This document discusses an anti-jamming protocol called WisperNet for embedded wireless networks. WisperNet aims to eliminate spatio-temporal patterns in communication while maintaining coordinated and collision-free operation. It does this through coordinated temporal randomization of slot schedules and sizes between each node and its neighbors, preventing jammers from predicting channel activity. WisperNet also employs adaptive routing to select paths with the highest packet delivery ratios to avoid random jammers co-located near nodes. The protocol tightly synchronizes legitimate nodes while ensuring no communication patterns are exposed to external observers like jammers.

1. Anti-Jamming for Embedded Wireless Networks
Miroslav Pajic and Rahul Mangharam
Department of Electrical and Systems Engineering
University of Pennsylvania
{pajic, rahulm}@seas.upenn.edu
ABSTRACT ded wireless networks for time-critical and safety criti-
Resilience to electromagnetic jamming and its avoidance cal operation such as in medical devices and industrial
are difficult problems. It is often both hard to distin- control networks, it is essential that mechanisms for re-
guish malicious jamming from congestion in the broad- silience to jamming are native to the communication pro-
cast regime and a challenge to conceal the activity pat- tocol. Resilience to jamming and its avoidance, collec-
terns of the legitimate communication protocol from the tively termed as anti-jamming, is a hard practical prob-
jammer. In the context of energy-constrained wireless lem as the jammer has an unfair advantage in detecting
sensor networks, nodes are scheduled to maximize the legitimate communication activity due to the broadcast
common sleep duration and coordinate communication nature of the channel. The jammer can then emit a se-
to extend their battery life. This results in well-defined quence of electromagnetic pulses to raise the noise floor
communication patterns with possibly predictable inter- and disrupt communication. Communication nodes are
vals of activity that are easily detected and jammed unable to differentiate jamming signals from legitimate
by a statistical jammer. We present an anti-jamming transmissions or changes in communication activity due
protocol for sensor networks which eliminates spatio- to node movement or nodes powering off without some
temporal patterns of communication while maintaining minimum processing at the expense of local and network
coordinated and contention-free communication across resources.
the network. Our protocol, WisperNet, is time-synchronized In the case of energy-constrained wireless sensor net-
and uses coordinated temporal randomization for slot works, nodes are scheduled to maximize the common
schedules and slot durations at the link layer and adapts sleep duration and coordinate communication to extend
routes to avoid jammers in the network layer. Through their battery life. With greater network synchroniza-
analysis, simulation and experimentation we demonstrate tion, the communication is more energy-efficient as nodes
that WisperNet reduces the efficiency of any statisti- wake up from low-power operation just before the com-
cal jammer to that of a random jammer, which has the mon communication interval. Such coordination intro-
lowest censorship-to-link utilization ratio. WisperNet is duces temporal patterns in communication with predictable
more energy efficient than low-power listen CSMA pro- intervals of transmission activity. Channel access pat-
tocols such as B-mac and is simple to analyze in terms of terns make it efficient for a jammer to scan and jam the
effective network throughput, reliability and delay. Wis- channel only during activity intervals. The jammer can
perNet has been implemented on the FireFly sensor net- time its pulse transmission to coincide with the pream-
work platform. bles of packets from legitimate nodes and thus have a
high censorship to channel utilization ratio while remain-
1. INTRODUCTION ing difficult to detect. The jammer is thus able to ex-
ploit the temporal patterns in communication to disrupt
Jamming is the radiation of electromagnetic energy in a transmission of longer length of legitimate transmis-
a communication channel which reduces the effective use sions with a small set of jamming pulses.
of the electromagnetic spectrum for legitimate commu- For nodes in fixed locations, a jammer can select re-
nication. Jamming results in a loss of link reliability, gions with heavier communication activity or denser con-
increased energy consumption, extended packet delays nectivity to increase the probability that a random jam-
and disruption of end-to-end routes. Jamming may be ming pulse results in corrupting an on-going transmis-
both malicious with the intention to block communica- sion. Nodes in the proximity of the jammer will endure
tion of an adversary or non-malicious in the form of un- a high cost of operation in terms of energy consumption
intended channel interference. In the context of embed- and channel utilization with a low message delivery rate.
They must either physically re-locate or increase the cost
of their links so the network may adapt its routes.

2. Methods for anti-jamming must therefore address threats 4. Coordinated changes of slot sizes: All nodes
due to both temporal patterns at the link layer and spa- must be aware of the current and next slot sizes. This is
tial distribution of routes in the network layer. Our very important because any incompatibility or synchro-
goal is to reduce or eliminate spatio-temporal patterns in nization error would disable communication between le-
communication while maintaining energy-efficient, coor- gitimate nodes.
dinated and collision-free operation in multi-hop wire-
5. Collision-free transmission: Communication must
less sensor networks. We achieve this by incorporat-
ing coordinated temporal randomization for slot sched- satisfy the hidden terminal problem so that a transmit
slot of a given node does not conflict with transmit slots
ules and slot durations between each node and its k-
hop neighbors. This prevents the jammer from predict- of nodes within its k-hop interference range.
ing the epoch and length of the next activity on the The rest of this paper is organized as follows: In Sec-
channel. Such mechanisms reduce the effectiveness of tion 2, we provide a background and related work for
any statistical jammer to that of a random pulse jam- energy efficient protocols and energy efficient jamming
mer. While temporal randomization prevents statisti- schemes. In Section 3, we provide an overview of the
cal jammers from determining any useful packet inter- WisperNet anti-jamming protocol and describe the co-
arrival distribution for preemptive attacks, it still has an ordinated temporal randomization scheme. In Section
efficiency of a random jammer and can achieve censor- 4, we describe the WisperNet coordinated spatial adap-
ship which increases linearly with channel utilization and tation scheme. Section 5 describes our implementation
jamming activity. To avoid such random jammers which experiences and experimental results followed by the con-
are co-located near nodes with active routes, we employ clusion.
adaptive routing to select paths such that the highest
possible end-to-end packet delivery ratios are achieved. 2. BACKGROUND AND RELATED WORK
We combine the above temporal and spatial schemes in To understand the inherent tradeoff between energy
a tightly synchronized protocol where legitimate nodes efficient link protocols with well-defined schedules and
are implicitly coordinated network-wide while ensuring their susceptibility to jamming attacks, we first describe
no spatio-temporal patterns in communication are ex- the different types of jammers and their impact on var-
posed to external observers. ious types of link layer protocols. We then highlight a
In the context of multi-hop embedded wireless net- particular class of statistical jammers and their impact
works, which are battery-operated and require low-energy on energy-efficient sensor network link protocols.
consumption, we require the following properties from
the anti-jamming protocol: 2.1 Jammers and Trade-offs with Jamming
1. Non-predictable schedules: Transmission instances
2.1.1 Comparison of Jamming Models
(e.g. slot assignments) are randomized and non-repeating
to prevent the jammer from predicting the timing of the In [1] and [2], Xu et al. introduce four common types
next slot based on observations of channel activity. In of jammers: constant, random, reactive and deceptive.
this way, even if the jammer successfully estimates slot Constant jammers continually emit a jamming signal and
sizes, it has to transmit pulse attacks at an interval of achieve the highest censorship of packets corrupted to to-
the average slot duration to corrupt communication be- tal packets transmitted. The constant jammer, however,
tween nodes. is not energy-efficient and can be easily detected and lo-
calized. The random jammer is similar to the constant
2. Non-predictable slot sizes: Slots are randomly jammer but operates at a lower duty cycle with intervals
sized on a packet-by-packet basis in order to prevent the of sleep. A random jammer transmits a jamming signal
jammer from estimating the duration of channel activity at instances derived from a uniform distribution with a
for energy efficient reactive jamming. This requirement known minimum and maximum interval. The censorship
further reduces the jammer’s lifetime as it will need to ratio of the random jammer is constant and invariant
employ the smallest observed slot duration as its jam- to channel utilization. At low duty cycles, the random
ming interval. jammer is difficult to detect and avoid. A reactive jam-
3. Coordinated and scheduled transmission: The mer keeps its receiver always on and listens for channel
communication schedule according to which a node trans- activity. If a known preamble pattern is detected, the
mits is known to all of its legitimate neighbors so they reactive jammer quickly emits a jamming signal to cor-
can wake up to receive the message during its trans- rupt the current transmission. Reactive jammers, while
mission slot. This also prevents nodes from turning on effective in corrupting a large proportion of legitimate
their receiver when no legitimate activity is scheduled packets, are not energy efficient as the receiver is always
and hence reduces the likelihood of a jammer draining on. A deceptive or protocol-aware jammer is one that
the energy of a node. has knowledge of the link protocol being used and the
dependencies between packet types. Such a jammer ex-

3. ploits temporal and sequential patterns of the protocol jammer has influence over the network. A jammed-area
and is very effective. mapping protocol is described in [7] which can be used to
In [3], a statistical jamming model is described where delineate regions affected by a jammer. Such information
the jammer first observes temporal patterns in channel can ultimately be used for network routing. One of the
activity, extracts a histogram of inter-arrival times be- requirements of the protocol is that every node knows
tween transmissions and schedules jamming pulses based its own position along with positions of all its neighbors.
on the observed distribution. This results in a very ef- Our proposed solution, WisperNet, does not require such
fective jammer that is not protocol-aware and is also dif- position and direction information and directly computes
ficult to detect. A statistical jammer chooses its trans- routes with the highest end-to-end packet delivery rate.
mission interval to coincide with the peak inter-arrival
times and is thus able to maximize its censorship ratio 2.2 Impact of Jamming on MAC Protocols
with relatively little effort. Fig. 1(a) illustrates the rela- We now investigate the characteristics of different classes
tive censorship ratio and the energy-efficiency of the dif- of sensor network link protocols and the impact of a jam-
ferent jammers. Fig. 1(b) illustrates the relative stealth mer on each class.
or difficulty in detection. We observe that the statistical
jammer has a high censorship ratio with both energy- 2.2.1 Energy-Efficient MAC Protocols
efficient and stealthy operation and hence focus on com-
Several MAC protocols have been proposed for low-
bating such jamming in the remainder of this paper.
power operation for multi-hop wireless mesh networks.
2.1.2 Techniques for Robust Transmission Such protocols may be categorized by their use of time
synchronization as asynchronous [8], loosely synchronous [9,
The traditional defenses against jamming include spread
10] and fully synchronized protocols [11, 12]. In general,
spectrum techniques[4] at the physical layer. While spread
with a greater degree of synchronization between nodes,
spectrum and frequency hopping techniques are impor-
packet delivery is more energy-efficient due to the min-
tant physical layer mechanisms for combating jamming,
imization of idle listening when there is no communica-
additional protection is required at the packet-level. As
tion, better collision avoidance and elimination of over-
in the case of standard wireless protocols such as IEEE
hearing of neighbor conversations.
802.11 and Bluetooth, the jammer may know the pseudo-
Asynchronous protocols such as Carrier Sense Mul-
random noise code or frequency hopping sequence.
tiple Access (CSMA) are susceptible to jamming both at
There have been several efforts to make communica-
the transmitter (busy channel indication) and at the re-
tion in sensor networks more robust in the presence of
ceiver (energy drain). The Berkeley MAC (B-MAC) [8]
a jammer. In [5], Wood et al. described DEEJAM, a
protocol performs the best in terms of energy conserva-
link layer protocol that includes several schemes for ro-
tion and simplicity in design. B-MAC supports CSMA
bust IEEE 802.15.4 based communication for reactive
with low power listening (LPL) where each node peri-
and random jammers. While mechanisms such as cod-
odically wakes up after a sample interval and checks the
ing and fragmentation are proposed, the jammer still
channel for activity for a short duration of 0.25ms. If the
has a competitive advantage in that it may increase the
channel is found to be active, the node stays awake to
power of its jamming signal and a single jamming sig-
receive the payload following an extended preamble. Us-
nal is capable of jamming multiple links in the vicinity.
ing this scheme, nodes may efficiently check for neighbor
The authors assume that reactive jammers can be con-
activity while maintaining no explicit schedule which a
sidered energy-efficient. Current radio transceivers with
statistical jammer may exploit.
the IEEE 802.15.4 physical layer of communication, use
Loosely-synchronous protocols such as S-MAC [9]
almost the same, if not greater, energy for receiving as
and T-MAC [13] employ local sleep-wake schedules know
they do for transmission [6].
as virtual clustering between node pairs to coordinate
In cases where resilience to jamming is not possible, it
is useful to detect and estimate the extent to which the
(a) (b)
Figure 1: (a) Jammer’s Energy efficiency vs. Figure 2: Comparison of robustness to jamming
Censorship ratio and (b) Energy efficiency vs. and energy efficient operation of sensor MAC
Stealth protocols

4. 0.1 0.25
0.08 0.2
Probability
0.06 0.15
Probability
0.04 0.1
0.02 0.05
0 0
0 50 100 150 200 250 0 10 20 30 40 50
Interarrival times [ms] Interarrival times [ms]
Figure 3: SMAC PDF for 15% utilization Figure 4: RT-Link PDF for 15% utilization
packet exchanges while reducing idle operation. Both S-MAC, we observe that all nodes quickly converge on
schemes exchange synchronizing packets to inform their one major activity period of 215ms. In Fig. 3, we also
neighbors of the interval until their next activity and use notice a spike close to 2ms. This is the interval between
CSMA prior to transmissions. S-MAC results in clus- the transmission of control packets and data packets at
tering of channel activity and is hence vulnerable to a the start of an activity period. In the case of RT-Link,
statistical jammer. we simulated four flows with different rates and hence
Synchronous protocols such as RT-Link [12], uti- observe 4 distinct spikes in Fig. 4. The other spikes with
lize hardware based time synchronization to precisely lower intensity are harmonics due to multiples of 32 slots
and periodically schedule activity in well-defined TDMA in a frame. In both cases we observe distinct inter-arrival
slots. RT-Link utilizes an out-of-band synchronization patterns which enable a statistical jammer to efficiently
mechanism using an AM broadcast pulse. Each node is attack both protocols.
equipped with two radios, an AM receiver for time syn-
2.3 Assumptions
chronization and an 802.15.4 transceiver for data com-
munication. A central synchronization unit periodically We make several assumptions in the design and evalua-
transmits a 50μs AM sync pulse. Each node wakes up tion of WisperNet. We assume the jammer is as energy-
just before the expected pulse epoch and synchronizes constrained as a legitimate node and must maintain a
the operating system upon detecting the pulse. As the stealth operation with a low duty-cycle. All packets
out-of-band sync pulse is a high-power (30W) signal with exchanged between nodes are encrypted with a group
no encoded data, it is not easily jammed by a malicious key shared by legitimate nodes and hence the jammer
sensor node. is not protocol-aware. We consider both malicious and
In general, RT-Link outperforms B-MAC which in turn non-malicious jamming and do not differentiate between
out-performs S-MAC in terms of battery life across all them as the anti-jamming mechanisms are native to the
event intervals [12]. Fig. 2 shows the relative node life- link and network protocol. The transmission power is
times for 2AA batteries and similar transmission duty 0dBm (1mW) and in the worst case (with maximum
cycles. Here node lifetimes for CSMA, S-MAC, B-MAC, power link jamming) the nominal packet delivery rate
and RT-link are 0.19, 0.54, 0.78 and 1.5 years respec- is never below ˜
20%. This has been demonstrated in pre-
tively for a network of 10 nodes with a 10s event sam- vious experiments [12]. For simplicity, we presume that
ple period (based on measurement values from [12], [9]). interference range is equal to the transmission range of
While RT-Link nodes communicate in periodic and well- one hop. This restriction does not limit our results. We
defined fixed-size time slots, a statistical jammer is able assume all communication is between a central gateway
to easily determine the channel activity schedule and du- and each of the nodes across one or more hops.
ration of each scheduled transmission. An attacker can 3. ANTI-JAMMING WITH COORDINATED
glean the channel activity pattern by scanning the chan-
SPATIO-TEMPORAL RANDOMIZATION
nel and schedule a jamming signal to coincide with the
packet preamble at the start of a time slot. An effective approach to diminish the impact of a sta-
tistical jammer on TDMA-based MAC protocols is to
2.2.2 Statistical Jamming eliminate the possibility to extract patterns in commu-
We focus on the statistical jammer’s performance with nication. These patterns appear as a result of the use of
S-MAC and RT-Link as both result in explicit patterns fixed schedules which are set when a node joins a net-
in packet inter-arrival times. We do not consider B-MAC work and are assumed to repeat till the network is dis-
as we aim to leverage the more energy-efficient RT-Link banded. Such simple and repetitive patterns are main-
as a base synchronized link-layer mechanism for Wisper- tained with tight time synchronization and result in min-
Net. We simulated a network of 10 nodes in each case, imal energy consumption, deterministic end-to-end delay
with a 3ms average transmission duration. In the case of and perhaps maximal transmission concurrency. In order

5. to limit the impact of statistical jamming but still ben- ical wireless link between two nodes. The physical net-
efit from the above energy and timeliness performance, work topology is logically pruned by disabling desired
we maintain the time synchronization but change the links. In order to logically remove a link, a node is sched-
schedule, transmission duration and routes in a random- uled to sleep during that particular neighbor’s transmis-
ized yet coordinated manner along small time scales. sion, thereby ignoring that transmission. By forming
Two components of the WisperNet protocol are Co- a directed acyclic graph we are able to efficiently as-
ordinated Temporal Randomization (WisperNet-Time) sign non-colliding schedules that can be changed for ev-
and Coordinated Spatial Adaptation (WisperNet-Space), ery frame, as shown in Fig. 5(b). Links marked by the
which perform different actions in the temporal and spa- dashed line are inactive but must be accounted for by
tial domains respectively. WisperNet-Time is designed any graph coloring algorithm.
to defeat statistical jammers. By randomizing the com- The algorithm for schedule randomization is organized
munication in time, a statistical jammer’s performance in a distributed manner. Every node uses a Pseudo-
is reduced to that of a random jammer as the distribu- Random Function (PRF) to obtain its transmission sched-
tion of packet inter-arrival times is flat. No timing-based ule from the current network key and its node ID. The
scheme can reduce the probability of being jammed by transmission schedule consists of different slot indexes
a random pulse jammer. In this case, the only way to that can be used for transmission to neighboring nodes.
decrease the jamming impact is by avoiding the jammed The schedule changes for every frame (i.e. 32 slots) and
areas using WisperNet-Space. WisperNet-Space imple- during a frame, a node transmits only on the time-slots
ments adaptive network routing as a jamming avoidance determined by its PRF output. After transmission, ev-
mechanism to use links which are less affected by the ery node goes to sleep, setting its sleep timer to wake
jammer, if possible. Both WisperNet-Time and WisperNet- up for the earliest receive or transmit slot. In this way
Space incorporate on-line algorithms where the network energy consumption is reduced to minimum.
is continuously monitored and node operations are ad- To obtain non-repeating schedules, but with full co-
justed in time and space. ordination between nodes, the PRF computed by ev-
ery node uses the current active network key along with
3.1 WisperNet-Time: Co-ordinated Temporal its node ID. Once in a cycle, between two synchroniza-
Randomization tion pulses, the gateway broadcasts the active keys for
The main requirement for the proposed protocol is the the next cycle. The keys, members of the one-way key
provision of tight time synchronization between nodes. chain, are generated during gateway’s initialization and
In order to keep coordination between nodes, all nodes are stored in its memory. All keys from this chain are
have to be informed about current network state in terms calculated from randomly chosen last key Kn by repeat-
of current slot schedule, current slot duration and cur- edly applying one-way function F (as shown in Fig. 6):
rent active network topology. We achieve this by build-
ing upon the FireFly sensor network platform [14] and Kj = F (Kj+1 ), j = 0, 1, 2, ...n − 1.
using the basic synchronization mechanisms adopted in As F is a one-way function, all previous members of
the RT-Link protocol. All communication with RT-Link chain (K0 , K1 , ..., Kj−1 ) can be calculated from some
is in designated time slots. 32 time slots form a frame chain element Kj but subsequent chain members Kj ,
and 32 frames form a cycle. The time sync pulse is re- Kj+1 ,...,Kn [15] cannot be derived. This authentication
ceived once every cycle. Each FireFly node is capable scheme is similar to [16, 17] but its use for scheduling is
of both hardware-based global time synchronization and new.
software-based in-band time sync. A second requirement We use the SHA1-HMAC[18] keyed-hash function to
for WisperNet is that changes in state should require generate the current slot schedule. Therefore, for sched-
minimum gateway-to-node communication and no state ule computation HM AC(ID, Kj ) is used, where Kj presents
information exchange between nodes. All communica- currently active network key (member of the one-way key
tion must be encrypted and authenticated so that an chain). SHA1-HMAC outputs 160 bits which are used to
eavesdropper may not be able to extract the logical state
of the network. We describe the authentication and im-
plicit coordination scheme in the following section and
the synchronization mechanism in the Implementation
section.
3.1.1 Schedule Randomization
The first step toward schedule randomization is a prun- (a) Physical network (b) Logical network topology
ing of the physical network topology graph into a di- topology
rected acyclical graph. Fig. 5(a) shows an example net- Figure 5: (a)Example network topology (b)its
work topology graph, where each edge represents phys- collision-free transmit schedule from frame-to-
frame

6. message in the same slot due to a lower precedence. This
results in a lower end-to-end bandwidth and an increase
in a message delay. However, this issue has a fairly low
probability of occurring in networks for sensor networks
with a low to moderate duty cycle.
Figure 6: Generation of keys at the gateway, us-
ing a one-way hash function. 3.1.2 Slot size randomization
specify the schedule of transmission slots for each of the Even though the statistical jammer uses energy effi-
32 frames. These 160 bits are divided into 32 groups of cient pulse attacks, the proposed schedule randomiza-
5-bits, where the node’s transmit schedule in i-th frame tion reduces its efficiency to that of a random jammer.
(i = 0, 1, 2, ...31) is determined by i-th group of 5 bits. However, with the schedule randomization, an adversary
These 5 bits represent the index of one of the 32 frame’s is able to estimate slot sizes from the probability distri-
slots, eventually used for transmission. bution function (PDF) of packet inter-arrival times [3].
Implicit Schedule Conflict Resolution This statistical jamming scheme allows the jammer to
This approach for determining the transmission schedule transmit short pulse attacks at beginning of each slot,
locally can introduce a problem of potential interference therefore corrupting all communication attempts. Al-
that may occur when neighboring nodes are assigned the though this jamming scheme is less energy efficient than
same random slot. To prevent this, every node, in addi- a fixed schedule TDMA protocol, it is still more efficient
tion to its schedule, calculates a slot precedence (or pri- than a random jammer.
ority) for every transmission. The precedence for the i-th Slot size randomization is implemented in a similar
frame’s transmission schedule is determined by (32 − i)- manner to slot schedule randomization, using SHA1-
th 5 bits group (i.e. reverse order of the transmission HMAC, as schedule randomization, but with one impor-
schedule). Since there is an even number of frames, tant difference. Instead of using the last revealed key
the transmission schedule and precedence are never ex- for the slot size calculation, every node uses a shared
tracted from same group of bits. Therefore, to compute predefined key, Kslot , and the network’s state counter
its schedule in one sync period with 32 frames, each node cnt. Therefore, for slot size randomization the PRF is
has to calculate exactly one SHA1-HMAC function for calculated as HM AC(cnt, Kslot ). The cycle counter is
itself, and one SHA1-HMAC per node for all nodes in its transmitted in the header of each packet and is incre-
k-hop interference range. We assume the node IDs of all mented every cycle. Kslot is intentionally a local key so
k-hop neighbors are known (when node joins the network that a node joining the network will be able to synchro-
it broadcast its ID to all its neighbors in k-hop range). nize its slot sizes after receiving one legitimate packet.
Given the IDs for all nodes in its k-hop radius, a node The SHA1-HMAC’s output, which is also calculated on
calculates the schedule and precedence for all of neigh- a frame-by-frame basis, defines the slot size for the next
bors as shown in Figure 7. After schedule conflicts are frame as shown in Fig. 8. The network’s state counter
resolved implicitly based on the higher precedence, the represents the number of sync pulses received by the net-
node follows the combined transmit and receive schedule work, and its value is exchanged between neighboring
in a single vector. Proposed solution introduces some ad- nodes in the header of every packet. Here we assume
ditional memory and processing requirements considered that every sync pulse is received as it is a global and
in details in implementation section. high-power AM pulse. Therefore it is only nodes who
The proposed slot conflict resolution can have minor want to join an already operational network need to be
inefficiencies when a node with a higher transmit prece- informed about current network counter. The proposed
dence for a particular slot does not have any message to coordinated slot size randomization scheme assures that
send, while the another node is not allowed to send its all nodes know the current frame’s slot sizes and al-
lows them to calculate an accurate time interval for their
transmissions/receptions.
If a key from the key chain is used for slot size cal-
Figure 8: Slot size randomization on a frame-by-
Figure 7: Implicit conflict resolution frame basis

7. culation instead a predefined one, in cases when node factor (U ) on the PDF of inter-arrival times and show
does not receive a key from the gateway would result in that it has very little influence with the proposed scheme.
complete loss of synchronization. Without correct infor- This is one of the major benefits of WisperNet-Time,
mation about a slot size, nodes that do not know the because for other protocols the only way to reduce spikes
current frame size are not able to schedule themselves in the PDF is to reduce the utilization factor, as proposed
to wake-up for the expected sync pulse. With the prede- in [3]. Results for PDF of inter-arrival times are shown
fined key used for slot size calculations, nodes are always in in Fig. 9 for U = 50%, where slot sizes were randomly
able to know size of each frame, therefore they can sched- chosen from one of the 32 possible values in desired span.
ule their awakening on time. While channel utilization has an effect to the PDF, it is
Slot sizes have values from a discrete set, where the set to a signficantly smaller extent than in B-MAC’s case.
size is determined by the number of PRF output bits. We observe that the peak of the PDF is less than 2%
The number of values used for slot sizes and relative and no patterns can be extracted by the jammer. With U
distance between them have direct influence on PDF of below 50%, a small increment can be seen on spikes in (5
packet inter-arrivals times. The goal of our anti-jamming 10]ms interval. Also with integer multiples of some slot
scheme is to have a uniform PDF, or at least a PDF with sizes within [1 5]ms interval, influence of U can almost
spikes flattened as much as possible, which does not allow be ignored. Due to the uniform distribution for all three
timing information extraction. It is recommended that cases of U it is not possible to extract slot sizes. Even if
at least 8 slot sizes with small relative difference between the PDF is derived from a smaller statistical sample size,
them be used. the results are similar due to the pseudo-randomness of
Slot size randomization requires additional memory re- the slot size.
sources if nodes need to send some fixed-size data block
in a fixed time interval. In this case slot sizes can be both 3.2.1 Impact on End-to-end Delay
smaller and bigger than the size necessary for data block To analyze how the slot size changes affect the end-
transmission, which can result in lower network utiliza- to-end delay, we simulated a 1-dimension chain with 20
tion in former case or data congestion in later case. In nodes. In every frame, each node forwards the previously
the latter case, a portion of the data available for trans- received data to next node. If the slot size is smaller than
mission will have to be buffered in node’s internal queue necessary to transmit the backlogged data, the maxi-
till the next transmission slot occurs. In this case, the mum allowed packet size is sent and a rest of the data is
average slot size must be larger than slot size needed buffered. In a simulated chain, the source node receives
for one data block transmission. The size of the queue fixed size data blocks at a fixed interval and at a slightly
needed in every node is directly connected with ratio smaller size than for an average slot size (e.g. 3ms).
between these two sizes. Fig. 10 presents PDF and CDF of delay at last node
for different slot’s size quantizations. We observe that
with finer quantization of slot sizes, the distribution in-
3.2 WisperNet-Time: Performance Analysis terval of the last node has not only a smaller maximum
We now investigate the impact of channel utilization delay but also a smaller possible set of delay values that
on the PDF of packet inter-arrival times. We also deter-
mine the buffering needs due to randomized slot sizing 0.025
50% utilization
and its impact on the end-to-end delay. Finally we look
0.02
at the censorship ratio vs. jammer’s lifetime for RT-Link,
S-MAC and WisperNet.
Probability
0.015
We conducted a simulation in Matlab on a protocol
with structure similar to RT-Link [12], where each cy- 0.01
cle consists of 32 frames and each frame consists of 32
slots. At the beginning of every cycle a sync pulse is 0.005
transmitted. We have simulated a system where slot
sizes have uniform distribution with values in range [1 0
0 10 20 30 40 50
5]ms. A maximum slot size of 5ms is chosen to match the
Cumulative Distribution
Interarrival times [ms]
maximum message size of 128 bytes for IEEE 802.15.4 1
75% utilization
transceiver with data rate of 250kbps[6]. 128 bytes can 50% utilization
be sent with transmission duration of 4.2ms and the rest 0.5 25% utilization
of the slot time is used for inter-slot processing and for
0
guard times. A simulation for 10000 sync pulses (i.e. 0 10 20 30 40 50
Interarrival times [ms]
cycles) was carried out, which on an average lasts 50
minutes.
We first simulated the influence of the link utilization Figure 9: (Top) PDF of inter-arrival times for
WisperNet. (Bottom) Corresponding CDF.

8. can be expected. The reason is that finer quantization for the latter’s calculations, while using keys from the
allows better data distribution per packets and there- gateway’s one-way chain for former. If some nodes are
fore reduces the delay caused with packets fragmenta- captured and compromised, only the predefined slot-size
tion. Expectedly, this randomization introduced some key would be risk being extracted.
additional delay. In a TDMA system with a constant
slot size of 3ms, the delay at the last node would be
4. WISPERNET-SPACE:
20 · 3ms = 60ms. Here average delay is around 75ms, COORDINATED SPATIAL ADAPTATION
but with 95% probability interval [67 88]ms. This shows We now discuss spatial aspect of anti-jamming. For
that randomization introduces some variability into the the WisperNet-Space, we consider a dense sensor net-
communication end-to-end delay estimation. work where each node is modeled as a unit disk graph.
Another potential side-effect of WisperNet-Time is a The network is represented as an undirected graph G(V, E)
need for additional memory for data queuing. The first where V is a set of nodes (vertices) and E a set of links
node, with its constant data block input, requires a buffer (edges). For each link e = e(u, v), k weights (or costs)
with an additional 512 bytes of memory. All other nodes wj (u, v), (j = 1, 2, ..., k) are associated. For a tree T in
require an additional buffer for one maximum sized packet. graph G, the aggregate weight Wj (T ) is defined as
3.2.2 Comparative Analysis of MAC Protocols Wj (T ) = wj (e), j = 1, 2, ..., k
Fig. 14 presents the relationship between the jammer’s e∈T
lifetime (LIFE) and censorship ratio (CR) for communi- Weights associated with each link describe the different
cation in its range. We simulated the influence of two types of costs which may include the network’s para-
types of jammers - statistical jammers (SJ) and random functional properties, such as reliability of network com-
jammers (RJ) - on different kinds of protocols. Both munication, or delay and energy consumption of a sensor
these types of jammers transmit 150μs-long pulse at- network.
tacks. We modeled these attacks with a 90% success In general a set L ⊆ V of terminal nodes is given and
rate of packet corruption in cases when jamming pulse the objective is to find a connected subgraph, spanning
is transmitted during a node’s communication. For RT- all the terminals with minimal aggregate weights for all
Link and WisperNet-Time, we used the previously de- j = 1, 2, ...k. If only one weighting function is consid-
scribed protocols, while for the Random Schedule TDMA ered, L = V and the connected subgraph is required to
(RSTDMA) we also used 32 slots per frame, where every be a tree, then the problem is defined as a Minimum
slot is 3ms long. All protocols are simulated for systems Spanning Tree problem (MST). The MST problem can
with 25% of network utilization. be solved using known algorithms (Kruskal’s, Boruvka’s,
As we expected, for RT-Link and S-MAC, the SJ’s life- etc) [19]. If L = V and also only one weighting functions
time is very high. As shown, RSTDMA is easily jammed is considered, problem is equivalent to Steiner minimal
and the SJ enjoys the longest lifetime. In addition, the tree problem (SMT). SMT is a NP-complete problem,
slot size randomization component decreases the jam- but several heuristics exist which resolve SMT problem
mer’s lifetime, for almost 0.1 years at 50% CR. Note in both a centralized and a distributed manner.
that differences between LIFE-CR curve for SJ and RJ For WisperNet-Space we only considered network’s re-
are caused only by the fact that SJ does not transmit liability, so we associate a reliability weight function for
pulses in intervals smaller than 1ms, which, in this case, each link in network. We define the weight of each link
is the smallest slot size (only parameter that can be ex- to be a function of the packet loss ratio and hence aim
tracted from input signal statistics). We observe that to derive routes which connect all essential nodes using
schedule randomization has a significantly higher impact most reliable links. The continuous execution of the cost
on the jammer’s lifetime than does slot size randomiza- minimization function, essentially allows evasion of links
tion. This justifies our decision to use a pre-stored key under the influence of a random jammer.
5 The network’s reliability is measured in terms of its
Probability [%]
95% region Step 0.5
4 Packet Delivery Ratio (PDR) which is defined as the
3
2
Step 0.2 ratio of packets that are successfully delivered to a des-
Step 0.1
1 tination [2]. PDR can be perceived as the probability of
0
50 60 70 80 90 100 110 error-free communication between two nodes. Thus, the
Delay [ms]
Cumulative Distribution
1
reliability of a path P in the given network can be defined
as a e∈P P DR(e). Our goal is to achieve maximum re-
0.5 Step 0.5
liability on a path P , which is equivalent to maximizing
Step 0.2
Step 0.1
0 ln P DR(e) = lnP DR(e).
50 60 70 80 90 100 110
Delay [ms] e∈P e∈P
Figure 10: Message delay and its Cumulative Dis- With P DR(e) ≤ 1 for path P , our goal is to minimize
tribution at last node, for 20 nodes chain

9. 100
zoomed
80 RSTDMA with
90 Statistical
Jammer
Censorship Ratio [%]
70
Censorship Ratio [%]
80 WnT with
Statistical
70 60 Jammer
WnT with
60 Random
50 Jammer
50 RT Link with
40 Statistical
40 Jammer
30 S−MAC with
30 Statistical
Jammer
20 20
0 1 2 3 4 5 6 7 0.4 0.6 0.8 1 1.2
(a) Jammer’s Lifetime [years] (b) Jammer’s Lifetime [years]
Figure 11: (a) Dependency between jammer’s lifetime and Censorship Ratio and (b) zoomed
e∈P |lnP DR(e)|. Therefore, the reliability weight for sequence that maps the node ID of the active nodes to
some link e = e(u, v) is defined as the index of the N − 2 sequence. In a case of dense
networks, with N nodes, from which the Steiner tree is
wr (u, v) = |lnP DR(u, v)|.
derived, a much smaller number of nodes (M ) may be
4.1 Active topology update active. Therefore for all M nodes from the Steiner tree,
different temporal IDs are assigned from 1 : M interval,
For adaptive routing in WisperNet-Space, we use a
and for that tree, a Prufer code with M − 2 elements is
MST-Steiner heuristic to solve the SMT problem. All
derived. Along with this sequence and number of active
active nodes periodically send the PDRs for all their ac-
nodes, M , a look-up table with size M is sent, where
tive links to the gateway. After receiving a link’s weight,
i-th position in this table contains ID of a node, that is
the gateway updates its weight table for all existing links
indexed as i while creating the Prufer code sequence. In
in the network. Since the PDR is not defined for inactive
this way only 2 · M − 1 values are sent from gateway and
(not used) links, these links keep same weights as they
can be encapsulated within one maximum-sized 128 byte
had prior to activation of the present network topology.
IEEE 802.15.4 packet.
Their weights can not be reset to zero, since that would
allow some heavily jammed links to become competitive
4.2 Topology Maintenance and Updates
for network routing right in next iteration.
In order to defend against mobile jammers, the weights WisperNet-Space computes a new network topology
of unused network’s links are processed in time with a every 128 cycles. Given the average slot size of 3ms
leaky integrator. To avoid situations where some pre- and 1024 slots/cycle, the topology update occurs every
viously heavily jammed link still has a high weight al- 6.4 minutes on average. The current active topology in-
though the jammer that caused it has moved away, for cludes a subset of the node population as active nodes
every link e = e(u, v) and the current active subgraph and the unused node, which are not part of the active
T , the reliability weight for the next network topology topology, are considered inactive nodes. The key chal-
calculation is defined as: lenged during a topology update is to activate the inac-
tive nodes, which to save energy operate at a very low
|lnP DR(u, v)|, e ∈ T
wr (u, v) = duty cycle.
ρ · wr (u, v), e ∈ T
/
At the beginning of the new topology distribution all
ρ (0 < ρ < 1) is a leaky constant that determines a currently active nodes are informed about new active
speed of network’s adaptation to jammers’ mobility. It topology by a broadcast from the gateway. To acti-
is not recommended to set a too small value for ρ, since vate inactive nodes, which are to be part of the topol-
something similar to previously described situation can ogy update, 8 slots after the sync pulse are reserved for
happen, when a jammed link can be repeatedly included asynchronous communication. We refer to these 8 slots
in active topology after very short duration. For example in each cycle to be the ‘topology configuration’ frame.
with ρ = 0.8 reliability weight for unused link would be Thus topology maintenance and updates account for a
reduced by 20% for every calculation of network topol- 0.78% overhead. Instead using contention based trans-
ogy, which would allow inclusion of the jammed link into mission for inactive nodes, we opted to schedule these
new topology after only a few iterations. If all jammers transmissions from inactive nodes for a more determin-
have fixed positions, ρ can be set to 1. istic behavior for the propagation of topology updates.
After updating its weights table, the gateway calcu- As information needs to be spread in only one direction
lates the new active topology with minimum costs to (from gateway) through a low-degree tree, and since only
reach all Steiner points (i.e. active nodes). To distribute nodes that need to activate some inactive nodes (on the
the information about active links, we used the Prufer periphery of the current topology) would be scheduled
code (sequence) [19], a unique sequence associated with for transmission in these slots, the TDMA configuration
a tree, which for a tree with N vertices contains N − 2 frame of 8 slots is enough for collision free transmission
elements. In addition to this code, we send a second code scheduling of a degree-4 tree with 2-hop coloring. These

10. transmission indices are calculated using conservative with 400 randomly distributed nodes in a 4km x 4km
version of MAX [20] for maximal transmission concur- square was analyzed. We also randomly distributed nine
rency. jamming nodes, each with the same RF characteristics
Algorithm 1 describes the gateway’s procedure for topol- as network’s nodes. To emphasize the jamming effect
ogy dissemination. The generated message with the in- in order to test WisperNet-Space’s adaptation, the jam-
formation about new network topology is distributed mers’ link utilization is set to 50%. We implemented
over the network using all active links. Since some cur- a communication protocol so that all neighboring nodes
rently inactive nodes may be part of next active topology, exchange exactly one message per frame. Changes in
the mechanism to inform them is included. network routes for both SMT and MST components are
Algorithm 1 Gateway procedure description performed once in 100 frames. In our experiments we
used a value of 0.999 for ρ, which decreases reliability
while 1 do
weight of unused link by 1% for every period of 96 sec-
if NewWeightArrive then
onds (on average).
Update Weight Table
Fig. 12(a) presents the initial network topology and
if AllReceived or T opologyT imerOn then
the initial routes. The terminal nodes and the areas un-
T ableU pdated ← 1
der attack by the jammers are highlighted. We observe
end if
a large number of active links are under attack. The
end if
average censorship ratio for this network is 9% for this
if TableUpdated then
startup configuration. The censorship ratio decreases to
SMT
less than 1% as the routes adapt to more realible paths
CalculateSpreadingSchedule
and it can not go below this minimum value. This is
FloodNetwork
because for the given Steiner tree topology and its dis-
end if
tribution of jamming regions, the best case routes de-
end while
termiend by WisperNet-Space do include at least 2 par-
All nodes that are used for activation of the inactive tially jammed links. The optimal configuration includes
nodes along with the new topology receive 3-bit index of 0 links jammed in both direction and 2 links jammed in
the slot dedicated for its transmission, in the 8 slots ”con- only one direction, as shown in Fig. 13.
figuration” frame. Using this index, each nodes schedule We observed that at some intermediate moments (for
its transmission of the new configuration to neighboring example moments t1 and t2 as seen in Fig. 12(b) and cor-
node and keep on transmitting it on the same slot in responding Fig. 14) network routes with more jammed
every ”configuration” frame. Once all its required neigh- links were chosen, which directly resulted in increase of
boring nodes (i.e. currently active or inactive nodes that the overall censorship ratio. This is more prominent at
need to be activated) are heard retransmitting the new the beginning of the WisperNet-Space’s operation when
topology update, a node is assured that its topology has all links start with the same minimum weight (0). We
been successfully updated. see in Fig. 12(b), three links are jammed in both direc-
All inactive nodes wake up after every sync pulse, and tions in the top-right corner. As the routing algorithm
listen for the first 8 slots in a cycle. If the message for explores the problem space with different sets of active
its activation is received, a node switches to active mode links, it often chooses links under heavy influence of the
and executes the active mode’s algorithm. jammer. As this procedure of refining the route contin-
Since new topology is computed once in 128 cycles, ues and more links are evaluated for the first time, the
1024 configuration slots are available for both activa- algorithm will choose jammed links only if its weight,
tion of dormant nodes and also for association of newly due to the leaky integrator, drops below a threshold that
added nodes. Our experiments showed that for networks would make the aggregate weight of a subgraph smaller
with less than 500 nodes all inactive nodes are activated than the aggregate weight of currently used subgraph.
in first 10% of these slots. Given this, we allowed last We observe these spikes in the network’s censorship ra-
20% of these slots (i.e. configuration slots 820-1024) to tio in Fig. 14. Fig. 12(c) presents optimal solution where
be used as contention slots for addmission of new nodes only two links from highlighted area, jammed in only one
only. These slots enable nodes that want to join network direction, are used for routing. Over the course of the
to announce their presence to neighboring nodes (via a adaptation for one hour, we observer in Fig. 15 that the
HELLO packet in RT-Link), so that they can be initially number of active links does not vary much. We also no-
included as inactive nodes in the network. ticed the stretch factor of the network path lengths is
≤1.3 due to the end-to-end weight minimization func-
4.3 WisperNet-Space: Performance Analysis tion for calculating cumulative packet reliability across
In order to evaluate the performance of WisperNet- multiple links.
Space under random jamming attacks we first simulated
an SMT network with a random topology. A network 5. IMPLEMENTATION AND EVALUATION

11. 123 95 123 95
250 250
299 236 109 357 216 255 364 299 236 109 357 216 255 364 123 95
153 373 124 153 373 124 250
141 141 299 236 109 357 216 255 364
337 263 337 263 153 373 124
290 53 283 29 290 53 283 29 141 1
177 177 337
202 317 202 317 290 283 29 263
33 37 144 149 121 211 33 37 144 149 121 211 177 53
70 324 70 324
96 361 16 358 96 361 16 358 202 1 317
362 210 332 362 210 332 33 37 144 149 121 211 1
361 16 1
251 203 173 55 251 203 173 55 70 324
2101
84 162 235 65 28 84 162 235 65 28 96 358
201 80 201 80
168 224 168 224 251 1 362 1 203 332
65 173 55
28
145 237 233 61 145 237 233 61
84 1 162 235 201 80
261 392 212 49 174 293 349 64 261 392 212 49 174 293 349 64
168 224 1 1
79 291 198 228 79 291 198 145 237 233 61
228 156
143 396 156
143 396 392 1
212 49 174
249 110 238 249 110 238 79 261 198 293 349 64
97 311 97 228 156
143 1 291
311
3 399 26 181 3 399 26 181 249 396
42 42 110 238
50
159 178 50
159 178 311
3 399 1 26 181 1 97
1
327 8 278 15
380 91 327 8 278 15
380 91 50 1 1 42
161 356179 377 161 356179 377 159 178
394
340
394
340 1
327 8 278 1 15
380 91
82 306 309 287 82 241 306 309 287 161 356179 1 377
90
241 150 368 328 230344 90 150 368 328 230344 1 1 340
59 59 82 241 306 394 309 287
122 191 122 191 150 368 328 230344 1
83
77 113 163 217
83
77 113 163 90 1 1 59 1 191
384 217
115 351 305 384 115 351 305 1 122 1 83
105 105 217 77 113 163
282 103 206 282 103 206
133 384 115 1 351 305
329 133 329 105 1
272 272 282 103 1 206
369 182 81 369 182 81 133
200 187 167 200219 187 167 1 1 329 272
85
219
166 85 166 369 182 81 1
138 243 200219 187 167
138 281 215 192 243
227279 281 215 192 227279
11
164 288
56 371 148 125
273 363
120
11
164 288
56 371 148 125
273 363 152
120
138
85
281 215 243
227279
166 1
17 260 68 152 17 260 68 192
390
72 63
193 325 147 390
72 63
193 325 147
11
164 288
56 371
1 148 125
273 363 1
120
176
367
286
58 139 265
176
367
286
58 139 265
1
17
390
72 260 68
63
193 1 152 325 147
86 30 86 30 315 326 367 58 139 265
108 383248 352 315 333 326 108 383248 352 333 176 286 1
366 157 165 366 157 165 86 30 315 326
137 289 137 92 266 289 108 383248 352 333
92 266 1137 1 366 157 165
397 294 397 294 92 266 289
175 175
209 264 209 264 1 397 294
78 381 78 175
316 381
280 98 316 280 1 209 264 1
98 128 134 128 134 78
119 27 98 316 381
280
119 27 1 128 134
102 52 398
386 102 277 119 27
52 398
386 222 277 222
322 285 223 322 321 285 34 223 52 398
386
1 102 277
252379
321 34 388 252379 388 1 322
1 222
308 308 252 321 285 34 223
208 208 379 388
101 101 308
35 131 355 35 131 208
101
1
355 268 387 256 268 387 100 35 1
353 256 100 353 1 355 61.221 131
87 47 87 47 256 268 387 100
44 365 225 44 365 225
66 353
57 330 66 62 347 57 205 330 284 87 365 47
62 347 205 284 2 44 225
66 1
2 126 45 310 69 126 45 62 347 57 205 330 284
310 69 106
213 244 39 106
254 320 341 213
19
244 39
331 254 320 341 2
310 69 126 451
19 342 135 331 125 22
342 51
135 125 259 22
180 213 244 68.0945 39
1 1
106
254 320 341
51 259 180
199
19 342 135 331 125 1
346
199
348 76 346 51 1 259 1 22
180
348 76 7 229 7 199
229 297 348 76 346 7 1
297 239 1 218 107196 239 1 218 229
107 196 297
170 170 21 107 196 1 239 1 218
359 116 4 21 359 116 4 112 170 1
112 350 298 359 21
350 298 40 270 40 116 4 112 1
118 183 270 118 183 304 246 350 298
304 246 172 270 40
302 319 172 302 319 118 183 304 246
313 25 232 184 313 25 232 1 302 1 319 172
184 169 220 335 169 220 313 1 25 232
335 360 360 184 169 220
375 245 24
155
375
323 154 31
245
274 24
10 155 158
323
67 154 31 274 10 375
335 360 1 245 24 1
158 374 67 374 13 155 158
323
67 154 31 274 10
13 269 1 374 1 1
129 269 75 129 292 75 13
292 46 314 46 314
111 6 385 111 6 385 129 292 1 269 46 314
75
231 231 247 111 6 385
247 171 54 171 1 231 1 1 1 247 1
54 160 23 242 307 160 171
23 242
389 307 140 296 389 140 338 296 54 160
132 338 240 132 23 2421
389 1 307 140 296
240 336 197 301 336 1 240 1 132 338
197 301 189 9 189
9 300 378 300 275 226
378 197 301 1 336 1 189
275 226 318 9 300 378
117 334 318 339 117 334 393 257 339 275 1 226
221
393 257 190 136 71
267 18 221 190 136 71
267 117 334 393 318
257 339 190 71
18
262 370 234 303 262 370 391 345 382 234 18 221 1 136 267
303 391 345 382 89 262 370 234
89 303 391 345 382 1
127 114 89
276
127
20 114 276 20 1 127 114
151 41 88 48 151 41 142 88 276 1 1 20
48 142 151 41 142 88
99 99 48 1 1
376 73 376 73 43 99 1
43 104 400 104 376 73 1
400
38 395
214 38 395
214 400 43 104
1 1
130 38 395214
195 130 36 195
36 74 74 372 36
1 1 195 1 130
271 253 372 271 253 93 74 372
93 186 343 186 271 253
343 185 146 295 312 185 343 93 186
146 295 312 14 258 146 295 1 312 185
14 258 94 94 204 60 207 258
204 60
354 207 354 14 94 204 60
32 188 32 194 188 354 207
194 32 194 188
(a) Network topology - beginning (b) Network topology at an intermedi- (c) Network topology - optimal
ate time instance, t1
Figure 12: Network topology; green links - actual, ”physical” links; red - links used for Steiner tree;
blue nodes - terminal nodes (members of set L); dark gray area - area under jammers’ influence
The WisperNet anti-jamming protocol was implemented sage per frame.
on a network of FireFly sensor nodes[14]. Each node con- We observe that most of the current hardware plat-
sists of a microcontroller, an 802.15.4 2.4GHz transceiver forms used for wireless sensor networks development are
and multiple sensors. FireFly nodes have two configura- not CPU-constrained, but have a memory limitation.
tions - one with in-band software-based time synchro- Our implementation of the SHA1-HMAC function re-
nization and the other with an add-on AM radio re- quired only 3 additional 160-bit buffers as the compari-
ceiver for receiving an out-of-band AM sync pulse. In son of schedules and precedences is done iteratively for
order to achieve the highly accurate time synchroniza- all the node’s neighbors. The SHA1-HMAC function re-
tion required for TDMA at a packet level granularity, we quired 12.5ms for calculations on TI’s MSP430F22x mi-
use a carrier-current AM transmitter to provide an out- crocontroller. For networks where maximal node’s de-
of-band time synchronization pulse. The time synchro- gree in a network is N , every node, in the worst case,
nization transmitter (a separate module) plugged into needs to execute SHA1-HMAC function (N 2 + 1) times
the wall-outlet and used the building’s power grid as an for schedule calculation and once more for slot size com-
extended AM antenna and was thus able to cover the putation in every sync period. For example if N = 5,
entire building. Nodes were synchronized with a 50μs in worst case 27 SHA1-HMAC function executions are
pulse that was transmitted every 10 seconds from the needed, which results in 337.5ms of CPU time used for
AM transmitter (see [14] for details). The AM pulse has these calculations in every sync period, where one sync
a jitter of ≤ 150μs. period contains 32 · 32 = 1024 slots, with sizes from 1ms
We implemented our jamming avoidance scheme in- to 5ms. Therefore in worst case less than 33% of CPU
corporating SHA1, SHA1-HMAC, gateway schedule up- processing is used for these calculations, while on av-
dates and neighbor information exchange in 8-bit fixed- erage less than 11% is used. From perpective of mem-
point C for the Atmel ATMEGA32L microcontroller and ory constraints, the implemented procedure for schedule
a 16-bit 16MHz TI MSP430F22x microcontroller. Each randomization uses 276 bytes of flash memory and 400
node ran the nano-RK[21] real-time operating system bytes of RAM. Since only two nodes’ schedules have to
and the RT-Link[12] link protocol. The RT-Link TDMA be available at the same, schedule calculation procedure
cycle includes 32 frames which in turn are composed of occupies only 236 bytes for code size, along with addi-
32 slots. The slot size were assigned values from [1 5]ms. tional 40 bytes of data pre-stored in FLASH.
In our tests, every node attempts to transmit one mes- In Fig. 16, we connected three nodes to the oscillo-
scope to display the transmit and receive activity. Two
Number of links jammed in both direction
10 Averaged Censorship Ratio
t1 t2 10
Links
5
8
Censorship ratio [%]
0
0 2000 4000 6000 8000 10000 6
Number of links jammed in only one direction
20 4 t1 t2
Links
10 2
0 0
0 20 40 60 80 100
0 2000 4000 6000 8000 10000
Network configurations
Frame number
Figure 13: Number of links jammed in 2/1 direc- Figure 14: Averaged network’s censorship ratio
tion used for communication on 100 blocks, for implemented Steiner tree

12. Number of links used for communication that WisperNet is able to effectively reduce the impact
220
of statistical and random jammers. Unlike coding-based
210
schemes, WisperNet is resilient to jamming even un-
Links
200
der moderate to high link utilization with ≤2% cen-
190 sorship rate for the network topologies explored in this
180 work. The schedules derived from WisperNet are non-
0 2000 4000 6000 8000 10000
Frame number repeating, with randomized packet lengths while main-
Figure 15: Number of active links taining coordinated and collision-free communication. Wis-
perNet has been implemented on a network of FireFly
nodes were programmed to be a transmit and receive
sensor nodes with tightly synchronized operation and low
pair to show the coordinated and collision-free schedule
operation overhead.
randomization. A third node was programmed to raise
a signal on every slot to provide a reference of the slot 7. REFERENCES
boundaries. In Fig. 17, the top signal on the oscilloscope [1] W. Xu, W. Trappe, Y. Zhang, and T. Wood. The feasibility of
launching and detecting jamming attacks in wireless networks.
is triggered by the transmit pin of the transmitter and In ACM MobiHoc, 2005.
the middle signal is triggered by the receive pin on the [2] W. Xu, T. Wood, W. Trappe, and Y. Zhang. Channel Surfing
and Spatial Retreats: Defenses against Wireless Denial of
receiver. The signal at the bottom is triggered on every Service. In ACM WiSe, pages 80–89, 2004.
slot interval to provide a reference of the slot bound- [3] Y. W. Law et al. Energy-efficient link-layer jamming attacks. In
ACM SASN, 2005.
aries. We observe that the schedule is both coordinated [4] A. J. Viterbi. Spread Spectrum Communications: Myths and
and changes on a frame-by-frame basis. Realities. In IEEE Comm. Magazine, 2002.
[5] A. D. Wood, J. A. Stankovic, and G. Zhou. DEEJAM: Defeating
5.1 Limitations Energy-Efficient Jamming. IEEE SECON, 2007.
[6] Texas Instruments Inc. Chipcon CC2420 Data Sheet, 2003.
The WisperNet-Spatial routing scheme is centralized [7] A. D. Wood, J. A. Stankovic, and S. H. Son. JAM: A Jammed
and will not scale well in large networks (>500 nodes) Area Mapping for Sensor Networks. In IEEE RTSS, 2003.
under moderate to heavy attack as the message from the [8] J. Polastre, J. Hill, and D. Culler. Versatile Low Power Media
Access for Wireless Sensor Networks. SenSys, November 2005.
gateway may not get through. While several distributed [9] W. Ye, J. Heidemann, and D. Estrin. An energy-efficient MAC
heuristics for the MST problem exist, they require a large protocol for wireless sensor networks. IEEE INFOCOM, 2002.
[10] A. El-Hoiydi and J. Decotignie. WiseMac: An Ultra Low Power
amount of information with respect to shortest paths MAC Protocol. ISCC, 2004.
from a node to all other nodes in the network. For con- [11] L.F.W. van Hoesel and P.J.M. Havinga. A lightweight medium
access protocol for wireless sensor networks. INSS, 2004.
tinuously changing system, with respect to the weights [12] A. Rowe, R. Mangharam, and R. Rajkumar. RT-Link: A
of used link, these distributed solutions do not represent Time-Synchronized Link Protocol for Energy Constrained
satisfactory solution. Also these schemes are not con- Multi-hop Wireless Networks. IEEE SECON, 2006.
[13] T. Dam and K. Langendoen. An adaptive energy-efficient mac
ducive to energy-constrained and memory-constrained protocol for wireless sensor networks. SenSys, November 2003.
sensor networks. We aim to explore distributed solutions [14] R. Mangharam, A. Rowe, and R. Rajkumar. FireFly: A
Cross-layer Platform for Real-time Embedded Wireless
further. Networks. Real-Time System Journal, 37(3):183–231, 2007.
6. DISCUSSION AND CONCLUSION [15] B. Schneier. Applied Cryptography. John Willey Inc., 1996.
[16] A. Perrig and et. al. SPINS: Security Protocols for Sensor
In this paper we proposed the WisperNet anti-jamming Networks. Wireless Networks, 8(5):521–534, 2002.
[17] A. Perrig, R. Canetti, D. Tygar, and D. Song. The TESLA
protocol which uses Coordinated Temporal Randomiza- Broadcast Authentication Protocol. Cryptobytes, 5(2), 2002.
tion of transmissions (WisperNet-Time) to reduce the [18] H. Krawczyk, M. Bellare, and R. Canetti. HMAC:
censorship ratio of a statistical jammer to that of a ran- Keyed-Hashing for Message Authentication. RFC 2104, 1997.
[19] B. Y. Wu and Kun-Mao Chao. Spanning Trees and
dom jammer. A second component of WisperNet is Co- Optimization Problems. Chapman and Hall, CRC Press, 2004.
ordinated Spatial Adaptation (WisperNet-Space), where [20] R. Mangharam and R. Rajkumar. Max: A maximal transmission
concurrency mac for wireless networks with regular structure. In
network routes are adapted continually to avoid jammed IEEE Broadnets, 2006.
regions (and hence random jammers) and select paths [21] A. Eswaran, A. Rowe, and R. Rajkumar. Nano-RK: Energy
aware Resource centric RTOS. IEEE RTSS, 2005.
with the max packet delivery ratio.
Through simulation and experiments, we demonstrate
Figure 16: Experimental setup with 3 nodes Figure 17: WisperNet-Time on Oscilloscope