Subject: [manet] IP spoofing in ad hoc networks?

From: Bin Lu <[email-masked]>
Date: Thu, 23 Jan 2003 16:16:48 -0600 (CST)

Hi,

I have a question about IP spoofing in MANET.

As you must know, a malicious node could issue DoS attacks or masquerade
its true identity by using a source address which is invalid or forged to
appear to have originated from another legitimate node. In wired
networks, filters are used to prevent from IP spoofing attacks.
Since ad hoc networks don't have fixed infrastructures, which makes it 
hard or almost impossible to install filters, is there any other solution
yet to deal with the problem? Or is there any work done on this topic so
far?

Thanks a lot!

Bin

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Frank Kargl <[email-masked]>
Date: Fri, 24 Jan 2003 11:09:57 +0100

Hi Bin,

Bin Lu wrote:
> appear to have originated from another legitimate node.

You are adressing a whole bunch of problems here. First it is a matter
of IP address assignment. There are some drafts on this subject, e.g.

Global Connectivity for IPv6 Mobile Ad Hoc Networks -
   draft-wakikawa-manet-globalv6-00.txt
or
IP Address Autoconfiguration for Ad Hoc Networks -
   draft-perkins-manet-autoconf-00.txt
(you might want to search for newer versions!)

Given this, an IP says nothing about the identity of a node or its user.
And of course you can use arbitrary IPs, even from other users. Even in
the wired Internet, filters don't provide 100% security, as they are
often realized only on border routers etc. Thus I can still happily
spoof IP addresses within my subnet etc.

> In wired
> yet to deal with the problem?

Clearly I don't think that filters will be of much help in a MANET. IMHO
you need to have an unforgable identity in your network which only can
be provided on a cryptographic basis (with a digital signature issued by
a TTP). There are a lot of things to discuss here: is the ID based on a
user or on a device? Who is to work as a TTP? Do you get your ID on
network entry? By whom? Or do you have a "life-long" ID generated long
before you enter the MANET? ...

Btw: if anyone believes that you actually can create an unforgeable ID
without a TTP, I would be happy to discuss this.

> Or is there any work done on this topic so
> far?

I know of no publications regarding this issue so far. You might want to
take a look at http://www.ccs.neu.edu/home/zhufeng/security_manet.html,
perhaps you find some paper that I missed. Additionally it is worth
having a look at P2P networks as they face similar problems.

I am currently writing my PhD thesis which is about creating an
all-including security framework for MANETs (sounds rather megalomaniac,
does it? ;-) which also tries to deal with this matter.

Unfortunately all I have written so far is in german, but I will try to
get some english publications ready in the near future.

One interesting aspect here is that you don't really want to have a
clear ID in a MANET. Otherwise it would be quite easy for anybody in the
network, to trace your motions relativly to other nodes (with a perhaps
known position). Therefor you might want to include the concept of
pseudonyms which makes everything even more complex.

Regards ... Frank

-- 
-----------------------------------------------------------------------
   Frank Kargl          Multimedia Computing, University of Ulm, Germany
   Mail:[email-masked] http://www.uni-ulm.de/~fkargl/
-----------------------------------------------------------------------
     Use the SOURCE, Luke !  I feel a great disturbance in the SOURCE.
              But beware of the Microsoft side of the SOURCE !