Your SlideShare is downloading. ×
Antijam ipsn09
Upcoming SlideShare
Loading in...5

Thanks for flagging this SlideShare!

Oops! An error has occurred.


Introducing the official SlideShare app

Stunning, full-screen experience for iPhone and Android

Text the download link to your phone

Standard text messaging rates apply

Antijam ipsn09


Published on

Published in: Technology, Business

  • Be the first to comment

  • Be the first to like this

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

No notes for slide


  • 1. Anti-Jamming for Embedded Wireless Networks Miroslav Pajic and Rahul Mangharam Department of Electrical and Systems Engineering University of Pennsylvania {pajic, rahulm}@seas.upenn.eduABSTRACT ded wireless networks for time-critical and safety criti-Resilience to electromagnetic jamming and its avoidance cal operation such as in medical devices and industrialare difficult problems. It is often both hard to distin- control networks, it is essential that mechanisms for re-guish malicious jamming from congestion in the broad- silience to jamming are native to the communication pro-cast regime and a challenge to conceal the activity pat- tocol. Resilience to jamming and its avoidance, collec-terns of the legitimate communication protocol from the tively termed as anti-jamming, is a hard practical prob-jammer. In the context of energy-constrained wireless lem as the jammer has an unfair advantage in detectingsensor networks, nodes are scheduled to maximize the legitimate communication activity due to the broadcastcommon sleep duration and coordinate communication nature of the channel. The jammer can then emit a se-to extend their battery life. This results in well-defined quence of electromagnetic pulses to raise the noise floorcommunication patterns with possibly predictable inter- and disrupt communication. Communication nodes arevals of activity that are easily detected and jammed unable to differentiate jamming signals from legitimateby a statistical jammer. We present an anti-jamming transmissions or changes in communication activity dueprotocol for sensor networks which eliminates spatio- to node movement or nodes powering off without sometemporal patterns of communication while maintaining minimum processing at the expense of local and networkcoordinated and contention-free communication across resources.the network. Our protocol, WisperNet, is time-synchronized In the case of energy-constrained wireless sensor net-and uses coordinated temporal randomization for slot works, nodes are scheduled to maximize the commonschedules and slot durations at the link layer and adapts sleep duration and coordinate communication to extendroutes to avoid jammers in the network layer. Through their battery life. With greater network synchroniza-analysis, simulation and experimentation we demonstrate tion, the communication is more energy-efficient as nodesthat WisperNet reduces the efficiency of any statisti- wake up from low-power operation just before the com-cal jammer to that of a random jammer, which has the mon communication interval. Such coordination intro-lowest censorship-to-link utilization ratio. WisperNet is duces temporal patterns in communication with predictablemore energy efficient than low-power listen CSMA pro- intervals of transmission activity. Channel access pat-tocols such as B-mac and is simple to analyze in terms of terns make it efficient for a jammer to scan and jam theeffective network throughput, reliability and delay. Wis- channel only during activity intervals. The jammer canperNet has been implemented on the FireFly sensor net- time its pulse transmission to coincide with the pream-work platform. bles of packets from legitimate nodes and thus have a high censorship to channel utilization ratio while remain-1. INTRODUCTION ing difficult to detect. The jammer is thus able to ex- ploit the temporal patterns in communication to disrupt Jamming is the radiation of electromagnetic energy in a transmission of longer length of legitimate transmis-a communication channel which reduces the effective use sions with a small set of jamming pulses.of the electromagnetic spectrum for legitimate commu- For nodes in fixed locations, a jammer can select re-nication. Jamming results in a loss of link reliability, gions with heavier communication activity or denser con-increased energy consumption, extended packet delays nectivity to increase the probability that a random jam-and disruption of end-to-end routes. Jamming may be ming pulse results in corrupting an on-going transmis-both malicious with the intention to block communica- sion. Nodes in the proximity of the jammer will enduretion of an adversary or non-malicious in the form of un- a high cost of operation in terms of energy consumptionintended channel interference. In the context of embed- and channel utilization with a low message delivery rate. They must either physically re-locate or increase the cost of their links so the network may adapt its routes.
  • 2. Methods for anti-jamming must therefore address threats 4. Coordinated changes of slot sizes: All nodesdue to both temporal patterns at the link layer and spa- must be aware of the current and next slot sizes. This istial distribution of routes in the network layer. Our very important because any incompatibility or synchro-goal is to reduce or eliminate spatio-temporal patterns in nization error would disable communication between le-communication while maintaining energy-efficient, coor- gitimate nodes.dinated and collision-free operation in multi-hop wire- 5. Collision-free transmission: Communication mustless sensor networks. We achieve this by incorporat-ing coordinated temporal randomization for slot sched- satisfy the hidden terminal problem so that a transmit slot of a given node does not conflict with transmit slotsules and slot durations between each node and its k-hop neighbors. This prevents the jammer from predict- of nodes within its k-hop interference the epoch and length of the next activity on the The rest of this paper is organized as follows: In Sec-channel. Such mechanisms reduce the effectiveness of tion 2, we provide a background and related work forany statistical jammer to that of a random pulse jam- energy efficient protocols and energy efficient jammingmer. While temporal randomization prevents statisti- schemes. In Section 3, we provide an overview of thecal jammers from determining any useful packet inter- WisperNet anti-jamming protocol and describe the co-arrival distribution for preemptive attacks, it still has an ordinated temporal randomization scheme. In Sectionefficiency of a random jammer and can achieve censor- 4, we describe the WisperNet coordinated spatial adap-ship which increases linearly with channel utilization and tation scheme. Section 5 describes our implementationjamming activity. To avoid such random jammers which experiences and experimental results followed by the con-are co-located near nodes with active routes, we employ clusion.adaptive routing to select paths such that the highestpossible end-to-end packet delivery ratios are achieved. 2. BACKGROUND AND RELATED WORKWe combine the above temporal and spatial schemes in To understand the inherent tradeoff between energya tightly synchronized protocol where legitimate nodes efficient link protocols with well-defined schedules andare implicitly coordinated network-wide while ensuring their susceptibility to jamming attacks, we first describeno spatio-temporal patterns in communication are ex- the different types of jammers and their impact on var-posed to external observers. ious types of link layer protocols. We then highlight a In the context of multi-hop embedded wireless net- particular class of statistical jammers and their impactworks, which are battery-operated and require low-energy on energy-efficient sensor network link protocols.consumption, we require the following properties fromthe anti-jamming protocol: 2.1 Jammers and Trade-offs with Jamming1. Non-predictable schedules: Transmission instances 2.1.1 Comparison of Jamming Models(e.g. slot assignments) are randomized and non-repeatingto prevent the jammer from predicting the timing of the In [1] and [2], Xu et al. introduce four common typesnext slot based on observations of channel activity. In of jammers: constant, random, reactive and deceptive.this way, even if the jammer successfully estimates slot Constant jammers continually emit a jamming signal andsizes, it has to transmit pulse attacks at an interval of achieve the highest censorship of packets corrupted to to-the average slot duration to corrupt communication be- tal packets transmitted. The constant jammer, however,tween nodes. is not energy-efficient and can be easily detected and lo- calized. The random jammer is similar to the constant2. Non-predictable slot sizes: Slots are randomly jammer but operates at a lower duty cycle with intervalssized on a packet-by-packet basis in order to prevent the of sleep. A random jammer transmits a jamming signaljammer from estimating the duration of channel activity at instances derived from a uniform distribution with afor energy efficient reactive jamming. This requirement known minimum and maximum interval. The censorshipfurther reduces the jammer’s lifetime as it will need to ratio of the random jammer is constant and invariantemploy the smallest observed slot duration as its jam- to channel utilization. At low duty cycles, the randomming interval. jammer is difficult to detect and avoid. A reactive jam-3. Coordinated and scheduled transmission: The mer keeps its receiver always on and listens for channelcommunication schedule according to which a node trans- activity. If a known preamble pattern is detected, themits is known to all of its legitimate neighbors so they reactive jammer quickly emits a jamming signal to cor-can wake up to receive the message during its trans- rupt the current transmission. Reactive jammers, whilemission slot. This also prevents nodes from turning on effective in corrupting a large proportion of legitimatetheir receiver when no legitimate activity is scheduled packets, are not energy efficient as the receiver is alwaysand hence reduces the likelihood of a jammer draining on. A deceptive or protocol-aware jammer is one thatthe energy of a node. has knowledge of the link protocol being used and the dependencies between packet types. Such a jammer ex-
  • 3. ploits temporal and sequential patterns of the protocol jammer has influence over the network. A jammed-areaand is very effective. mapping protocol is described in [7] which can be used to In [3], a statistical jamming model is described where delineate regions affected by a jammer. Such informationthe jammer first observes temporal patterns in channel can ultimately be used for network routing. One of theactivity, extracts a histogram of inter-arrival times be- requirements of the protocol is that every node knowstween transmissions and schedules jamming pulses based its own position along with positions of all its neighbors.on the observed distribution. This results in a very ef- Our proposed solution, WisperNet, does not require suchfective jammer that is not protocol-aware and is also dif- position and direction information and directly computesficult to detect. A statistical jammer chooses its trans- routes with the highest end-to-end packet delivery rate.mission interval to coincide with the peak inter-arrivaltimes and is thus able to maximize its censorship ratio 2.2 Impact of Jamming on MAC Protocolswith relatively little effort. Fig. 1(a) illustrates the rela- We now investigate the characteristics of different classestive censorship ratio and the energy-efficiency of the dif- of sensor network link protocols and the impact of a jam-ferent jammers. Fig. 1(b) illustrates the relative stealth mer on each class.or difficulty in detection. We observe that the statisticaljammer has a high censorship ratio with both energy- 2.2.1 Energy-Efficient MAC Protocolsefficient and stealthy operation and hence focus on com- Several MAC protocols have been proposed for low-bating such jamming in the remainder of this paper. power operation for multi-hop wireless mesh networks.2.1.2 Techniques for Robust Transmission Such protocols may be categorized by their use of time synchronization as asynchronous [8], loosely synchronous [9, The traditional defenses against jamming include spread 10] and fully synchronized protocols [11, 12]. In general,spectrum techniques[4] at the physical layer. While spread with a greater degree of synchronization between nodes,spectrum and frequency hopping techniques are impor- packet delivery is more energy-efficient due to the min-tant physical layer mechanisms for combating jamming, imization of idle listening when there is no communica-additional protection is required at the packet-level. As tion, better collision avoidance and elimination of over-in the case of standard wireless protocols such as IEEE hearing of neighbor conversations.802.11 and Bluetooth, the jammer may know the pseudo- Asynchronous protocols such as Carrier Sense Mul-random noise code or frequency hopping sequence. tiple Access (CSMA) are susceptible to jamming both at There have been several efforts to make communica- the transmitter (busy channel indication) and at the re-tion in sensor networks more robust in the presence of ceiver (energy drain). The Berkeley MAC (B-MAC) [8]a jammer. In [5], Wood et al. described DEEJAM, a protocol performs the best in terms of energy conserva-link layer protocol that includes several schemes for ro- tion and simplicity in design. B-MAC supports CSMAbust IEEE 802.15.4 based communication for reactive with low power listening (LPL) where each node peri-and random jammers. While mechanisms such as cod- odically wakes up after a sample interval and checks theing and fragmentation are proposed, the jammer still channel for activity for a short duration of 0.25ms. If thehas a competitive advantage in that it may increase the channel is found to be active, the node stays awake topower of its jamming signal and a single jamming sig- receive the payload following an extended preamble. Us-nal is capable of jamming multiple links in the vicinity. ing this scheme, nodes may efficiently check for neighborThe authors assume that reactive jammers can be con- activity while maintaining no explicit schedule which asidered energy-efficient. Current radio transceivers with statistical jammer may exploit.the IEEE 802.15.4 physical layer of communication, use Loosely-synchronous protocols such as S-MAC [9]almost the same, if not greater, energy for receiving as and T-MAC [13] employ local sleep-wake schedules knowthey do for transmission [6]. as virtual clustering between node pairs to coordinate In cases where resilience to jamming is not possible, itis useful to detect and estimate the extent to which the (a) (b)Figure 1: (a) Jammer’s Energy efficiency vs. Figure 2: Comparison of robustness to jammingCensorship ratio and (b) Energy efficiency vs. and energy efficient operation of sensor MACStealth protocols
  • 4. 0.1 0.25 0.08 0.2 Probability 0.06 0.15 Probability 0.04 0.1 0.02 0.05 0 0 0 50 100 150 200 250 0 10 20 30 40 50 Interarrival times [ms] Interarrival times [ms] Figure 3: SMAC PDF for 15% utilization Figure 4: RT-Link PDF for 15% utilizationpacket exchanges while reducing idle operation. Both S-MAC, we observe that all nodes quickly converge onschemes exchange synchronizing packets to inform their one major activity period of 215ms. In Fig. 3, we alsoneighbors of the interval until their next activity and use notice a spike close to 2ms. This is the interval betweenCSMA prior to transmissions. S-MAC results in clus- the transmission of control packets and data packets attering of channel activity and is hence vulnerable to a the start of an activity period. In the case of RT-Link,statistical jammer. we simulated four flows with different rates and hence Synchronous protocols such as RT-Link [12], uti- observe 4 distinct spikes in Fig. 4. The other spikes withlize hardware based time synchronization to precisely lower intensity are harmonics due to multiples of 32 slotsand periodically schedule activity in well-defined TDMA in a frame. In both cases we observe distinct inter-arrivalslots. RT-Link utilizes an out-of-band synchronization patterns which enable a statistical jammer to efficientlymechanism using an AM broadcast pulse. Each node is attack both protocols.equipped with two radios, an AM receiver for time syn- 2.3 Assumptionschronization and an 802.15.4 transceiver for data com-munication. A central synchronization unit periodically We make several assumptions in the design and evalua-transmits a 50μs AM sync pulse. Each node wakes up tion of WisperNet. We assume the jammer is as energy-just before the expected pulse epoch and synchronizes constrained as a legitimate node and must maintain athe operating system upon detecting the pulse. As the stealth operation with a low duty-cycle. All packetsout-of-band sync pulse is a high-power (30W) signal with exchanged between nodes are encrypted with a groupno encoded data, it is not easily jammed by a malicious key shared by legitimate nodes and hence the jammersensor node. is not protocol-aware. We consider both malicious and In general, RT-Link outperforms B-MAC which in turn non-malicious jamming and do not differentiate betweenout-performs S-MAC in terms of battery life across all them as the anti-jamming mechanisms are native to theevent intervals [12]. Fig. 2 shows the relative node life- link and network protocol. The transmission power istimes for 2AA batteries and similar transmission duty 0dBm (1mW) and in the worst case (with maximumcycles. Here node lifetimes for CSMA, S-MAC, B-MAC, power link jamming) the nominal packet delivery rateand RT-link are 0.19, 0.54, 0.78 and 1.5 years respec- is never below ˜ 20%. This has been demonstrated in pre-tively for a network of 10 nodes with a 10s event sam- vious experiments [12]. For simplicity, we presume thatple period (based on measurement values from [12], [9]). interference range is equal to the transmission range ofWhile RT-Link nodes communicate in periodic and well- one hop. This restriction does not limit our results. Wedefined fixed-size time slots, a statistical jammer is able assume all communication is between a central gatewayto easily determine the channel activity schedule and du- and each of the nodes across one or more hops.ration of each scheduled transmission. An attacker can 3. ANTI-JAMMING WITH COORDINATEDglean the channel activity pattern by scanning the chan- SPATIO-TEMPORAL RANDOMIZATIONnel and schedule a jamming signal to coincide with thepacket preamble at the start of a time slot. An effective approach to diminish the impact of a sta- tistical jammer on TDMA-based MAC protocols is to2.2.2 Statistical Jamming eliminate the possibility to extract patterns in commu- We focus on the statistical jammer’s performance with nication. These patterns appear as a result of the use ofS-MAC and RT-Link as both result in explicit patterns fixed schedules which are set when a node joins a net-in packet inter-arrival times. We do not consider B-MAC work and are assumed to repeat till the network is dis-as we aim to leverage the more energy-efficient RT-Link banded. Such simple and repetitive patterns are main-as a base synchronized link-layer mechanism for Wisper- tained with tight time synchronization and result in min-Net. We simulated a network of 10 nodes in each case, imal energy consumption, deterministic end-to-end delaywith a 3ms average transmission duration. In the case of and perhaps maximal transmission concurrency. In order
  • 5. to limit the impact of statistical jamming but still ben- ical wireless link between two nodes. The physical net-efit from the above energy and timeliness performance, work topology is logically pruned by disabling desiredwe maintain the time synchronization but change the links. In order to logically remove a link, a node is sched-schedule, transmission duration and routes in a random- uled to sleep during that particular neighbor’s transmis-ized yet coordinated manner along small time scales. sion, thereby ignoring that transmission. By forming Two components of the WisperNet protocol are Co- a directed acyclic graph we are able to efficiently as-ordinated Temporal Randomization (WisperNet-Time) sign non-colliding schedules that can be changed for ev-and Coordinated Spatial Adaptation (WisperNet-Space), ery frame, as shown in Fig. 5(b). Links marked by thewhich perform different actions in the temporal and spa- dashed line are inactive but must be accounted for bytial domains respectively. WisperNet-Time is designed any graph coloring defeat statistical jammers. By randomizing the com- The algorithm for schedule randomization is organizedmunication in time, a statistical jammer’s performance in a distributed manner. Every node uses a Pseudo-is reduced to that of a random jammer as the distribu- Random Function (PRF) to obtain its transmission sched-tion of packet inter-arrival times is flat. No timing-based ule from the current network key and its node ID. Thescheme can reduce the probability of being jammed by transmission schedule consists of different slot indexesa random pulse jammer. In this case, the only way to that can be used for transmission to neighboring nodes.decrease the jamming impact is by avoiding the jammed The schedule changes for every frame (i.e. 32 slots) andareas using WisperNet-Space. WisperNet-Space imple- during a frame, a node transmits only on the time-slotsments adaptive network routing as a jamming avoidance determined by its PRF output. After transmission, ev-mechanism to use links which are less affected by the ery node goes to sleep, setting its sleep timer to wakejammer, if possible. Both WisperNet-Time and WisperNet- up for the earliest receive or transmit slot. In this waySpace incorporate on-line algorithms where the network energy consumption is reduced to continuously monitored and node operations are ad- To obtain non-repeating schedules, but with full co-justed in time and space. ordination between nodes, the PRF computed by ev- ery node uses the current active network key along with3.1 WisperNet-Time: Co-ordinated Temporal its node ID. Once in a cycle, between two synchroniza- Randomization tion pulses, the gateway broadcasts the active keys for The main requirement for the proposed protocol is the the next cycle. The keys, members of the one-way keyprovision of tight time synchronization between nodes. chain, are generated during gateway’s initialization andIn order to keep coordination between nodes, all nodes are stored in its memory. All keys from this chain arehave to be informed about current network state in terms calculated from randomly chosen last key Kn by repeat-of current slot schedule, current slot duration and cur- edly applying one-way function F (as shown in Fig. 6):rent active network topology. We achieve this by build-ing upon the FireFly sensor network platform [14] and Kj = F (Kj+1 ), j = 0, 1, 2, ...n − 1.using the basic synchronization mechanisms adopted in As F is a one-way function, all previous members ofthe RT-Link protocol. All communication with RT-Link chain (K0 , K1 , ..., Kj−1 ) can be calculated from someis in designated time slots. 32 time slots form a frame chain element Kj but subsequent chain members Kj ,and 32 frames form a cycle. The time sync pulse is re- Kj+1 ,...,Kn [15] cannot be derived. This authenticationceived once every cycle. Each FireFly node is capable scheme is similar to [16, 17] but its use for scheduling isof both hardware-based global time synchronization and in-band time sync. A second requirement We use the SHA1-HMAC[18] keyed-hash function tofor WisperNet is that changes in state should require generate the current slot schedule. Therefore, for sched-minimum gateway-to-node communication and no state ule computation HM AC(ID, Kj ) is used, where Kj presentsinformation exchange between nodes. All communica- currently active network key (member of the one-way keytion must be encrypted and authenticated so that an chain). SHA1-HMAC outputs 160 bits which are used toeavesdropper may not be able to extract the logical stateof the network. We describe the authentication and im-plicit coordination scheme in the following section andthe synchronization mechanism in the Implementationsection.3.1.1 Schedule Randomization The first step toward schedule randomization is a prun- (a) Physical network (b) Logical network topologying of the physical network topology graph into a di- topologyrected acyclical graph. Fig. 5(a) shows an example net- Figure 5: (a)Example network topology (b)itswork topology graph, where each edge represents phys- collision-free transmit schedule from frame-to- frame
  • 6. message in the same slot due to a lower precedence. This results in a lower end-to-end bandwidth and an increase in a message delay. However, this issue has a fairly low probability of occurring in networks for sensor networks with a low to moderate duty cycle.Figure 6: Generation of keys at the gateway, us-ing a one-way hash function. 3.1.2 Slot size randomizationspecify the schedule of transmission slots for each of the Even though the statistical jammer uses energy effi-32 frames. These 160 bits are divided into 32 groups of cient pulse attacks, the proposed schedule randomiza-5-bits, where the node’s transmit schedule in i-th frame tion reduces its efficiency to that of a random jammer.(i = 0, 1, 2, ...31) is determined by i-th group of 5 bits. However, with the schedule randomization, an adversaryThese 5 bits represent the index of one of the 32 frame’s is able to estimate slot sizes from the probability distri-slots, eventually used for transmission. bution function (PDF) of packet inter-arrival times [3]. Implicit Schedule Conflict Resolution This statistical jamming scheme allows the jammer toThis approach for determining the transmission schedule transmit short pulse attacks at beginning of each slot,locally can introduce a problem of potential interference therefore corrupting all communication attempts. Al-that may occur when neighboring nodes are assigned the though this jamming scheme is less energy efficient thansame random slot. To prevent this, every node, in addi- a fixed schedule TDMA protocol, it is still more efficienttion to its schedule, calculates a slot precedence (or pri- than a random jammer.ority) for every transmission. The precedence for the i-th Slot size randomization is implemented in a similarframe’s transmission schedule is determined by (32 − i)- manner to slot schedule randomization, using SHA1-th 5 bits group (i.e. reverse order of the transmission HMAC, as schedule randomization, but with one impor-schedule). Since there is an even number of frames, tant difference. Instead of using the last revealed keythe transmission schedule and precedence are never ex- for the slot size calculation, every node uses a sharedtracted from same group of bits. Therefore, to compute predefined key, Kslot , and the network’s state counterits schedule in one sync period with 32 frames, each node cnt. Therefore, for slot size randomization the PRF ishas to calculate exactly one SHA1-HMAC function for calculated as HM AC(cnt, Kslot ). The cycle counter isitself, and one SHA1-HMAC per node for all nodes in its transmitted in the header of each packet and is incre-k-hop interference range. We assume the node IDs of all mented every cycle. Kslot is intentionally a local key sok-hop neighbors are known (when node joins the network that a node joining the network will be able to synchro-it broadcast its ID to all its neighbors in k-hop range). nize its slot sizes after receiving one legitimate packet.Given the IDs for all nodes in its k-hop radius, a node The SHA1-HMAC’s output, which is also calculated oncalculates the schedule and precedence for all of neigh- a frame-by-frame basis, defines the slot size for the nextbors as shown in Figure 7. After schedule conflicts are frame as shown in Fig. 8. The network’s state counterresolved implicitly based on the higher precedence, the represents the number of sync pulses received by the net-node follows the combined transmit and receive schedule work, and its value is exchanged between neighboringin a single vector. Proposed solution introduces some ad- nodes in the header of every packet. Here we assumeditional memory and processing requirements considered that every sync pulse is received as it is a global andin details in implementation section. high-power AM pulse. Therefore it is only nodes who The proposed slot conflict resolution can have minor want to join an already operational network need to beinefficiencies when a node with a higher transmit prece- informed about current network counter. The proposeddence for a particular slot does not have any message to coordinated slot size randomization scheme assures thatsend, while the another node is not allowed to send its all nodes know the current frame’s slot sizes and al- lows them to calculate an accurate time interval for their transmissions/receptions. If a key from the key chain is used for slot size cal- Figure 8: Slot size randomization on a frame-by- Figure 7: Implicit conflict resolution frame basis
  • 7. culation instead a predefined one, in cases when node factor (U ) on the PDF of inter-arrival times and showdoes not receive a key from the gateway would result in that it has very little influence with the proposed scheme.complete loss of synchronization. Without correct infor- This is one of the major benefits of WisperNet-Time,mation about a slot size, nodes that do not know the because for other protocols the only way to reduce spikescurrent frame size are not able to schedule themselves in the PDF is to reduce the utilization factor, as proposedto wake-up for the expected sync pulse. With the prede- in [3]. Results for PDF of inter-arrival times are shownfined key used for slot size calculations, nodes are always in in Fig. 9 for U = 50%, where slot sizes were randomlyable to know size of each frame, therefore they can sched- chosen from one of the 32 possible values in desired span.ule their awakening on time. While channel utilization has an effect to the PDF, it is Slot sizes have values from a discrete set, where the set to a signficantly smaller extent than in B-MAC’s case.size is determined by the number of PRF output bits. We observe that the peak of the PDF is less than 2%The number of values used for slot sizes and relative and no patterns can be extracted by the jammer. With Udistance between them have direct influence on PDF of below 50%, a small increment can be seen on spikes in (5packet inter-arrivals times. The goal of our anti-jamming 10]ms interval. Also with integer multiples of some slotscheme is to have a uniform PDF, or at least a PDF with sizes within [1 5]ms interval, influence of U can almostspikes flattened as much as possible, which does not allow be ignored. Due to the uniform distribution for all threetiming information extraction. It is recommended that cases of U it is not possible to extract slot sizes. Even ifat least 8 slot sizes with small relative difference between the PDF is derived from a smaller statistical sample size,them be used. the results are similar due to the pseudo-randomness of Slot size randomization requires additional memory re- the slot size.sources if nodes need to send some fixed-size data blockin a fixed time interval. In this case slot sizes can be both 3.2.1 Impact on End-to-end Delaysmaller and bigger than the size necessary for data block To analyze how the slot size changes affect the end-transmission, which can result in lower network utiliza- to-end delay, we simulated a 1-dimension chain with 20tion in former case or data congestion in later case. In nodes. In every frame, each node forwards the previouslythe latter case, a portion of the data available for trans- received data to next node. If the slot size is smaller thanmission will have to be buffered in node’s internal queue necessary to transmit the backlogged data, the maxi-till the next transmission slot occurs. In this case, the mum allowed packet size is sent and a rest of the data isaverage slot size must be larger than slot size needed buffered. In a simulated chain, the source node receivesfor one data block transmission. The size of the queue fixed size data blocks at a fixed interval and at a slightlyneeded in every node is directly connected with ratio smaller size than for an average slot size (e.g. 3ms).between these two sizes. Fig. 10 presents PDF and CDF of delay at last node for different slot’s size quantizations. We observe that with finer quantization of slot sizes, the distribution in-3.2 WisperNet-Time: Performance Analysis terval of the last node has not only a smaller maximum We now investigate the impact of channel utilization delay but also a smaller possible set of delay values thaton the PDF of packet inter-arrival times. We also deter-mine the buffering needs due to randomized slot sizing 0.025 50% utilizationand its impact on the end-to-end delay. Finally we look 0.02at the censorship ratio vs. jammer’s lifetime for RT-Link,S-MAC and WisperNet. Probability 0.015 We conducted a simulation in Matlab on a protocolwith structure similar to RT-Link [12], where each cy- 0.01cle consists of 32 frames and each frame consists of 32slots. At the beginning of every cycle a sync pulse is 0.005transmitted. We have simulated a system where slotsizes have uniform distribution with values in range [1 0 0 10 20 30 40 505]ms. A maximum slot size of 5ms is chosen to match the Cumulative Distribution Interarrival times [ms]maximum message size of 128 bytes for IEEE 802.15.4 1 75% utilizationtransceiver with data rate of 250kbps[6]. 128 bytes can 50% utilizationbe sent with transmission duration of 4.2ms and the rest 0.5 25% utilizationof the slot time is used for inter-slot processing and for 0guard times. A simulation for 10000 sync pulses (i.e. 0 10 20 30 40 50 Interarrival times [ms]cycles) was carried out, which on an average lasts 50minutes. We first simulated the influence of the link utilization Figure 9: (Top) PDF of inter-arrival times for WisperNet. (Bottom) Corresponding CDF.
  • 8. can be expected. The reason is that finer quantization for the latter’s calculations, while using keys from theallows better data distribution per packets and there- gateway’s one-way chain for former. If some nodes arefore reduces the delay caused with packets fragmenta- captured and compromised, only the predefined slot-sizetion. Expectedly, this randomization introduced some key would be risk being extracted.additional delay. In a TDMA system with a constantslot size of 3ms, the delay at the last node would be 4. WISPERNET-SPACE:20 · 3ms = 60ms. Here average delay is around 75ms, COORDINATED SPATIAL ADAPTATIONbut with 95% probability interval [67 88]ms. This shows We now discuss spatial aspect of anti-jamming. Forthat randomization introduces some variability into the the WisperNet-Space, we consider a dense sensor net-communication end-to-end delay estimation. work where each node is modeled as a unit disk graph. Another potential side-effect of WisperNet-Time is a The network is represented as an undirected graph G(V, E)need for additional memory for data queuing. The first where V is a set of nodes (vertices) and E a set of linksnode, with its constant data block input, requires a buffer (edges). For each link e = e(u, v), k weights (or costs)with an additional 512 bytes of memory. All other nodes wj (u, v), (j = 1, 2, ..., k) are associated. For a tree T inrequire an additional buffer for one maximum sized packet. graph G, the aggregate weight Wj (T ) is defined as3.2.2 Comparative Analysis of MAC Protocols Wj (T ) = wj (e), j = 1, 2, ..., k Fig. 14 presents the relationship between the jammer’s e∈Tlifetime (LIFE) and censorship ratio (CR) for communi- Weights associated with each link describe the differentcation in its range. We simulated the influence of two types of costs which may include the network’s para-types of jammers - statistical jammers (SJ) and random functional properties, such as reliability of network com-jammers (RJ) - on different kinds of protocols. Both munication, or delay and energy consumption of a sensorthese types of jammers transmit 150μs-long pulse at- network.tacks. We modeled these attacks with a 90% success In general a set L ⊆ V of terminal nodes is given andrate of packet corruption in cases when jamming pulse the objective is to find a connected subgraph, spanningis transmitted during a node’s communication. For RT- all the terminals with minimal aggregate weights for allLink and WisperNet-Time, we used the previously de- j = 1, 2, ...k. If only one weighting function is consid-scribed protocols, while for the Random Schedule TDMA ered, L = V and the connected subgraph is required to(RSTDMA) we also used 32 slots per frame, where every be a tree, then the problem is defined as a Minimumslot is 3ms long. All protocols are simulated for systems Spanning Tree problem (MST). The MST problem canwith 25% of network utilization. be solved using known algorithms (Kruskal’s, Boruvka’s, As we expected, for RT-Link and S-MAC, the SJ’s life- etc) [19]. If L = V and also only one weighting functionstime is very high. As shown, RSTDMA is easily jammed is considered, problem is equivalent to Steiner minimaland the SJ enjoys the longest lifetime. In addition, the tree problem (SMT). SMT is a NP-complete problem,slot size randomization component decreases the jam- but several heuristics exist which resolve SMT problemmer’s lifetime, for almost 0.1 years at 50% CR. Note in both a centralized and a distributed manner.that differences between LIFE-CR curve for SJ and RJ For WisperNet-Space we only considered network’s re-are caused only by the fact that SJ does not transmit liability, so we associate a reliability weight function forpulses in intervals smaller than 1ms, which, in this case, each link in network. We define the weight of each linkis the smallest slot size (only parameter that can be ex- to be a function of the packet loss ratio and hence aimtracted from input signal statistics). We observe that to derive routes which connect all essential nodes usingschedule randomization has a significantly higher impact most reliable links. The continuous execution of the coston the jammer’s lifetime than does slot size randomiza- minimization function, essentially allows evasion of linkstion. This justifies our decision to use a pre-stored key under the influence of a random jammer. 5 The network’s reliability is measured in terms of its Probability [%] 95% region Step 0.5 4 Packet Delivery Ratio (PDR) which is defined as the 3 2 Step 0.2 ratio of packets that are successfully delivered to a des- Step 0.1 1 tination [2]. PDR can be perceived as the probability of 0 50 60 70 80 90 100 110 error-free communication between two nodes. Thus, the Delay [ms] Cumulative Distribution 1 reliability of a path P in the given network can be defined as a e∈P P DR(e). Our goal is to achieve maximum re- 0.5 Step 0.5 liability on a path P , which is equivalent to maximizing Step 0.2 Step 0.1 0 ln P DR(e) = lnP DR(e). 50 60 70 80 90 100 110 Delay [ms] e∈P e∈PFigure 10: Message delay and its Cumulative Dis- With P DR(e) ≤ 1 for path P , our goal is to minimizetribution at last node, for 20 nodes chain
  • 9. 100 zoomed 80 RSTDMA with 90 Statistical Jammer Censorship Ratio [%] 70 Censorship Ratio [%] 80 WnT with Statistical 70 60 Jammer WnT with 60 Random 50 Jammer 50 RT Link with 40 Statistical 40 Jammer 30 S−MAC with 30 Statistical Jammer 20 20 0 1 2 3 4 5 6 7 0.4 0.6 0.8 1 1.2 (a) Jammer’s Lifetime [years] (b) Jammer’s Lifetime [years] Figure 11: (a) Dependency between jammer’s lifetime and Censorship Ratio and (b) zoomed e∈P |lnP DR(e)|. Therefore, the reliability weight for sequence that maps the node ID of the active nodes tosome link e = e(u, v) is defined as the index of the N − 2 sequence. In a case of dense networks, with N nodes, from which the Steiner tree is wr (u, v) = |lnP DR(u, v)|. derived, a much smaller number of nodes (M ) may be4.1 Active topology update active. Therefore for all M nodes from the Steiner tree, different temporal IDs are assigned from 1 : M interval, For adaptive routing in WisperNet-Space, we use a and for that tree, a Prufer code with M − 2 elements isMST-Steiner heuristic to solve the SMT problem. All derived. Along with this sequence and number of activeactive nodes periodically send the PDRs for all their ac- nodes, M , a look-up table with size M is sent, wheretive links to the gateway. After receiving a link’s weight, i-th position in this table contains ID of a node, that isthe gateway updates its weight table for all existing links indexed as i while creating the Prufer code sequence. Inin the network. Since the PDR is not defined for inactive this way only 2 · M − 1 values are sent from gateway and(not used) links, these links keep same weights as they can be encapsulated within one maximum-sized 128 bytehad prior to activation of the present network topology. IEEE 802.15.4 packet.Their weights can not be reset to zero, since that wouldallow some heavily jammed links to become competitive 4.2 Topology Maintenance and Updatesfor network routing right in next iteration. In order to defend against mobile jammers, the weights WisperNet-Space computes a new network topologyof unused network’s links are processed in time with a every 128 cycles. Given the average slot size of 3msleaky integrator. To avoid situations where some pre- and 1024 slots/cycle, the topology update occurs everyviously heavily jammed link still has a high weight al- 6.4 minutes on average. The current active topology in-though the jammer that caused it has moved away, for cludes a subset of the node population as active nodesevery link e = e(u, v) and the current active subgraph and the unused node, which are not part of the activeT , the reliability weight for the next network topology topology, are considered inactive nodes. The key chal-calculation is defined as: lenged during a topology update is to activate the inac- tive nodes, which to save energy operate at a very low |lnP DR(u, v)|, e ∈ T wr (u, v) = duty cycle. ρ · wr (u, v), e ∈ T / At the beginning of the new topology distribution allρ (0 < ρ < 1) is a leaky constant that determines a currently active nodes are informed about new activespeed of network’s adaptation to jammers’ mobility. It topology by a broadcast from the gateway. To acti-is not recommended to set a too small value for ρ, since vate inactive nodes, which are to be part of the topol-something similar to previously described situation can ogy update, 8 slots after the sync pulse are reserved forhappen, when a jammed link can be repeatedly included asynchronous communication. We refer to these 8 slotsin active topology after very short duration. For example in each cycle to be the ‘topology configuration’ frame.with ρ = 0.8 reliability weight for unused link would be Thus topology maintenance and updates account for areduced by 20% for every calculation of network topol- 0.78% overhead. Instead using contention based trans-ogy, which would allow inclusion of the jammed link into mission for inactive nodes, we opted to schedule thesenew topology after only a few iterations. If all jammers transmissions from inactive nodes for a more determin-have fixed positions, ρ can be set to 1. istic behavior for the propagation of topology updates. After updating its weights table, the gateway calcu- As information needs to be spread in only one directionlates the new active topology with minimum costs to (from gateway) through a low-degree tree, and since onlyreach all Steiner points (i.e. active nodes). To distribute nodes that need to activate some inactive nodes (on thethe information about active links, we used the Prufer periphery of the current topology) would be scheduledcode (sequence) [19], a unique sequence associated with for transmission in these slots, the TDMA configurationa tree, which for a tree with N vertices contains N − 2 frame of 8 slots is enough for collision free transmissionelements. In addition to this code, we send a second code scheduling of a degree-4 tree with 2-hop coloring. These
  • 10. transmission indices are calculated using conservative with 400 randomly distributed nodes in a 4km x 4kmversion of MAX [20] for maximal transmission concur- square was analyzed. We also randomly distributed ninerency. jamming nodes, each with the same RF characteristics Algorithm 1 describes the gateway’s procedure for topol- as network’s nodes. To emphasize the jamming effectogy dissemination. The generated message with the in- in order to test WisperNet-Space’s adaptation, the jam-formation about new network topology is distributed mers’ link utilization is set to 50%. We implementedover the network using all active links. Since some cur- a communication protocol so that all neighboring nodesrently inactive nodes may be part of next active topology, exchange exactly one message per frame. Changes inthe mechanism to inform them is included. network routes for both SMT and MST components areAlgorithm 1 Gateway procedure description performed once in 100 frames. In our experiments we used a value of 0.999 for ρ, which decreases reliability while 1 do weight of unused link by 1% for every period of 96 sec- if NewWeightArrive then onds (on average). Update Weight Table Fig. 12(a) presents the initial network topology and if AllReceived or T opologyT imerOn then the initial routes. The terminal nodes and the areas un- T ableU pdated ← 1 der attack by the jammers are highlighted. We observe end if a large number of active links are under attack. The end if average censorship ratio for this network is 9% for this if TableUpdated then startup configuration. The censorship ratio decreases to SMT less than 1% as the routes adapt to more realible paths CalculateSpreadingSchedule and it can not go below this minimum value. This is FloodNetwork because for the given Steiner tree topology and its dis- end if tribution of jamming regions, the best case routes de- end while termiend by WisperNet-Space do include at least 2 par- All nodes that are used for activation of the inactive tially jammed links. The optimal configuration includesnodes along with the new topology receive 3-bit index of 0 links jammed in both direction and 2 links jammed inthe slot dedicated for its transmission, in the 8 slots ”con- only one direction, as shown in Fig. 13.figuration” frame. Using this index, each nodes schedule We observed that at some intermediate moments (forits transmission of the new configuration to neighboring example moments t1 and t2 as seen in Fig. 12(b) and cor-node and keep on transmitting it on the same slot in responding Fig. 14) network routes with more jammedevery ”configuration” frame. Once all its required neigh- links were chosen, which directly resulted in increase ofboring nodes (i.e. currently active or inactive nodes that the overall censorship ratio. This is more prominent atneed to be activated) are heard retransmitting the new the beginning of the WisperNet-Space’s operation whentopology update, a node is assured that its topology has all links start with the same minimum weight (0). Webeen successfully updated. see in Fig. 12(b), three links are jammed in both direc- All inactive nodes wake up after every sync pulse, and tions in the top-right corner. As the routing algorithmlisten for the first 8 slots in a cycle. If the message for explores the problem space with different sets of activeits activation is received, a node switches to active mode links, it often chooses links under heavy influence of theand executes the active mode’s algorithm. jammer. As this procedure of refining the route contin- Since new topology is computed once in 128 cycles, ues and more links are evaluated for the first time, the1024 configuration slots are available for both activa- algorithm will choose jammed links only if its weight,tion of dormant nodes and also for association of newly due to the leaky integrator, drops below a threshold thatadded nodes. Our experiments showed that for networks would make the aggregate weight of a subgraph smallerwith less than 500 nodes all inactive nodes are activated than the aggregate weight of currently used first 10% of these slots. Given this, we allowed last We observe these spikes in the network’s censorship ra-20% of these slots (i.e. configuration slots 820-1024) to tio in Fig. 14. Fig. 12(c) presents optimal solution wherebe used as contention slots for addmission of new nodes only two links from highlighted area, jammed in only oneonly. These slots enable nodes that want to join network direction, are used for routing. Over the course of theto announce their presence to neighboring nodes (via a adaptation for one hour, we observer in Fig. 15 that theHELLO packet in RT-Link), so that they can be initially number of active links does not vary much. We also no-included as inactive nodes in the network. ticed the stretch factor of the network path lengths is ≤1.3 due to the end-to-end weight minimization func-4.3 WisperNet-Space: Performance Analysis tion for calculating cumulative packet reliability across In order to evaluate the performance of WisperNet- multiple links.Space under random jamming attacks we first simulatedan SMT network with a random topology. A network 5. IMPLEMENTATION AND EVALUATION
  • 11. 123 95 123 95 250 250 299 236 109 357 216 255 364 299 236 109 357 216 255 364 123 95 153 373 124 153 373 124 250 141 141 299 236 109 357 216 255 364 337 263 337 263 153 373 124 290 53 283 29 290 53 283 29 141 1 177 177 337 202 317 202 317 290 283 29 263 33 37 144 149 121 211 33 37 144 149 121 211 177 53 70 324 70 324 96 361 16 358 96 361 16 358 202 1 317 362 210 332 362 210 332 33 37 144 149 121 211 1 361 16 1 251 203 173 55 251 203 173 55 70 324 2101 84 162 235 65 28 84 162 235 65 28 96 358 201 80 201 80 168 224 168 224 251 1 362 1 203 332 65 173 55 28 145 237 233 61 145 237 233 61 84 1 162 235 201 80 261 392 212 49 174 293 349 64 261 392 212 49 174 293 349 64 168 224 1 1 79 291 198 228 79 291 198 145 237 233 61 228 156 143 396 156 143 396 392 1 212 49 174 249 110 238 249 110 238 79 261 198 293 349 64 97 311 97 228 156 143 1 291 311 3 399 26 181 3 399 26 181 249 396 42 42 110 238 50 159 178 50 159 178 311 3 399 1 26 181 1 97 1 327 8 278 15 380 91 327 8 278 15 380 91 50 1 1 42 161 356179 377 161 356179 377 159 178 394 340 394 340 1 327 8 278 1 15 380 91 82 306 309 287 82 241 306 309 287 161 356179 1 377 90 241 150 368 328 230344 90 150 368 328 230344 1 1 340 59 59 82 241 306 394 309 287 122 191 122 191 150 368 328 230344 1 83 77 113 163 217 83 77 113 163 90 1 1 59 1 191 384 217 115 351 305 384 115 351 305 1 122 1 83 105 105 217 77 113 163 282 103 206 282 103 206 133 384 115 1 351 305 329 133 329 105 1 272 272 282 103 1 206 369 182 81 369 182 81 133 200 187 167 200219 187 167 1 1 329 272 85 219 166 85 166 369 182 81 1 138 243 200219 187 167 138 281 215 192 243 227279 281 215 192 227279 11 164 288 56 371 148 125 273 363 120 11 164 288 56 371 148 125 273 363 152 120 138 85 281 215 243 227279 166 1 17 260 68 152 17 260 68 192 390 72 63 193 325 147 390 72 63 193 325 147 11 164 288 56 371 1 148 125 273 363 1 120 176 367 286 58 139 265 176 367 286 58 139 265 1 17 390 72 260 68 63 193 1 152 325 147 86 30 86 30 315 326 367 58 139 265 108 383248 352 315 333 326 108 383248 352 333 176 286 1 366 157 165 366 157 165 86 30 315 326 137 289 137 92 266 289 108 383248 352 333 92 266 1137 1 366 157 165 397 294 397 294 92 266 289 175 175 209 264 209 264 1 397 294 78 381 78 175 316 381 280 98 316 280 1 209 264 1 98 128 134 128 134 78 119 27 98 316 381 280 119 27 1 128 134 102 52 398 386 102 277 119 27 52 398 386 222 277 222 322 285 223 322 321 285 34 223 52 398 386 1 102 277 252379 321 34 388 252379 388 1 322 1 222 308 308 252 321 285 34 223 208 208 379 388 101 101 308 35 131 355 35 131 208 101 1 355 268 387 256 268 387 100 35 1 353 256 100 353 1 355 61.221 131 87 47 87 47 256 268 387 100 44 365 225 44 365 225 66 353 57 330 66 62 347 57 205 330 284 87 365 47 62 347 205 284 2 44 225 66 1 2 126 45 310 69 126 45 62 347 57 205 330 284 310 69 106 213 244 39 106 254 320 341 213 19 244 39 331 254 320 341 2 310 69 126 451 19 342 135 331 125 22 342 51 135 125 259 22 180 213 244 68.0945 39 1 1 106 254 320 341 51 259 180 199 19 342 135 331 125 1 346 199 348 76 346 51 1 259 1 22 180 348 76 7 229 7 199 229 297 348 76 346 7 1 297 239 1 218 107196 239 1 218 229 107 196 297 170 170 21 107 196 1 239 1 218 359 116 4 21 359 116 4 112 170 1 112 350 298 359 21 350 298 40 270 40 116 4 112 1 118 183 270 118 183 304 246 350 298 304 246 172 270 40 302 319 172 302 319 118 183 304 246 313 25 232 184 313 25 232 1 302 1 319 172 184 169 220 335 169 220 313 1 25 232 335 360 360 184 169 220 375 245 24 155 375 323 154 31 245 274 24 10 155 158 323 67 154 31 274 10 375 335 360 1 245 24 1 158 374 67 374 13 155 158 323 67 154 31 274 10 13 269 1 374 1 1 129 269 75 129 292 75 13 292 46 314 46 314 111 6 385 111 6 385 129 292 1 269 46 314 75 231 231 247 111 6 385 247 171 54 171 1 231 1 1 1 247 1 54 160 23 242 307 160 171 23 242 389 307 140 296 389 140 338 296 54 160 132 338 240 132 23 2421 389 1 307 140 296 240 336 197 301 336 1 240 1 132 338 197 301 189 9 189 9 300 378 300 275 226 378 197 301 1 336 1 189 275 226 318 9 300 378 117 334 318 339 117 334 393 257 339 275 1 226 221 393 257 190 136 71 267 18 221 190 136 71 267 117 334 393 318 257 339 190 71 18 262 370 234 303 262 370 391 345 382 234 18 221 1 136 267 303 391 345 382 89 262 370 234 89 303 391 345 382 1 127 114 89 276 127 20 114 276 20 1 127 114 151 41 88 48 151 41 142 88 276 1 1 20 48 142 151 41 142 88 99 99 48 1 1 376 73 376 73 43 99 1 43 104 400 104 376 73 1 400 38 395 214 38 395 214 400 43 104 1 1 130 38 395214 195 130 36 195 36 74 74 372 36 1 1 195 1 130 271 253 372 271 253 93 74 372 93 186 343 186 271 253 343 185 146 295 312 185 343 93 186 146 295 312 14 258 146 295 1 312 185 14 258 94 94 204 60 207 258 204 60 354 207 354 14 94 204 60 32 188 32 194 188 354 207 194 32 194 188 (a) Network topology - beginning (b) Network topology at an intermedi- (c) Network topology - optimal ate time instance, t1Figure 12: Network topology; green links - actual, ”physical” links; red - links used for Steiner tree;blue nodes - terminal nodes (members of set L); dark gray area - area under jammers’ influence The WisperNet anti-jamming protocol was implemented sage per frame.on a network of FireFly sensor nodes[14]. Each node con- We observe that most of the current hardware plat-sists of a microcontroller, an 802.15.4 2.4GHz transceiver forms used for wireless sensor networks development areand multiple sensors. FireFly nodes have two configura- not CPU-constrained, but have a memory limitation.tions - one with in-band software-based time synchro- Our implementation of the SHA1-HMAC function re-nization and the other with an add-on AM radio re- quired only 3 additional 160-bit buffers as the compari-ceiver for receiving an out-of-band AM sync pulse. In son of schedules and precedences is done iteratively fororder to achieve the highly accurate time synchroniza- all the node’s neighbors. The SHA1-HMAC function re-tion required for TDMA at a packet level granularity, we quired 12.5ms for calculations on TI’s MSP430F22x mi-use a carrier-current AM transmitter to provide an out- crocontroller. For networks where maximal node’s de-of-band time synchronization pulse. The time synchro- gree in a network is N , every node, in the worst case,nization transmitter (a separate module) plugged into needs to execute SHA1-HMAC function (N 2 + 1) timesthe wall-outlet and used the building’s power grid as an for schedule calculation and once more for slot size com-extended AM antenna and was thus able to cover the putation in every sync period. For example if N = 5,entire building. Nodes were synchronized with a 50μs in worst case 27 SHA1-HMAC function executions arepulse that was transmitted every 10 seconds from the needed, which results in 337.5ms of CPU time used forAM transmitter (see [14] for details). The AM pulse has these calculations in every sync period, where one synca jitter of ≤ 150μs. period contains 32 · 32 = 1024 slots, with sizes from 1ms We implemented our jamming avoidance scheme in- to 5ms. Therefore in worst case less than 33% of CPUcorporating SHA1, SHA1-HMAC, gateway schedule up- processing is used for these calculations, while on av-dates and neighbor information exchange in 8-bit fixed- erage less than 11% is used. From perpective of mem-point C for the Atmel ATMEGA32L microcontroller and ory constraints, the implemented procedure for schedulea 16-bit 16MHz TI MSP430F22x microcontroller. Each randomization uses 276 bytes of flash memory and 400node ran the nano-RK[21] real-time operating system bytes of RAM. Since only two nodes’ schedules have toand the RT-Link[12] link protocol. The RT-Link TDMA be available at the same, schedule calculation procedurecycle includes 32 frames which in turn are composed of occupies only 236 bytes for code size, along with addi-32 slots. The slot size were assigned values from [1 5]ms. tional 40 bytes of data pre-stored in FLASH.In our tests, every node attempts to transmit one mes- In Fig. 16, we connected three nodes to the oscillo- scope to display the transmit and receive activity. Two Number of links jammed in both direction 10 Averaged Censorship Ratio t1 t2 10 Links 5 8 Censorship ratio [%] 0 0 2000 4000 6000 8000 10000 6 Number of links jammed in only one direction 20 4 t1 t2 Links 10 2 0 0 0 20 40 60 80 100 0 2000 4000 6000 8000 10000 Network configurations Frame numberFigure 13: Number of links jammed in 2/1 direc- Figure 14: Averaged network’s censorship ratiotion used for communication on 100 blocks, for implemented Steiner tree
  • 12. Number of links used for communication that WisperNet is able to effectively reduce the impact 220 of statistical and random jammers. Unlike coding-based 210 schemes, WisperNet is resilient to jamming even un- Links 200 der moderate to high link utilization with ≤2% cen- 190 sorship rate for the network topologies explored in this 180 work. The schedules derived from WisperNet are non- 0 2000 4000 6000 8000 10000 Frame number repeating, with randomized packet lengths while main- Figure 15: Number of active links taining coordinated and collision-free communication. Wis- perNet has been implemented on a network of FireFlynodes were programmed to be a transmit and receive sensor nodes with tightly synchronized operation and lowpair to show the coordinated and collision-free schedule operation overhead.randomization. A third node was programmed to raisea signal on every slot to provide a reference of the slot 7. REFERENCESboundaries. In Fig. 17, the top signal on the oscilloscope [1] W. Xu, W. Trappe, Y. Zhang, and T. Wood. The feasibility of launching and detecting jamming attacks in wireless triggered by the transmit pin of the transmitter and In ACM MobiHoc, 2005.the middle signal is triggered by the receive pin on the [2] W. Xu, T. Wood, W. Trappe, and Y. Zhang. Channel Surfing and Spatial Retreats: Defenses against Wireless Denial ofreceiver. The signal at the bottom is triggered on every Service. In ACM WiSe, pages 80–89, 2004.slot interval to provide a reference of the slot bound- [3] Y. W. Law et al. Energy-efficient link-layer jamming attacks. In ACM SASN, 2005.aries. We observe that the schedule is both coordinated [4] A. J. Viterbi. Spread Spectrum Communications: Myths andand changes on a frame-by-frame basis. Realities. In IEEE Comm. Magazine, 2002. [5] A. D. Wood, J. A. Stankovic, and G. Zhou. DEEJAM: Defeating5.1 Limitations Energy-Efficient Jamming. IEEE SECON, 2007. [6] Texas Instruments Inc. Chipcon CC2420 Data Sheet, 2003. The WisperNet-Spatial routing scheme is centralized [7] A. D. Wood, J. A. Stankovic, and S. H. Son. JAM: A Jammedand will not scale well in large networks (>500 nodes) Area Mapping for Sensor Networks. In IEEE RTSS, 2003.under moderate to heavy attack as the message from the [8] J. Polastre, J. Hill, and D. Culler. Versatile Low Power Media Access for Wireless Sensor Networks. SenSys, November 2005.gateway may not get through. While several distributed [9] W. Ye, J. Heidemann, and D. Estrin. An energy-efficient MACheuristics for the MST problem exist, they require a large protocol for wireless sensor networks. IEEE INFOCOM, 2002. [10] A. El-Hoiydi and J. Decotignie. WiseMac: An Ultra Low Poweramount of information with respect to shortest paths MAC Protocol. ISCC, 2004.from a node to all other nodes in the network. For con- [11] L.F.W. van Hoesel and P.J.M. Havinga. A lightweight medium access protocol for wireless sensor networks. INSS, 2004.tinuously changing system, with respect to the weights [12] A. Rowe, R. Mangharam, and R. Rajkumar. RT-Link: Aof used link, these distributed solutions do not represent Time-Synchronized Link Protocol for Energy Constrainedsatisfactory solution. Also these schemes are not con- Multi-hop Wireless Networks. IEEE SECON, 2006. [13] T. Dam and K. Langendoen. An adaptive energy-efficient macducive to energy-constrained and memory-constrained protocol for wireless sensor networks. SenSys, November 2003.sensor networks. We aim to explore distributed solutions [14] R. Mangharam, A. Rowe, and R. Rajkumar. FireFly: A Cross-layer Platform for Real-time Embedded Wirelessfurther. Networks. Real-Time System Journal, 37(3):183–231, 2007.6. DISCUSSION AND CONCLUSION [15] B. Schneier. Applied Cryptography. John Willey Inc., 1996. [16] A. Perrig and et. al. SPINS: Security Protocols for Sensor In this paper we proposed the WisperNet anti-jamming Networks. Wireless Networks, 8(5):521–534, 2002. [17] A. Perrig, R. Canetti, D. Tygar, and D. Song. The TESLAprotocol which uses Coordinated Temporal Randomiza- Broadcast Authentication Protocol. Cryptobytes, 5(2), 2002.tion of transmissions (WisperNet-Time) to reduce the [18] H. Krawczyk, M. Bellare, and R. Canetti. HMAC:censorship ratio of a statistical jammer to that of a ran- Keyed-Hashing for Message Authentication. RFC 2104, 1997. [19] B. Y. Wu and Kun-Mao Chao. Spanning Trees anddom jammer. A second component of WisperNet is Co- Optimization Problems. Chapman and Hall, CRC Press, 2004.ordinated Spatial Adaptation (WisperNet-Space), where [20] R. Mangharam and R. Rajkumar. Max: A maximal transmission concurrency mac for wireless networks with regular structure. Innetwork routes are adapted continually to avoid jammed IEEE Broadnets, 2006.regions (and hence random jammers) and select paths [21] A. Eswaran, A. Rowe, and R. Rajkumar. Nano-RK: Energy aware Resource centric RTOS. IEEE RTSS, 2005.with the max packet delivery ratio. Through simulation and experiments, we demonstrate Figure 16: Experimental setup with 3 nodes Figure 17: WisperNet-Time on Oscilloscope