Anti-Jamming for Embedded Wireless Networks                                 Miroslav Pajic and Rahul Mangharam            ...
Methods for anti-jamming must therefore address threats     4. Coordinated changes of slot sizes: All nodesdue to both tem...
ploits temporal and sequential patterns of the protocol         jammer has influence over the network. A jammed-areaand is ...
0.1                                                                          0.25                         0.08            ...
to limit the impact of statistical jamming but still ben-    ical wireless link between two nodes. The physical net-efit fr...
message in the same slot due to a lower precedence. This                                                              resu...
culation instead a predefined one, in cases when node           factor (U ) on the PDF of inter-arrival times and showdoes ...
can be expected. The reason is that finer quantization                                           for the latter’s calculati...
100                                                                                                                       ...
transmission indices are calculated using conservative          with 400 randomly distributed nodes in a 4km x 4kmversion ...
Antijam ipsn09
Antijam ipsn09
Upcoming SlideShare
Loading in …5
×

Antijam ipsn09

333 views

Published on

Published in: Technology, Business
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
333
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Antijam ipsn09

  1. 1. Anti-Jamming for Embedded Wireless Networks Miroslav Pajic and Rahul Mangharam Department of Electrical and Systems Engineering University of Pennsylvania {pajic, rahulm}@seas.upenn.eduABSTRACT ded wireless networks for time-critical and safety criti-Resilience to electromagnetic jamming and its avoidance cal operation such as in medical devices and industrialare difficult problems. It is often both hard to distin- control networks, it is essential that mechanisms for re-guish malicious jamming from congestion in the broad- silience to jamming are native to the communication pro-cast regime and a challenge to conceal the activity pat- tocol. Resilience to jamming and its avoidance, collec-terns of the legitimate communication protocol from the tively termed as anti-jamming, is a hard practical prob-jammer. In the context of energy-constrained wireless lem as the jammer has an unfair advantage in detectingsensor networks, nodes are scheduled to maximize the legitimate communication activity due to the broadcastcommon sleep duration and coordinate communication nature of the channel. The jammer can then emit a se-to extend their battery life. This results in well-defined quence of electromagnetic pulses to raise the noise floorcommunication patterns with possibly predictable inter- and disrupt communication. Communication nodes arevals of activity that are easily detected and jammed unable to differentiate jamming signals from legitimateby a statistical jammer. We present an anti-jamming transmissions or changes in communication activity dueprotocol for sensor networks which eliminates spatio- to node movement or nodes powering off without sometemporal patterns of communication while maintaining minimum processing at the expense of local and networkcoordinated and contention-free communication across resources.the network. Our protocol, WisperNet, is time-synchronized In the case of energy-constrained wireless sensor net-and uses coordinated temporal randomization for slot works, nodes are scheduled to maximize the commonschedules and slot durations at the link layer and adapts sleep duration and coordinate communication to extendroutes to avoid jammers in the network layer. Through their battery life. With greater network synchroniza-analysis, simulation and experimentation we demonstrate tion, the communication is more energy-efficient as nodesthat WisperNet reduces the efficiency of any statisti- wake up from low-power operation just before the com-cal jammer to that of a random jammer, which has the mon communication interval. Such coordination intro-lowest censorship-to-link utilization ratio. WisperNet is duces temporal patterns in communication with predictablemore energy efficient than low-power listen CSMA pro- intervals of transmission activity. Channel access pat-tocols such as B-mac and is simple to analyze in terms of terns make it efficient for a jammer to scan and jam theeffective network throughput, reliability and delay. Wis- channel only during activity intervals. The jammer canperNet has been implemented on the FireFly sensor net- time its pulse transmission to coincide with the pream-work platform. bles of packets from legitimate nodes and thus have a high censorship to channel utilization ratio while remain-1. INTRODUCTION ing difficult to detect. The jammer is thus able to ex- ploit the temporal patterns in communication to disrupt Jamming is the radiation of electromagnetic energy in a transmission of longer length of legitimate transmis-a communication channel which reduces the effective use sions with a small set of jamming pulses.of the electromagnetic spectrum for legitimate commu- For nodes in fixed locations, a jammer can select re-nication. Jamming results in a loss of link reliability, gions with heavier communication activity or denser con-increased energy consumption, extended packet delays nectivity to increase the probability that a random jam-and disruption of end-to-end routes. Jamming may be ming pulse results in corrupting an on-going transmis-both malicious with the intention to block communica- sion. Nodes in the proximity of the jammer will enduretion of an adversary or non-malicious in the form of un- a high cost of operation in terms of energy consumptionintended channel interference. In the context of embed- and channel utilization with a low message delivery rate. They must either physically re-locate or increase the cost of their links so the network may adapt its routes.
  2. 2. Methods for anti-jamming must therefore address threats 4. Coordinated changes of slot sizes: All nodesdue to both temporal patterns at the link layer and spa- must be aware of the current and next slot sizes. This istial distribution of routes in the network layer. Our very important because any incompatibility or synchro-goal is to reduce or eliminate spatio-temporal patterns in nization error would disable communication between le-communication while maintaining energy-efficient, coor- gitimate nodes.dinated and collision-free operation in multi-hop wire- 5. Collision-free transmission: Communication mustless sensor networks. We achieve this by incorporat-ing coordinated temporal randomization for slot sched- satisfy the hidden terminal problem so that a transmit slot of a given node does not conflict with transmit slotsules and slot durations between each node and its k-hop neighbors. This prevents the jammer from predict- of nodes within its k-hop interference range.ing the epoch and length of the next activity on the The rest of this paper is organized as follows: In Sec-channel. Such mechanisms reduce the effectiveness of tion 2, we provide a background and related work forany statistical jammer to that of a random pulse jam- energy efficient protocols and energy efficient jammingmer. While temporal randomization prevents statisti- schemes. In Section 3, we provide an overview of thecal jammers from determining any useful packet inter- WisperNet anti-jamming protocol and describe the co-arrival distribution for preemptive attacks, it still has an ordinated temporal randomization scheme. In Sectionefficiency of a random jammer and can achieve censor- 4, we describe the WisperNet coordinated spatial adap-ship which increases linearly with channel utilization and tation scheme. Section 5 describes our implementationjamming activity. To avoid such random jammers which experiences and experimental results followed by the con-are co-located near nodes with active routes, we employ clusion.adaptive routing to select paths such that the highestpossible end-to-end packet delivery ratios are achieved. 2. BACKGROUND AND RELATED WORKWe combine the above temporal and spatial schemes in To understand the inherent tradeoff between energya tightly synchronized protocol where legitimate nodes efficient link protocols with well-defined schedules andare implicitly coordinated network-wide while ensuring their susceptibility to jamming attacks, we first describeno spatio-temporal patterns in communication are ex- the different types of jammers and their impact on var-posed to external observers. ious types of link layer protocols. We then highlight a In the context of multi-hop embedded wireless net- particular class of statistical jammers and their impactworks, which are battery-operated and require low-energy on energy-efficient sensor network link protocols.consumption, we require the following properties fromthe anti-jamming protocol: 2.1 Jammers and Trade-offs with Jamming1. Non-predictable schedules: Transmission instances 2.1.1 Comparison of Jamming Models(e.g. slot assignments) are randomized and non-repeatingto prevent the jammer from predicting the timing of the In [1] and [2], Xu et al. introduce four common typesnext slot based on observations of channel activity. In of jammers: constant, random, reactive and deceptive.this way, even if the jammer successfully estimates slot Constant jammers continually emit a jamming signal andsizes, it has to transmit pulse attacks at an interval of achieve the highest censorship of packets corrupted to to-the average slot duration to corrupt communication be- tal packets transmitted. The constant jammer, however,tween nodes. is not energy-efficient and can be easily detected and lo- calized. The random jammer is similar to the constant2. Non-predictable slot sizes: Slots are randomly jammer but operates at a lower duty cycle with intervalssized on a packet-by-packet basis in order to prevent the of sleep. A random jammer transmits a jamming signaljammer from estimating the duration of channel activity at instances derived from a uniform distribution with afor energy efficient reactive jamming. This requirement known minimum and maximum interval. The censorshipfurther reduces the jammer’s lifetime as it will need to ratio of the random jammer is constant and invariantemploy the smallest observed slot duration as its jam- to channel utilization. At low duty cycles, the randomming interval. jammer is difficult to detect and avoid. A reactive jam-3. Coordinated and scheduled transmission: The mer keeps its receiver always on and listens for channelcommunication schedule according to which a node trans- activity. If a known preamble pattern is detected, themits is known to all of its legitimate neighbors so they reactive jammer quickly emits a jamming signal to cor-can wake up to receive the message during its trans- rupt the current transmission. Reactive jammers, whilemission slot. This also prevents nodes from turning on effective in corrupting a large proportion of legitimatetheir receiver when no legitimate activity is scheduled packets, are not energy efficient as the receiver is alwaysand hence reduces the likelihood of a jammer draining on. A deceptive or protocol-aware jammer is one thatthe energy of a node. has knowledge of the link protocol being used and the dependencies between packet types. Such a jammer ex-
  3. 3. ploits temporal and sequential patterns of the protocol jammer has influence over the network. A jammed-areaand is very effective. mapping protocol is described in [7] which can be used to In [3], a statistical jamming model is described where delineate regions affected by a jammer. Such informationthe jammer first observes temporal patterns in channel can ultimately be used for network routing. One of theactivity, extracts a histogram of inter-arrival times be- requirements of the protocol is that every node knowstween transmissions and schedules jamming pulses based its own position along with positions of all its neighbors.on the observed distribution. This results in a very ef- Our proposed solution, WisperNet, does not require suchfective jammer that is not protocol-aware and is also dif- position and direction information and directly computesficult to detect. A statistical jammer chooses its trans- routes with the highest end-to-end packet delivery rate.mission interval to coincide with the peak inter-arrivaltimes and is thus able to maximize its censorship ratio 2.2 Impact of Jamming on MAC Protocolswith relatively little effort. Fig. 1(a) illustrates the rela- We now investigate the characteristics of different classestive censorship ratio and the energy-efficiency of the dif- of sensor network link protocols and the impact of a jam-ferent jammers. Fig. 1(b) illustrates the relative stealth mer on each class.or difficulty in detection. We observe that the statisticaljammer has a high censorship ratio with both energy- 2.2.1 Energy-Efficient MAC Protocolsefficient and stealthy operation and hence focus on com- Several MAC protocols have been proposed for low-bating such jamming in the remainder of this paper. power operation for multi-hop wireless mesh networks.2.1.2 Techniques for Robust Transmission Such protocols may be categorized by their use of time synchronization as asynchronous [8], loosely synchronous [9, The traditional defenses against jamming include spread 10] and fully synchronized protocols [11, 12]. In general,spectrum techniques[4] at the physical layer. While spread with a greater degree of synchronization between nodes,spectrum and frequency hopping techniques are impor- packet delivery is more energy-efficient due to the min-tant physical layer mechanisms for combating jamming, imization of idle listening when there is no communica-additional protection is required at the packet-level. As tion, better collision avoidance and elimination of over-in the case of standard wireless protocols such as IEEE hearing of neighbor conversations.802.11 and Bluetooth, the jammer may know the pseudo- Asynchronous protocols such as Carrier Sense Mul-random noise code or frequency hopping sequence. tiple Access (CSMA) are susceptible to jamming both at There have been several efforts to make communica- the transmitter (busy channel indication) and at the re-tion in sensor networks more robust in the presence of ceiver (energy drain). The Berkeley MAC (B-MAC) [8]a jammer. In [5], Wood et al. described DEEJAM, a protocol performs the best in terms of energy conserva-link layer protocol that includes several schemes for ro- tion and simplicity in design. B-MAC supports CSMAbust IEEE 802.15.4 based communication for reactive with low power listening (LPL) where each node peri-and random jammers. While mechanisms such as cod- odically wakes up after a sample interval and checks theing and fragmentation are proposed, the jammer still channel for activity for a short duration of 0.25ms. If thehas a competitive advantage in that it may increase the channel is found to be active, the node stays awake topower of its jamming signal and a single jamming sig- receive the payload following an extended preamble. Us-nal is capable of jamming multiple links in the vicinity. ing this scheme, nodes may efficiently check for neighborThe authors assume that reactive jammers can be con- activity while maintaining no explicit schedule which asidered energy-efficient. Current radio transceivers with statistical jammer may exploit.the IEEE 802.15.4 physical layer of communication, use Loosely-synchronous protocols such as S-MAC [9]almost the same, if not greater, energy for receiving as and T-MAC [13] employ local sleep-wake schedules knowthey do for transmission [6]. as virtual clustering between node pairs to coordinate In cases where resilience to jamming is not possible, itis useful to detect and estimate the extent to which the (a) (b)Figure 1: (a) Jammer’s Energy efficiency vs. Figure 2: Comparison of robustness to jammingCensorship ratio and (b) Energy efficiency vs. and energy efficient operation of sensor MACStealth protocols
  4. 4. 0.1 0.25 0.08 0.2 Probability 0.06 0.15 Probability 0.04 0.1 0.02 0.05 0 0 0 50 100 150 200 250 0 10 20 30 40 50 Interarrival times [ms] Interarrival times [ms] Figure 3: SMAC PDF for 15% utilization Figure 4: RT-Link PDF for 15% utilizationpacket exchanges while reducing idle operation. Both S-MAC, we observe that all nodes quickly converge onschemes exchange synchronizing packets to inform their one major activity period of 215ms. In Fig. 3, we alsoneighbors of the interval until their next activity and use notice a spike close to 2ms. This is the interval betweenCSMA prior to transmissions. S-MAC results in clus- the transmission of control packets and data packets attering of channel activity and is hence vulnerable to a the start of an activity period. In the case of RT-Link,statistical jammer. we simulated four flows with different rates and hence Synchronous protocols such as RT-Link [12], uti- observe 4 distinct spikes in Fig. 4. The other spikes withlize hardware based time synchronization to precisely lower intensity are harmonics due to multiples of 32 slotsand periodically schedule activity in well-defined TDMA in a frame. In both cases we observe distinct inter-arrivalslots. RT-Link utilizes an out-of-band synchronization patterns which enable a statistical jammer to efficientlymechanism using an AM broadcast pulse. Each node is attack both protocols.equipped with two radios, an AM receiver for time syn- 2.3 Assumptionschronization and an 802.15.4 transceiver for data com-munication. A central synchronization unit periodically We make several assumptions in the design and evalua-transmits a 50μs AM sync pulse. Each node wakes up tion of WisperNet. We assume the jammer is as energy-just before the expected pulse epoch and synchronizes constrained as a legitimate node and must maintain athe operating system upon detecting the pulse. As the stealth operation with a low duty-cycle. All packetsout-of-band sync pulse is a high-power (30W) signal with exchanged between nodes are encrypted with a groupno encoded data, it is not easily jammed by a malicious key shared by legitimate nodes and hence the jammersensor node. is not protocol-aware. We consider both malicious and In general, RT-Link outperforms B-MAC which in turn non-malicious jamming and do not differentiate betweenout-performs S-MAC in terms of battery life across all them as the anti-jamming mechanisms are native to theevent intervals [12]. Fig. 2 shows the relative node life- link and network protocol. The transmission power istimes for 2AA batteries and similar transmission duty 0dBm (1mW) and in the worst case (with maximumcycles. Here node lifetimes for CSMA, S-MAC, B-MAC, power link jamming) the nominal packet delivery rateand RT-link are 0.19, 0.54, 0.78 and 1.5 years respec- is never below ˜ 20%. This has been demonstrated in pre-tively for a network of 10 nodes with a 10s event sam- vious experiments [12]. For simplicity, we presume thatple period (based on measurement values from [12], [9]). interference range is equal to the transmission range ofWhile RT-Link nodes communicate in periodic and well- one hop. This restriction does not limit our results. Wedefined fixed-size time slots, a statistical jammer is able assume all communication is between a central gatewayto easily determine the channel activity schedule and du- and each of the nodes across one or more hops.ration of each scheduled transmission. An attacker can 3. ANTI-JAMMING WITH COORDINATEDglean the channel activity pattern by scanning the chan- SPATIO-TEMPORAL RANDOMIZATIONnel and schedule a jamming signal to coincide with thepacket preamble at the start of a time slot. An effective approach to diminish the impact of a sta- tistical jammer on TDMA-based MAC protocols is to2.2.2 Statistical Jamming eliminate the possibility to extract patterns in commu- We focus on the statistical jammer’s performance with nication. These patterns appear as a result of the use ofS-MAC and RT-Link as both result in explicit patterns fixed schedules which are set when a node joins a net-in packet inter-arrival times. We do not consider B-MAC work and are assumed to repeat till the network is dis-as we aim to leverage the more energy-efficient RT-Link banded. Such simple and repetitive patterns are main-as a base synchronized link-layer mechanism for Wisper- tained with tight time synchronization and result in min-Net. We simulated a network of 10 nodes in each case, imal energy consumption, deterministic end-to-end delaywith a 3ms average transmission duration. In the case of and perhaps maximal transmission concurrency. In order
  5. 5. to limit the impact of statistical jamming but still ben- ical wireless link between two nodes. The physical net-efit from the above energy and timeliness performance, work topology is logically pruned by disabling desiredwe maintain the time synchronization but change the links. In order to logically remove a link, a node is sched-schedule, transmission duration and routes in a random- uled to sleep during that particular neighbor’s transmis-ized yet coordinated manner along small time scales. sion, thereby ignoring that transmission. By forming Two components of the WisperNet protocol are Co- a directed acyclic graph we are able to efficiently as-ordinated Temporal Randomization (WisperNet-Time) sign non-colliding schedules that can be changed for ev-and Coordinated Spatial Adaptation (WisperNet-Space), ery frame, as shown in Fig. 5(b). Links marked by thewhich perform different actions in the temporal and spa- dashed line are inactive but must be accounted for bytial domains respectively. WisperNet-Time is designed any graph coloring algorithm.to defeat statistical jammers. By randomizing the com- The algorithm for schedule randomization is organizedmunication in time, a statistical jammer’s performance in a distributed manner. Every node uses a Pseudo-is reduced to that of a random jammer as the distribu- Random Function (PRF) to obtain its transmission sched-tion of packet inter-arrival times is flat. No timing-based ule from the current network key and its node ID. Thescheme can reduce the probability of being jammed by transmission schedule consists of different slot indexesa random pulse jammer. In this case, the only way to that can be used for transmission to neighboring nodes.decrease the jamming impact is by avoiding the jammed The schedule changes for every frame (i.e. 32 slots) andareas using WisperNet-Space. WisperNet-Space imple- during a frame, a node transmits only on the time-slotsments adaptive network routing as a jamming avoidance determined by its PRF output. After transmission, ev-mechanism to use links which are less affected by the ery node goes to sleep, setting its sleep timer to wakejammer, if possible. Both WisperNet-Time and WisperNet- up for the earliest receive or transmit slot. In this waySpace incorporate on-line algorithms where the network energy consumption is reduced to minimum.is continuously monitored and node operations are ad- To obtain non-repeating schedules, but with full co-justed in time and space. ordination between nodes, the PRF computed by ev- ery node uses the current active network key along with3.1 WisperNet-Time: Co-ordinated Temporal its node ID. Once in a cycle, between two synchroniza- Randomization tion pulses, the gateway broadcasts the active keys for The main requirement for the proposed protocol is the the next cycle. The keys, members of the one-way keyprovision of tight time synchronization between nodes. chain, are generated during gateway’s initialization andIn order to keep coordination between nodes, all nodes are stored in its memory. All keys from this chain arehave to be informed about current network state in terms calculated from randomly chosen last key Kn by repeat-of current slot schedule, current slot duration and cur- edly applying one-way function F (as shown in Fig. 6):rent active network topology. We achieve this by build-ing upon the FireFly sensor network platform [14] and Kj = F (Kj+1 ), j = 0, 1, 2, ...n − 1.using the basic synchronization mechanisms adopted in As F is a one-way function, all previous members ofthe RT-Link protocol. All communication with RT-Link chain (K0 , K1 , ..., Kj−1 ) can be calculated from someis in designated time slots. 32 time slots form a frame chain element Kj but subsequent chain members Kj ,and 32 frames form a cycle. The time sync pulse is re- Kj+1 ,...,Kn [15] cannot be derived. This authenticationceived once every cycle. Each FireFly node is capable scheme is similar to [16, 17] but its use for scheduling isof both hardware-based global time synchronization and new.software-based in-band time sync. A second requirement We use the SHA1-HMAC[18] keyed-hash function tofor WisperNet is that changes in state should require generate the current slot schedule. Therefore, for sched-minimum gateway-to-node communication and no state ule computation HM AC(ID, Kj ) is used, where Kj presentsinformation exchange between nodes. All communica- currently active network key (member of the one-way keytion must be encrypted and authenticated so that an chain). SHA1-HMAC outputs 160 bits which are used toeavesdropper may not be able to extract the logical stateof the network. We describe the authentication and im-plicit coordination scheme in the following section andthe synchronization mechanism in the Implementationsection.3.1.1 Schedule Randomization The first step toward schedule randomization is a prun- (a) Physical network (b) Logical network topologying of the physical network topology graph into a di- topologyrected acyclical graph. Fig. 5(a) shows an example net- Figure 5: (a)Example network topology (b)itswork topology graph, where each edge represents phys- collision-free transmit schedule from frame-to- frame
  6. 6. message in the same slot due to a lower precedence. This results in a lower end-to-end bandwidth and an increase in a message delay. However, this issue has a fairly low probability of occurring in networks for sensor networks with a low to moderate duty cycle.Figure 6: Generation of keys at the gateway, us-ing a one-way hash function. 3.1.2 Slot size randomizationspecify the schedule of transmission slots for each of the Even though the statistical jammer uses energy effi-32 frames. These 160 bits are divided into 32 groups of cient pulse attacks, the proposed schedule randomiza-5-bits, where the node’s transmit schedule in i-th frame tion reduces its efficiency to that of a random jammer.(i = 0, 1, 2, ...31) is determined by i-th group of 5 bits. However, with the schedule randomization, an adversaryThese 5 bits represent the index of one of the 32 frame’s is able to estimate slot sizes from the probability distri-slots, eventually used for transmission. bution function (PDF) of packet inter-arrival times [3]. Implicit Schedule Conflict Resolution This statistical jamming scheme allows the jammer toThis approach for determining the transmission schedule transmit short pulse attacks at beginning of each slot,locally can introduce a problem of potential interference therefore corrupting all communication attempts. Al-that may occur when neighboring nodes are assigned the though this jamming scheme is less energy efficient thansame random slot. To prevent this, every node, in addi- a fixed schedule TDMA protocol, it is still more efficienttion to its schedule, calculates a slot precedence (or pri- than a random jammer.ority) for every transmission. The precedence for the i-th Slot size randomization is implemented in a similarframe’s transmission schedule is determined by (32 − i)- manner to slot schedule randomization, using SHA1-th 5 bits group (i.e. reverse order of the transmission HMAC, as schedule randomization, but with one impor-schedule). Since there is an even number of frames, tant difference. Instead of using the last revealed keythe transmission schedule and precedence are never ex- for the slot size calculation, every node uses a sharedtracted from same group of bits. Therefore, to compute predefined key, Kslot , and the network’s state counterits schedule in one sync period with 32 frames, each node cnt. Therefore, for slot size randomization the PRF ishas to calculate exactly one SHA1-HMAC function for calculated as HM AC(cnt, Kslot ). The cycle counter isitself, and one SHA1-HMAC per node for all nodes in its transmitted in the header of each packet and is incre-k-hop interference range. We assume the node IDs of all mented every cycle. Kslot is intentionally a local key sok-hop neighbors are known (when node joins the network that a node joining the network will be able to synchro-it broadcast its ID to all its neighbors in k-hop range). nize its slot sizes after receiving one legitimate packet.Given the IDs for all nodes in its k-hop radius, a node The SHA1-HMAC’s output, which is also calculated oncalculates the schedule and precedence for all of neigh- a frame-by-frame basis, defines the slot size for the nextbors as shown in Figure 7. After schedule conflicts are frame as shown in Fig. 8. The network’s state counterresolved implicitly based on the higher precedence, the represents the number of sync pulses received by the net-node follows the combined transmit and receive schedule work, and its value is exchanged between neighboringin a single vector. Proposed solution introduces some ad- nodes in the header of every packet. Here we assumeditional memory and processing requirements considered that every sync pulse is received as it is a global andin details in implementation section. high-power AM pulse. Therefore it is only nodes who The proposed slot conflict resolution can have minor want to join an already operational network need to beinefficiencies when a node with a higher transmit prece- informed about current network counter. The proposeddence for a particular slot does not have any message to coordinated slot size randomization scheme assures thatsend, while the another node is not allowed to send its all nodes know the current frame’s slot sizes and al- lows them to calculate an accurate time interval for their transmissions/receptions. If a key from the key chain is used for slot size cal- Figure 8: Slot size randomization on a frame-by- Figure 7: Implicit conflict resolution frame basis
  7. 7. culation instead a predefined one, in cases when node factor (U ) on the PDF of inter-arrival times and showdoes not receive a key from the gateway would result in that it has very little influence with the proposed scheme.complete loss of synchronization. Without correct infor- This is one of the major benefits of WisperNet-Time,mation about a slot size, nodes that do not know the because for other protocols the only way to reduce spikescurrent frame size are not able to schedule themselves in the PDF is to reduce the utilization factor, as proposedto wake-up for the expected sync pulse. With the prede- in [3]. Results for PDF of inter-arrival times are shownfined key used for slot size calculations, nodes are always in in Fig. 9 for U = 50%, where slot sizes were randomlyable to know size of each frame, therefore they can sched- chosen from one of the 32 possible values in desired span.ule their awakening on time. While channel utilization has an effect to the PDF, it is Slot sizes have values from a discrete set, where the set to a signficantly smaller extent than in B-MAC’s case.size is determined by the number of PRF output bits. We observe that the peak of the PDF is less than 2%The number of values used for slot sizes and relative and no patterns can be extracted by the jammer. With Udistance between them have direct influence on PDF of below 50%, a small increment can be seen on spikes in (5packet inter-arrivals times. The goal of our anti-jamming 10]ms interval. Also with integer multiples of some slotscheme is to have a uniform PDF, or at least a PDF with sizes within [1 5]ms interval, influence of U can almostspikes flattened as much as possible, which does not allow be ignored. Due to the uniform distribution for all threetiming information extraction. It is recommended that cases of U it is not possible to extract slot sizes. Even ifat least 8 slot sizes with small relative difference between the PDF is derived from a smaller statistical sample size,them be used. the results are similar due to the pseudo-randomness of Slot size randomization requires additional memory re- the slot size.sources if nodes need to send some fixed-size data blockin a fixed time interval. In this case slot sizes can be both 3.2.1 Impact on End-to-end Delaysmaller and bigger than the size necessary for data block To analyze how the slot size changes affect the end-transmission, which can result in lower network utiliza- to-end delay, we simulated a 1-dimension chain with 20tion in former case or data congestion in later case. In nodes. In every frame, each node forwards the previouslythe latter case, a portion of the data available for trans- received data to next node. If the slot size is smaller thanmission will have to be buffered in node’s internal queue necessary to transmit the backlogged data, the maxi-till the next transmission slot occurs. In this case, the mum allowed packet size is sent and a rest of the data isaverage slot size must be larger than slot size needed buffered. In a simulated chain, the source node receivesfor one data block transmission. The size of the queue fixed size data blocks at a fixed interval and at a slightlyneeded in every node is directly connected with ratio smaller size than for an average slot size (e.g. 3ms).between these two sizes. Fig. 10 presents PDF and CDF of delay at last node for different slot’s size quantizations. We observe that with finer quantization of slot sizes, the distribution in-3.2 WisperNet-Time: Performance Analysis terval of the last node has not only a smaller maximum We now investigate the impact of channel utilization delay but also a smaller possible set of delay values thaton the PDF of packet inter-arrival times. We also deter-mine the buffering needs due to randomized slot sizing 0.025 50% utilizationand its impact on the end-to-end delay. Finally we look 0.02at the censorship ratio vs. jammer’s lifetime for RT-Link,S-MAC and WisperNet. Probability 0.015 We conducted a simulation in Matlab on a protocolwith structure similar to RT-Link [12], where each cy- 0.01cle consists of 32 frames and each frame consists of 32slots. At the beginning of every cycle a sync pulse is 0.005transmitted. We have simulated a system where slotsizes have uniform distribution with values in range [1 0 0 10 20 30 40 505]ms. A maximum slot size of 5ms is chosen to match the Cumulative Distribution Interarrival times [ms]maximum message size of 128 bytes for IEEE 802.15.4 1 75% utilizationtransceiver with data rate of 250kbps[6]. 128 bytes can 50% utilizationbe sent with transmission duration of 4.2ms and the rest 0.5 25% utilizationof the slot time is used for inter-slot processing and for 0guard times. A simulation for 10000 sync pulses (i.e. 0 10 20 30 40 50 Interarrival times [ms]cycles) was carried out, which on an average lasts 50minutes. We first simulated the influence of the link utilization Figure 9: (Top) PDF of inter-arrival times for WisperNet. (Bottom) Corresponding CDF.
  8. 8. can be expected. The reason is that finer quantization for the latter’s calculations, while using keys from theallows better data distribution per packets and there- gateway’s one-way chain for former. If some nodes arefore reduces the delay caused with packets fragmenta- captured and compromised, only the predefined slot-sizetion. Expectedly, this randomization introduced some key would be risk being extracted.additional delay. In a TDMA system with a constantslot size of 3ms, the delay at the last node would be 4. WISPERNET-SPACE:20 · 3ms = 60ms. Here average delay is around 75ms, COORDINATED SPATIAL ADAPTATIONbut with 95% probability interval [67 88]ms. This shows We now discuss spatial aspect of anti-jamming. Forthat randomization introduces some variability into the the WisperNet-Space, we consider a dense sensor net-communication end-to-end delay estimation. work where each node is modeled as a unit disk graph. Another potential side-effect of WisperNet-Time is a The network is represented as an undirected graph G(V, E)need for additional memory for data queuing. The first where V is a set of nodes (vertices) and E a set of linksnode, with its constant data block input, requires a buffer (edges). For each link e = e(u, v), k weights (or costs)with an additional 512 bytes of memory. All other nodes wj (u, v), (j = 1, 2, ..., k) are associated. For a tree T inrequire an additional buffer for one maximum sized packet. graph G, the aggregate weight Wj (T ) is defined as3.2.2 Comparative Analysis of MAC Protocols Wj (T ) = wj (e), j = 1, 2, ..., k Fig. 14 presents the relationship between the jammer’s e∈Tlifetime (LIFE) and censorship ratio (CR) for communi- Weights associated with each link describe the differentcation in its range. We simulated the influence of two types of costs which may include the network’s para-types of jammers - statistical jammers (SJ) and random functional properties, such as reliability of network com-jammers (RJ) - on different kinds of protocols. Both munication, or delay and energy consumption of a sensorthese types of jammers transmit 150μs-long pulse at- network.tacks. We modeled these attacks with a 90% success In general a set L ⊆ V of terminal nodes is given andrate of packet corruption in cases when jamming pulse the objective is to find a connected subgraph, spanningis transmitted during a node’s communication. For RT- all the terminals with minimal aggregate weights for allLink and WisperNet-Time, we used the previously de- j = 1, 2, ...k. If only one weighting function is consid-scribed protocols, while for the Random Schedule TDMA ered, L = V and the connected subgraph is required to(RSTDMA) we also used 32 slots per frame, where every be a tree, then the problem is defined as a Minimumslot is 3ms long. All protocols are simulated for systems Spanning Tree problem (MST). The MST problem canwith 25% of network utilization. be solved using known algorithms (Kruskal’s, Boruvka’s, As we expected, for RT-Link and S-MAC, the SJ’s life- etc) [19]. If L = V and also only one weighting functionstime is very high. As shown, RSTDMA is easily jammed is considered, problem is equivalent to Steiner minimaland the SJ enjoys the longest lifetime. In addition, the tree problem (SMT). SMT is a NP-complete problem,slot size randomization component decreases the jam- but several heuristics exist which resolve SMT problemmer’s lifetime, for almost 0.1 years at 50% CR. Note in both a centralized and a distributed manner.that differences between LIFE-CR curve for SJ and RJ For WisperNet-Space we only considered network’s re-are caused only by the fact that SJ does not transmit liability, so we associate a reliability weight function forpulses in intervals smaller than 1ms, which, in this case, each link in network. We define the weight of each linkis the smallest slot size (only parameter that can be ex- to be a function of the packet loss ratio and hence aimtracted from input signal statistics). We observe that to derive routes which connect all essential nodes usingschedule randomization has a significantly higher impact most reliable links. The continuous execution of the coston the jammer’s lifetime than does slot size randomiza- minimization function, essentially allows evasion of linkstion. This justifies our decision to use a pre-stored key under the influence of a random jammer. 5 The network’s reliability is measured in terms of its Probability [%] 95% region Step 0.5 4 Packet Delivery Ratio (PDR) which is defined as the 3 2 Step 0.2 ratio of packets that are successfully delivered to a des- Step 0.1 1 tination [2]. PDR can be perceived as the probability of 0 50 60 70 80 90 100 110 error-free communication between two nodes. Thus, the Delay [ms] Cumulative Distribution 1 reliability of a path P in the given network can be defined as a e∈P P DR(e). Our goal is to achieve maximum re- 0.5 Step 0.5 liability on a path P , which is equivalent to maximizing Step 0.2 Step 0.1 0 ln P DR(e) = lnP DR(e). 50 60 70 80 90 100 110 Delay [ms] e∈P e∈PFigure 10: Message delay and its Cumulative Dis- With P DR(e) ≤ 1 for path P , our goal is to minimizetribution at last node, for 20 nodes chain
  9. 9. 100 zoomed 80 RSTDMA with 90 Statistical Jammer Censorship Ratio [%] 70 Censorship Ratio [%] 80 WnT with Statistical 70 60 Jammer WnT with 60 Random 50 Jammer 50 RT Link with 40 Statistical 40 Jammer 30 S−MAC with 30 Statistical Jammer 20 20 0 1 2 3 4 5 6 7 0.4 0.6 0.8 1 1.2 (a) Jammer’s Lifetime [years] (b) Jammer’s Lifetime [years] Figure 11: (a) Dependency between jammer’s lifetime and Censorship Ratio and (b) zoomed e∈P |lnP DR(e)|. Therefore, the reliability weight for sequence that maps the node ID of the active nodes tosome link e = e(u, v) is defined as the index of the N − 2 sequence. In a case of dense networks, with N nodes, from which the Steiner tree is wr (u, v) = |lnP DR(u, v)|. derived, a much smaller number of nodes (M ) may be4.1 Active topology update active. Therefore for all M nodes from the Steiner tree, different temporal IDs are assigned from 1 : M interval, For adaptive routing in WisperNet-Space, we use a and for that tree, a Prufer code with M − 2 elements isMST-Steiner heuristic to solve the SMT problem. All derived. Along with this sequence and number of activeactive nodes periodically send the PDRs for all their ac- nodes, M , a look-up table with size M is sent, wheretive links to the gateway. After receiving a link’s weight, i-th position in this table contains ID of a node, that isthe gateway updates its weight table for all existing links indexed as i while creating the Prufer code sequence. Inin the network. Since the PDR is not defined for inactive this way only 2 · M − 1 values are sent from gateway and(not used) links, these links keep same weights as they can be encapsulated within one maximum-sized 128 bytehad prior to activation of the present network topology. IEEE 802.15.4 packet.Their weights can not be reset to zero, since that wouldallow some heavily jammed links to become competitive 4.2 Topology Maintenance and Updatesfor network routing right in next iteration. In order to defend against mobile jammers, the weights WisperNet-Space computes a new network topologyof unused network’s links are processed in time with a every 128 cycles. Given the average slot size of 3msleaky integrator. To avoid situations where some pre- and 1024 slots/cycle, the topology update occurs everyviously heavily jammed link still has a high weight al- 6.4 minutes on average. The current active topology in-though the jammer that caused it has moved away, for cludes a subset of the node population as active nodesevery link e = e(u, v) and the current active subgraph and the unused node, which are not part of the activeT , the reliability weight for the next network topology topology, are considered inactive nodes. The key chal-calculation is defined as: lenged during a topology update is to activate the inac- tive nodes, which to save energy operate at a very low |lnP DR(u, v)|, e ∈ T wr (u, v) = duty cycle. ρ · wr (u, v), e ∈ T / At the beginning of the new topology distribution allρ (0 < ρ < 1) is a leaky constant that determines a currently active nodes are informed about new activespeed of network’s adaptation to jammers’ mobility. It topology by a broadcast from the gateway. To acti-is not recommended to set a too small value for ρ, since vate inactive nodes, which are to be part of the topol-something similar to previously described situation can ogy update, 8 slots after the sync pulse are reserved forhappen, when a jammed link can be repeatedly included asynchronous communication. We refer to these 8 slotsin active topology after very short duration. For example in each cycle to be the ‘topology configuration’ frame.with ρ = 0.8 reliability weight for unused link would be Thus topology maintenance and updates account for areduced by 20% for every calculation of network topol- 0.78% overhead. Instead using contention based trans-ogy, which would allow inclusion of the jammed link into mission for inactive nodes, we opted to schedule thesenew topology after only a few iterations. If all jammers transmissions from inactive nodes for a more determin-have fixed positions, ρ can be set to 1. istic behavior for the propagation of topology updates. After updating its weights table, the gateway calcu- As information needs to be spread in only one directionlates the new active topology with minimum costs to (from gateway) through a low-degree tree, and since onlyreach all Steiner points (i.e. active nodes). To distribute nodes that need to activate some inactive nodes (on thethe information about active links, we used the Prufer periphery of the current topology) would be scheduledcode (sequence) [19], a unique sequence associated with for transmission in these slots, the TDMA configurationa tree, which for a tree with N vertices contains N − 2 frame of 8 slots is enough for collision free transmissionelements. In addition to this code, we send a second code scheduling of a degree-4 tree with 2-hop coloring. These
  10. 10. transmission indices are calculated using conservative with 400 randomly distributed nodes in a 4km x 4kmversion of MAX [20] for maximal transmission concur- square was analyzed. We also randomly distributed ninerency. jamming nodes, each with the same RF characteristics Algorithm 1 describes the gateway’s procedure for topol- as network’s nodes. To emphasize the jamming effectogy dissemination. The generated message with the in- in order to test WisperNet-Space’s adaptation, the jam-formation about new network topology is distributed mers’ link utilization is set to 50%. We implementedover the network using all active links. Since some cur- a communication protocol so that all neighboring nodesrently inactive nodes may be part of next active topology, exchange exactly one message per frame. Changes inthe mechanism to inform them is included. network routes for both SMT and MST components areAlgorithm 1 Gateway procedure description performed once in 100 frames. In our experiments we used a value of 0.999 for ρ, which decreases reliability while 1 do weight of unused link by 1% for every period of 96 sec- if NewWeightArrive then onds (on average). Update Weight Table Fig. 12(a) presents the initial network topology and if AllReceived or T opologyT imerOn then the initial routes. The terminal nodes and the areas un- T ableU pdated ← 1 der attack by the jammers are highlighted. We observe end if a large number of active links are under attack. The end if average censorship ratio for this network is 9% for this if TableUpdated then startup configuration. The censorship ratio decreases to SMT less than 1% as the routes adapt to more realible paths CalculateSpreadingSchedule and it can not go below this minimum value. This is FloodNetwork because for the given Steiner tree topology and its dis- end if tribution of jamming regions, the best case routes de- end while termiend by WisperNet-Space do include at least 2 par- All nodes that are used for activation of the inactive tially jammed links. The optimal configuration includesnodes along with the new topology receive 3-bit index of 0 links jammed in both direction and 2 links jammed inthe slot dedicated for its transmission, in the 8 slots ”con- only one direction, as shown in Fig. 13.figuration” frame. Using this index, each nodes schedule We observed that at some intermediate moments (forits transmission of the new configuration to neighboring example moments t1 and t2 as seen in Fig. 12(b) and cor-node and keep on transmitting it on the same slot in responding Fig. 14) network routes with more jammedevery ”configuration” frame. Once all its required neigh- links were chosen, which directly resulted in increase ofboring nodes (i.e. currently active or inactive nodes that the overall censorship ratio. This is more prominent atneed to be activated) are heard retransmitting the new the beginning of the WisperNet-Space’s operation whentopology update, a node is assured that its topology has all links start with the same minimum weight (0). Webeen successfully updated. see in Fig. 12(b), three links are jammed in both direc- All inactive nodes wake up after every sync pulse, and tions in the top-right corner. As the routing algorithmlisten for the first 8 slots in a cycle. If the message for explores the problem space with different sets of activeits activation is received, a node switches to active mode links, it often chooses links under heavy influence of theand executes the active mode’s algorithm. jammer. As this procedure of refining the route contin- Since new topology is computed once in 128 cycles, ues and more links are evaluated for the first time, the1024 configuration slots are available for both activa- algorithm will choose jammed links only if its weight,tion of dormant nodes and also for association of newly due to the leaky integrator, drops below a threshold thatadded nodes. Our experiments showed that for networks would make the aggregate weight of a subgraph smallerwith less than 500 nodes all inactive nodes are activated than the aggregate weight of currently used subgraph.in first 10% of these slots. Given this, we allowed last We observe these spikes in the network’s censorship ra-20% of these slots (i.e. configuration slots 820-1024) to tio in Fig. 14. Fig. 12(c) presents optimal solution wherebe used as contention slots for addmission of new nodes only two links from highlighted area, jammed in only oneonly. These slots enable nodes that want to join network direction, are used for routing. Over the course of theto announce their presence to neighboring nodes (via a adaptation for one hour, we observer in Fig. 15 that theHELLO packet in RT-Link), so that they can be initially number of active links does not vary much. We also no-included as inactive nodes in the network. ticed the stretch factor of the network path lengths is ≤1.3 due to the end-to-end weight minimization func-4.3 WisperNet-Space: Performance Analysis tion for calculating cumulative packet reliability across In order to evaluate the performance of WisperNet- multiple links.Space under random jamming attacks we first simulatedan SMT network with a random topology. A network 5. IMPLEMENTATION AND EVALUATION

×