Geethanjali College of Engineering and Technology

Geethanjali College of Engineering and Technology
DEPARTMENT OF COMPUTER SCIENCE ENGINEERING
(Name of the Subject/Lab Course):ADHOC AND SENSOR NETWORKS
(JNTU CODE: 58039 ) Programme: UG/PG
Branch: CSE Version No: 1
Year: IV Document Number :GCET/IT/304
Semester: II No. of Pages:
Classification status (Unrestricted/Restricted ) :
Distribution List:
Prepared by : Updated by :
1) Name : K.VijayaBhaskar 1) Name :
2) Sign : 2) Sign :
3) Design :Assistant Professor 3) Design :
4) Date :1st December 2015 4) Date :
Verified by : *For Q.C only
1) Name : 1)Name :
2) Sign : 2) Sign :
3) Design : 3) Design :
4) Date : 4) Date :
Approved by (HOD) :
1) Name:
2) Sign :
3) Date :
GEETHANJALI COLLEGE OF ENGINEERING & TECHNOLOGY

CHEERYAL (V) KEESARA (M) RR District.
Department of Computer Science and Engineering
Name of the Subject: Adhoc and Sensor Networks
Name of the Faculty: K.VijayaBhaskar Designation: Assistant Professor
Year and Semester to Whom Subject is offered: IV BTech. II Sem A
Department: CSE Academic year: 2015-2016
1.1. Introduction to the subject:
Ad hoc and sensor networks emphasizes that there is a major interdependence among various layers of the
network protocol stack. Contrary to wired or even one-hop cellular networks, the lack of a fixed
infrastructure, the inherent mobility, the wireless channel, and the underlying routing mechanism by ad hoc
and sensor networks introduce a number of technological challenges that are difficult to address within the
boundaries of a single protocol layer.
1.2. Prerequisites
There are no mandatory prerequisites. But it will be very helpful if you have a good understanding of
networks, including Ethernet and other multiple access networks ,routing and network protocols, including
the TCP/IP suite, and computer algorithms. If you are not familiar with these topics, please consult the
instructors.
I.3.Objectives of the subject
This is a graduate level course emphasing research in wireless networking area

with an emphasis on ad hoc & sensor networks. This course is structured slightly differently. There ill be
regular lectures throughout the semester except for couple of weeks during which students will be presenting
papers chosen from the list of published papers available via course website. The course examines wireless
cellular, ad hoc and sensor networks, covering topics such as wireless communication fundamentals, medium
access control, network and transport protocols, unicast and multicast routing algorithms, mobility and its
impact on routing protocols, application performance, quality of service guarantees, and security. Energy
efficiency and the role of hardware and software architectures may also be presented for sensor networks.
Upon completion of this course, it is envisaged that the students will be able to:
1. Explain the constraints of the wireless physical layer that affect the design and performance
2. of ad hoc and sensor networks, protocols, and applications;
3. Explain the performance of various unicast and multicast routing protocols that have been proposed
for ad hoc networks.
4. Explain the operation of several media access protocols that have been proposed for ad hoc and
sensor networks
5. describe the platform architectures that are suitable for mobile computing and communications, e.g.
personal digital assistants (PDAs), handsets, etc.
6. Explain the energy issues in sensor networks and how they can be addressed using scheduling, media
access control, and special hardware
7. Explain various security threats to ad hoc networks and describe proposed solutions.
8. To understand the Principles of Ad hoc wireless and sensor networks.
9. To understand and design protocols including congestion control and routing.
10. To implement protocols using hard wares.
11. Explore fundamental issues of Mobile Ad Hoc Networks (MANETs) and Sensor Networks.
Course Outcomes
At the end of this course student will:
1. This course will help students to identify the major issues associated with ad-hoc/sensor networks.
2. Students will explore current ad-hoc/sensor technologies by researching key areas such as algorithms,
protocols, hardware, and applications.
3. Students will learn how to program and communicate with embedded operating system such as Tiny OS
,a prominent application development environment for sensor systems using Motes..
4. At the end of this course students will gain hands-on experience through real-world programming projects
on ad-hoc/sensor hardware and be able to implement or develop algorithms involved in ad-hoc/sensor system
5. Provide knowledge of mobile ad hoc networks, design and implementation issues,
and available solutions.
6. Provide knowledge of routing mechanisms and the three classes of approaches:

proactive, on-demand, and hybrid..
7. Provide knowledge of clustering mechanisms and the different schemes that have
been employed, e.g., hierarchical, flat, and leaderless.
8. Provide knowledge of the 802.11 Wireless Lan (WiFi) and Bluetooth standards. This
includes their designs, operations, plus approaches to interoperability.
9. Provide knowledge of sensor networks and their characteristics. This includes design
of MAC layer protocols, understanding of power management, query processing, and
sensor databases.
10. Appreciate the importance of good Ad-Hoc Networks Functionality.
Learning Outcomes
At the end of each unit students will be able to learn the following things:
UNIT I:
1. Students will be able to describe the unique issues in ad-hoc wireless networks.
2. Students will be able to describe current technology trends for the implementation and deployment of ad-
hoc wireless networks..
3. Students will be able to discuss the challenges in designing MAC, routing and transport protocols for ad-
hoc wireless networks.
4. Students will be able to discuss the issues in designing Security Protocols for ad hoc wireless networks
5. Students will be able to discuss about the issues in QoS solutions and Energy Management Schemes in
Ad Hoc Wireless Networks
UNIT II:
1) Present the basic principles of routing in general packet-switched networks

2) Describe the basic principles of mobile ad hoc networks (MANETs) and MANET routing protocols.\
3) Describe AODV and OLSR as example MANET routing protocols
4) Discuss issues related to mobile ad hoc networks and MANET routing protocols
UNIT III:
1. Describe the principles of mobile ad hoc networks and what distinguishes them from infrastructure-
based networks..
2. Explain how proactive routing protocols function.
3. Explain how reactive routing protocols function.
4. Explainthe issue of broadcast storms and flooding, and how some techniques attempt to reduce them.
UNIT IV:
1. Identify the layers of the WiFi standard and their functions.

2. Identify the layers Bluetooth and their functions.
3. Describe how nodes within a piconet communicate.
4. Explain the principles and characteristics of sensor networks.
UNIT V:
1. Describe the limitations of wireless sensor networks, especially energy constraints, and the
devised solutions..
2. Analyze the components of a wireless sensor nodes and the role of each component in the
wireless sensor network.
UNIT VI:
1. Explain the application layer support for implementations..

2. Describe the mechanisms employed in clock synchronizing .
3. Explain the techniques and strategies for localizing sensor nodes in a network by means of exact
and relative positioning techniques.
UNIT VII:
1. Explain the differences between routing in MANETs and routing in WSNs, and the general
techniques used.
2. Apply and explain simple filtering rules based on IP and TCP header information.
3. Distinguish between firewalls based on packet-filtering routers, application level gateways and
circuit level gateways.
UNIT VIII:
1. Work on a project that addresses an issue applicable to MANETs.

2. Students will learn basic principles of wireless and mobile networks with focus on computer and
data networks, Knowledge of basic protocols and interfaces.
3. Bluetooth device along with providing resources, tutorials, reading materials and support
materials to access for further guidance or questions users may have.
Mapping of Course to PEOs and POs
ASN PEO1,PEO3 PO1,PO2,PO3,PO4,PO5,PO6,PO7,PO10,PO11,PO12,PO13,PO14
Mapping of Course outcomes to Program Outcomes
S.No. Course Outcome POs
1 This course will help students to identify the major PO12

issues associated with ad-hoc/sensor networks
2 Students will explore current ad-hoc/sensor PO2 ,PO3,PO4,PO5

technologies by researching key areas such as
algorithms, protocols, hardware, and applications.
3 Students will learn how to program and PO2 ,PO3,PO4,PO5
communicate with embedded operating system such
as Tiny OS ,a prominent application development
environment for sensor systems using Motes.
4 At the end of this course students will gain hands-on PO2 ,PO3,PO4,PO5
experience through real-world programming projects
on ad-hoc/sensor hardware and be able to implement
or develop algorithms involved in ad-hoc/sensor
system.
5 Provide knowledge of mobile ad hoc networks, PO2 ,PO3,PO4,PO5

design and implementation issues,
6 Provide knowledge of routing mechanisms and the PO2 ,PO3,PO4,PO5

three classes of approaches:
proactive, on-demand, and hybrid.
7 Provide knowledge of the 802.11 Wireless Lan PO2 ,PO3,PO4,PO5

(WiFi) and Bluetooth standards. This
includes their designs, operations, plus approaches to
interoperability.
8 Provide knowledge of sensor networks and their PO12

characteristics. This includes design
of MAC layer protocols, understanding of power
management, query processing, and
sensor databases.
9 Appreciate the importance of good Ad-Hoc PO10,PO11,PO13,PO14

Networks Functionality
10 Provide knowledge of mobile ad hoc networks, PO13,PO14

design and implementation issues,
1.3. JNTU Syllabus with Additional Topics
.no UNIT NO Topic Additional Topics

1 UNIT – I
Introduction to Ad Hoc and wireless networks
Characteristics of MANETS
Applications of MANETS
Challenges in MANETS
2 UNIT – II
Routing in MANETS
Topology based vs. Position based approaches
Topology based routing Protocols
Position based Routing Protocols
Other routing Protocols
3 UNIT – III
Data Transmission in MANETS
Broadcast Strom
Multicast
Geocasting
TCP over Ad Hoc Networks
TCP Protocol overview
TCP and MANETS
Solution for TCP over Ad Hoc
4 UNIT – IV
Basics of Wireless sensors and Applications
The Mica Mote
Sensing and Communication ranges
Design Issues
Energy Consumptions
Clustering of sensors
Applications
5 UNIT – V
Data Retrieval in Sensor Networks
Classification of WSN
MAC Layer
Routing Layer
High Level application layer support
Adapting to Internet dynamic nature of WSN
6 UNIT – VI
Security
Security in Ad Hoc and Wireless Networks
Key Management
Secure Routing
Cooperation in MANETS
Intrusion Detection systems
7 UNIT – VII
Sensor Network Platform and Tools
Sensor Network Hardware
Sensor Network Programming Languages
Node Level Software Platforms
8 UNIT – VIII
Operating System
Tiny OS
Imperative Languages: NESC

Data flow style languages: Tiny GALS
Node level Simulators
NS-2 and Sensor network Extension
TOSSIM
S.no Unit Total no Topics to be covered Reg/Additional Teaching Remarks
No of Periods aids used
LCD/OHP
/BB
1 UNIT – I
Introduction to Ad Hoc and wireless networks Regular OHP,BB
Characteristics of MANETS Regular OHP,BB
Applications of MANETS Regular OHP,BB
Challenges in MANETS Regular BB, OHP
2 UNIT – II
Routing in MANETS Regular BB
Topology based vs. Position based approaches Regular BB
Topology based routing Protocols Regular BB
Position based Routing Protocols Regular BB
Other routing Protocols Regular OHP,BB
3 UNIT – III
Data Transmission in MANETS Regular BB
Broadcast Strom Regular BB
Multicast Regular OHP,BB
Geo casting Regular BB,OHP
TCP over Ad Hoc Networks Regular BB
TCP Protocol overview Regular OHP,BB
TCP and MANETS Regular BB
Solution for TCP over Ad Hoc Regular BB
4 UNIT – IV
Basics of Wireless sensors and Applications Regular OHP,BB
The Mica Mote Regular BB
Sensing and Communication ranges Regular OHP,BB
Design Issues Regular OHP,BB

Energy Consumptions Regular OHP,BB
Clustering of sensors Regular BB
Applications Regular OHP,BB
5 UNIT – V
Data Retrieval in Sensor Networks Regular OHP,BB
Classification of WSN Regular OHP,BB
MAC Layer Regular BB
Routing Layer Regular OHP,BB
High Level application layer support Regular BB
Adapting to Internet dynamic nature of WSN Regular BB
6 UNIT – VI
Security Regular OHP,BB
Security in Ad Hoc and Wireless Networks Regular BB
Key Management Regular BB
Secure Routing Regular OHP,BB
Cooperation in MANETS Regular BB
Intrusion Detection systems Regular OHP,BB
7 UNIT – VII
Sensor Network Platform and Tools Regular OHP,BB
Sensor Network Hardware Regular BB
Sensor Network Programming Languages Regular OHP,BB
Node Level Software Platforms Regular BB,LCD
8 UNIT – VIII
Operating System Regular OHP,BB
Tiny OS Regular OHP,BB
Imperative Languages: NESC Regular OHP,BB
Data flow style languages: Tiny GALS Regular OHP,BB
Node level Simulators Regular OHP,BB
NS-2 and Sensor network Extension Regular OHP,BB
1.4. Sources of Information
TEXT BOOKS
1. ADHOC AND SENSOR NETWORKS -THEORY AND APPLICATIONS, Carols Corderio, Dharma
Prakash Agarwal, World Scientific Publications / Cambridge University Press March 2006.
2. Wireless Sensor Networks-An Information Processing Approach, Feng Zhao, and Elsevier Science
imprint, Morgan Publishers 2005
REFERENCES
1. Ad hoc and Wireless Networks by C.Shiva Rama Murthy, B.S.Murthy.
2. Ad hoc Networking Charles E Perkins.
WEBSITES
 http://ceng.usc.edu/~anrg/SensorNetBib.html
 http://www.crhc.uiuc.edu/wireless/talks/draft-infocom-2004.ppt
 http://www.cn.uni-duesseldorf.de/publications/library/Mauve2001f.pdf
1.5. Unit wise Summary
1.6. Micro Plan:-
L Period Uni Date Topic to be covered in One lecture Reg/Addit Teaching Remarks
No t ional aids used
o No LCD/OHP
/
BB
1 UNIT – I Regular OHP,BB
1 Introduction to MC, novel applications Regular OHP,BB
2 limitations, and architecture Regular OHP,BB
3 GSM: Mobile services, System architecture Regular OHP,BB
4 Radio interface, Protocols Regular BB
6 Localization and calling, Handover, Security, Regular BB

and New data services.
UNIT – II Regular BB
Medium Access Control: Regular OHP,BB
0 8 Motivation for a specialized MAC Regular BB
1 9 SDMA ,FDMA Regular BB
2 10 TDMA Regular OHP,BB
3 14 CDMA Regular BB
5 UNIT – III Regular OHP
6 Mobile Network Layer:
7 15 3 Mobile IP: Goals, assumptions, entities and Regular OHP,BB

terminology
8 16 Agent advertisement and discovery, Regular BB

registration,
9 18 Tunneling and encapsulation, optimizations Regular BB
0 20 Dynamic Host Configuration Protocol Regular OHP,BB
2 4 UNIT – IV Regular OHP,BB
3 Mobile Transport Layer: Regular BB
4 21 Traditional TCP, Indirect TCP, Regular BB
5 22 Snooping TCP, Mobile TCP Regular OHP,BB

6 24 Fast retransmit/ fast recovery, Transmission Regular BB
/time-out freezing,
7
8 5 UNIT – V Regular BB
9 Database Issues: Regular BB
0 26 Hoarding techniques, caching invalidation Regular OHP,BB

mechanisms
1 27 client server computing with adaptation, power- Regular BB

aware and context-aware computing
2 29 Transactional models, query processing, Regular OHP,BB

recovery, and quality of service issues.
4 6 UNIT – VI
5 Data Dissemination:
6 31 Communications asymmetry Regular BB
7 33 Classification of new data delivery mechanisms Regular BB
8 36 Push-based mechanisms, pull-based Regular OHP,BB

mechanisms
9 38 Hybrid mechanisms, selective tuning (indexing) Regular OHP,BB

techniques.
1 7 UNIT – VII
Mobile Ad hoc Networks (MANETs):
2 39 Overview, Properties of a MANET Regular BB
3 40 Spectrum of MANET applications Regular BB
4 42 Routing and various routing algorithms Regular BB
5 44 Security in MANETs Regular OHP,BB
6 Regular BB
7 8 UNIT – VIII
8 Protocols and Tools:
9 46 Wireless Application Protocol-WAP Regular OHP,BB

Introduction, protocol.
0 49 Architecture, and treatment of protocols of all Regular OHP,BB

layers
1 52 Bluetooth -User scenarios, physical layer Regular BB
2 54 MAC layer, networking, security, link Regular BB

management
1.7. Subject Contents
1.7. 1. Synopsis page for each period (62 pages)
1.7.2. Detailed Lecture notes containing:
1. PPTS
2. OHP slides
3. Subjective type questions (approximately 5 t0 8 in no)
4. Objective type questions (approximately 20 to 30 in no)
5. Any simulations
MANET (Mobile ad hoc network)-

Characteristics and Features
November 13, 2011 Jesna Jamal 2 Comments featured, iMANET, MANET, MANET attacks, MANET features, VANET
What is a MANET ?
It is an infrastructureless IP based network of mobile and wireless machine nodes connected with radio.
In operation, the nodes of a MANET do not have a centralized administration mechanism. It is known
for its routeable network properties where each node act as a “router” to forward the traffic to other
specified node in the network.
Types of MANET
There are different types of MANETs including:
 InVANETs – Intelligent vehicular ad hoc networks make use of artificial intelligence to

tackle unexpected situations like vehicle collision and accidents.
 Vehicular ad hoc networks (VANETs) – Enables effective communication with another
vehicle or helps to communicate with roadside equipments.
 Internet Based Mobile Ad hoc Networks (iMANET) – helps to link fixed as well as
mobile nodes.
Characteristics of MANET
 In MANET, each node act as both host and router. That is it is autonomous in behavior.
 Multi-hop radio relaying- When a source node and destination node for a message is out
of the radio range, the MANETs are capable of multi-hop routing.
 Distributed nature of operation for security, routing and host configuration. A centralized
firewall is absent here.
 The nodes can join or leave the network anytime, making the network topology dynamic
in nature.
 Mobile nodes are characterized with less memory, power and light weight features.
 The reliability, efficiency, stability and capacity of wireless links are often inferior when
compared with wired links. This shows the fluctuating link bandwidth of wireless links.
 Mobile and spontaneous behavior which demands minimum human intervention to
configure the network.
 All nodes have identical features with similar responsibilities and capabilities and hence it
forms a completely symmetric environment.
 High user density and large level of user mobility.
 Nodal connectivity is intermittent.
Manet Challenges
A Manet environment has to overcome certain issues of limitation and inefficiency. It includes:
 The wireless link characteristics are time-varying in nature: There are transmission
impediments like fading, path loss, blockage and interference that adds to the susceptible
behavior of wireless channels. The reliability of wireless transmission is resisted by different
factors.
 Limited range of wireless transmission – The limited radio band results in reduced data
rates compared to the wireless networks. Hence optimal usage of bandwidth is necessary by
keeping low overhead as possible.
 Packet losses due to errors in transmission – MANETs experience higher packet loss due
to factors such as hidden terminals that results in collisions, wireless channel issues (high bit
error rate (BER)), interference, frequent breakage in paths caused by mobility of nodes,
increased collisions due to the presence of hidden terminals and uni-directional links.
 Route changes due to mobility- The dynamic nature of network topology results in
frequent path breaks.
 Frequent network partitions- The random movement of nodes often leads to partition of
the network. This mostly affects the intermediate nodes.
The application of this wireless network is limited due to the mobile and ad hoc nature. Similarly, the
lack of a centralized operation prevents the use of firewall in MANETs. It also faces a multitude of
security threats just like wired networks. It includes spoofing, passive eavesdropping, denial of service
and many others. The attacks are usually classified on the basis of employed techniques and the
consequences.
 ← Complete Guide on iOS 4.3.3 Jailbreak (Using RedsnOw 0.9.6rc15)

 AMD FX 8120: 8-Core CPU Review And Features →
You May Also Like
Effective Tips to Select Japanese Used Cars
August 7, 2011 0
Perl Program to Check Whether a Number is Prime or Not

February 29, 2012 0
Routing Protocols in MANETs

September 18, 2012 0
MANET ( Mobile Adhoc NETwork )
INTRODUCTION - WHAT IS MANET
As the importance of computers in our daily life increases it also sets new demands for connectivity.
Wired solutions have been around for a long time but there is increasing demand on working wireless
solutions for connecting to the Internet, reading and sending E-mail messages, changing information in
a meeting and so on. There are solutions to these needs, one being wireless local area network that is
based on IEEE 802.11 standard. However, there is increasing need for connectivity in situations where
there is no base station (i.e. backbone connection) available (for example two or more PDAs need to be
connected). This is where ad hoc networks step in.
In Latin, ad hoc means "for this," further meaning "for this purpose only.- It is a good and emblematic
description of the idea why ad hoc networks are needed. They can be set up anywhere without any
need for external infrastructure (like wires or base stations). They are often mobile and that's why a
term MANET is often used when talking about Mobile Ad hoc NETworks. MANETs are often defined as
follows: A "mobile ad hoc network" (MANET) is an autonomous system of mobile routers (and
associated hosts) connected by wireless links - the union of which forms an arbitrary graph. The routers
are free to move randomly and organize themselves arbitrarily; thus, the network's wireless topology
may change rapidly and unpredictably. Such a network may operate in a standalone fashion, or may be
connected to the larger Internet.
The strength of the connection can change rapidly in time or even disappear completely. Nodes can
appear, disappear and re-appear as the time goes on and all the time the network connections should
work between the nodes that are part of it. As one can easily imagine, the situation in ad hoc networks
with respect to ensuring connectivity and robustness is much more demanding than in the wired case.
Ad hoc networks are networks are not (necessarily) connected to any static (i.e. wired) infrastructure.
An ad-hoc network is a LAN or other small network, especially one with wireless connections, in which
some of the network devices are part of the network only for the duration of a communications session
or, in the case of mobile or portable devices, while in some close proximity to the rest of the network.
The ad hoc network is a communication network without a pre-exist network infrastructure. In cellular
networks, there is a network infrastructure represented by the base-stations, Radio network
controllers,… etc. In ad hoc networks every communication terminal (or radio terminal RT)
communicates with its partner to perform peer to peer communication. If the required RT is not a
neighbour to the initiated call RT (outside the coverage area of the RT), then the other intermediate
RTs are used to perform the communication link. This is called multi-hope peer to peer communication.
This collaboration between the RTs is very important in the ad hoc networks. In ad hoc networks all the
communication network protocols should be distributed throughout the communication terminals (i.e.
the communication terminals should be independent and highly cooperative).
CHARACTERISTICS
Mobile Adhoc Network (MANET) is a collection of independent mobile nodes that can communicate to
each other via radio waves. The mobile nodes that are in radio range of each other can directly
communicate, whereas others needs the aid of intermediate nodes to route their packets. These
networks are fully distributed, and can work at any place without the help of any infrastructure. This
property makes these networks highly exible and robost.
The characteristics of these networks are summarized as follows:
• Communication via wireless means.
• Nodes can perform the roles of both hosts and routers.
• No centralized controller and infrastructure. Intrinsic mutual trust.
• Dynamic network topology. Frequent routing updates.
• Autonomous, no infrastructure needed.
• Can be set up anywhere.

• Energy constraints
• Limited security
Generally, the communication terminals have a mobility nature which makes the topology of the
distributed networks time varying. The dynamical nature of the network topology increases the
challenges of the design of ad hoc networks. Each radio terminal is usually powered by energy limited
power source (as rechargeable batteries). The power consumption of each radio terminal could be
divided generally into three parts, power consumption for data processing inside the RT, power
consumption to transmit its own information to the destination, and finally the power consumption
when the RT is used as a router, i.e. forwarding the information to another RT in the network. The
energy consumption is a critical issue in the design of the ad hoc networks.
The mobile devices usually have limited storage and low computational capabilities. They heavily
depend on other hosts and resources for data access and information processing. A reliable network
topology must be assured through efficient and secure routing protocols for Ad Hoc networks.
APPLICATION AREAS
Some of the applications of MANETs are
• Military or police exercises.

• Disaster relief operations.
• Mine site operations.
• Urgent Business meetings
• Robot data acquisition
It is easy to imagine a number of applications where this type of properties would bring benefits. One
interesting research area is inter-vehicle communications. It is one area where the ad hoc networks
could really change the way we communicate covering personal vehicles as well as professional mobile
communication needs. Also, it is area where no conventional (i.e. wired) solutions would do because of
the high level of mobility. When considering demanding surroundings, say mines for example, then
neither would the base station approach work but we must be able to accomplish routing via nodes that
are part of the network i.e. we have to use ad hoc network.
Such networks can be used to enable next generation of battlefield applications envisioned by the
military including situation awareness systems for maneuvering war fighters, and remotely deployed
unmanned micro-sensor networks. Ad Hoc networks can provide communication for civilian
applications, such as disaster recovery and message exchanges among medical and security personnel
involved in rescue missions.
NETWORK SECURITY
Network security extends computer security, thus all the things in computer security are still valid, but
there are other things to consider as well. Computer security is defined as follows:
-Broadly speaking, security is keeping anyone from doing things you do not want them to do to, with,
or from your computers or any peripherals- -William R. Cheswick.
Network security is then computer security plus secure communication between the computers or other
devices. Not all nodes are computers in an Ad Hoc network, thus nodes cannot be assumed to
implement the security services normally existent in computers' operating systems. That is why
network security should be defined as:
-Making sure that the nodes enforce a proper computer security and then securing the communication
between them-.
Different variables have different impact on security issues and design. Especially environment, origin,
range, quality of service and security criticality are variables that affect the security in the network.
If the environment is concerned, networks can operate in hostile or friendly environments. A battlefield
has totally different requirements for security if compared with home networks. On a battlefield also
physical security and durability might be needed to ensure the functionality of the network.
The ways to implement security vary if the range of the network varies. If the nodes are very far from
each others, the risk of security attacks increases. On the other hand, if the nodes are so close to each
others that they actually can have a physical contact, some secret information (e.g. secret keys) can be
transmitted between the nodes without sending them on air. That would increase the level of security,
because the physical communication lines are more secure than wireless communication lines.
Quality of service issues deal with questions like -Is it crucial that all messages reach their destination?-
or -Is it crucial that some information reaches the destination in certain time?-. QoS is generally
demanded in real time applications where reliable and deterministic communication is required. These
issues refer to security e.g. in process control applications. We could have an Ad Hoc network in some
process and all the measurements and control signals could be transmitted through the network. In
order to have secure and reliable control of the process, quality of service requirements need to be
met.
The last variable of Ad Hoc networks described with respect to security is security criticality. This means
that before we think of the ways to implement security, we must consider carefully whether security is
required at all or whether it matters or not if someone outside can see what packets are sent and what
they contain. Is the network threatened if false packets are inserted and old packets are retransmitted?
Security issues are not always critical, but it might cost a lot to ensure it. Sometimes there is trade-off
between security and costs.
Security Problems in MANETs
MANETs are much more vulnerable to attack than wired network. This is because of the following
reasons :
Open Medium - Eavesdropping is more easier than in wired network.
Dynamically Changing Network Topology - Mobile Nodes comes and goes from the network, thereby
allowing any malicious node to join the network without being detected.
Cooperative Algorithms - The routing algorithm of MANETs requires mutual trust between nodes which
violates the principles of Network Security.
Lack of Centralized Monitoring - Absence of any centralized infrastructure prohibits any monitoring
agent in the system.
Lack of Clear Line of Defense - The only use of I line of defense - attack prevention may not su ce.
Experience of security research in wired world has taught us that we need to deploy layered security
mechanisms because security is a process that is as secure as its weakest link . In addition to pre-
vention, we need II line of defense - detection and response.
Advantages
The following are the advantages of MANETs:
• They provide access to information and services regardless of geographic position.
• These networks can be set up at any place and time.

• These networks work without any pre-existing infrastructure.
Disadvantages
Some of the disadvantages of MANETs are:
• Limited resources. Limited physical security.
• Intrinsic mutual trust vulnerable to attacks. Lack of authorization facilities.
• Volatile network topology makes it hard to detect malicious nodes.
Security protocols for wired networks cannot work for ad hoc networks.
CONCLUSION
Ad hoc networks can be implemented using various techniques like Bluetooth or WLAN for example.
The definition itself does not imply any restrictions to the implementing devices.
Ad Hoc networks need very specialized security methods. There is no approach fitting all networks,
because the nodes can be any devices. The computer security in the nodes depends on the type of
node, and no assumptions on security can be made. In this paper the computer security issues have
not been discussed, because the emphasis has been on network security.
But with the current MAC layer and routing solutions the true and working ad hoc network is just a
dream for now. However, it can be used with relatively small networks and potentially some very nice
applications can be realized. Although some peer-to-peer type of solutions work nicely already today, it
would be nice to see that some new and innovative solutions would be seen in the arena of ad hoc
networks since it is not hard for one to imagine a countless number of nice ad hoc based applications
that would make the world at least a bit better place.
Reactive protocols - AODV
Reactive protocols seek to set up routes on-demand. If a node wants to initiate communication
with a node to which it has no route, the routing protocol will try to establish such a route.
The Ad-Hoc On-Demand Distance Vector routing protocol is described in RFC 3561[54]. The
philosophy in AODV, like all reactive protocols, is that topology information is only transmitted
by nodes on-demand. When a node wishes to transmit traffic to a host to which it has no route, it
will generate a route request(RREQ) message that will be flooded in a limited way to other
nodes. This causes control traffic overhead to be dynamic and it will result in an initial delay
when initiating such communication. A route is considered found when the RREQ message
reaches either the destination itself, or an intermediate node with a valid route entry for the
destination. For as long as a route exists between two endpoints, AODV remains passive. When
the route becomes invalid or lost, AODV will again issue a request.
AODV avoids the ``counting to infinity'' problem from the classical distance vector algorithm by
using sequence numbers for every route. The counting to infinity problem is the situation where
nodes update each other in a loop. Consider nodes A, B, C and D making up a MANET as
illustrated in figure 2.2. A is not updated on the fact that its route to D via C is broken. This means
that A has a registered route, with a metric of 2, to D. C has registered that the link to D is down, so
once node B is updated on the link breakage between C and D, it will calculate the shortest path
to D to be via A using a metric of 3. C receives information that B can reach D in 3 hops and
updates its metric to 4 hops. A then registers an update in hop-count for its route to D via C and
updates the metric to 5. And so they continue to increment the metric in a loop.
Figure: A scenario that can lead to the ``counting to infinity'' problem.
The way this is avoided in AODV, for the example described, is by B noticing that As route to D is
old based on a sequence number. B will then discard the route and C will be the node with the
most recent routing information by which B will update its routing table.
AODV defines three types of control messages for route maintenance:
RREQ - A route request message is transmitted by a node requiring a route to a node.
As an optimization AODV uses an expanding ring technique when flooding these

messages. Every RREQ carries a time to live (TTL) value that states for how many hops
this message should be forwarded. This value is set to a predefined value at the first
transmission and increased at retransmissions. Retransmissions occur if no replies are
received.
Data packets waiting to be transmitted(i.e. the packets that initiated the RREQ) should be
buffered locally and transmitted by a FIFO principal when a route is set.
RREP - A route reply message is unicasted back to the originator of a RREQ if the receiver
is either the node using the requested address, or it has a valid route to the requested
address. The reason one can unicast the message back, is that every route forwarding a
RREQ caches a route back to the originator.
RERR - Nodes monitor the link status of next hops in active routes. When a link breakage
in an active route is detected, a RERR message is used to notify other nodes of the loss of
the link. In order to enable this reporting mechanism, each node keeps a ``precursor
list'', containing the IP address for each its neighbors that are likely to use it as a next hop
towards each destination.
Figure: A possible path for a route reply if A wishes to find a route to J.
Figure 2.3 illustrates an AODV route lookup session. Node A wishes to initiate traffic to node J
for which it has no route. A broadcasts a RREQ which is flooded to all nodes in the network.
When this request is forwarded to J from H, J generates a RREP. This RREP is then unicasted
back to A using the cached entries in nodes H, G and D.
Proactive protocols - OLSR
A proactive approach to MANET routing seeks to maintain a constantly updated topology

understanding. The whole network should, in theory, be known to all nodes. This results in a
constant overhead of routing traffic, but no initial delay in communication.
The Optimized Link State routing(OLSR) is described in RFC3626[23]. It is a table-driven pro-

active protocol. As the name suggests, it uses the link-state scheme in an optimized manner to
diffuse topology information. In a classic link-state algorithm, link-state information is flooded
throughout the network. OLSR uses this approach as well, but since the protocol runs in wireless
multi-hop scenarios the message flooding in OLSR is optimized to preserve bandwidth. The
optimization is based on a technique called MultiPoint Relaying. The MPR technique is studied
further in chapter 3.
Being a table-driven protocol, OLSR operation mainly consists of updating and maintaining
information in a variety of tables. The data in these tables is based on received control traffic,
and control traffic is generated based on information retrieved from these tables. The route
calculation itself is also driven by the tables.
OLSR defines three basic types of control messages all of which will be studied in detail in
chapter 3:
HELLO - HELLO messages are transmitted to all neighbors. These messages are used for
neighbor sensing and MPR calculation.
TC - Topology Control messages are the link state signaling done by OLSR. This messaging
is optimized in several ways using MPRs.
MID - Multiple Interface Declaration messages are transmitted by nodes running OLSR on
more than one interface. These messages lists all IP addresses used by a node.
Hybrids - ZRP
Figure: A ZRP scenario showing the zones of node A and node J using a r value of 2. Within the zones a pro-active routing
protocol is used while a re-active protocol is used between zones.
Hybrid protocols seek to combine the proactive and reactive approaches. An example of such a
protocol is the Zone Routing Protocol(ZRP)[39]. ZRP divides the topology into zones and seek
to utilize different routing protocols within and between the zones based on the weaknesses and
strengths of these protocols. ZRP is totally modular, meaning that any routing protocol can be
used within and between zones. The size of the zones is defined by a parameter r describing the
radius in hops. Figure 2.4 illustrates a ZRP scenario with r set to 1. Intra-zone routing is done by
a proactive protocol since these protocols keep an up to date view of the zone topology, which
results in no initial delay when communicating with nodes within the zone. Inter-zone routing is
done by a reactive protocol. This eliminates the need for nodes to keep a proactive fresh state of
the entire network.
ZRP defines a technique called the Bordercast Resolution Protocol (BRP) to control traffic
between zones. If a node has no route to a destination provided by the proactive inter-zone
routing, BRP is used to spread the reactive route request. Figure 2.5 illustrates the different
components of ZRP.
Figure: The different components of the Zone Routing Protocol.
Overview
The three routing protocols AODV, OLSR and ZRP have been introduced in this section. AODV
and OLSR are both accepted as experimental RFCs by the IETF and they are probably the two
most popular MANET routing protocols at the current time. Much research and work is being
done using these protocols. The hybrid ZRP protocol has not gained that much popularity. The
protocol is actually more of a framework than a routing protocol, and it relies on well defined
and robust routing protocols to be utilized in and between the zones. The latest ZRP Internet
draft expired January 2003, but work is still said to be done by the authors and others. The need
for solutions like ZRP might arise when the basic protocols are well tested and their limitations
have been proven.
Position based routing protocols are kinds of routing protocols, which use nodes location
information, instead of links information to routing. In position based routing protocols, it
supposed that the packet source node has position information of itself and it's neighbors and
the packet destination node. Greedy is a very important position based routing protocol. In one
of it's kinds, named MFR (Most Forward Within Radius), the source node or packet forwarder
node, sends packet to one of it's neighbors with most forward progress towards destination
node (closest neighbor to destination). Using distance deciding metric in Greedy to forward
packet to a neighbor node, is not suitable for all conditions. If closest neighbor to destination
node, has high speed, in compare with the source node or intermediate packet forwarder node
speed or has very low remained battery power, then the packet loss probability will increase.
The Proposed strategy uses combination of metrics distance-velocity similarity-power, to
deciding about to which neighbor the packet should be given. Simulation results show that the
proposed strategy has lower lost packets average than Greedy, so it is more reliable.
1.1 Background
A network is a collection of two or more computing devices connected by a communication medium.

Figure 1.1 shows a simple network with three computing devices. When a computing device wishes
to send information to another device, it may do so by transmitting the information along a shared
communication medium.
Figure 1.1: Simple network with three nodes.
In this paper, any computing device actively participating in a network is called a node. Nodes are connected by
a communication medium or link. Nodes exchange information over links in discrete blocks called packets.
In Figure 1.1, any node can communicate with any other node along the single shared link. In this
case, no special steps are needed for any two nodes in the network to exchange information. If,
however, nodes in a network do not share a common link, this no longer holds true. Figure 1.2 shows
a network where different nodes share different links.
Figure 1.2: Network with eight nodes connected by four separate links.
www.jntuworld.com
www.jntuworld.com www.jwjobs.net
For example, in Figure 1.2, for node 1 to send a packet to node 8, the packet must first be sent to
node 3. Node 3 must subsequently be willing and able to forward the packet on to node 8. The links
and nodes a packet traverses along its journey from source to destination is called the packet’s path.
Whenever a packet is transmitted from one node to another, it is said to have made a hop. In the above
example, a packet sent from node 1 to node 3 requires one hop, whereas a packet sent from node 1 to
node 8 requires two hops (one hop from node 1 to node 3, and a second hop from node 3 to node 8).
In the above example, the various nodes along the packet’s path from node 1 to node 8 must cooperate in
order to make the information exchange successful. This cooperation process is called routing.
Routing in conventional network technologies, such as the Internet Protocol (IP) [1] or ATM [8], is
simplified by designing the link topology in a predictable (usually hierarchical) manner. The topology
of a network is the way in which nodes are connected to each other. In these networks, the routing
protocol can take advantage of the topology structure, resulting in a simplified routing algorithm.
Conventional networks tend to change infrequently, relaxing the burden on the routing protocol to return
to a stable state in response to a topology change. The process of returning to a stable state after a
topology change is called convergence. The time required for a routing protocol to converge is called its
convergence time. As will be seen in later sections, many routing protocols (in both ad hoc and
conventional networks) can form temporary routing loops when the topology changes. These routing
loops may persist until the routing protocol converges.
1.2 Characteristics of Ad Hoc Networks of Mobile Nodes
An ad hoc network is a collection of mobile nodes forming a temporary network without the aid of any
centralized administration or standard support services regularly available on conventional networks. In
this paper, it is assumed the mobile hosts use wireless RF transceivers as their network interface,
although many of the same principles will apply to infra-red and wire based networks. Some form of
routing protocol is necessary in these ad hoc networks since two hosts wishing to exchange packets may
not be able to communicate directly.
For example, Figure 1.3 illustrates an ad hoc network with three wireless mobile hosts. Node 3 is not
within the range of node 1’s wireless transmitter (indicated by the circle around node 1) and vice versa.
If node 1 and node 3 wish to exchange packets, they must enlist the services of node 2 to forward
packets for them, since node 2 is within the range overlap between node 1 and node 3.
Figure 1.3: Ad hoc network of three wireless mobile hosts.
www.jntuworld.com
The situation in Figure 1.3 becomes more complicated with the addition of more nodes. The addition of
just one node, as illustrated in Figure 1.4, results in multiple paths existing between nodes 1 and 3;
packets may travel the path 1 - 2 - 3, 1 - 4 - 3, or even 1 - 4 - 2 - 3. An ad hoc routing protocol must be
able to decide on a single "best" path between any two nodes.
Figure 1.4: Ad hoc network with four wireless nodes.
Another situation unique to wireless networks is illustrated in Figure 1.5. In this example, node 1 has a large
enough range to transmit packets directly to node 3. However, node 3 has a much smaller range and must enlist
the help of node 2 in order to return packets to node 1. This makes the link between node 1 and node 3 appear as
a one-way or unidirectional link. Most conventional routing protocols require bidirectional links.
Figure 1.5: Ad hoc network with a one-way link.
Another problem with wireless network interfaces is they typically operate at significantly slower bit rates than
their wire-based counterparts. Frequent flooding of packets throughout the network, a mechanism many
protocols require, can consume significant portions of the available network bandwidth. Ad hoc routing
protocols must minimize bandwidth overhead at the same time as they enable proper routing to take place.
Finally, ad hoc networks must deal with frequent changes in topology. By their very nature, mobile
nodes tend to "wander around", changing their network location and link status on a regular basis.
Furthermore, new nodes may unexpectedly join the network or existing nodes may leave or be turned
off. Ad hoc routing protocols must minimize the time required to converge after these topology changes.
A low convergence time is more critical in ad hoc networks because temporary routing loops can result
in packets being transmitted in circles, further consuming valuable bandwidth.
www.jntuworld.com
For the purposes of this report, an ad hoc routing protocol is considered to fill the space between two
network extremes. At one extreme, the network topology is changing so rapidly the only feasible routing
mechanism is for every packet to be flooded throughout the network. At the other extreme, the network
topology is sufficiently permanent and static as to permit the use of conventional routing mechanisms
such as those employed in the Internet. Ad hoc networks are networks which lack the support structure
and permanency of traditional networks, yet change sufficiently slowly as to permit the use of a routing
protocol to optimize transmission bandwidth.
2. Destination-Sequenced Distance-Vector
Routing
Destination-Sequenced Distance-Vector Routing (DSDV) [16] is an adaption of a conventional routing
protocol to ad hoc networks. DSDV is based on the Routing Information Protocol (RIP) [9], used in
parts of the Internet. Consequently, DSDV only makes use of bidirectional links. DSDV is one of the
earlier ad hoc routing protocols developed.
2.1 Protocol Overview
In DSDV, packets are routed between nodes of an ad hoc network using routing tables stored at each
node. Each routing table, at each node, contains a list of the addresses of every other node in the
network. Along with each node’s address, the table contains the address of the next hop for a packet to
take in order to reach the node.
Figure 2.1 illustrates the routing procedure in DSDV. In this example, a packet is being sent from node 1 to
node 3 (node 3 is not shown). From node 1, the next hop for the packet is node 4 (Figure 2.1 a). When node
4 receives the packet, it looks up the destination address (node 3) in its routing table (Figure 2.1 b). Node 4
then transmits the packet to the next hop as specified in the table, in this case node 5 (Figure 2.1 c). This
procedure is repeated as required until the packet finally reaches its destination.
www.jntuworld.com
Figure 2.1: An example of the routing procedure in DSDV.
2.2 Routing Table Management
The bulk of the DSDV protocol does not involve routing at all. Rather, the crux of DSDV is the generation and
maintenance of the routing tables. Every time the network topology changes, the routing table in every node
needs to be updated. As one might expect, this is no trivial task. The situation is further complicated by the fact
that, when routing tables are out of sync (i.e. the routing protocol has not converged), routing loops may form.
To facilitate routing table maintenance, several additional pieces of information are stored in the
routing tables. In addition to the destination address and next hop address, routing tables maintain the
route metric and the route sequence number.
Periodically, or immediately when network topology changes are detected, each node will broadcast a routing
table update packet. The update packet starts out with a metric of one. This signifies to each receiving neighbor
they are one hop away from the node. The neighbors will increment this metric (in this case, to two) and then
retransmit the update packet. This process repeats itself until every node in the network has received a copy of the
update packet with a corresponding metric. If a node receives duplicate update packets, the node will only pay
attention to the update packet with the smallest metric and ignore the rest.
To distinguish stale update packets from valid ones, each update packet is tagged by the original node with
a sequence number. The sequence number is a monotonically increasing number which uniquely identifies
each update packet from a given node. Consequently, if a node receives an update packet from another
node, the sequence number must be equal to or greater than the sequence number already in the routing
table; otherwise the update packet is stale and ignored. If the sequence number matches the sequence
number in the routing table, then the metric is compared and updated as previously discussed.
Each time an update packet is forwarded, the packet not only contains the address of the eventual destination, but
it also contains the address of the transmitting node. The address of the transmitting node is entered into the
www.jntuworld.com
routing table as the next hop (unless the packet is ignored, of course). Figure 2.2 illustrates how a node
processes an update packet under varying conditions. Note update packets with higher sequence numbers
are always entered into the routing table, regardless of whether they have a higher metric or not.
Figure 2.2: A node receiving three update packets.
Each node must periodically transmit its entire routing table to its neighbors using update packets.
The neighbors will update their tables based on this information, if required. Likewise each node
will listen to its neighbors update packets and update its own routing table.
2.3 Responding to Topology Changes
Mobile nodes cause broken links as they move from place to place. The broken link may be detected by
the communication hardware, or it may be inferred if no broadcasts have been received for a while from
a former neighbor. A broken link is described as having a metric of infinity. Since this qualifies as a
substantial route change, the detecting node will broadcast an update message for the lost destination.
This update message will have a new sequence number and a metric of infinity. This will essentially
cause the routing table entries for the lost node to be flushed from the network. Routes to the lost node
will be established again when the lost node sends out its next broadcast.
To avoid nodes and their neighbors generating conflicting sequence numbers when the topology
changes, nodes only generate even sequence numbers for themselves, and neighbors responding to
link changes only generate odd sequence numbers.
DSDV contains substantially more procedures for handling different network layer addresses, dealing with
non-mobile base stations, and damping fluctuations caused by topology changes. However, the details of
these procedures are deemed beyond the scope of this report. For more information, refer to [16].
www.jntuworld.com
2.4 Analysis and Discussion
DSDV is based on a conventional routing protocol, RIP, adapted for use in ad hoc networks. Routing is
achieved by using routing tables maintained by each node. The bulk of the complexity in DSDV is in
generating and maintaining these routing tables.
DSDV requires nodes to periodically transmit routing table update packets, regardless of network
traffic. These update packets are broadcast throughout the network so every node in the network knows
how to reach every other node. As the number of nodes in the network grows , the size of the routing
tables and the bandwidth required to update them also grows. This overhead is DSDV’s main weakness,
as Broch et al. [5] found in their simulations of 50-node networks. Furthermore, whenever the topology
changes, DSDV is unstable until update packets propagate throughout the network. Broch found DSDV
to have the most trouble (of four protocols analyzed) in dealing with high rates of node mobility.
3. Temporally-Ordered Routing Algorithm

Temporally-Ordered Routing Algorithm (TORA) [15] is a distributed routing protocol based on a "link
reversal" algorithm. It is designed to discover routes on demand, provide multiple routes to a destination,
establish routes quickly, and minimize communication overhead by localizing the reaction to topological
changes when possible. Route optimality (shortest-path routing) is considered of secondary importance,
and longer routes are often used to avoid the overhead of discovering newer routes. It is also not necessary
(nor desirable) to maintain routes between every source/destination pair at all times.
The actions taken by TORA can be described in terms of water flowing downhill towards a destination node
through a network of tubes that model the routing state of the network. The tubes represent links between nodes
in the network, the junctions of the tubes represent the nodes, and the water in the tubes represents the packets
flowing towards the destination. Each node has a height with respect to the destination that is computed by the
routing protocol. If a tube between two nodes becomes blocked such that water can no longer flow through it,
the height of the nodes are set to a height greater than that of any neighboring nodes, such that water will now
flow back out of the blocked tube and find an alternate path to the destination.
At each node in the network, a logically separate copy of TORA is run for each destination. When a
node needs a route to a particular destination, it broadcasts a route query packet containing the address
of the destination. This packet propagates through the network until it reaches either the destination, or
an intermediate node having a route to the destination. The recipient of the query packet then broadcasts
an update packet listing its height with respect to the destination (if the recipient is the destination, this
height is 0). As this packet propagates back through the network, each node that receives the update sets
its height to a value greater than the height of the neighbor from which the update was received. This has
the effect of creating a series of directed links from the original sender of the query to the node that
initially generated the update. An example of this process is illustrated in Figure 3.1.
www.jntuworld.com
Figure 3.1: Generation of an ordered graph in TORA.
When a node discovers that a route to a destination is no longer valid, it adjusts its height so that it is a local
maximum with respect to its neighbors and transmits an update packet. This process is illustrated in Figure 3.2.
When a node detects a network partition, where a part of the network is physically separated from the
destination, the node generates a clear packet that resets the routing state and removes invalid routes
from the network.
www.jntuworld.com
Figure 3.2: TORA protocol reaction to node mobility.
TORA sits as a routing layer above another, network level protocol called the Internet MANET
Encapsulation Protocol (IMEP) [6]. IMEP is designed to support the operation of many routing algorithms,
network control protocols or other upper layer protocols intended for use in mobile ad hoc networks. The
protocol incorporates mechanisms for supporting link status and neighbor connectivity sensing, control
packet aggregation and encapsulation, one-hop neighbor broadcast reliability, multipoint relaying, network-
layer address resolution, and provides hooks for interrouter authentication procedures.
TORA is one of the largest and most complicated protocols presented in this paper. In terms of
memory requirements, each node must maintain a structure describing the node’s height as well as the
status of all connected links per connection supported by the network [15]. In terms of CPU and
bandwidth requirements, each node must be in constant coordination with neighboring nodes in order
to detect topology changes and converge. As was found with DSDV, routing loops can occur while the
network is reacting to a change in topology [5] [15].
TORA is designed to carry IP traffic over wireless links in an ad hoc network. Based on simulation results [5]
www.jntuworld.com
[14], it is best suited to large, densely packed arrays of nodes with very low node mobility (although
Broch [5] calls into question the validity of Park and Corson’s simulations in [14] supporting this
claim). Of the two papers reporting simulation results, only the one by Broch et al. [5] actually simulates
node mobility. Broch found TORA to be encumbered by its layering on top of IMEP, and found IMEP
caused considerable congestion when TORA was trying to converge in response to node mobility. This
resulted in TORA requiring between one to two orders of magnitude more routing overhead than other
ad hoc routing protocols investigated by Broch in [5].
4. Dynamic Source Routing

Dynamic Source Routing (DSR) [12] [2] is designed to allow nodes to dynamically discover a source
route across multiple network hops to any destination in the ad hoc network. When using source routing,
each packet to be routed carries in its header the complete, ordered list of nodes through which the
packet must pass. A key advantage of source routing is that intermediate hops do not need to maintain
routing information in order to route the packets they receive, since the packets themselves already
contain all necessary routing information. An example of a packet moving through an ad hoc network
with source routing is illustrated in Figure 4.1.
Figure 4.1: A packet being source routed from node 9 to node 5.
Unlike every other protocol presented in this paper, DSR does not require the periodic transmission of
router advertisements or link status packets, reducing the overhead of DSR. In addition, DSR has been
designed to compute correct routes in the presence of unidirectional links.
Source routing is a routing technique in which the sender of a packet determines the complete
sequence of nodes through which to forward the packet. The sender explicitly lists this path in the
packet’s header, identifying each forwarding hop by the address of the next node to which to transmit
the packet on its way to the destination host.
DSR is broken down into three functional components: routing, route discovery and route maintenance.
Routing has already been described and is relatively trivial. Route discovery is the mechanism by which
a node wishing to send a packet to a destination obtains a path to the destination. Route maintenance is
the mechanism by which a node detects a break in its source route and obtains a corrected route.
www.jntuworld.com
4.2 Route Discovery
To perform route discovery, the source node broadcasts a route request packet with a recorded source
route listing only itself. Each node that hears the route request forwards the request (if appropriate),
adding its own address to the recorded source route in the packet. The route request packet propagates
hop-by-hop outward from the source node until either the destination node is found or until another node
is found that can supply a route to the target.
Nodes forward route requests if they are not the destination node and they are not already listed as a hop
in the route. In addition, each node maintains a cache of recently received route requests and does not
propagate any copies of a route request packet after the first.
All source routes learned by a node are kept (memory permitting) in a route cache, which is used to
further reduce the cost of route discovery. A node may learn of routes from virtually any packet the
node forwards or overhears. When a node wishes to send a packet, it examines its own route cache and
performs route discovery only if no suitable source route is found.
Further, when a node receives a route request for which it has a route in its cache, it does not propagate
the route request, but instead returns a route reply to the source node. The route reply contains the full
concatenation of the recorded route from the source, and the cached route leading to the destination.
Naturally, if a route request packet reaches the destination node, the destination node returns a route
reply packet to the source node with the full source to destination path listed.
4.3 Route Maintenance
Conventional routing protocols integrate route discovery with route maintenance by continuously
sending periodic routing updates. If the status of a link or node changes, the periodic updates will
eventually reflect the change to all other nodes, presumably resulting in the computation of new routes.
However, using route discovery, there are no periodic messages of any kind from any of the mobile
nodes. Instead, while a route is in use, the route maintenance procedure monitors the operation of the
route and informs the sender of any routing errors.
If a node along the path of a packet detects an error, the node returns a route error packet to the sender.
The route error packet contains the addresses of the nodes at both ends of the hop in error. When a route
error packet is received or overheard, the hop in error is removed from any route caches and all routes
which contain this hop must be truncated at that point.
There are many methods of returning a route error packet to the sender. The easiest of these, which is
only applicable in networks which only use bidirectional links, is to simply reverse the route contained
in the packet from the original host. If unidirectional links are used in the network, the DSR protocol
presents several alternative methods of returning route error packets to the sender.
Route maintenance can also be performed using end-to-end acknowledgments rather than the hop-by-
hop acknowledgments described above. As long as some route exists by which the two end hosts can
communicate, route maintenance is possible. In this case, existing transport or application level replies or
acknowledgments from the original destination, or explicitly requested network level acknowledgments,
may be used to indicate the status of the node’s route to the other node.
www.jntuworld.com
Two sources of bandwidth overhead in DSR are route discovery and route maintenance. These occur when
new routes need to be discovered or when the network topology changes [2] [12]. However, this overhead
can be reduced by employing intelligent caching techniques in each node, at the expense of memory and
CPU resources. The remaining source of bandwidth overhead is the required source route header included
in every packet. This overhead cannot be reduced by techniques outlined in the DSR literature.
DSR simulation results have been reported in numerous papers, [5], [12], and [4] to name a few. In [5],
Broch et al. found DSR to perform the best of four protocols simulated in their scenarios. Unfortunately,
Broch only simulated networks of 50 nodes; as node count increases, the detrimental effects of route
discovery and maintenance can be expected to grow.
5. Virtual Subnets
The virtual subnet protocol (VS) [18] [19] breaks up a large body of nodes into smaller logical groups
called subnets. It then applies a hierarchical addressing scheme to these subnets. A novel routing
scheme is then employed to enable broadcasting within subnets and limited broadcasting between
subnets. The virtual subnet addressing scheme is somewhat reminiscent of that used in ATM [8].
In this method, network nodes are assigned addresses depending on their current physical connectivity. Assume
the network is segmented into physical subnets (the distinction between physical and virtual subnets will be
clarified shortly; for the moment assume that physical subnets cover a local area) each containing mobile nodes.
Each node in the network is assigned a unique address constructed of two parts: one part is a subnet address
allocated to the entire subnet (subnet_id), and the other part is an address which is unique within the node’s
subnet (node_id). In this paper, this address is written as subnet_id.node_id (e.g.: 12.2, 5.3).
Each node in this topology is affiliated with nodes whose address differs only in one digit; that is, node x1.x0 is
affiliated with nodes x1.x0’ and x1’.x0 Thus, every node is affiliated with every node within its subnet, as well
as one node in every other subnet. These cross-linked affiliations are the building blocks of the
ad hoc network. Figure 5.1 illustrates a network arranged in this fashion.
Figure 5.1: Physical and virtual subnets in an ad hoc network.
www.jntuworld.com
5.2 Logical Topology
Each node in the network is affiliated with a physical subnet (the local nodes all sharing the same subnet_id)
and a virtual subnet (the nodes all sharing the same node_id). Nodes which are members of a physical subnet
(subnet_id) are within close proximity in a local geographic area. Nodes which are members of a virtual
subnet (node_id) form a regional network (i.e., beyond a local area). Figure 5.1 illustrates an example of an
ad hoc network with physical subnets (in shaded areas) and virtual subnets. Note all nodes within a physical
subnet have the same subnet_id, while all nodes within a virtual subnet have the same node_id.
A node becomes a member of a physical subnet by acquiring the first available address (with the lowest node_id)
in that subnet. Once a node becomes affiliated with a specific physical subnet, it automatically becomes a
member of a virtual subnet defined by the node_ID in its address. As long as a node remains within "hearing"
distance of its subnet neighbors, it will keep its current physical subnet affiliation and its address.
When a node moves to a new location where it cannot establish a connection with its previous
physical subnet’s members, it will drop its previous address and join a new physical subnet.
5.3 Routing
In the simple case where the destination node is within two hops of the source node, packets traverse
one network address digit at a time in fixed order. For example, when the source node address is
12.15 and the destination node address is 9.17, the packet would follow the route: 12.15 to 12.17 to
9.17. In this case, routing requires at most two hops.
In general, the network will be arranged such that more than two hops are necessary from source to
destination. In this case the routing is performed in two phases. In the first phase, routing is performed only
in the physical subnet. Packets are routed to the node belonging to the same virtual subnet as the
destination. Using the same example as above, phase one consists of routing packets from 12.15 to 12.17.
In phase two, packets are routed between virtual subnets. The papers describing virtual subnets by
Sharony [18] [19] become especially sketchy at this stage of the protocol. The papers call for
adjustments of transmission frequencies, transmission power, and/or directional antennae to facilitate
logical network connections. It must be assumed that all nodes are capable of reaching neighboring
physical subnets when required to do so. However, the papers do not describe how subnets become
aware of, and plot routes through, neighboring subnets to facilitate multi-hop routing.
The VS protocol, as currently specified, can best be described as a method to optimize throughput when
multiple frequencies and/or spatial reuse is possible, on the condition that nodes are close together
relative to their transmitter range. Virtual subnets have been analyzed using queueing theory, but no
actual simulations or implementations have been studied. Furthermore, there are apparent holes in the
proposed routing mechanism regarding forwarding of packets between subnets.
6. Other Routing Protocols
Various routing protocols exist other than those presented in previous sections. For the most part, these routing
protocols offer improvements to the protocols already discussed. This sections highlights the improvements or
www.jntuworld.com
novel applications these protocols offer without repeating concepts presented in previous sections.
6.1 Ad Hoc On-Demand Distance Vector Routing
Ad Hoc On-Demand Distance Vector (AODV) [17] routing is essentially a combination of both DSR
and DSDV. It borrows the basic on-demand mechanism of route discovery and route maintenance from
DSR, plus the use of hop-by-hop routing, sequence numbers, and periodic update packets from DSDV.
The main benefit of AODV over DSR is the source route does not need to be included with each packet.
This results in a reduction of routing protocol overhead. Unfortunately, AODV requires periodic
updates which, based on simulations by Broch [5], consume more bandwidth than is saved from not
including source route information in the packets.
6.2 Signal Stability based Adaptive Routing
Signal stability based adaptive routing (SSA) [3] is a variant of the AODV protocol to take advantage
of information available at the link level. Both the signal quality of links and link congestion are taken
into consideration when finding routes. It is assumed links with strong signals will change state less
frequently. By favoring these strong signal links in route discovery, it is hoped routes will survive
longer and the number of route discovery operations will be reduced. Link signal strength is measured
when the nodes transmit periodic hello packets.
One important difference of SSA from AODV or DSR is that paths with strong signal links are favored
over optimal paths. While this may make routes longer, it is hoped discovered routes will survive longer.
6.3 Cluster Based Routing Protocol
The cluster based routing protocol (CBRP) [11] is a variation of the DSR protocol. CBRP groups nodes
located physically close together into clusters. Each cluster elects a cluster head. The cluster head
maintains complete knowledge of cluster membership and inter-cluster members (called gateways)
which have access to neighboring clusters.
The main difference between DSR and CBRP is during the route discovery operation. DSR floods route
query packets throughout the entire network. CBRP takes advantage of its cluster structure to limit the
scope of route query flooding. In CBRP, only the cluster heads (and corresponding gateways) are
flooded with query packets, reducing the bandwidth required by the route discovery mechanism.
Unfortunately, CBRP depends on nodes transmitting periodic hello packets; a large part of the gains
made by DSR are because DSR does not require periodic packets of any kind.
6.4 Optimized Link State Routing
Optimized Link State Routing (OLSR) [10] is a link state routing protocol. OLSR is an
adaption of conventional routing protocols to work in an ad hoc network on top of IMEP [6].
The novel attribute of OLSR is its ability to track and use multi-point relays. The idea of multi-point relays is to
minimize the flooding of broadcast messages in the network by reducing/optimizing duplicate re-transmissions in
the same region. Each node in the network selects a set of nodes in its neighborhood who will re-transmit its
broadcast packets. This set of selected neighbor nodes is called the multi-point relays of that node. Each node
selects its multi-point relay set in a manner to cover all the nodes that are two hops away from it. The neighbors
www.jntuworld.com
www.jntuworld.com
which are not in the multi-point relay set still receive and process broadcast packets but
do not re-transmit them. Figure 6.1 illustrates an example of multi-point relay versus
regular broadcasting in a network of 10 nodes.
Figure 6.1: Multi-point relay versus conventional broadcasting. In this example,

conventional broadcasting (a) requires 10 transmissions of the packet; multi-point
relay broadcasting (b) only requires 3 (the routes taken by broadcast packets are
shown by darker lines).
6.5 Zone Routing Protocol
The Zone Routing Protocol (ZRP) [7] is a hybrid of DSR, DSDV, and OLSR. In ZRP, each node
proactively maintains a zone around itself using a protocol such as DSDV. The zone consists of all
nodes within a certain number of hops, called the zone radius, away from the node. Each node
knows the best way to reach each other node within its zone. The nodes which are on the edges of
the zone (i.e.: are exactly zone_radius hops from the node) are called border nodes, and are
employed in a similar fashion to multi-point relays in OLSR.
When a node needs to route a packet, it first checks to see if the destination node is within its
zone. If it is, the node knows exactly how to route to the destination. Otherwise, a route
search similar to DSR is employed. However, to reduce redundant route search broadcasts,
nodes only transmit route query packets to the border nodes (called bordercasting). When the
border nodes receive the search query packet, they repeat the process for their own zones.
Because ZRP only employs proactive network management in a local zone, overhead is
reduced over protocols like DSDV. When route discovery procedures are employed as in
DSR, overhead is reduced by limiting the query packet broadcasts to border nodes.
1. Introduction
Ad-hoc networks are a new paradigm of wireless communication for mobile hosts. No fixed
infrastructure such as base stations as mobile switching .Nodes within each other radio range
communicate directly via wireless links while these which are far apart rely on other nodes to
relay messages. Node mobility causes frequent changes in topology.
1.1 Security Goals

1) Availability: Ensures survivability despite Denial Of Service ( DOS ) attacks. On physical
and media access control layer attacker can use jamming techniques to interfere with
communication on physical channel. On network layer the attacker can disrupt the routing
protocol. On higher layers, the attacker could bring down high level services e.g.: key
management service.
2) Confidentiality: Ensures certain information is never disclosed to unauthorized entities.
3) Integrity: Message being transmitted is never corrupted.
4) Authentication: Enables a node to ensure the identity of the peer node it is communicating
with. Without which an attacker would impersonate a node, thus gaining unauthorized access to
resource and sensitive information and interfering with operation of other nodes.
5) Non-repudiation Ensures that the origin of a message cannot deny having sent the message.
1.2 Challenges
Use of wireless links renders an Adhoc network susceptible to link attacks ranging from
passive eavesdropping to active impersonation, message replay and message distortion.
Eavesdropping might give an attacker access to secret information thus violating confidentiality.
Active attacks could range from deleting messages, injecting erroneous messages, impersonate a
node etc thus violating availability, integrity, authentication and non-repudiation. Nodes roaming
freely in a hostile environment with relatively poor physical protection have non-negligible
probability of being compromised. Hence, we need to consider malicious attacks not only from
outside but also from within the network from compromised nodes. For high survivability Adhoc
networks should have a distributed architecture with no central entities, centrality increases
vulnerability. Ad-hoc network is dynamic due to frequent changes in topology. Even the trust
relationships among individual nodes also changes, especially when some nodes are found to be
compromised. Security mechanism need to be on the fly(dynamic) and not static and should be
scalable. Hundreds of thousand of nodes.
1.3 Key Management

Cryptographic schemes such as digital signatures are often employed to protect both routing
info as well as data. Public key systems are generally espoused because of its upper hand in key
distribution. In public key infrastructure each node has a public/private key pair. Public keys
distributed to other nodes, while private keys are kept to nodes themselves and that too
confidentially. Third party (trusted) called Certification Authority (CA) is used for key
management.CA has a public/private key pair, with its public key known to every node and signs
certificates binding public keys to nodes. The trusted CA has to stay online to reflect the current
bindings, since the bindings could change overtime. Public key should be revoked if the owner
node is no longer trusted or is out of network. A single key management service for an Ad-hoc
network is probably not a good idea, since it's likely to become Achilles’ heel of the network. If
CA is down/unavailable nodes cannot get the current public keys of other nodes to establish
secure connection. Also if a CA is compromised, the attacker can sign any erroneous certificates
with the private key. Naive replication of CA can make the network more vulnerable, since
compromising of a single replica can cause the system to fail. Hence it's more prudent to
distribute the trust to a set of nodes by letting these nodes share the key management
responsibility.
1.3 Secure Routing

The contemporary routing protocols for Adhoc networks cope well with dynamically
changing topology but are not designed to accommodate defense against malicious attackers. No
single standard protocol. Capture common security threats and provide guidelines to secure
routing protocol. Routers exchange network topology informally in order to establish routes
between nodes - another potential target for malicious attackers who intend to bring down the
network. External attackers - injecting erroneous routing info, replaying old routing info or
distorting routing info in order to partition a network or overloading a network with
retransmissions and inefficient routing. Internal compromised nodes - more severe detection and
correction more difficult Routing info signed by each node won't work since compromised nodes
can generate valid signatures using their private keys. Detection of compromised nodes through
routing information is also difficult due to dynamic topology of Adhoc networks. Can make use
of some properties of adhoc networks to facilitate secure routing. Routing protocols for Adhoc
networks must handle outdated routing information to accommodate dynamic changing
topology. False routing information generated by compromised nodes can also be regarded as
outdated routing information. As long as there are sufficient no. of valid nodes, the routing
protocol should be able to bypass the compromised nodes, this however needs the existence of
multiple, possibly disjoint routes between nodes. Routing protocol should be able to make use of
an alternate route if the existing one appears to have faulted.
2. Key Agreement in Wireless Ad-hoc Networks
2.1 New key agreement scenario

Consider a group of people getting together for an Adhoc meeting in a room and trying to
establish a wireless network through their laptops. They trust one another personally, however
don't have any a priori shared secret (password) to authenticate one another. They don't want
anybody outside the room to get a wind of their conversation indoors. This particular scenario is
vulnerable to any attacker who not only can monitor the communication but can also modify the
messages and can also insert messages and make them appear to have come from somebody
inside the room. This is a classic example of Adhoc network and the most simple way to tackle
this example would be through location based key agreement - to map locations to name ladles
and then use identity based mechanisms for key agreement. e.g.: participants writing the IP
addresses on a piece of paper and passing it around. Then a certificate based key agreement
mechanism can be used. These public key certificates can allow participants to verify the binding
between the IP address and keys of other participants.
Two obvious problems
a) Difficult to determine if the certificate presented by the participant has been revoked.
b) Participants may be divided into 2 or more certification hierarchies and that they don't have
cross certification hierarchies.
One obvious solution

A trusted third party capable of locating players, however not always feasible due to non-
infrastructure nature of Adhoc networks.
Physically secure channel limited to those present in the room to negotiate the session key
before switching to the insecure wireless channel.
2.2 Password based Authenticated Key Exchange

A fresh password is chosen and shared among those present in the room in order to capture
the existing shared context. If this password is a long random string, can be used to setup
security association, but less user friendly. Natural language phrases, more user friendly,
however vulnerable to dictionary attacks. Need to derive a strong session key from a weak
shared password.
2.2.1 Desirable properties for such a protocol
Secrecy
Only those players that know the initial shared weak secret password should learn the session
key and nobody else should.
Perfect Forward Secrecy

Warrants that if an attacker who succeeds in compromising one of the participants at a later
time would be unable to figure out the session key resulting from previous runs of protocol.
Contributory key agreement
If each and every player participates in the creation of the final session key, by making a
contribution, then it is called contributory key agreement.
Tolerance to disruption attempts

Not only strong attackers who can disrupt communication by jamming radio channels etc but
even the weaker attackers who can insert but cannot modify or delete messages sent by players
are also provided for.
2.2.2 Generic Protocol
A and B are two communicating parties with a shared secret (password) p. (EA, DA) are the keys
of A.
(1) A --> B : A, P(EA).
A encrypts EA with the password and sends it to B. It also sends a label 'A' to identify itself.
(2) B knows 'P' so decrypts p(EA) extracts EA. B generates 'R' randomly, encrypts it using EA and
the whole thing is encrypted with P and sent to A.
B --> A : P(EA (R)).
This message authenticates B to A, since B could extract EA from the message sent by A to B
only if B knew password 'P'.
(3) A decrypts this message, extracts R, generates (challenge)A and SA , encrypts it using R and
sends it to B.
A --> B : R((challenge)A, SA).
This message authenticates A to B, since A could extract R only if it knew password P.
(4) B decrypts this message, extracts (challenge)A and SA. It then computes h( ((challenge)A)
where h() is a hash function. B then generates (challenge)B and SB and then sends
h((challenge)A), ((challenge)B and SB to A, encrypted by R.
B --> A : R(h((challenge)A), (challenge)B, SB).
This message serves as an acknowledgement to A's previous message from step:3 and also
notify A that SA has been successfully noted.(5) A decrypts this message, extracts (challenge)B
and SB. A computes h((challenge)B), encrypts it using R and sends it to B.
A --> B : R((challenge)B).
This message serves as an acknowledgement to B saying that SB has been noted.

Now both parties A and B know both SA and SB, so both can compute the session key
K = f(SA, SB) and start communicating.
This protocol can be easily extended to multi-party case by electing a leader. The leader will
broadcast the message in step1, the rest of the messages will be point to point with A acting as
the leader.
At the end of each protocol run, each player shares a key with the leader. An additional round
will be needed for the leader to pick a common session key and to distribute it among other
players using the pair wise key the user shares with the participants. The main drawback is that
this protocol is non-contributory since the key is chosen only by the leader.
However, we can slightly modify the protocol for it to act as a contributory multi-party
protocol. The challenges (challenge)A and (challenge)B are used by A and B to confirm that the
other knows the password P. The random quantities SA and SB which already have been
generated could be used for the purpose of confirmation instead of the challenges. These
quantities are used to generate the final session key K = f(SA, SB), these SA and SB could be
easily used to confirm each other's knowledge of K.
Thus the modified protocol follows.
(1) A --> B : A, P(EA).
(2) B --> A : P(EA (R, SB)).
Note: (challenge)B replaced by SB.
(3) A --> B : R(SA). SA used instead of (challenge)A.
(4) A --> B : K(SA, h(SA, SB)).
(5) B --> A : K(SB, h(SA, SB)).
The last two steps 4 and 5 are used by the receiving party (B and A respectively) that the
sending party (A and B respectively) knows K (and hence P). The h(., .) is a public hash
function.
This protocol can be easily extended to multiple parties.
Let Mi i = 1 to n be the set of n players with Mn as the leader, Si being the random share
contributed by Mi towards the generation of the final session key K.
(1) Mn --> ALL : Mn, P(E).

(2) Mi --> Mn : Mi, P(E(Ri, Si)), i = 1 to n-1.
(3) Mn --> Mi : Ri({Sj, j = 1 to n}), i = 1 to n-1.
(4) Mi --> Mn : Mi.
The last step confirms to each player that one other player knows the same key K. The multiparty
protocol is contributory as every player makes its contribution towards generating the final
session key. Mn takes contributions from every player and combines each one of them to
generate the session key 'K'.
The protocol also provides perfect forward secrecy for all parties except for the one who knows
the decryption key D, unless the decryption key is also destroyed at the end of the protocol run.
The attacker who succeeds in compromising the leader Mn will be able to decipher a copy of the
past session.
The protocol is also tolerant of disruption attempts by anyone except Mn. If the attacker doesn't
know garbage it would send garbage message. Thus the true players agree on a key which has a
contribution from the attacker, however the attacker cannot determine the session key as it does
not have the knowledge of the initial shared secret (password) P.
Since the protocol is contributory, a certain amount of delay is introduced with it, since the
leader has to wait for contributions from each player before it can start sending out messages.
Drawbacks
1) Any quantity encrypted using the weak secret (password) P should be random. Thus E cannot
be well known long term encryption key, hence it is important to use a fresh key pair for every
run of the protocol and this is computationally expensive.
2) The parts of encryption key E may have special properties which might help the attacker
attempting a dictionary attack on P(E), thus care must be taken only to encrypt the unpredictable
parts of E, thus increasing the computational cost of the protocol.
2.3 Password authenticated Diffie - Hellman key exchange

2.3.1 Two party version
In the elementary DH protocol, two parties A and B agree on a prime p and a generator g of the
multiplicative group Zp* (i.e. the set {1, 2, …, p-1}). A and B choose random secrets SA and SB
such that 1 <= SA, SB <= p-1.
(1) A computes gSA, encrypts it with the shared secret password P and sends it to B.
A --> B : A, P(gSA).
(2) B extracts gSA from the message computes gSB and also computes the session key K =
(gSA)SB. B then chooses a random challenge CB and encrypts it using the key K. B encrypts SB
using P. It then sends the two quantities to A.
B --> A : P(SB), K(CB).

(3) A extracts SB from P(SB) and computes the key K = (gSA)SB. It then extracts CB by decrypting
K(CB). A then generates challenge (random) CA, encrypts both CA and CB with K and sends it to
B.
A --> B : K(CA, CB).
(4) This message(3) convinces B that A was able to decrypt the message in (2) correctly. B then
encrypts CA using K and sends it to A.
B --> A : K(CA).
A decrypts the message to see if the plaintext is indeed C A. This would convince A that B knew
K. This would in turn convince A that B knew P.
2.3.2 Multi-party version
There are let's just say n players M1, M2, …, Mn who all share a password P, each generating a
random quantity Si which is its contribution to the eventual session key K = g S1S2_ _ _Sn-1Sn.
The protocol is divided into 3 parts. In the first part (steps 1 and 2) players Mi to Mn-1 generate an
intermediate key
PI = g S1S2_ _ _Sn-1 in n-1 steps.
In the second part (steps 3 and 4) each Mi (i = 1 to n-1) has a separate with Mn, at the end of
which all the players are in a position to compute K.
The third part (step 5) being the key confirmation.
(1) Mi --> Mi+1 : g S1S2_ _ _Si, i = 1 to n-2 in sequence.
(2) Mn-1 --> ALL : PI = g S1S2_ _ _Sn-1, broadcast.
(3) Mi --> Mn : P(Ci), i = 1 to n-1, in parallel, where Ci = PI Si’/Si and Si ‘ is the blinding factor
that is randomly choosen by Mi.
(4) Mn --> Mi : (Ci) Sn, i = 1 to n-1, in parallel.
(5) Mi --> ALL : Mi, K(Mi, h(M1, M2,…, Mn) broadcast.
Step 1 consists of (n-2) sub steps. In the first sub step player M1 computes gS1 and sends it to M2
etc. At the end of the (n-2)th sub step, Mn-1 receives g S1S2_ _ _Sn-2, which it then raises by (S n-1) to
get the intermediate key PI = g S1S2_ _ _Sn-1.
In step 2, Mn-1 broadcast this PI to everyone. Now every Mi (i = 1 to n-1) removes its
contribution i.e, Si (i = 1 to n-1) from the PI respectively but also inserts a randomly chosen
blinding factor Si, encrypts the whole thing with the shared password P.
In step 3,each Mi will in parallel send the encryption to Mn. Mn decrypts the received message to
extract Ci. It then raises each Ci by Sn and returns the result in parallel to each Mi. At this point
each player can compute the session key as follows K = g S1S2_ _ _Sn-1Sn. Mn raises PI by Sn : K =
(PI)Sn. Each Mi unblinds the quantity it receives from Mn and re inserts its original contribution
Si to construct the session key K = g S1S2_ _ _Sn-1Sn = (PI)Sn.
Finally, some player broadcasts a key confirmation message that allows each player to verify that
at least one another player has decided on the same key K.
The blinding factor Si is needed for the following reasons.
(a) Without the blinding, the quantity encrypted with P by Mn-1 from step 3 is the same as what it
receives in step 1.
(b) An attacker could send g S1S2_ _ _Si to Mi in step 2 instead of the broadcast message
(intermediate key) PI. If Mi uses this quantity to generate its message in step 3, the resulting
message is same as the message received by Mi in step 1. To thwart dictionary attacks, blinding
is necessary.
This protocol does provide perfect forward secrecy. It is also quasi-resilient to disruption except
when Mn is compromised/disrupted.
3. Secure routing in Ad-hoc networks
3.1 Problems associated with Ad-hoc routing
3.1.1 Infrastructure
An Ad-hoc network is an infrastructure less network. Unlike traditional networks there is

no pre-deployed infrastructure such as centrally administered routers or strict policy for
supporting end-to-end routing. The nodes themselves are responsible for routing packets.
Each node relies on the other nodes to route packets for them. Mobile nodes in direct radio
range of one another can communicate directly, but nodes that are too far apart to
communicate directly must depend on the intermediate nodes to route messages for them.
Direct Radio Reach
Trusted
Router
Fig 3.1 Routing in Ad-hoc Fig 3.2 Routing in traditional
networks networks using router.
3.1.2 Frequent changes in network topology
Ad-hoc networks contain nodes that may frequently change their locations. Hence the
topology in these networks is highly dynamic. This results in frequently changing neighbors
on whom a node relies for routing. As a result traditional routing protocols can no longer be
used in such an environment. This mandates new routing protocols that can handle the
dynamic topology by facilitating fresh route discoveries.
3.1.3 Problems associated with wireless communication
As the communication is through wireless medium, it is possible for any intruder to tap
the communication easily. Wireless channels offer poor protection and routing related
control messages can be tampered. The wireless medium is susceptible to signal
interference, jamming, eavesdropping and distortion. An intruder can easily eavesdrop to
know sensitive routing information or jam the signals to prevent propagation of routing
information or worse interrupt messages and distort them to manipulate routes. Routing
protocols should be well adopted to handle such problems.
3.1.4 Problems with existing Ad-hoc routing protocols
3.1.4.1 Implicit trust relationship between neighbors
Current Ad-hoc routing protocols inherently trust all participants. Most Ad-hoc routing
protocols are cooperative by nature and depend on neighboring nodes to route packets. This
naive trust model allows malicious nodes to paralyze an Ad-hoc network by inserting
erroneous routing updates, replaying old messages, changing routing updates or advertising
incorrect routing information. While these attacks are possible in fixed network as well, the
Ad-hoc environment magnifies this makes detection difficult.
3.1.4.2 Throughput
Ad-hoc networks maximize total network throughput by using all available nodes for
routing and forwarding. However a node may misbehave by agreeing to forward packets
and then failing to do so, because it is overloaded, selfish, malicious or broken. Misbehaving
nodes can be a significant problem. Although the average loss in throughput due to
misbehaving nodes is not too high, in the worst case it is very high.
S A B C D X S A B M C D X
Fig. 3.3 a Fig 3.4 b
3.1.4.3 Attacks using modification of protocol fields of messages
Current routing protocols assume that nodes do not alter the protocol fields of messages
passed among nodes. Routing protocol packets carry important control information that
governs the behavior of data transmission in Ad-hoc networks. Since the level of trust in a
traditional Ad-hoc network cannot be measured or enforced, enemy nodes or compromised
nodes may participate directly in the route discovery and may intercept and filter routing
protocol packets to disrupt communication. Malicious nodes can easily cause redirection of
network traffic and DOS attacks by simply altering these fields.
For example, in the network illustrated in Figure3.3, a malicious node M could keep
traffic from reaching X by consistently advertising to B a shorter route to X than the route to
X, which C is advertising.
The attacks can be classified as remote redirection attacks and denial of service attacks.
Let us look at them now.
(a) Remote redirection with modified route sequence number (AODV)
Remote redirection attacks are also called black hole attacks. In the attacks, a malicious
node uses routing protocol to advertise itself as the shortest path to nodes whose packets it
wants to intercept. Protocols such as AODV instantiate and maintain routes by assigning
monotonically increasing sequence numbers to routes towards a specific destination. In
AODV, any node may divert traffic through itself by advertising a route to a node with a
destination sequence number greater than the authentic value.
Figure 3.3 illustrates an example ad hoc network. Suppose a malicious node, M, receives
the RREQ that originated from S for destination X after it is re-broadcast by B during route
discovery. M redirects traffic towards itself by unicasting to B a RREP containing a
significantly higher destination sequence num for X than the authentic value last advertised
by X.
(b) Redirection with modified hop count (AODV)
A redirection attack is also possible in certain protocols, such as AODV, by modification

of the hop count field in route discovery messages. When routing decisions cannot be made
by other metrics, AODV uses the hop count field to determine a shortest path. In AODV,
malicious nodes can attract route towards themselves by resetting the hop count field of the
RREP to zero. Similarly, by setting the hop count field of the RREP to infinity, routes will
tend to be created that do not include the malicious node.
Once the malicious node has been able to insert itself between two communicating nodes
it is able to do anything with the packets passing between them. It can choose to drop
packets to perform a denial of service attack, or alternatively use its place on the route as a
first step in man-in-the-middle attack.
(c) Denial of service with modified source routes
DSR is a routing protocol, which explicitly states routes in data packets. These routes
lack any integrity checks and a simple denial-of-service attack can be launched in DSR by
altering the source routes in packet headers.
Modification to source routes in DSR may also include the introduction of loops in the
specified path. Although DSR prevents looping during the route discovery process, there are
insufficient safeguards to prevent the insertion of loops into a source route after a route has
been salvaged.
3.1.5 Attacks using impersonation
Current Ad-hoc routing protocols do not authenticate source IP address. A malicious

node can launch many attacks by altering its MAC or IP address. Both AODV and DSR are
susceptible to this attack.
3.1.6 Attacks using fabrication
Generation of false routing messages is termed as fabrication messages. Such attacks are
difficult to detect.
3.1.6.1. Falsifying route error messages in AODV or DSR
AODV and DSR implement path maintenance measures to recover broken paths when
nodes move. If the destination node or an intermediate node along an active path moves, the
node upstream of the link break broadcasts a route error message to all active upstream
neighbors. The node also invalidates the route for this destination in its routing table.
The vulnerability is that routing attacks can be launched by sending false route error
messages. Suppose node S has a route to node X via nodes A, B, and C, as in Figure3.3. A
malicious node M can launch a denial of service attack against X by continually sending
route error messages to B spoofing node C, indicating a broken link between nodes C and X.
B receives the spoofed route error message thinking that it came from C. B deletes its
routing table entry for X and forwards the route error message on to A, who then also
deletes its routing table entry. If M listens and broadcasts spoofed route error messages
whenever a route is established from S to X, M can successfully prevent communications
between S and X.
3.1.6.2. Route cache poisoning in DSR
This is a passive attack that can occur in DSR due to promiscuous mode of updating
routing table which is employed by DSR. This occurs when information stored in routing
table at routers is deleted, altered or injected with false information.
In addition to learning routes from headers of packets, which a node is processing along a
path, routes in DSR may also be learned from promiscuously received packets. A node
overhearing any packet may add the routing information contained in that packet's header to
its own route cache, even if that node is not on the path from source to destination.
The vulnerability is that an attacker could easily exploit this method of learning routes
and poison route caches. Suppose a malicious node M wanted to poison routes to node X. If
M were to broadcast spoofed packets with source routes to X via itself, neighboring nodes
that overhear the packet transmission may add the route to their route cache.
3.1.6.3. Routing table overflow attack
In routing table overflow attack, the attacker attempts to create route to non-existent
nodes. The goal of the attacker is to create enough routers to prevent new routes from being
created or overwhelm the protocol. Implementation and flush out legitimate routes from
routing tables. Proactive routing algorithms attempt to discover routing information even
before they are needed, while reactive algorithms create only when they are needed. This
makes proactive algorithms more vulnerable to table overflow attacks.
3.1.7 No way to detect and isolate misbehaving nodes
As we observed earlier in section 4.1, misbehaving nodes can affect network throughput
adversely in worst-case scenarios. The existing Ad-hoc routing protocols do not include any
mechanism to identify misbehaving nodes. It is necessary to clearly define misbehaving
nodes in order to prevent false positives. It may be possible that a node appears to be
misbehaving when it is actually encountering temporary problem such as overload or low
battery. A routing protocol should be able to identify misbehaving nodes and isolate them
during route discovery operation.
3.1.8 Easily leak information about network topology

Ad-hoc routing protocols like AODV and DSR carry routes discovery packets in clear
text. These packets contain the routes to be followed by a packet. By analyzing these packets
any intruder can find out the structure of the network. The attack might use information
gained to know which other nodes are adjacent to the target or the physical location of a
particular node. Such an attack can be done passively. It can reveal roles of nodes in the
network and their location. Intruders can use this information to attack command ad control
nodes.
3.1.9 Lack of self-stabilization property
Routing protocols should be able to recover from an attack in finite time. An intruder
should not be able to permanently disable a network by injecting a smaller number of mal-
informed routing packets. E.g. AODV, however is prone to self-stabilization problems as
sequence numbers are used to verify route validity times, and incorrect state may remain
stored in the routing tables for a long time.
3.2 Solutions to problems in Ad-hoc-routing
3.2.1 Using pre-deployed security infrastructure
Here we assume existence of certain amount of security infrastructure. The type of Ad-
hoc environment that we are dealing with here is called managed-open environment.
Assumptions
A managed-open environment assumes that there is opportunity for pre-deployment.

Nodes wishing to communicate can exchange initialization parameters before hand, perhaps
within the security of an infrastructured network where session keys may be exchanged or
through a trusted third party like a certification authority.
ARAN protocol in managed-open environment
ARAN or Authenticated Routing for Ad-hoc Networks detects and protects against
malicious actions by third parties and peers in Ad-hoc environment. ARAN introduces
authentication, message integrity and non-repudiation to an Ad-hoc environment.
ARAN is composed of two distinct stages. The first stage is simple and requires little
extra work from peers beyond traditional ad hoc protocols. Nodes that perform the optional
second stage increase the security of their route, but incur additional cost for their ad hoc
peers who may not comply (e.g., if they are low on battery resources).
ARAN makes use of cryptographic certificates for the purposes of authentication and
non-repudiation.
(1) Stage 1
It contains a preliminary certification stage and a mandatory end-end authentication
stage. It is a lightweight stage and does not demand too many resources.
(a) Preliminary Certification
ARAN requires the use of a trusted certificate server T. Before entering the Ad-hoc
network, each node requests a certificate from T. For a node A,
T -> A: CertA = [IPA, KA+, t, e]KT-
The certificate contains the IP address of A, the public key of A, a timestamp t of when
the certificate was created, and a time e at which the certificate expires. These variables are
concatenated and signed by T. All nodes must maintain fresh certificates with the trusted
server and must know T’s public key.
(b) End-to-End authentication
The goal of stage 1 is for the source to verify that the intended destination was reached.
In this stage, the source trusts the destination to choose the return path.
(i)Source node
A source node, A, begins route instantiation to a destination X by broadcasting to its
neighbors a route discovery packet (RDP):
A -> broadcast: [RDP, IPX, CertA, NA, t]KA-
The RDP includes a packet type identifier (“RDP"), the IP address of the destination
(IPx), A's certificate (CertA), a nonce NA , and the current time t, all signed with A's private
key. Each time A performs route discovery, it monotonically increases the nonce. Nodes
then store the nonce they have last seen with its timestamp.
(ii) Intermediate node for RDP

Each node records the neighbor from which it received the message. It then forwards the
message to each of its neighbors, signing the contents of the message. This signature
prevents spoofing attacks that may alter the route or form loops. Let A's neighbor be B.
B -> broadcast: [[RDP, IPX, CertA, NA, t]KA-]KB-, CertB
Nodes do not forward messages for which they have already seen the (N A ,IPA) tuple.
Upon receiving the broadcast, B's neighbor C validates the signature with the given
certificate. C then rebroadcasts the RDP to its neighbors, first removing B's signature.
C -> broadcast: [[RDP, IPX, CertA, NA, t]KA-]KC-, CertC
(iii) Destination node

Eventually, the message is received by the destination, X, who replies to the first RDP
that it receives for a source and a given nonce. There is no guarantee that the first RDP
received traveled along the shortest path from the source.
The destination unicasts a Reply (REP) packet back along the reverse path to the source.
X -> D: [REP, IPA, CertX, NA, t]KX-
(iv) Intermediate node for REP

Nodes that receive the REP forward the packet back to the predecessor from which they
received the original RDP. All REPs are signed by the sender. Let D's next hop to the source
be node C.
D -> C: [[REP, IPA, CertX, NA, t]KX-]KD-, CertD
C validates D's signature, removes the signature, and then signs the contents of the
message before unicasting the RDP to B.
C -> B: [[REP, IPA, CertX, NA, t]KX-]KC-, CertC
A node checks the signature of the previous hop as the REP is returned to the source.
This avoids attacks where malicious nodes instantiate routes by impersonation and re-play
of X's message.
(v) Source node

When the source receives the REP, it verifies that the correct nonce was returned by the
destination as well as the destination's signature. Only the destination can answer an RDP
packet. Other nodes that already have paths to the destination cannot reply for the
destination. While other protocols allow this networking optimization, we note that
removing it also removes several possible exploits and cuts down on the reply traffic
received by the source. Because only the destination can send REPs, loop freedom is
guaranteed easily.
Disadvantages
ARAN requires that nodes keep one routing table entry per source-destination pair that is
currently active. This is certainly more costly than per-destination entries in non-secure ad
hoc routing protocols.
(2) Stage 2
Stage (2) is done only after Stage (1) is over. This is because the destination certificate is
required in Stage (2). This stage is primarily used for discovery of shortest path in a secure
fashion. Since a path is already discovered in Stage (2), data transfer can be pipelined with
Stage (2)'s shortest path discovery operation.
(i) Source
The source begins by broadcasting a Shortest Path Confirmation (SPC) message to its
neighbors (the same variables are used as in stage 1).
A -> broadcast: SPC, IPX, CertX, [[IPX, CertA, NA, t]KA- ]KX+
The SPC message begins with the SPC packet identifier (“SPC"), X's IP address and
certificate. The source concatenates a signed message containing the IP address of X, its
certificate, a nonce and timestamp. This signed message is encrypted with X's public key so
that other nodes cannot modify the contents.
(ii) Intermediate Node

A neighbor B that receives the message, rebroadcasts the message after including its own
cryptographic credentials. B signs the encrypted portion of the received SPC, includes its
own certificate, and re-encrypts with the public key of X. This public key can be obtained in
the certificate forwarded by A.
B ->broadcast: SPC, IPX, CertX, [[[IPX, CertA, NA, t]KA-]KX+]KB-, CertB]KX+
Nodes that receive the SPC packet create entries in their routing table so as not to
forward duplicate packets. The entry also serves to route the reply packet from the
destination along the reverse path.
(iii) Destination Node

Once the destination X receives the SPC, it checks that all the signatures are valid. X
replies to the first SPC it receives and also any SPC with a shorter recorded path. X sends a
Recorded Shortest Path (RSP) message to the source through its predecessor D.
X -> D: [RSP, IPA, certX, NA, route]KX-
The source eventually receives the packet and verifies that the nonce corresponds to the
SPC is originally generated.
Advantages
The onion-like signing of messages prevents nodes in the middle from changing the path
in several ways. First, to increase the path length of the SPC, malicious nodes require an
additional valid certificate. Second, malicious nodes cannot decrease the recorded path
length or alter it because doing so would break the integrity of the encrypted data.
Route Maintenance
ARAN is an on-demand protocol. Nodes keep track of whether routes are active. When
no traffic has occurred on an existing route for that route's lifetime, the route is simply de-
activated in the route table. Data received on an inactive route causes nodes to generate an
Error (ERR) message that travels the reverse path towards the source. Nodes also use ERR
messages to report links in active routes that are broken due to node movement. All ERR
message must be signed. For a route between source A and destination X, a node B
generates the ERR message for its neighbor C as follows:
B -> C: [ERR, IPA, IPX, CertC, NB, t]KB-
This message is forwarded along the path towards the source without modification. A
nonce and timestamp ensures the ERR message is fresh. Because messages are signed,
malicious nodes cannot generate ERR messages for other nodes. The non-repudiation
provided by the signed ERR message allows a node to be verified as the source of each ERR
message that it sends. A node which transmits a large number of ERR messages, whether the
ERR messages are valid or fabricated, should be avoided.
Key revocation
ARAN attempts a best effort key revocation that is backed up with limited time
certificates. In the event that a certificate needs to be revoked, the trusted certificate server,
T, sends a broadcast message to the ad hoc group that announces the revocation. Calling the
revoked certificate cert r, the transmission appears as:
T -> broadcast: [revoke, CertR]KT-
Any node receiving this message re-broadcasts it to its neighbors. Revocation notices
need to be stored until the revoked certificate would have expired normally. Any neighbor of
the node with the revoked certificate needs to reform routing as necessary to avoid
transmission through the now-untrusted node.
This method is not failsafe. If an untrusted node, whose certificate is being revoked, is
the only link between 2 parts of an Ad-hoc network, it may not propagate the revocation
message to the other part - leading to a partitioned network.
To detect this situation and to hasten the propagation of revocation notices, when a node
meets a new neighbor, it can exchange a summary of its revocation notices with that
neighbor. If these summaries do not match, the actual signed notices can be forwarded and
re-broadcasted to restart propagation of the notice.
3.2.2 Concealing Network topology or structure
1) Using independent Security Agents (SA)

This method is called the Non-disclosure method (NDM). In NDM a number of
independent security agents (SA) are distributed over the network. Each of these agents SAi
owns a pair of asymmetric cryptographic keys KSAi and KSAi-. Sender s wishes to transmit a
message M to receiver R without disclosing his location. S sends the message using a
number of SAs: SA1  SA2  …SAN  R. The message is encapsulated N times using
the public keys KSA1…KSAn as follows.
M’ = KSA1(SA2, (KSA2 (SA3 (…(KSAN(R, M))…))))
To deliver the packet, S sends it to the first security agent SA1 which decrypts the outer
most encapsulation and forwards the packet to the next agent. Each SA knows only the
address of the previous and the next hop. The last agent finally decrypts the message and
forwards it to R. It introduces a large amount of overhead and hence is not preferred for
routing.
2) Zone Routing Protocol (ZRP)

It is a hierarchical protocol where the network is divided in to zones. The zones operate
independently from each other. ZRP involves two separate routing protocols.
Such a hierarchical routing structure is favorable with respect to security since a well
designed algorithm should be able to contain certain problems to small portion of the
hierarchy leaving other portions unaffected.
ZRP has some features that appear to make it somewhat less susceptible to routing
attacks. Its hierarchical organization hides some of the routing information within the zones.
ZRP provides some form of security against disclosing network topology by dividing
routing into zones, which conceal the internal organization.
3.2.3. Installing extra facilities in the network to mitigate routing misbehavior
Misbehaving nodes can reduce network throughput and result in poor robustness. Sergio
Marti Et al propose a technique to identify and isolate such nodes by installing a watchdog
and a pathrater in the Ad-hoc network on each node.
Assumptions
It is assumed that the wireless links are bi-directional. Most MAC layer protocols require
this. It also assumes support for promiscuous mode of operation for the nodes. This helps the
nodes supervise each other operation. The third assumption is that the underlying Ad-hoc
routing protocol is DSR. It is possible to extend the mechanism to other routing protocols as
well.
Mechanism
The watchdog identifies misbehaving nodes, while the pathrater avoids routing packets
through these nodes. When a node forwards a packet, the node’s watchdog verifies that the
next node in the path also forwards the packet. The watchdog does this by listening
promiscuously to the next node’s transmissions. If the next node does not forward the
packet, then it is misbehaving. The pathrater uses this knowledge of misbehaving nodes to
choose the network path that is most likely to deliver packets.
Watchdog
The watchdog method detects misbehaving nodes. Figure3.4 illustrates how the
watchdog works. Node A cannot transmit all the way to node C, but it can listen in on node
B’s traffic. Thus, when A transmits a packet for B to forward to C, A can often tell if B
transmits the
S A B C D
Fig 3.4 Operation of the watchdog.
packet. If encryption is not performed separately for each link, which can be expensive, then
A can also tell if B has tampered with the payload or the header.
We implement the watchdog by maintaining a buffer of recently sent packets and
comparing each overheard packet with the packet in the buffer to see if there is a match. If
so, the packet in the buffer is removed and forgotten by the watchdog, since it has been
forwarded on. If the packet has remained in the buffer for longer than a certain timeout, the
watchdog increments a failure tally for the node responsible for forwarding on the packet. If
the tally exceeds a certain threshold bandwidth, it determines that the node is misbehaving
and sends a message to the source notifying it of the misbehaving node.
Advantages
The watchdog mechanism can detect misbehaving nodes at forwarding level and not just
the link level.
Weakness
It might not detect misbehaving nodes in presence of 1) ambiguous collusions 2) receiver

collusions 3) limited transmission power 4) false misbehavior 5) collision 6) partial
dropping.
Analysis of Watchdog's weaknesses

2 1 1
S A B C D
Fig 3.5 Ambiguous Collision.
1) Ambiguous collision
The ambiguous collision problem prevents A from overhearing transmissions from B. As

figure3.5 illustrates, a packet collision occur at A while it is listening for B to forward on a
packet. A does not know if the collision was caused by forwarding on a packet as it should
or if B never forwarded the packet and the collision was caused by other nodes in A’s
neighborhood. Because of this uncertainty, A should instead continue to watch B over a
period of time.
S A B C D
Fig 3.6 Receiver Collision.
2) Receiver collision
In the receiver collision problem, node A can only tell whether B sends the packet to C,
but it cannot tell if C receives it. If a collision occurs at C when B first forwards the packet,
A only sees B forwarding the packet and assumes that C successfully receives it. Thus, B
could skip retransmitting the packet and evade detection. Figure 3.6
3) False misbehavior
False misbehavior can occur when nodes falsely report other nodes as misbehaving. A
malicious node could attempt to partition the network by claiming that some nodes
following it in the pat h are misbehaving. For instance, node A could report that node B is
not forwarding packets when in fact it is. This will cause S to mark B as misbehaving when
A is the culprit. This behavior, however, will be detected. Since A is passing messages onto
B (as verified by S), then any acknowledgements from D to S will go through A to S, and S
will wonder why it receives replies from D when supposedly B dropped packets in the
forward direction. In addition, if A drops acknowledgements to hide them from S, the node
B will detect this misbehavior and will report it to D.
4) Limited transmission power
Another problem is that a misbehaving node that can control its transmission power can
circumvent the watchdog. A node could limit its transmission power such that the signal is
strong enough to be overheard by the previous node but too weak to be received by the true
recipient.
5) Multiple colluding nodes
Multiple nodes in collusion can mount a more sophisticated attack. For example, B and C
from figure3.4 could collude to cause mischief. In this case, B forwards a packet to C but
does not report to A when C drops the packet. Because of its limitation, it may be necessary
to disallow two consecutive untrusted nodes in a routing path.
6) Partial dropping
A node can circumvent the watchdog by dropping packets at a lower rate than the
watchdog’s configured minimum misbehavior threshold. Although the watchdog will not
detect this node as misbehaving, this node is forced to forward at the threshold bandwidth.
In this way the watchdog serves to enforce this minimum bandwidth. For the watchdog to
work properly it must know where a packet should be in two hops.
Pathrater
Just like the watchdog, the pathrater is run by each node. It combines the knowledge of
misbehaving nodes with link reliability data to pick. The most reliable route. Each node
maintains a rating for every other node it knows about in the network. It calculates a path
metric by averaging the node ratings in the path. We choose this metric because it gives a
comparison of the overall reliability of different paths and allows pathrater to emulate the
shortest length path algorithm when no reliability information ahs been collected, as
explained below. If there are multiple paths to the same destination, we choose the path with
the highest metric. Since the pathrater depends on knowing the exact path a packet has
traversed, it must be implemented on top of a source routing protocol.
The pathrater assigns ratings to nodes according to the following algorithm. When anode
in the network becomes known to the pathrater (through route discovery), the pathrater
assigns it a “neutral” rating of 0.5. A node always rates itself with a 1.0. This ensures that
when calculating path rates, if all other nodes are neutral nodes (rather than suspected
misbehaving nodes); the pathrater picks the shortest length path. The pathrater increments
the ratings of nodes on all actively used paths by 0.01 at periodic intervals of 200 ms. An
actively used path is one on which the node has sent a packet within the previous rate
increment interval. The maximum value a neutral node can attain is 0.8. We decrement a
node’s rating by 0.05 when we detect a link break during packet forwarding and the node
becomes unreachable. The lower bound rating of a “neutral” node is 0.0. The pathrater does
not modify the ratings of nodes that are not currently in active use.
We assign special highly negative value, -100 in the simulations, to nodes suspected of
misbehaving by the watchdog mechanism. When the pathrater calculates the path metric,
negative path values indicate the existence of one or more suspected misbehaving nodes in
the path. If a node is marked as misbehaving due to a temporary malfunction or incorrect
accusation it would be preferable if it were not permanently excluded from routing.
Therefore nodes that have negative ratings should have their ratings slowly increased or set
back to a non-negative value after a long timeout.
Performance
Throughput and Overhead
The watchdog and pathrater mechanism with DSR algorithm improves throughput by
27% while increasing the overhead from 12% to 24%. But this overhead is due to the way
DSR operates to maintain routes. The watchdog itself adds very little overhead. Although
the overhead is significant, these extensions still improve net throughput. In networks with
moderate mobility throughput improves by 17% while overhead transmission increases from
9% to 17%.
3.2.4 Security-Aware Ad-hoc Routing (SAR)
It makes use of trust levels (security attributes assigned to nodes) to make informed, secure routing
decision. Current routing protocols discover the shortest path between two nodes. But SAR can discover a
path with desired security attributes (E.g. a path through nodes with a particular shared key).
A node initiating route discovery sets the sought security level for the route i.e. the required minimal
trust level for nodes participating in the query/ reply propagation. Nodes at each trust level share
symmetric encryption keys. Intermediate nodes of different levels cannot decrypt in-transit routing
packets or determine whether the required security attributes can be satisfied and drop them. Only the
nodes with the correct key can read the header and forward the packet. So if a packet has reached the
destination, it must have been propagated by nodes at the same level, since only they can decrypt the
packet, see its header and forward it.
Shortest route
Secure route
Secure Node with the key
Other nodes in the network
Implementation
SAR can extend any routing protocol. Here we see how to extend AODV and call it SAODV. Most of
AODV’s original behavior such as on-demand discovery using flooding, reverse path maintenance and
forward path setup via Route Request and Reply (RREP) messages is retained.
The RREQ (Route REQuest) and the RREP (Route REPly) packets formats are modified to carry
additional security information. The RREQ packet has an additional field called
RQ_SEC_REQIREMENT that indicates the required security level for the route the sender wishes to
discover. This could be a bit vector.
An intermediate node at the required trust level, updates the RREQ packet by updating another new field,
RQ_SEC_GUARANTEE field. The RQ_SEC_GUARANTEE field contains the minimum security
offered in the route. This can be achieved if each intermediate node at the required trust level performs an
‘AND’ operation with RQ_SEC_GUARANTEE field it receives and puts the updated value back into the
RQ_SEC_GUARANTEE field before forwarding the packet.
Finally the packet reaches the destination if a route exists. In the RREP packet one additional field is
also added. When an RREQ successfully traverses the network to the sender, the
RQ_SEC_GUARANTEE represents the minimum security level in the entire path from source to
destination. So the destination copies this from the RREQ to the RREP, into a new field called
RP_SEC_GUARANTEE field. The sender can use this value to determine the security level on the whole
path, since the sender can find routes which offer more security than asked for, with which he can make
informed decisions.
Drawbacks
A lot of encryption overhead, since each intermediate node has to performs it.
3.2.5 Secure Routing Protocol
Assumptions
A Security Association (SA) exists between the source node (S) and destination node (T).One way of
establishing this SA is negotiating a shared secret key by the knowledge of the public key of the other
end. The existence of the SA is justified, because the end hosts choose a secure communication scheme
and consequently should be able to authenticate each other. The SA would be established by any of group
key exchange schemes. However the exists of SAs with any of the intermediate nodes is unnecessary.
It is required that the end nodes be able to use non-volatile memory to maintain state information
regarding relayed queries, so that previously seen route requests are discarded.
It is also expected that a one to one mapping exists between MAC and IP addresses exists.
Finally the broadcast nature of the radio channels requires that each transmission is received by all
neighbors, which are assumed to operate in promiscuous mode (i.e. able to overhear all transmissions
from nodes within the range of their transceiver).
Working
1 T
M2
M1
S 5
2 3
The source node (S) initiates the route discovery by constructing a route request packet. The route
request packet is identified by a random query identifier (rnd#) and a sequence number (sq#). We
assumed that a security association (a shared key KST) is established between source (S) and destination
(T).
S constructs a Message Authentication Code (MAC) which is a hash of source, destination, random
query identifier, sequence number and KST
i.e. MAC = h(S, T, rnd#, sq#, KST). In addition the identifier (IP addresses) of the traversed intermediate
nodes are accumulated in the route request packet.
Intermediate nodes relay route requests. The intermediate nodes also maintain a limited amount of
state information regarding relayed queries (by storing their random sequence number), so that previously
seen route requests are discarded.
More than one route request packet reaches the destination through different routes. The destination T
calculates a MAC covering the route reply contents and then returns the packet to S over the reverse route
accumulated in the respective request packet. The destination responds to one or more route request
packets to provide the source with an as diverse topology picture as possible.
Advantages
 Computing the MAC is not computationally expensive.

 Message integrity is preserved.
 If confidentiality of data is required we could encrypt the pay load with the shared key K ST
Different attacks on routing and how they are countered
Let M1, M2 be two malicious intermediate nodes.
We denote the query request as a list { QST; n1, n2, …. nk}. QST denotes the SRP header for a query
searching for T and initiated by S.
ni , i not = {1,k} are the IP addresses of the intermediate nodes and n1= S, nk= T.
Similarly, a route reply is denoted as { RST; n1, n2, …. nk}
Case 1:
When M receives { QST; S} it tries to mislead S by generating{ RST; S, M1, T} i.e. it fakes that
destination T is its neighbor. This is possible in a regular routing protocol, but not here, since only T can
generate the MAC which is verified by S.
Case 2:
If M1 discards request packets that it receives, it narrows the topology view of S. But at the same time
it practically removes itself from S’s view. Thus it cannot inflict harm to data flows originating from S,
and route chosen by S would not include M1.
Case 3:
When M1 receives { RST; S,1, M1, S, 4, T} it tampers with its contents and relays{ RST; S, 1, M, Y,
T}. Y being any sequence of nodes. S readily discards the reply due to the integrity protection provided
by MAC.
Case 4:
When M2 receives { QST; S, 2, 3 } it corrupts the accumulated route and relays
{ QST; S, X, 3, M2} to its neighbors, where X is a false IP address. This request arrives at T, which
constructs the reply and routes it over {T, M2, 3, X, S} towards S. but when node 3 receives the reply it
cannot forward it any further since X is not its neighbor and the reply is dropped.
Case 5:
If M1 replays route requests to consume network resources, they will be discarded by intermediate
nodes, since they maintain a list of query identifiers seen in the past. The query identifier is a random
number, so that it is not guessable by the malicious node.
Case 6:
If M1 attempts to forward { QST; S, M*} i.e. it spoofs its IP address. Consequently S would accept {
RST; S, M*, 1, 4, T} as a route. But the connectivity information conveyed by such a reply is correct.
However, in practice, neighbor discovery that maintain information on the binding of the MAC and IP
address can strengthen the protocol. Packets would be discarded when relayed by same data link interface
i.e. same MAC address with more than one different IP address.
Attacks on SRP Protocol
Tunneling
If 2 nodes collude during the 2 phases (request and reply) of a single route discovery, then the protocol
could be attacked.
e.g.: if M1 received a route request, it can tunnel it to M2 i.e. discover a route to M2 and send the request
encapsulated in a data packet. Then M2 broadcasts a request with the route segment between M1 and M2
falsified { QST; S, M1, Z, M2}. T receives the request and constructs a reply which is routed one {T, M2,
Z, M1, S}. M2 receives the reply and tunnels it back to M1, which then returns it to S. As a result the
connectivity information is only partially correct.
Geethanjali College Of Engineering & Technology
Cheeryal(V),Keesara(M),R.R.Dist
Tutorial Class Sheets

IV year CSE – 2 Sem Adhoc Sensor Networks
Set: 1
1. What is MANET? Discuss in detail about its applications and challenges?
2. Discuss about topology based routing protocols?
3. What is broadcast storm? Discuss in detail?
4. What are the basic design issues in wireless sensor networks?
Set: 2
2. Discuss about position based routing protocols?
3. Discuss about different multicast routing protocols?
4. Define WSN and discuss its applications?
Set: 3
2. Discuss about proactive and reactive routing protocols?
3. What is Geocasting? Discuss in detail about protocols?
4. Explain in detail about MICA MOTE?

Set: 4
1. What is MANET? What are the important characteristics and challenges of MANETS?
2. Discuss about location services and forwarding strategies in position based routing?
3. Discuss in detail about TCP protocol?
4. Discuss about minimizing the energy consumption in wireless sensor networks?
Set: 5
1. (a)What are the important characteristics and challenges of MANETS?
(b)Discuss in detail about various wireless networks.
2. (a)Differentiate topology based and position based routing.
(b)Discuss in detail about other routing protocols.
3. (a)Discuss about solutions for TCP over ADHOC.
(b)Discuss about effects of partitions on TCP and its impact on lower layers?
4. Discuss about clustering of sensors?
Set: 6
1. Discuss in detail about classification of WSN?
2. Give an overview about security issues over adhoc and sensor networks?
3. What are the challenges of sensor network programming?
4. Discuss about Tiny OS?
Set: 7
1. Explain about Network Architecture of Senor network and design issues in MAC layer?
2. Explain about problems affecting secure adhoc routing?
3. Discuss about node Level Software platforms?
4. What is NESC? Explain about it in detail?

Set: 8
1. Discuss in detail about any two MAC protocols in WSN?
2. Write about ARAN Protocol and its advantages?
3. Explain about Sensor network programming challenges?
4. Discuss about node level simulators?
Set: 9
1. Explain in detail about Sensor-MAC?
2. Write in detail about Authenticated Routing for adhoc Network?
3. Explain about three categories of Sensor node hardware and Sensor Network Programming
Challenges?
4. Explain about NS-2 and TOSSIM?
Set: 10
1. Differentiate flat routing and Hierarchical routing?
2. Discuss about challenges and requirements of security protocol in adhoc network?
3. Discuss about node Level Software platforms?
4. Discuss about node level simulators?

1.8. Course Review (By the concerned Faculty):
(I)Aims
(II) Sample check
(III) End of the course report by the concerned faculty
GUIDELINES:
Distribution of periods:
No. of classes required to cover JNTU syllabus : 40
No. of classes required to cover Additional topics : 4
No. of classes required to cover Assignment tests (for every 2 units 1 test) : 4
No. of classes required to cover tutorials : 8
No. of classes required to cover Mid tests : 2
No of classes required to solve University : 4
Question papers -------
Total periods 62

Geethanjali College of Engineering and Technology

Uploaded by

Copyright:

Available Formats

Geethanjali College of Engineering and Technology

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Geethanjali College of Engineering and Technology

Uploaded by

Copyright:

Available Formats

Geethanjali College of Engineering and Technology

DEPARTMENT OF COMPUTER SCIENCE ENGINEERING

(Name of the Subject/Lab Course):ADHOC AND SENSOR NETWORKS

(JNTU CODE: 58039 ) Programme: UG/PG

Branch: CSE Version No: 1

Year: IV Document Number :GCET/IT/304

Semester: II No. of Pages:

Classification status (Unrestricted/Restricted ) :

1) Name : K.VijayaBhaskar 1) Name :

3) Design :Assistant Professor 3) Design :

4) Date :1st December 2015 4) Date :

Verified by : *For Q.C only

GEETHANJALI COLLEGE OF ENGINEERING & TECHNOLOGY

Name of the Faculty: K.VijayaBhaskar Designation: Assistant Professor

Year and Semester to Whom Subject is offered: IV BTech. II Sem A

Department: CSE Academic year: 2015-2016

1.1. Introduction to the subject:

I.3.Objectives of the subject

This is a graduate level course emphasing research in wireless networking area

At the end of this course student will:

6. Provide knowledge of routing mechanisms and the three classes of approaches:

10. Appreciate the importance of good Ad-Hoc Networks Functionality.

1) Present the basic principles of routing in general packet-switched networks

1. Identify the layers of the WiFi standard and their functions.

1. Explain the application layer support for implementations..

1. Work on a project that addresses an issue applicable to MANETs.

Mapping of Course to PEOs and POs

ASN PEO1,PEO3 PO1,PO2,PO3,PO4,PO5,PO6,PO7,PO10,PO11,PO12,PO13,PO14

Mapping of Course outcomes to Program Outcomes

S.No. Course Outcome POs

1 This course will help students to identify the major PO12

2 Students will explore current ad-hoc/sensor PO2 ,PO3,PO4,PO5

5 Provide knowledge of mobile ad hoc networks, PO2 ,PO3,PO4,PO5

6 Provide knowledge of routing mechanisms and the PO2 ,PO3,PO4,PO5

7 Provide knowledge of the 802.11 Wireless Lan PO2 ,PO3,PO4,PO5

8 Provide knowledge of sensor networks and their PO12

9 Appreciate the importance of good Ad-Hoc PO10,PO11,PO13,PO14

10 Provide knowledge of mobile ad hoc networks, PO13,PO14

1.3. JNTU Syllabus with Additional Topics

.no UNIT NO Topic Additional Topics

Topology based vs. Position based approaches

Topology based routing Protocols

Position based Routing Protocols

Other routing Protocols

Data Transmission in MANETS

TCP over Ad Hoc Networks

TCP Protocol overview

TCP and MANETS

Solution for TCP over Ad Hoc

Basics of Wireless sensors and Applications

The Mica Mote

Sensing and Communication ranges

Data Retrieval in Sensor Networks

High Level application layer support

Adapting to Internet dynamic nature of WSN

Security in Ad Hoc and Wireless Networks

Intrusion Detection systems

Sensor Network Platform and Tools