Fescim fair, efficient, and secure cooperation incentive mechanism for multihop cellular networks.bak


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Fescim fair, efficient, and secure cooperation incentive mechanism for multihop cellular networks.bak

  1. 1. IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012 753 FESCIM: Fair, Efficient, and Secure Cooperation Incentive Mechanism for Multihop Cellular Networks Mohamed M.E.A. Mahmoud, Member, IEEE, and Xuemin (Sherman) Shen, Fellow, IEEE Abstract—In multihop cellular networks, the mobile nodes usually relay others’ packets for enhancing the network performance and deployment. However, selfish nodes usually do not cooperate but make use of the cooperative nodes to relay their packets, which has a negative effect on the network fairness and performance. In this paper, we propose a fair and efficient incentive mechanism to stimulate the node cooperation. Our mechanism applies a fair charging policy by charging the source and destination nodes when both of them benefit from the communication. To implement this charging policy efficiently, hashing operations are used in the ACK packets to reduce the number of public-key-cryptography operations. Moreover, reducing the overhead of the payment checks is essential for the efficient implementation of the incentive mechanism due to the large number of payment transactions. Instead of generating a check per message, a small-size check can be generated per route, and a check submission scheme is proposed to reduce the number of submitted checks and protect against collusion attacks. Extensive analysis and simulations demonstrate that our mechanism can secure the payment and significantly reduce the checks’ overhead, and the fair charging policy can be implemented almost computationally free by using hashing operations. Index Terms—Network-level security and protection, wireless communication, payment schemes, hybrid systems. Ç1 INTRODUCTIONM ULTIHOP cellular network (MCN) [1], [2], [3], [4] is a network operation requires the nodes to collaborate, colla- network architecture that incorporates the ad hoc boration consumes the nodes’ resources such as energy and http://ieeexploreprojects.blogspot.comcharacteristics into the cellular system. A node’s traffic is computing power, and does not provide direct benefits.usually relayed through other nodes to the destination. The Selfish nodes are not interested in cooperation withoutnetwork nodes commit bandwidth, data storage, CPU cycles, incentive and make use of the cooperative nodes to relaybattery power, etc., forming a pool of resources that can be their packets, which has a negative effect on the networkshared by all of them. The utility that the nodes can obtain fairness and performance. A fairness issue arises when selfishfrom the pooled resources is much higher than that they can nodes take advantage of the cooperative nodes without anyobtain on their own. The considered MCN is used for civilian contribution to them. The selfish behavior also significantlyapplications where the network has long life and the mobile degrades the network performance, which may result innodes are supposed to have long-term relations with the failure of the multihop communications [8], [9].network. Multihop packet relay can reduce the dead areas Reputation-based and incentive mechanisms [10], [11]by extending the communication range of the base stations have been proposed to thwart selfishness attacks. Forwithout additional costs. It can also reduce the energy reputation-based mechanisms [12], [13], [14], the nodesconsumption because packets are transmitted over shorter usually monitor the transmissions of their neighbors todistances, and improve the area spectral efficiency and the make sure that the neighbors relay other nodes’ traffic, andnetwork throughput and capacity [5], [6], [7]. However, due thus, selfish nodes can be identified and punished. Forto involving autonomous devices in packet relay, the packet incentive mechanisms, packet relay is a service not anrouting process suffers from new security challenges that obligation. The source and destination nodes pay credits (orendanger the practical implementation of MCN. virtual currency) to the intermediate nodes for relaying The assumption that the network nodes are willing to their packets. Credits can stimulate the nodes’ cooperationrelay other nodes’ packets may not hold for civilian by proving that it is more beneficial for the nodes toapplications where the nodes are autonomous and self- cooperate than behaving selfishly.interested in the sense that they aim to maximize their welfare Reputation-based mechanisms suffer from essentialand minimize their contributions. Although the proper problems that discourage implementing them in MCN. First, monitoring the nodes’ transmissions by overhearing the channel is not energy efficient for transmitters. The full-. The authors are with the Department of Electrical and Computer power transmission is used instead of adapting the Engineering, University of Waterloo, Waterloo, ON N2L 3G1, Canada. transmission power according to the distance separating E-mail: {mmabdels, xshen}@bbcr.uwaterloo.ca. the transmitter and the receiver [15] to enable moreManuscript received 23 May 2010; revised 20 Feb. 2011; accepted 12 Mar. neighboring nodes to hear the packet transmission. Second,2011; published online 28 Apr. 2011.For information on obtaining reprints of this article, please send e-mail to: reputation-based mechanisms do not achieve fairnesstmc@computer.org, and reference IEEECS Log Number TMC-2010-05-0247. because the highly contributing nodes are not compensated.Digital Object Identifier no. 10.1109/TMC.2011.92. For example, although the nodes at the network center relay 1536-1233/12/$31.00 ß 2012 IEEE Published by the IEEE CS, CASS, ComSoc, IES, & SPS
  2. 2. 754 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012more packets than those at the periphery, they are not number of submitted checks and protect against collusioncompensated. Third, the mechanisms suffer from unreliable attack. In Section 5, we will show that if each intermediatedetection of the selfish nodes and false accusation of the node submits a low ratio of randomly chosen checks, mosthonest nodes. That is because it is difficult to differentiate of the checks can be probabilistically submitted underbetween a node’s unwillingness and incapability to co- collusion attack. Extensive analysis and simulations de-operate, e.g., due to low resources, packet collision, and monstrate that FESCIM can secure the payment, charge thenetwork congestion. source and destination nodes almost computationally free, In addition to cooperation stimulation, the incentive and significantly reduce the number of generated andmechanisms can achieve fairness by charging or rewarding submitted checks.credits to balance a node’s contribution and its benefit. The The remainder of this paper is organized as follows:node’s contribution can be relaying other nodes’ packets or Section 2 reviews the related work and Section 3 presentspaying credits, whereas the node’s benefit can be relaying the system models. The proposed cooperation incentiveits packets or earning credits. In other words, credits are mechanism is presented in Section 4. Security analysis andused to compensate the nodes for relaying other nodes’ performance evaluation are provided in Sections 5 and 6,packets to enforce fairness. Moreover, incentive mechanisms respectively, followed by conclusion and future work incan discourage launching Resource-Exhaustion attack by Section 7.sending bogus messages to exhaust the intermediate nodes’resources because the nodes pay for relaying their packets.Incentive mechanisms can also efficiently bill the network 2 RELATED WORKusers when they roam among different foreign networks by In tamper-proof device (TPD)-based incentive mechanismspaying all the parties involved in the communication [17], [18], [19], [20], [21], a TPD is installed in each node towithout contacting distant home location registers [16]. manage its credit account and secure its operation. In However, the efficient implementation of the existing Nuglets [17], [18], the self-generated and forwardingincentive mechanisms is questionable because they impose packets are passed to the TPD to decrease and increasesignificant overhead. First, the fair charging policy is to the node’s credit account, respectively. The packet pursecharge both the source and destination nodes when both of and the packet trade models have been proposed. In thethem benefit from the communication. To securely imple- packet purse model, only the source node pays by loadingment this charging policy, two signatures are usually some credits in each packet before sending it. Eachrequired per message (one from the source node and the intermediate node acquires the amount of credits that coverother from the destination node) to prevent payment the packet’s relaying cost. In the packet trade model, each http://ieeexploreprojects.blogspot.comrepudiation and manipulation. Nevertheless, the extensive intermediate node runs an auction to sell the packets to theuse of the public key cryptography is very costly, which following node in the route. In this way, each intermediatedegrades the network performance and stimulates the node earns some credits and the destination node paysnodes to behave selfishly. Second, since a trusted party the total packet relaying cost. In SIP [19], after receiving amay not be involved in the communication sessions, the data packet, the destination node sends a paymentnodes usually compose undeniable proof of packet relaying RECEIPT packet to the source node to issue a REWARDcalled check, and submit the checks to a central unit called packet to increment the credit accounts of the intermediatethe accounting center (AC) for clearance. However, sub- nodes. In CASHnet [20], [21], the source node’s traffic creditmitting and processing a large number of checks implies account is charged and a signature is attached for each datasignificant communication and computation overhead and packet. Upon receiving the packet, the destination node’simplementation complexity. traffic credit account is also charged and a digitally signed In this paper, we propose FESCIM, a Fair, Efficient, and ACK packet is sent back to increase the helper creditSecure Cooperation Incentive Mechanism, to stimulate the accounts of the intermediate nodes. Users regularly visitnode cooperation in MCN. In order to efficiently and service points to buy traffic credits with real money and/orsecurely charge the source and destination nodes, the transfer helper credits to traffic credits.lightweight hashing operations are used in the ACK packets The TPD-based incentive mechanisms suffer from theto reduce the number of public-key-cryptography opera- following problems. First, the assumption that the TPDtions. The destination node generates a hash chain and cannot be tampered is neither secure nor practical forsigns its root, and acknowledges message reception by MCNs. That is because the nodes are autonomous and self-releasing a hash value from the hash chain. In this way, the interested and the attackers can communicate freely in an undetectable way if they could compromise the TPDs [22].destination node generates a signature per group of Moreover, since the security protection of these mechan-messages instead of generating a signature per message. isms completely fails if the TPDs are tampered, only a small Furthermore, instead of generating a check per message number of manufacturers can be trusted to make theor generating a nodal check for each intermediate node, a network nodes, which is too restrictive for civilian net-small-size check containing the payment data for all the works. Second, a node cannot communicate if it does notintermediate nodes is generated per route. In addition, have sufficient credits at the communication time. Thetrusting one node to submit the check is not secure because nodes at the network edge cannot earn as many credits asthis node may collude with the source and destination the nodes at other locations because they are less frequentlynodes to not submit the check, as we will discuss in selected by the routing protocol. Furthermore, the creditSection 4.2. Instead of submitting the checks by all the distribution has direct impact on the network performance,intermediate nodes to thwart collusion attack, a Probabil- e.g., if a small number of nodes have a large ratio of theistic-Check-Submission scheme is proposed to reduce the network credits, the network performance significantly
  3. 3. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 755degrades because the rich nodes are not motivated tocooperate and the poor nodes cannot initiate communica-tions. Finally, since credits are cleared in real time, thenetwork performance degrades if the network does nothave enough credits circulating around. In [23], it is shownthat the overall credits in the network decline graduallybecause the total charges are not necessarily equal to thetotal rewards. That is because the source node is fullycharged after sending a packet but some intermediate nodesmay not be rewarded when the route is broken. AlthoughCASHnet can alleviate this problem by buying credits withreal money, it is shown in [23] that in spite of having helpercredits, some nodes starve because they cannot find aservice point to convert them to traffic credits. In order to eliminate the need for TPDs, a central bankcalled the AC can be used to store and manage the nodes’accounts. In [24], the source node appends a payment tokento each transmitted packet, and each intermediate node Fig. 1. The architecture of the multihop cellular network.uses its secret key to check whether the token correspondsto a winning ticket. Winning tickets are submitted to the AC intermediate nodes is large because the source nodeto reward the winning nodes. The source and destination attaches one hash value for each intermediate node. Innodes are charged per packet but the intermediate nodes Sprite and Express, only the source node pays no matterare rewarded per winning ticket. In a security flaw, the how the destination node benefits from the communication.colluding nodes can exchange tokens to be checked in each Moreover, since the intermediate nodes are rewarded fornode to steal credits. In our earlier work [25], instead of the relayed messages that do not reach the destination, allsubmitting payment checks to the AC, each node submits the nodes in a route submit the checks because packet relayan activity report containing its alleged charges and is considered successful by a node if a next node in therewards of different sessions. The AC uses a reputation route submits a valid check. We call this check submissionsystem to identify the cheating nodes that report false scheme All-Submitters because all the intermediate nodescharges and/or rewards to steal credits. However, due to submit all the checks. In Sprite and Express, significantthe nature of the reputation systems, some honest nodes communication and computation overhead is implied due http://ieeexploreprojects.blogspot.commay be falsely identified as cheaters and the colluding to generating and submitting a large number of checksnodes may manage to steal credits. because a check is generated per message and all the nodes In [26], each node in a route buys packets from the in a route submit all the checks.previous node and sells them to the next node. The packets’ In [30], an incentive mechanism has been proposed forbuyers contact the AC to get deposited coins and the ad hoc networks that are used to connect the nodes to thepackets’ sellers submit the coins to the AC to claim their Internet. The source node signs the identities of the nodes inpayment. However, the interactive involvement of the AC the route and appends this signature to the message, andin each communication session is not efficient and creates a the destination node signs a check and sends it to the lastbottleneck at the AC. In [27], an incentive mechanism has intermediate node to submit to the AC. Since only the lastbeen proposed for MCN. Unlike the original MCN intermediate node submits the check, we call this checkarchitecture proposed in [1], the base stations are involved submission scheme Fixed-Submitter. However, the sourcein every communication session, which may lead to and destination nodes can communicate freely and thesuboptimal routes when the source and destination nodes intermediate nodes are not rewarded if the last intermediatereside in the same cell. In addition, the corrupted messagesare relayed to the base station before they are dropped node colludes with the source and destination nodes to notbecause the intermediate nodes cannot verify the authen- submit the checks. Moreover, generating two signatures perticity and the integrity of the messages. message is too costly for mobile nodes. In [31], a hash chain In Sprite [28], the source node signs the identities of the is used to efficiently authenticate digital streams butnodes in the route and appends its signature to each FESCIM uses a hash chain to achieve payment nonrepudia-transmitted message. The intermediate and the destination tion to secure the payment.nodes compose checks and submit them to the AC to claimthe payment. In Express [29], the source node generates a 3 SYSTEM MODELShash chain for each intermediate node IDK and commits tothe hash chain by digitally signing the root of the hash chain 3.1 Network and Communication Modelsand sending the signature to IDK . Each time the node IDK As shown in Fig. 1, the considered MCN includes anrelays a message, the source node releases the preimage of accounting center, a set of base stations, and mobile nodes.the last sent hash value. The source, intermediate, and The AC stores and manages the credit accounts of thedestination nodes compose checks and submit them to the nodes, and generates private/public key pair and certificateAC. However, the nodes have to generate and store a large with unique identity for each node. Once the AC receives anumber of hash chains because any node in the network check, it updates the accounts of the participating nodes.may act as an intermediate node due to the node mobility. The base stations are connected with each other and withThe packet overhead is large especially if the number of the AC by a backbone network that may be wired or
  4. 4. 756 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012wireless. FESCIM can be implemented on the top of any or not because relaying a packet consumes the node’srouting protocol, such as DSR [32] and AODV [33], to resources. However, it is difficult to corroborate anestablish an end-to-end communication session provided intermediate forwarding action without involving too muchthat the full identities of the nodes in the route are known tooverhead, e.g., all the intermediate nodes have to submit allthe source and destination nodes. It is important to include the checks in [28], [29]. Moreover, rewarding the nodes forthese identities in the source and the destination node’s relaying route establishment packets or packet retransmis-signatures to compose valid checks. sions significantly increases the number of checks because a All communications are unicast and the nodes can large number of nodes may relay route establishmentcommunicate in one of two modes: pure ad hoc or hybrid. packets and packet retransmission frequently happens inFor pure ad hoc mode, the source and destination nodes wireless networks. Therefore, the AC charges the sourcecommunicate without involving base stations. The source and destination nodes for every transmitted message even ifnode’s messages may be relayed in several hops by the the message does not reach the destination, but the ACintermediate nodes to the destination node. For hybrid rewards the intermediate nodes only for the deliveredmode, at least one base station is involved in the messages. For fair rewarding policy, the value of iscommunication. The source node transmits its messages determined to compensate the nodes for relaying route-to the source base station (BSS ), if necessary in multiple establishment packets, packet retransmission, and undeliv-hops. If the destination node resides in a different cell, the ered packets. In Section 5, we will argue that our chargingmessages are forwarded to the destination base station and rewarding policies can thwart rational attacks and(BSD ) that transmits the messages to the destination node encourage the nodes’ cooperation. Similar to the VISApossibly in multiple hops. The nodes can contact the AC at system and the incentive mechanisms in [25], [28], [29], [30],least once every few days. This connection can occur via the the nodes communicate first and pay later. The AC issuesbase stations or the wired networks such as the Internet. certificates to enable the nodes to transact by issuing digitalDuring this connection, the nodes submit checks, renew checks without the need for direct verification from the ACtheir certificates, and convert credits to real money and/or to avoid frequently contacting the AC and thus creating apurchase credits with real money. bottleneck at the AC. The nodes at the network border cannot earn as many3.2 Threat and Trust Models credits as those at other locations because they are lessSince the mobile nodes are autonomous and self-interested, frequently selected by the routing protocol. In order tothe attacker has full control on his node, and thus he can communicate, they can purchase credits with real money.change its operation. The attackers work individually or However, we do not consider this as a fairness problemcollude with each other under the control of one authority http://ieeexploreprojects.blogspot.com behind incentive mechanisms isto launch sophisticated attacks. The attackers are rational in because the philosophy that packet relay is a service not an obligation. This servicethe sense that they misbehave when they can achieve more may not be requested from some nodes, i.e., the customersbenefits than behaving honestly. Specifically, the attackers (source and destination nodes) request the packet-relayattempt to steal credits, pay less, and communicate freely. service from the best service providers (shortest routeThe mobile nodes are probable attackers because they are nodes). If the traffic is directed through the border nodes,motivated to misbehave to increase their welfare, but the obviously, we sacrifice the network performance becauseAC is fully secure. It is impossible to realize secure payment the routes may be long. Due to the node mobility, thebetween two entities without trusted third party [34]. For border nodes can change their location and earn morethe trust models, the network nodes fully trust the AC to credits as shown in [19]. Moreover, the border nodes docorrectly perform billing and auditing, but the AC does not not relay as many packets as others, and thus, it is fair totrust any node or base station in the network. The network charge the border nodes real money to compensate thenodes also trust their operators’ base stations but do nottrust those of other operators. other nodes that relayed more packets. Table 1 gives the used notations in this paper.3.3 Payment ModelA fair charging policy is to support cost sharing between 4 THE PROPOSED FESCIMthe source and destination nodes when both of them benefitfrom the communication. In order to make FESCIM flexible, In this section, we first present FESCIM for hybrid modethe payment-splitting ratio is adjustable and service and then for pure ad hoc mode.dependent, e.g., a DNS server should not pay for name 4.1 Hybrid Moderesolution. For rewarding policy, some incentive mechan- 4.1.1 Route Discovery Phaseisms, such as [35], consider that a packet relaying reward isproportional to the incurred energy in relaying the packet. It In order to establish an end-to-end route, the source nodeis difficult to implement this rewarding policy in practice broadcasts the Route Request Packet (RREQ) containing thewithout involving complicated route discovery process and identities of the source (IDS ) and the destination (IDD )calculation of enroute individual payments. Therefore, nodes, the route establishment time stamp (TS ), and thesimilar to [19], [25], [28], [29], we use fixed rewarding rate, payment-splitting ratio (Pr ). The source node is charged thee.g., credits per unit-sized packet. ratio of Pr of the total payment and the destination node is In MCNs, packet loss may occur normally due to node charged the ratio of 1ÀPr . A network node appends itsmobility, channel impairment, etc. Ideally, any node that identity and broadcasts the packet if the time stamp ishas ever tried to relay a packet should be rewarded no within a proper range. The RREQ packet is relayed by BSSmatter whether the packet eventually reaches its destination to BSD (if the destination node resides in a different base
  5. 5. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 757 TABLE 1 The Useful Notations Fig. 3. The exchanged security tags in a session.station) that broadcasts it. Finally, the destination node message can significantly reduce the check size becausesends back the Route Reply Packet (RREP) to establish the the smaller size HðM Þ and not M is attached to the check. X Xroute. The source node initiates a new route discovery The source node attaches its certificate to the first dataphase if the route is broken. packet to enable the intermediate and destination nodes to As shown in Fig. 2, the destination node generates a verify its signatures. Before relaying a data packet, eachhash chain with size of Z þ 1 by iteratively hashing a 0 intermediate node verifies the attached signature to ensurerandom value called seed (HD ðiÞ) Z http://ieeexploreprojects.blogspot.com times to obtain a finalhash value called root (HD ðiÞ), where HD ðiÞ ¼ HðHD ðiÞÞ the message’s integrity and authenticity and to verify the Z X XÀ1and i is the hash-chain number. Note that multiple hash payment data that include Si and X. The intermediate nodeschains may be used in one route. From Fig. 3, the RREP store only the last source node’s signature to be used in thepacket contains the session identifier (Si ), the destination check composition, i.e., after receiving the Xth data packet,node’s certificate, the root of the first hash chain (HZ ð1Þ), the intermediate nodes delete SigS ðSi ; X À 1; HðMXÀ1 ÞÞ and Dand the destination node’s signature (SigD ðSi ; HZ ð1ÞÞ). Si store SigS ðSi ; X; HðMX ÞÞ that is enough to prove that X Dcontains the identities of the nodes in the route, TS , and Pr , messages have been transmitted and X À 1 messages havee.g., Si ¼ IDS , ID1 , ID2 , BSS , ID3 , ID4 , IDD , TS , Pr for the route been delivered. Each node in the route restarts a timer eachshown in Fig. 3. The destination node’s signature authenti- time the node transmits or relays a packet. The route iscates the node and proves its approval to pay for the considered broken when the timer expires. After receivingsession. The signature also proves that the hash chain has the ACK of the last message, the source node sends End ofindeed been created by the destination node and links it to Session (EoS) packet to close the session.the route. Upon receiving the RREP packet, each inter-mediate node relays the packet if the signature is correctly 4.1.3 ACK Generation and Relay Phaseverified, and the source node starts data transmission. Upon receiving the Xth data packet and X Z, the destination node sends back ACK packet containing the4.1.2 Data Generation and Relay Phase preimage of the last released hash value, or HD ð1Þ, toZÀXFor the Xth data packet, Fig. 3 shows that the source node acknowledge receiving the message in an undeniable way.appends the message MX and its signature (SigS ðSi ; X; Therefore, instead of generating a signature per ACKHðMX ÞÞ). Signing the hash of the message instead of the packet, one signature is generated per Z ACKs. Payment nonrepudiation and nonmanipulation are achievable be- cause the hash function is one-way, i.e., only the destination node could have generated the hash chain because it is not ZÀXÀ1 ZÀX possible to compute HD ð1Þ from HD ð1Þ. Each inter- mediate node verifies the hash value by making sure that HD ð1Þ is generated from hashing HZÀXÀ1 ð1Þ. As illustrated ZÀX D in Fig. 3, after releasing all the hash values of the first hash chain, the destination node creates a new hash chain and authenticates it by signing all the used hash chains’ roots, or SigD ðSi ; HZ ð1Þ; HZ ð2ÞÞ, instead of signing only the last hash D DFig. 2. Hash chain generated by the destination node. chain’s root. In this way, the intermediate nodes store only
  6. 6. 758 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012 Fig. 5. The charges and rewards for X messages. root of the second hash chain, and the last released hash value (HZÀLÀ1 ð2Þ), where X ¼ Z þ L þ 1. Moreover, the two D hash chains’ roots are included in the destination node’s signature. Fig. 4d shows the composed check when the last received packet is the ACK of the Xth message. 4.1.5 Check Clearance Phase The base station submits the check to the AC for redemption, but the nodes submit the check if the base station belongs to a different operator. The nodes also submit the check if the route is not complete, i.e., the EOS packet is not received, and the base station does not have correct payment information. For example, if the route is broken during relaying the ACK of MX from IDD to BSD , the BSD ’s check does not prove that the Xth message is delivered, and thus, the nodes are not rewarded for theFig. 4. The formats of the payment checks. last message if they do not submit the check. Once the AC receives a check, it checks that the check has not beenthe last destination node’s signature for the check composi- deposited before using its unique identifier (S ). Then, the ition because it can authenticate all the used hash chains in AC generates the source and destination nodes’ signaturesthe route. The intermediate nodes also store the hash and hashes them to verify the check’s credibility. The checkchains’ roots and seeds and the last released hash value for is valid if the resultant hash value is identical to the check’sthe check composition. Security Token. For a check (SC(X)), the number of transmitted messages (X) is signed by the source node,4.1.4 Check Composition Phase http://ieeexploreprojects.blogspot.com and the number of delivered messages can be computedFor each route, one check containing the payment data for from the number of hashing operations to map HZÀX ð1Þ to Dall the intermediate nodes can be composed. The general HZ ð1Þ. Finally, the AC clears the check according to the Dformat of the route check is shown in Fig. 4a, where “[Y]” charging and rewarding policy discussed in Section 3.3.means that Y may not exist in some cases. A check containstwo main parts: Descriptor (D) and Security Token (St ). The 4.2 Pure Ad Hoc ModeDescriptor contains Si that has the identities of the payers The proposed mechanism for hybrid mode can be used forand the payees, TS , and Pr . The Descriptor also contains the pure ad hoc mode, but the intermediate nodes have tomessages’ number (X), the hash value of the last received submit the checks to the AC because the base stations aremessage, the hash chains’ roots and seeds, and the last not involved in the communication. A check containsreleased hash value (½HZÀL ðvފ). The Security Token is an payment data for all the nodes in the route, but it is not Dundeniable proof that prevents payment repudiation and secure to trust one node to submit the check because itmanipulation, and thus ensures that the check is undeni- may collude with the source and destination nodes so asable, unmodifiable, and unforgeable. In order to signifi- not to submit the check to increase their welfare. Fig. 5cantly reduce the check size, the Security Token is composed shows the charges and rewards for sending X messages inby hashing the source and destination nodes’ signatures a route with n intermediate nodes. If the source andinstead of attaching the large-size signatures. The check size destination nodes collude with K intermediate nodes anddepends on the number of used hash chains because two the check is not submitted, the colluders can save X Á Áhash values should be attached for each hash chain, and ðn À KÞ credits. Obviously, the colluders can achieve gainsthus properly choosing the hash chain size can minimize when K n, and thus, the source and destination nodesthe check size. can compensate the colluding intermediate nodes. On the Fig. 4b shows the composed check when the route is other hand, it is not efficient to submit a check by eachbroken during relaying the Xth data packet and 1 X Z, intermediate node [28], [29] due to significantly increasingi.e., only one hash chain is used. If the route is broken after the number of redundant checks. In this section, wereceiving the first data packet (X ¼ 1), the check does not propose two schemes for efficiently thwarting the collusion ZÀXþ1have HD ð1Þ because the ACK packet is not received. attacks against check submission.However, for 1 X Z, the last hash value received fromthe destination node (HZÀXþ1 ð1Þ) is attached to the check. 4.2.1 Changeable-Submitter Check Submission DFig. 4c shows the composed check when the route is broken Schemeafter receiving the Xth data packet and Z X 2 Á Z, i.e., Similar to [30], one node submits the check, but the positiontwo hash chains are used. It can be seen that the check of the check submitter is randomly changed instead ofcontains the seed and the root of the first hash chain, the fixed. All the intermediate nodes execute a public function
  7. 7. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 759 Fig. 7. The effect of on PðQ ! 0:9 Á ).Fig. 6. The effect of RC on the number of submitted checks. PðQ ! qÞ ¼ 0:9. The minimum RC that achieves this probability is denoted by RC Ã , e.g., from Fig. 6, RC Ã iscalled Selector to decide the check submitter. The Selector’sinput is the session identifier and the return value is the0.56 and 0.33 when n equals 3 and 6, respectively. The rationale here is that a little increase in RC significantlyposition of the check submitter, e.g., if the return value is 1, increases the number of redundant checks in the long run,the first intermediate node after the source node is the checksubmitter and so on. Obviously, changing the function’s but the increase of RC above RC Ã has little effect on theinput can change the position of the check submitter, whichcheck submission probability. From Fig. 6, when n equals 3,increases the difficulty of the collusion attack. The Selector the increase of RC from 0.52 to 0.55 and from 0.55 to 0.58can be implemented using a hash function with deriving the changes PðQ ! 0:9 Á Þ with 0.75 and 0.15, respectively.return value from the output hash value such that all Fig. 7 shows the effect of on the probability of clearingpossible cases are equally likely, i.e., all the intermediate at least 90 percent of the checks. The figure demonstratesnodes have the same probability to be the check submitter. that properly choosing the value of RC , e.g., between 0.5 and 0.55, can make have very little effect on PðQ ! 0:9 Á Þ.4.2.2 Probabilistic-Check-Submission Scheme Fig. 8 shows the effect of the collusion attack on PðQ ! by each intermediate 0:9 Á Þ at different values of RC and n of 5. The figureInstead of submitting all the checkshttp://ieeexploreprojects.blogspot.comnode [28], [29], each node submits the ratio of RC of demonstrates how the honest nodes can take protectiverandomly chosen checks such that a minimum ratio of the measures to protect against the colluding nodes. To Ãunrepeated checks will be submitted probabilistically. mitigate the effect of one and two colluding nodes, RCEquations (1) and (2) give the probability that at least q should be 0.46 and 0.56, respectively, i.e., if each nodeunrepeated checks out of are submitted for routes with n submits only 56 percent of the checks, we can probabil-intermediate nodes and C colluding nodes, where Q denotes istically guarantee submitting at least 90 percent of the checks even if two nodes collude. Therefore, the increase ofan integer random variable ð0 Q Þ that represents the RC strengthens the robustness against the collusion attack butnumber of unrepeated checks that are submitted: with additional redundant checks, which shows an intuitive X trade-off between security and overhead. PðQ ! qÞ ¼ PðQ ¼ jÞ ð1Þ j¼q 4.3 Discussion Although our focus was on the unidirectional data transmis- sion in the previous sections, FESCIM can also be applied for PðQ ¼ jÞ ¼ Á ð1 À ð1 À Rc ÞnÀC Þj Á ðð1 À Rc ÞnÀC ÞÀj : ð2Þ bidirectional data transmission. In this case, FESCIM can j bypass sending some ACK packets by using the data packets Fig. 6 shows the relation between PðQ ! qÞ and RC atdifferent values of q and n assuming that is 1,000 checksand all the nodes do not collude (C ¼ 0). It can be seen thatmost of the checks can be submitted with a very high probabilitywhen RC is much less than 1. For example, when n equals to6, the probabilities of submitting at least 80 percent and90 percent of the checks are 1 if each node submits only27 percent and 34 percent of the checks, respectively.However, when n equals to 3, RC should be 0.44 and 0.57to submit at least 80 percent and 90 percent of the checkswith the probability of 1, respectively, i.e., RC should belarger for shorter routes to guarantee submitting the sameratio of the checks. RC should be determined to achieve aspecific probability of submitting a minimum ratio of thechecks. In this paper, we assume that RC is chosen to make Fig. 8. The effect of collusion attack on the ratio of submitted checks.
  8. 8. 760 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012 Fig. 11. FESCIM for asymmetric paths. in P1 contains DataP1 ðXÞ that is similar to the data packet in Fig. 3, and ACKP1 ðX À 1Þ that contains the destination node’s ACK for the message MXÀ1 , where ACKP1 ðX À 1Þ is sent from IDD to IDS through P2. The Xth data packet in P1 also contains the source node’s ACK for the X À 1th data packet sent through P2 ðACKp2 ðX À 1ÞÞ to enable ID3 and ID4 to compose checks. In other words, P1 transports the source node’s messages and P2 transports the ACKs of the messages. The source and destination nodes compose twoFig. 9. The security tags of the bidirectional data transmission. hash chains by iteratively hashing random values to obtain the hash chains’ roots ðHZ ð1Þ and HZ ð1ÞÞ. The source and D Sto serve as ACKs. Fig. 9 shows the exchanged security tags in destination nodes send the signatures Sig ðS ; HZ ð1ÞÞ and S i;P2 SFESCIM for bidirectional data transmission assuming that Sig ðS ; HZ ð1ÞÞ to authenticate the hash chains and link D i;P2 Dthe nodes IDA and IDB send X2 and X1 messages, them to P2, where S i;P2 ¼ IDS ; ID4 ; ID3 ; IDD ; TS ; Pr . Therespectively, and X2 X1. The Xth data packet sent from source and destination nodes release one element fromIDA to IDB contains Si , X, the message MA;X and its hash value, their hash chains, i.e., Data ðXÞ contains a hash value from P2 http://ieeexploreprojects.blogspot.comand the signature SigA ðSi ; X; HðMA;X ÞÞ. The Xth data packet the destination node’s hash chain to acknowledge the datasent from IDB to IDA contains Si , X, the message MB;X and its received from ID through P1, and ACK ðX À 1Þ contains a S P2hash value, and the signature SigB ðSi ; X; HðMB;X ÞÞ. The hash value from the source node’s hash chain to acknowl-security tag SigB ðSi ; X; HðMB;X ÞÞ means that node IDB has edge receiving DataP2 ðX À 1Þ. ID1 and ID2 can composesent X messages to IDA and has also received X messages checks using the mechanism discussed in Section 4.1, andfrom IDA . After IDB sends all its messages, it switches to the Fig. 10b shows the composed checks by ID3 and ID4 .hash-chain-based ACKs to enable IDA to complete sending itsmessages. The first ACK packet contains IDB ’s signature for ahash chain root ðHZ ð1ÞÞ and X1. Fig. 10a shows the check 5 SECURITY ANALYSIS Bformat of the bidirectional data transmission. For Double-Rewarding attack, the attacker attempts to FESCIM can also be used for asymmetric paths. As illegally increase its rewards by submitting a check multipleshown in Fig. 11, the path P1 with the intermediate nodes times. In order to thwart the attack and identify theID1 and ID2 can only transport packets from IDS to IDD , and attackers, the AC checks whether the check has beenthe path P2 with the intermediate nodes ID3 and ID4 can deposited using the check unique identifier (Si ). Foronly transport packets from IDD to IDS . The Xth data packet Double-Spending attack, the attacker attempts to generate identical checks for different sessions to pay once. Two checks cannot have the same identifier because it contains SC(X1, X2) the identities of the session nodes and time stamp. For Z Z-(X2-X1)-1 Check-Forgery-and-Manipulation attack, the attackers attempt D = Si, X1, X2, H(MA,X2), HB (1), HB (1) to forge checks or manipulate valid checks to increase their Z St = H( SigA(Si, X2, H(MA,X2)), SigB(Si, HB (1), X1) ) rewards. This is not possible with using secure hash function and signature scheme because it is not possible to forge or modify the source and destination nodes’ signatures and to compute the private keys from the public ones. It is also infeasible to compute the hash value of the source and destination nodes’ signatures without comput- ing the signatures, and to compute HD ðiÞ from HZÀXþ1 ðiÞ. ZÀX D The AC can identify the attackers when the verifications of their checks repeatedly fail.Fig. 10. The check format of the bidirectional data transmission and For Receiver-Robbery attack, the source node colludesasymmetric paths. with some intermediate nodes to steal credits from the
  9. 9. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 761 attacks against RREQ packets is not possible because the packet integrity can be checked at each node. For Denial-of-Check-Submission attack, the colluding attack- ers residing close to the base station may attempt to prevent the nodes from submitting the checks to the AC. First, the nodes accumulate the checks and submit them to the AC in batch to reduce the communication overhead, e.g., checksFig. 12. Secured RREQ packets. may be submitted every few days, and thus, the nodes can repeatedly try to contact the AC during this time. Second, thedestination node by sending bogus messages paid by the nodes do not delete the checks before receiving the Checks-source and destination nodes or composing faked or Submission-Confirmation packet from the AC. The nodesmanipulated checks. For example, from Fig. 5, if the source transmit the Checks-Submission-Request packet to the AC tonode colludes with K intermediate nodes, the colluding submit the checks. This packet contains the identity of theintermediate nodes earn ðX Á Á KÞ credits but the source submitter, time stamp, the checks, and the submitter’snode pays ðX Á Á n Á Pr Þ for X messages. Obviously, the signature. The signature authenticates the submitter, thwartscolluders can achieve gains when ðX Á Á K À X Á Á n Á Packet-Replay attack, and ensures the packet’s integrity. ThePr Þ 0 or ðK À n Á Pr Þ 0. In FESCIM, the colluding nodes AC replies with the Checks-Submission-Confirmation packetcannot fake or manipulate checks to steal credits from the containing the AC’s signature for the checks to confirm thedestination node because the destination node’s signature submission of the checks. Third, the nodes may change theirand hash chain elements are required to compose a valid cells due to the nodes’ mobility, and thus, if they cannotcheck. Moreover, a session cannot be established and a submit the checks through one base station, they can submitvalid check cannot be composed if the destination node is them through other base stations. Finally, the nodes cannot interested in the communication because its signature is contact the AC using wired networks such as the Internet andrequired. The intermediate nodes are rewarded only when Wi-Fi, as explained in Section 3.1.the destination node acknowledges receiving correct Due to using the postpaid payment policy, the nodes canmessages, and thus they do not earn from bogus messages. communicate even if they do not have sufficient credits atFor Packet-Replay attacks, the internal or external attackers the communication time. For Payment-Denial attacks, themay record valid packets and replay them in different place attackers may join the network for a short time and leaveand/or time claiming that they are fresh, to establish without paying their debts. Different from the traditional adsessions under the name of other nodes to communicate http://ieeexploreprojects.blogspot.com be temporarily established andfreely. FESCIM uses time stamp to ensure that stale packets hoc networks that can similar to the current single-hop cellular networks, MCN iscan be identified and dropped. For Impersonation attack, the a long-life network where the nodes have long-termattackers attempt to impersonate other nodes to commu-nicate freely or steal credits. This attack is not possible relations with the network. Moreover, the postpaid pay-because the nodes use their private keys to sign the packets, ment policy has been widely used successfully in manyand the attackers cannot compute other nodes’ private keys. services such as credit cards and cellular networks. In For Free-Riding attacks, two colluding intermediate FESCIM, each node needs a certificate to use the network.nodes in a legitimate session manipulate the session packets Issuing a certificate is not free to make changing an identityto piggyback their data to communicate freely. To thwart costly. Similar to the existing single-hop cellular networks,this attack, the integrity of the packets should be checked at the AC stores the personal information of the users, andeach node, and thus, the first node after the first colluder thus, it can take the legal procedures against the users whocan detect the packet manipulation and drop the packet. do not pay. To limit the debt, a certificate lifetime is shortFor data and RREP packets, the source and destination and depends on the node’s credits at the certificate issuingnodes’ signatures can ensure the packets’ integrity. The time and its average credit consumption rate. We can alsointegrity of the ACK packets can also be ensured because it mix both the prepaid and the postpaid payment policies tocontains one element of the hash chain, which is verified at reduce the debt amount, e.g., each node has to pay someeach node. The RREQ packets are much shorter than the money in advance at certificate renewal.data packets, e.g., if a node’s identity requires 4 bytes and Our payment model can counteract the rational attacksthe average number of nodes in a route is 5, the average and encourage node cooperation. Particularly, the rationalsize of the RREQ packet is nearly 20 bytes, which is attacker can exhibit one of the following actions:incomparable with 512 bytes of the data packets. FESCIMcan be implemented on the top of a secure routing protocol 1. If the intermediate nodes are rewarded for relayingsuch as ARAN [36] and Ariadne [37]. In this protocol, the the messages that do not reach the destination nodeintermediate nodes authenticate themselves to thwart the [28], [29], the colluding nodes can drop a messageexternal attacks, e.g., the external attackers that are not and relay only the source node’s signature that ismembers in the network participate in route discovery much shorter than the message to claim the paymentphase with the intention of dropping the data packets to for relaying the message. In our payment model, thelaunch Denial-of-Service attacks. Fig. 12 shows secured nodes are motivated to forward the messagesRREQ packets that can authenticate the intermediate nodes because they are rewarded only when the destina-and thwart packet manipulation. Each intermediate node tion node receives them.appends its certificate and signs the packet’s signature to 2. If the source and destination nodes are chargedauthenticate itself. In this way, launching Free-Riding only for the successfully delivered messages, the
  10. 10. 762 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012 In order to evaluate the security strength of the proposed check submission schemes, we introduce (3) and (4) which give the probabilities that a check is not submitted in the Probabilistic and Changeable Submitter schemes, respectively. They are equivalent to the probabilities that a session has at least one honest node and the honest nodes do not submit the check. Ph ði; nÞ given in (5) is the probability that i honest nodes participate in a session with n intermediate nodes. Pm is the probability that an intermediate node is a colluder, which is equivalent to the ratio of colluding nodes in the network. nt and n are the total number of nodes in the network and the number of intermediate nodes in a session, respectively. nh and nc are the number of honest andFig. 13. The probability of unsubmitting a check. colluding nodes, where nh ¼ ð1 À Pm Þ Á nt and nc ¼ Pm Á nt Á From Fig. 13, in order to prevent submitting a low ratio of the checks in the Probabilistic-Check-Submission scheme, the source destination node and/or colluding intermediate and destination nodes have to collude with a large number of node may claim that the message does not reach nodes, which is not realistic for civilian applications and scalable the destination so as not to pay. To prevent this, both the source and destination nodes are charged network. For example, in order to prevent submitting for the undelivered messages. 10 percent of the checks, the ratios of the colluding nodes are 33 percent, 48 percent, and 64 percent when RC is 0.55, 3. Relaying the route establishment packets is bene- 0.65, and 0.75, respectively. The figure also shows that the ficial for the nodes to participate in sessions and thus Probabilistic scheme can protect the check submission much earn credits. If the destination node does not acknowledge a message, it pays for the message better than the Changeable-Submitter scheme. The increase of and the source node does not send the next message. RC can reduce the probability of unsubmitting a check but Relaying the ACK packets is beneficial for the with additional redundant checks. The probability of intermediate nodes to trigger the source node to unsubmitting a check decreases at large value of Pm generate more messages and thus earn more credits. because the probability that an honest node participates in the session decreases: Although the charges are always more than or equal tothe rewards, our payment model does not make credits X i¼n http://ieeexploreprojects.blogspot.comdisappear because purchasing credits for real money can Pu ðprobabilistic schemeÞ ¼ ph ði; nÞ Á ð1 À Rc Þi ; ð3Þcompensate the credit loss. The rich nodes that have much i¼1more credits than their credit consumption may stopcooperation to save their resources. The AC converts credits X i¼n nÀito real money to motivate these nodes to cooperate because Pu ðChangeable Submitter schemeÞ ¼ ph ði; nÞ Á ; ð4Þ i¼1 nthis conversion reduces the nodes’ credits. Similar tothe existing mechanisms, we believe that ACK packets areessential to secure the payment whether only the source n QiÀ1 ðn À fÞ Á QnÀiÀ1 ðn À bÞ h cnode pays or both the source and destination nodes pay. Ph ði; nÞ ¼ Á f¼0 QnÀ1 b¼0 : ð5Þ i k¼0 ðnt À kÞThat is because 1) if only the source node pays, someintermediate nodes may drop the messages and save only In Table 2, T is the total number of submitted checks in athe source node’s signature to be rewarded for the noncollusion case, and Q is the number of unrepeatedundelivered messages; and 2) if both the source and checks submitted under the collusion attack for a route withdestination nodes pay, the source node may collude with five intermediate nodes and 1,000 checks. It can be seen thatsome intermediate nodes to steal credits from the destina- there is no redundant checks (cost ¼ 0) in Fixed-Submittertion node by sending bogus messages. and Changeable-Submitter schemes because each check is TABLE 2 The Number of Submitted Checks, n ¼ 5
  11. 11. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 763submitted once. However, for the Fixed-Submitter scheme, if TABLE 3the source and destination nodes collude with the last The Processing Times and Energy for RSA and SHA-1intermediate node in the route (C ¼ 1), all the checks are notsubmitted. The Changeable-Submitter scheme is more securethan the Fixed-Submitter scheme because the source anddestination nodes have to collude with a larger number ofnodes to achieve gains. The all-Submitters scheme is notvulnerable to the collusion attacks because each nodesubmits all the checks, but the number of redundant checksis large because six and seven copies of each check aresubmitted in Sprite and Express, respectively. For theProbabilistic-Check-Submission scheme, the increase of RC slower. According to NIST guidelines [42], the secureenhances the robustness against the collusion attack but private keys should have at least 1,024 bits.with additional redundant checks. For example, the In order to estimate the computational processing timesincrease of RC from 0.56 to 0.71 increases the number of for the signing, verifying, and hashing operations, we havesubmitted checks probabilistically from 903 to 969 when C implemented 1,024-bit RSA and SHA-1 using the Crypto++equals 2 but with increasing the cost from 1,800 to 2,550. library [43]. The mobile node is a laptop with an IntelMoreover, the Probabilistic-Check-Submission scheme is less processor at 1.6 GHZ and 1 GB Ram, and the operatingsensitive to the number of colluders comparing with the system of the mobile node is Windows XP. The resultsChangeable-Submitter scheme, e.g., at RC ¼ 0:56, when C given in Table 3 indicate that the RSA signature generationincreases from 1 to 3, Q drops from 800 to 400 in the is computationally intensive but the signature verificationChangeable-Submitter scheme and from 955 to 790 in the is much faster. The energy consumption of the RSA andProbabilistic-Check-Submission scheme. SHA-1 operations is measured in [44] and the results are Choosing a proper value for RC is important for reducing given in Table 3. The resources of a real mobile node maythe number of redundant checks and mitigating the be less than a laptop, so the results given in Table 3 arecollusion attacks. The value of RC may depend on the scaled by the factor of 5 in our simulations to estimate alikelihood or the ease of attacking the incentive mechanism, limited-resource node.e.g., the ease of obtaining multiple identities and compro- We simulate an MCN in a square cell of 1;000 m Âmising a device. The AC can dynamically estimate the value 1;000 m. Thirty-five mobile nodes are randomly deployedof RC and broadcast it to the nodes. The AC can increase RC and a fixed base station is located at the center of the cell.to improve the protection level whenhttp://ieeexploreprojects.blogspot.com range of the mobile nodes and the more nodes complain The radio transmissionthat they receive less rewards than their estimations. base station is 125 m. We use the modified randomMoreover, storage area should not be the main concern waypoint model [45] to emulate the nodes’ mobility.and the more important factors are bandwidth and energy Specifically, a node travels toward a random destinationbecause the capacities of the flash memories continue to rise uniformly selected within the network field; upon reachingas per Moore’s Law and their costs continue to plummet the destination, it pauses for some time; and the process[38]. Each node can store all the checks but submit only the repeats itself afterward. The node speed is uniformlyratio of RC . The AC informs the nodes about the identifiers distributed in the range ½0; Smax Š m/s and the pause timeof the cleared checks, and thus, the nodes delete them and is 20 s. The constant-bit-rate traffic source is implemented insubmit the uncleared checks to the AC. each node as an application layer. The source and destination pairs are randomly selected. All data packets have 512 bytes and are sent at the rate of 0.5 packets/s. We6 PERFORMANCE EVALUATION simulate the dynamic source routing (DSR) protocol [32]In this section, we evaluate the checks’ overhead in terms of over distributed coordination function of the IEEE 802.11the check size and the number of generated checks. We also medium access control protocol. The time stamp, node’sevaluate the overhead of the signed and hash-chain-based identity, and the number of messages are 5, 4, and 2 bytes,ACKs in terms of energy consumption and end-to-end respectively. Network simulator NS2 (version 2.27) ispacket delay. used to evaluate the end-to-end delay and the network throughput using signed and hash-chain-based ACKs, and6.1 Simulation Setup MATLAB is used to evaluate the check overhead. OurIn our simulation, we consider the RSA signature scheme simulation is executed for 15 simulated min and each dataand SHA-1 hash function with digest length of 20 bytes [39], point represents the average of 50 runs.[40]. Although the signature tags of the DSA and ECDSA 6.2 Simulation Resultssignature schemes are shorter than that of the RSA, theseschemes increase the end-to-end delay significantly because 6.2.1 Check Overheadthe verifying operations performed by the intermediate and The simulation results given in Table 4 demonstrate thatdestination nodes are computationally more demanding although FESCIM adopts more fair charging policy thanthan the signing operations performed by the source node. Sprite and Express, the check size can be less. This isIn [41], it is shown that the verification time of the 1,024-bit because of hashing the source and destination nodes’RSA is more than 31 and 45 times faster than those of the signatures and signing the hash of the message instead of168-bit ECDSA and 1,024-bit DSA, respectively, and the the message, i.e., hashing the signatures can alleviate thesignature generation is measured to be around 8 and 6 times effect of the long RSA signature tag. For FESCIM, a check
  12. 12. 764 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 11, NO. 5, MAY 2012 TABLE 4 TABLE 6 Average Check Size (Bytes) The Number of Checks and the Amount of Paid and Earned Creditssize depends on the number of used hash chains in thesession (i) because two hash values are attached to the checkper hash chain. If the hash-chain size is long enough,FESCIM can generate one fixed-size check per route. A checks. The increase of the nodes’ speed increases thestorage area of 1 MB can store up to 8,283; 5,176; and 5,350 amount of paid credits because more credits are paid for thechecks in FESCIM, Sprite, and Express, respectively, when undelivered messages. In FESCIM, the amount of earnedone hash chain is used in FESCIM. credits does not depend on the nodes’ speed because the Table 5 gives the statistical distribution of the number of nodes earn credits only for the delivered messages. How-hash chains used for a route. The simulation results ever, more credits are paid at high speed because the sourcedemonstrate that more hash chains are used in low node and destination nodes pay for more undelivered messages.mobility because more packets are transmitted before theroute is broken. It can also be seen that the probability of 6.2.2 ACK Overheadusing only one hash chain increases with the increase of Z. For Z messages, the destination node generates ZProperly choosing Z can reduce the number of used hash signatures in signed ACK-based incentive mechanisms,chains, which reduces the check size and saves the destina- but one signature and Z hashing operations are requiredtion node’s resources because the unused hash values in a in the ACK packets of FESCIM. From Table 3, we can seechain should not be used for other routes to secure the that the computational times of the signing and verifyingpayment. A good Z depends on the average number of operations are sufficient for 539 and 18 hashing operationstransmitted packets before the route is broken, which is for 512 bytes, respectively; and the consumed energy forrelated to the packet transmission rate, the node speed, and the signing and verifying operations are sufficient for 1,404the expected number of packets transmitted in the session. and 41 hashing operations for 512 bytes, respectively, http://ieeexploreprojects.blogspot.com Table 6 gives the expected number of checks and the which demonstrates that FESCIM can adopt fair chargingamount of paid and earned credits in Sprite, Express, and policy almost computationally free.FESCIM for a 300-second data transmission with different The average end-to-end delay is the average timenode speed. During the data transmission, a new route is interval between the data packet transmission and theestablished when the route is broken. For Sprite and Express, reception of the destination node’s acknowledgment. Fromthe simulation results demonstrate that the number of checks Fig. 14, it can be seen that FESCIM can significantly reduceis large due to generating a check per message. The increase the end-to-end delay due to replacing the destinationof the nodes’ speed increases the number of checks because node’s signature with the lightweight hashing operations.checks are generated for undelivered packets. FESCIM can Above 20 connections, the delay increases significantly withsignificantly reduce the number of checks due to generating and without implementing the cooperation incentiveone check per route. More checks are generated at high node mechanism due to the significant increase in the channelmobility because the routes are more frequently broken, i.e., contention and queuing delays.the messages are transmitted over larger number of routes. The average network throughput is computed by For Sprite and Express, the amount of paid credits is dividing the size of the received data by all the nodes overequal to the amount of earned credits because the payment isonly for the nodes that relayed the undelivered messages.For FESCIM, the amount of paid credits is always more thanor equal to the amount of earned credits because the sourceand destination nodes are charged full payment for theundelivered messages to reduce the number of submitted TABLE 5 The Statistical Distribution of the Number of Used Hash Chains Fig. 14. The end-to-end delay for the signed ACK mechanisms and FESCIM.
  13. 13. MAHMOUD AND SHEN: FESCIM: FAIR, EFFICIENT, AND SECURE COOPERATION INCENTIVE MECHANISM FOR MULTIHOP CELLULAR... 765 SigS ðSi ; X; HðMX ÞÞ and SigS ðSi ; X À 1; HðMXÀ1 ÞÞ, the AC can learn that the data packet number X is dropped by an intermediate node A, B, or in-between node. However, packets may be dropped sometime, e.g., due to mobility or bad channel, or maliciously, but frequently dropping packets is an obvious malicious behavior. In our future work, we will study how the AC can precisely differentiate between the honest nodes and the irrational packet droppers in order to reduce the number of honest nodes that are falsely identified as irrational packet droppers. ACKNOWLEDGMENTS This paper was presented in part at the 2009 IEEE International Conference on Communications.Fig. 15. The throughput for the signed ACK mechanisms and FESCIM.the simulation time. As shown in Fig. 15, it can be seen that REFERENCESincreasing the number of connections increases the network [1] Y. Lin and Y. Hsu, “Multihop Cellular: A New Architecture forthroughput until the network reaches its capacity. FESCIM Wireless Communications,” Proc. IEEE INFOCOM, vol. 3,is little better because more congestions occur in signed pp. 1273-1282, Mar. 2000.ACK mechanisms due to the longer packet processing delay [2] X. Li, B. Seet, and P. Chong, “Multihop Cellular Networks: Technology and Economics,” Computer Networks, vol. 52, no. 9,in the intermediate nodes. pp. 1825-1837, June 2008. [3] C. Gomes and J. Galtier, “Optimal and Fair Transmission Rate Allocation Problem in Multi-Hop Cellular Networks,” Proc. Int’l7 CONCLUSION AND FUTURE WORK Conf. Ad-Hoc, Mobile and Wireless Networks, pp. 327-340, Aug. 2009. [4] H. Wu, C. Qios, S. De, and O. Tonguz, “Integrated Cellular andIn this paper, we have proposed a fair, efficient, and secure Ad Hoc Relaying Systems: iCAR,” IEEE J. Selected Areas in Comm.,cooperation incentive mechanism for MCN. In order to fairly vol. 19, no. 10, pp. 2105-2115, Oct. 2001.and efficiently charge the source and destination nodes, the [5] G. Shen, J. Liu, D. Wang, J. Wang, and S. Jin, “Multi-Hop Relay forlightweight hashing operations are used to reduce the Next-Generation Wireless Access Networks,” Bell Labs Technical J., operations. Moreover, [6] vol. 13, no. 4,R. Halfmann, 2009.B. Walke, “MAC Performance of anumber of public-key-cryptography http://ieeexploreprojects.blogspot.com R. Schoenen, pp. 175-193, andto reduce the overhead of the payment checks, one small-size 3GPP-LTE Multihop Cellular Network,” Proc. IEEE Int’l Conf.check is generated per session instead of generating a check Comm. (ICC), pp. 4819-4824, May 2008.per message, and the Probabilistic-Check-Submission scheme [7] 3rd Generation Partnership Project, Technical Specification Grouphas been proposed to reduce the number of submitted checks Radio Access Network, “Opportunity Driven Multiple Access,” 3G Technical Report 25.924, Version 1.0.0, Dec. 1999.and protect against the collusion attack. Extensive analysis [8] S. Marti, T. Giuli, K. Lai, and M. Baker, “Mitigating Routingand simulations have demonstrated that our incentive Misbehavior in Mobile Ad Hoc Networks,” Proc. ACM MobiCom,mechanism can secure the payment and significantly reduce pp. 255-265, Aug. 2000.the overhead of storing, submitting, and processing the [9] P. Michiardi and R. Molva, “Simulation-Based Analysis of Security Exposures in Mobile Ad Hoc Networks,” Proc. Europeanchecks. In addition, replacing the destination node’s signa- Wireless Conf., Feb. 2002.tures with the hashing operations can charge the source and [10] J. Hu, “Cooperation in Mobile Ad Hoc Networks,” Technicaldestination nodes almost computationally free. Report TR-050111, Computer Science Dept., Florida State Univ., In this paper, instead of generating two signatures per Jan. 2005. [11] G. Marias, P. Georgiadis, D. Flitzanis, and K. Mandalas,packet (one from the source and the other from the “Cooperation Enforcement Schemes for MANETs: A Survey,”destination), we have replaced the destination node’s J. Wireless Comm. and Mobile Computing, vol. 6, no. 3, pp. 319-332,signature with hashing operations to reduce the number of 2006.public-key-cryptography operations nearly by half. The [12] C. Song and Q. Zhang, “OMH-Suppressing Selfish Behavior in Ad Hoc Networks with One More Hop,” Mobile Networks andsource node attaches a signature in each data packet to Applications, vol. 14, no. 2, pp. 178-187, Feb. 2009.ensure the payment nonrepudiation and to verify the [13] D. Djenouri and N. Badache, “On Eliminating Packet Droppers inmessage integrity at each intermediate node to thwart Free- MANET: A Modular Solution,” Ad Hoc Networks, vol. 7, no. 6,Riding attacks. In our future work, we will focus on reducing pp. 1243-1258, Aug. 2009.the number of public-key-cryptography operations due to [14] G. Bella, G. Costantino, and S. Riccobene, “Evaluating the Device Reputation Through Full Observation in MANETs,” J. Informationthe source node’s signatures. Although the payment non- Assurance and Security, vol. 4, no. 5, pp. 458-465, Mar. 2009.repudiation can be achieved using a hash chain at the source [15] L. Feeney, “An Energy-Consumption Model for Performancenode side, we will study how to efficiently verify the Analysis of Routing Protocols for Mobile Ad Hoc Networks,”message integrity at each intermediate node. In addition, Mobile Networks and Applications, vol. 3, no. 6, pp. 239-249, 2001. [16] M. Peirce and D. O’Mahony, “Micropayments for Mobile Net-similar to the existing incentive mechanisms, FESCIM can works,” technical report, Dept. of Computer Science, Trinitythwart selfishness attacks, but it cannot identify the College, 1999.irrational nodes that involve themselves in sessions with [17] L. Buttyan and J. Hubaux, “Enforcing Service Availability inthe intention of dropping the data packets to launch Denial- Mobile Ad-Hoc WANs,” Proc. ACM MobiHoc, pp. 87-96, Aug. 2000.of-Service attacks. In our future work, we will study how the [18] L. Buttyan and J. Hubaux, “Stimulating Cooperation in Self-AC can process the checks to identify the irrational nodes. In Organizing Mobile Ad Hoc Networks,” Mobile Networks andFESCIM, if two nodes IDA and IDB submit checks with Applications, vol. 8, no. 5, pp. 579-592, Oct. 2004.