

7 @#$%% Hello Hi Jamming Style DoS Bob Alice Jamming style DoS: 2 styles MAC-layer DoS Bypass the MAC protocol, repeatedly send out packets Introduces packet collision PHY-layer DoS Jam transmission channel by emitting energy in the frequency band corresponding to the channel Mr. X Australian CERT [0]: This vulnerability makes a successful, low cost attack against a wireless network feasible for a semi-skilled attacker Previously, attacks against the availability of IEEE networks have required specialised hardware and relied on the ability to saturate the wireless frequency with high-power radiation, an avenue not open to discreet attack. This vulnerability makes a successful, low cost attack against a wireless network feasible for a semi-skilled attacker. A common example: turning on the Microwave is a piece of cake. [0] AusCERT,"AA denial of service vulnerability in IEEE wireless devices", 6

8 Our Jammers MAC-layer Jammer Mica2 Motes (UC Berkeley) 8-bit CPU at 4MHz, 512KB flash, 4KB RAM 916.7MHz radio OS: TinyOS Disable the CSMA Keep sending out the preamble Preamble Sync Packet PHY-layer Jammer Waveform Generator Tune frequency to 916.7MHz 7

9 Handling Jamming: Strategies What can you do when your channel is occupied? In wired network you can cut the link that causes the problem, but in wireless Make the building as resistant as possible to incoming radio signals? Find the jamming source and shoot it down? Battery drain defenses/attacks are not realistic! Protecting networks is a constant battle between the security expert and the clever adversary. Therefore, we take motivation from The Art of War by Sun Tze: He who cannot defeat his enemy should retreat. Detection Strategies MAC Detection PHY Detection Retreat Strategies: Spectral evasion Spatial evasion 8

10 Detection: MAC Layer and PHY Layer

11 DoS Detection MAC Layer Idea: Want to use channel state information to detect whether a jamming has occurred. Adversary CSMA (TinyOS) Model: There is one stationary Senses the channel until it detects the channel is idle. adversary, If collision, who wait continuously for a random time. (no blasts exponential on backoff) a single channel Adversary at Model: a time. We assume there is only one stationary adversary, who blasts on a single channel at any time. Observation: Normal scenario: nodes can pass the CSMA after some time DoS scenario: nodes might never passes the CSMA Challenges: How to discriminate a legitimate traffic jam from illegitimate traffic? What is a good model to minimize the probability of a false positive? Thresholding is the bread and butter of detection theory (Neyman-Pearson, Bayesian inference). Sensing time? 10

12 Empirically setting the threshold Problem with theoretically setting threshold: Its hard to model more complicated MACs! Let each network device collect statistics regarding waiting time D Experiment ns-2 simulator protocol Disabled the MAC layer retransmission Two nodes, A and B, collected the statistical data Using some streams (from sender Si to receiver Ri) to increase the interfering traffic Observation: When only a few streams exist, A can get the channel quickly with high probability As the number of streams increases, the competition for channel becomes more intense, thus taking longer for A to acquire the channel Cumulative Distribution A S 1 S 2 R 2 Cumulative Distribution of Sensing Time R 1 R 3 11 Sensing Time (ms) S 3 B

13 DoS Detection PHY Layer Idea: Want to use PHY layer information to detect whether a jamming has occurred Observations: Ambient noise levels in normal (including congested) scenarios and abnormal scenarios are statistically different. Challenges: How to capture the time variant properties efficiently? What is a good model to use for minimizing the probability of a false positive? Network devices can sample noise levels prior to DoS attack and build a statistical model describing usual energy levels in the network. Discrimination between normal noise level measurements and abnormal data by employing the various features of the data. Tools: 2 ψ statistics: Spectral Discrimination 2 χ statistics: Distributional Discrimination 12

14 DoS Detection PHY Layer Platform: Mica2 Motes (UC Berkeley) Use RSSI ADC to measure the signal strength The values are in inverse relationship to power (signal strength) Three scenario No communicator Three communicators (obey CSMA) Use waveform generator as jammer The noise level time series with a jammer and without a jammer are different No communicator Three communicators Jammer 13 Time

15 Defenses: Channel Surfing and Spatial Retreats

16 Network Types DoS detection can be employed by a single node, however, DoS defenses are group activities. R X1 Three different network scenarios are concerned: Two party radio communication Baseline case A X 1 B X 2 Infrastructured wireless network Consist of two types of device: access points and mobile devices Access points communicate with each other via wired infrastructure Mobile devices communicate via the access point to other mobile devices Mobile Ad Hoc Wireless Networks Composed of mobile devices without access points Mobile devices can communicate to each other via multi-hop routing protocol AP 1 AP 2 D A AP 0 X 0 C A B C D E X F G H I J X 1 B K L 15

17 Dos Defenses Channel Surfing Adversary Model: We assume there is only one stationary adversary, who blasts on a single channel at any time. Adversary Model: There is one stationary adversary, who continuously blasts on a single channel at a time. Objective: In case we are blocked at a particular channel, we want to resume the normal wireless communication with other legal nodes. Channel Surfing: If we are blocked at a particular channel, we can resume our communication by switching to a different (and hopefully safe) channel that does not overlap current channel. Inspired by frequency hopping techniques, but operates at the link layer System Issues: Must have ability to choose multiple orthogonal channels: Prevents Interference Practical Issue: PHY specs do not necessarily translate into correct orthogonal channels Example: MICA2 Radio recommends: choose separate channels with a minimum spacing of 150KHz but.. 16

18 Throughput VS. Channel Assignment Interferer Sender Receiver Sender sends the packet as fast as it can. Receiver counts the packet and calculates the throughput The radio frequency of the sender and receiver was fixed at 916.7MHz. Increased the interferer s communication frequency by 50kHz each time. When the Jammer s communication frequency increases to 917.5MHz, there is almost no interference 17

19 Throughput VS. Channel Assignment Interferer Receiver Sender Wave generator 18

20 Dos Defenses Channel Surfing System Issues (cont.): Orthogonal channels: The fact is that we need at least 800KHz to escape the interference. Therefore, explicit determination of the amount of orthogonal channels is important. How to determine which channel to hop? The adversary X may periodically stop its interference and try to find the new channel the nodes are currently on. Goal: Maximize the delay before X finds out the new channel Therefore, using next available channel is NOT good! Use a (keyed) pseudo-random channel assignment! Basic Channel Surfing Algorithm: Both parties detect DoS independently, and change to a pre-determined channel and establish communication there 19

21 Two Party Radio Communication A X 1 R X1 B Prototype: Two Berkeley motes A and B A sends out a packet to B every 200msecs Measure the packet delivery rate = #recv/#sent Used waveform generator as jammer X A and B try to detect the DoS attack periodically X 2 Code: task void checkdos() { sent = call SendMsg.send( TOS_BCAST_ADDR, sizeof(uint16_t), &beacon_packet); if(!sent){ if(++failures< thresh) post checkdos(); else post changechan(); } else { failures = 0;} } Packet Delivery Rate Channel Surfing Experiment Jammer turned on Trial Number (Time) Change channel 20

22 DoS Defenses Spatial Retreats Adversary Model: We assume there is only one stationary adversary, who blasts on a single channel at any time. Adversary Model: There is one stationary adversary, who continuously blasts on a single Objective: No channel to switch to...then find a new place to reestablish channel connectivity! at a time. What will you do when your nearby microwaves almost kills the wireless connection of your laptop? Spatial Retreats: In order to resume our communication under the jamming style attack, we should move to a place that is outside of the jamming regions System Issues: Where to move? How to ensure that both parties leave the adversary s interference range? How to maintain radio connectivity following a spatial retreat? How to adapt to non-circular jamming regions? 21

23 Two Party Radio communication Three stage protocol: Establish Local coordinates Exit the Interference Region Move into Radio Range 22

24 Two Party Radio communication Three stage protocol: Establish Local coordinates Decide the initial positions prior to the introduction of adversary Y A X B Determine a local coordinate system Agree on the direction of the retreats. for example, y axis. Exit the Interference Region Move into Radio Range 23

25 Two Party Radio communication Three stage protocol: Establish Local coordinates Decide the initial positions prior to the introduction of adversary Determine a local coordinate system Y A X X B Agree on the direction of the retreats. for example, y axis. Exit the Interference Region Move into Radio Range 24

26 Two Party Radio communication Three stage protocol: Establish Local coordinates Y A X Exit the Interference Region Once A and B detect the DoS scenario, they try to move away from adversary along the y-axis. A and B stop, as soon as they detect that it is out of the interference range. Problem: A and B cannot talk to each other any more. A1 X B B Move into Radio Range 25

27 Two Party Radio communication Three stage protocol: Establish Local coordinates Y A X Exit the Interference Region Once A and B detect the DoS scenario, they try to move away from adversary along the y-axis. A and B stop, as soon as they detect that it is out of the interference range. Problem: A and B cannot talk to each other any more. A1 X B B Move into Radio Range 26

28 Two Party Radio communication Three stage protocol: Establish Local coordinates Y A X Exit the interference Region B Move into Radio Range What if they bypass each other? Let B be master and A be slave. Only slave moves A moves along x-axis (toward B, never beyond B) What if moving into the interference range again? tops moving along the x-axis, moving along y-axis A1 X B 27

29 Two Party Radio communication Three stage protocol: Establish Local coordinates Y A X Exit the interference Region B Move into Radio Range What if they bypass each other? Let B be master and A be slave. Only slave moves A moves along x-axis (toward B, never beyond B) What if moving into the interference range again? tops moving along the x-axis, moving along y-axis A1 A2 X B 28

30 Two Party Radio communication Three stage protocol: Establish Local coordinates X Y A Exit the interference Region B Move into Radio Range X What if they bypass each other? A1 A2 Let B be master and A be slave. Only slave moves A moves along x-axis (toward B, never beyond B) A3 A A4 What if moving into the interference range again? B stops moving along the x- axis, moving along y-axis 29

31 Conclusions: Due to the shared nature of the wireless medium, it is an easy feat for adversaries to perform a jamming-style denial of service against wireless networks We proposed two approaches that a single node may employ to detect a DoS Attack MAC layer: monitoring the sensing time PHY layer: observing the noise levels in the channel We have presented two different strategies to defend against the jamming style of DoS attacks Channel-surfing: changing the transmission frequency to a range where there is no interference from the adversary Spatial retreat: moving to a new location where there is no interference 30

32 Ongoing works: Study the detection strategies Jammer turns on for 95% of the time and keeps silent for the rest of 5% of the time Jammer will start to jam only if someone is sending out the message Investigate the channel-surfing and spatial retreat algorithm in new wireless network topologies: Infrastructured wireless networks Ad-hoc network Study the defenses against DoS with other issues: High mobility High redundant (in sensor network) A large scale (approximately 50 nodes) jamming-tolerant sensor network is being developed and results will be reported soon. 31

33 Other Investigations Many wireless security threats are being addressed Secure routing protocol, Temporal Key Integrity Protocol (TKIP), 802.1x, privacy Validation of the possibility of DDOS in wireless by mathematical models.[1] Using FAIR-MAC to prevent nodes from monopolizing the channel. Prerequisite: every node follows the fair MAC protocol.[2] DOMINO: System for Detection Of greedy behavior in the MAC layer of IEEE public Networks. [3] However, the jamming style DoS is not well studied Australian CERT announced the issue of MAC layer weaknesses in MAC. [0] Mapping a jamming-area for sensor networks.[4] [1] Q. Huang, H. Kobayashi, and B. Liu, Modeling of Distributed Denial of Service Attacks in Wireless Network, IEEE Pacific Rim Conference on Communications, Computers and Signal Processing [2] V. Gupta, S. Krishnamurthy, and M. Faloutsos, Denial of Service Attacks at the MAC layer in Wireless Ad Hoc Network, IEEE Milcom 2002, Anaheim, California, October 7-10, 2002 [3] M. Raya, J. Hubaux, and I. Aad, DOMINO: a system to detect greedy behavior in IEEE hotspots, 2004, MobiSYS, pp [4] A. Wood, J. Stankovic, and S. Son, JAM: A jammed-area Mapping Service for Sensor Networks, 2003, 24th IEEE International Real-Time Systems Symposium, pp