Subject: Re: MANET Security Question

From: "Pete Sholander" <[email-masked]>
Date: Wed, 27 Dec 2000 13:40:58 -0500

Brian,

Greetings!  Nice to see you're still doing wireless stuff!!

As we both know, cryptography *never* solves all of the security problems within wireless networks.  So, a more "layered" approach to security may also be worth investigating.  In particular, there has been some research on detecting subverted/malicious routers within both OSPF and MANET networks.  One academic paper that comes to mind is:

S. Marti, T. Giuli, K. Lai and M. Baker, "Mitigating Routing Misbehavior in Mobile Ad Hoc Networks", Proceedings of Mobicom 2000, Boston, August 2000.

Kind Regards,
Pete Sholander

Scientific Research Corporation 
Atlanta, GA  

>>> Manel Guerrero Zapata <[email-masked]> 12/15/00 07:52AM >>>
Hi Brian,

Well, I'm not part of the MANET WG, but...

In my own opinion you are pointing out a very important issue in MANET:
security. In most of the manet routing protocols they are assuming that
all nodes are friendly (!) or that retrofiting pre-existing security
mechanisms (like IPsec) is gonna be fine enough.

This is not Disneyland, so to assume that all nodes are friendly is not
a serious thing to do. About retrofiting security mechanisms, there is
a very big risk that it will just create new security holes. This is
because
the nature of MANET networks is completely different than the nature
that
is behind the scenarios on such security mechanisms where designed.

In the same way than routing protocols that work fine in fixed networks
do not work over manet networks, the same problem will arise with
security.
Don't get me wrong. Maybe some security mechanisms can be addapted to
work
in manet, but not put them just like thinking that they are black
boxes that 'provided security'.

So, for me, the to explanations for not to look at security in manet
right
from the begining of the design of a routing protocol are just cheap
excuses. There are people that think that you can create a routing
protocol without security and later on added as if it was a 'patch'
without
major modifications. (This is called the "We'll think about this later"
problem ;) ).

Of course there are some papers about security in manet. But there is
not
a serious security componet in the manet routing protocols that are
being
specified right now.

But, trying to answer your question:

- It is very good disctintion the one you do about user data and control
data. It is obvious that independently of the security level required
for
the user's communication, control data (routing packets) should be at
least
authentified (right now I don't see the need to encrypt it. In the
possible
scenarios that I'm thinking routing tables could be public (except
millitary
applications and so on) otherwise an malicious nodes (yes there will be
always bad guys) could alter completely the routing paths to do
unnummerable
number of attacks. This makes me think of the need of identifying nodes,
which will be actually specially difficult in IPv6 where there is
dinamyc
addresses and so on. (But well in MANET WG the v6 world is not really
take it into account yet).

-About the decentralized nature of network control: Well, it makes the 
network more robust because denial of services (the most complicated
(impossible?) attack to prevent) is against servers of services. With
manet topologies there is not a clear server. Each node can provide
certain
services, or let's say that you cannot put all the services in one node,
because you cannot guaranty that all the nodes are gonna have network
connectivity with 'the server'. So yeah, manet topologies are stronger
to this kind of attack.

-I think that manet protocols should protect the control data and let
'the
others' protect user data in more conventional ways. But at least ensure
that nobody can lie about how the routes in the network are.

Let's assume that without real security mechanisms nobody is gonna use
any
manet protocol in the real world.

Regards,

	Manel Guerrero

"EXT Van Leeuwen, Brian P" wrote:
> 
> MANET WG:
> 
> I am interested in using wireless ad hoc communication in systems that have
> security requirements.  So I thought I would pose a few questions and see
> what the MANET WG considers to be effective security of an ad hoc network.
> 
> First, I think it is important to distinguish between USER-PLANE DATA vs.
> CONTROL-PLANE DATA.  The user-plane data can be secured with application
> layer cryptography or even lower layer cryptography.  However, the question
> I have is what needs to be protected at the lower layer headers of the
> user-plane data and how best to protect the CONTROL-PLANE DATA.
>         *       Is it necessary to encrypt all packet headers at the link
> layer so destination and source addresses are not transmitted in the clear?
> If so all nodes in listening range must decrypt the header to determine if
> the packet is addressed to that node.
>         *       How can the MAC be done without providing addressing
> information?  RTS and CTS exchange clearly describes who wants to
> communicate with who.  Any thoughts on what type of MAC provides the best
> opportunity for security; TDMA, CDMA,...?
>         *       How about HELLO packets or link state exchange packets;
> encrypted, signed?
>         *       Can the decentralized nature of network control in MANETs
> provide additional robustness against the single points of failure of more
> centralized approaches?
>         *       Also is it important to keep confidential the routing
> topology and source/destination addresses?
> 
> Without some form of link-layer security, a MANET routing protocol is
> vulnerable to many forms of attack.  It may be relatively simple to snoop
> network traffic, replay transmissions, manipulate packet headers, and
> redirect routing messages, within a wireless network without appropriate
> security provisions.   Existing link-level security techniques; encryption
> and/or authentication, are often applied within wireless networks to reduce
> these threats.  However, even with existing link-level security the
> destination/source addresses are sent in the clear; is this a problem?
> 
> Thanks,
> 
> Brian
> 
> [email-masked]