Malicious blackhole node detection and circumvention

Abstract

A method includes identifying a potentially malicious node using a rating assigned to a node within a network and decrementing the rating based on a detected dropped message to identify the potentially malicious node. A malicious node is identified based on location information obtained from the node within the network and a comparable distance to the potentially malicious node. The method also includes ending communication with the malicious node and selecting a new parent node based on an assumption that any node of the plurality of nodes other than the malicious node is non-malicious.

Description

[0001] Cross-reference to related applications

[0002] This PCT international application claims priority to U.S. Application No. 17 / 011,792, filed September 3, 2020, which is incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to the Internet of Things (IoT), wireless mesh networks (WMN), and wireless sensor networks (WSN). More specifically, this disclosure relates to the detection and evasion of blackhole attacks from malicious devices within low-power lossy networks (LLN). Background Technology

[0004] In IoT networks, mesh networks (WMNs or WSNs) comprising multiple nodes can utilize low-power lossy network (LLN) technology. An LLN comprises multiple devices with limited power, memory, and processing resources interconnected via various links (e.g., IEEE 802.15.4 or low-power Wi-Fi). Nodes within an LLN can include multiple sensing devices for sensing at least one environmental event at the location of each of the multiple nodes. Among numerous other applications and use cases, LLNs can be used in, for example, industrial monitoring, building automation (heating, ventilation, and air conditioning (HVAC), lighting, access control, and fire alarm and suppression systems, etc.), connected homes, healthcare, environmental monitoring, urban sensor networks, energy management, asset tracking, refrigeration, electrical lighting, and utility metering.

[0005] In some instances, LLNs can be vulnerable to denial-of-service attacks, referred to in this paper as "black hole attacks." A black hole in a network is a location where incoming and / or outgoing traffic is dropped or "dropped." In most black hole attacks, data packets destined for the black hole node are discarded by the black hole node instead of being transmitted to the receiving node within the network as intended or directed. The black hole node intentionally fails to notify both the sending and intended nodes, preventing data packets from reaching the receiving node. In this way, the black hole node simply acts as a data sink handling network traffic. Furthermore, black hole nodes are logically invisible when inspecting, for example, the topology of an LLN and can only be detected by monitoring lost traffic. Therefore, black hole nodes can be a malicious and harmful means of launching denial-of-service attacks against LLNs. Attached Figure Description

[0006] The following detailed description is given with reference to the accompanying drawings. In the drawings, the leftmost number(s) of the reference numerals indicate the drawing in which the reference numeral first appears. The same reference numerals are used in different drawings to denote similar or identical items. The systems depicted in the drawings are not drawn to scale, and the components in the drawings may not be drawn to scale relative to each other.

[0007] Figure 1 A system architecture diagram of an example wireless sensor network (WSN) for detecting malicious nodes is shown, based on the principles described herein.

[0008] Figure 2 A system architecture diagram of an example WSN for detecting malicious nodes is shown, based on the principles described herein.

[0009] Figure 3 A system architecture diagram of an example WSN is shown, which is an example of the principles described in this article. This example WSN removes the link to the malicious node at the first level and creates new links to other nodes.

[0010] Figure 4 A system architecture diagram of an example WSN is shown, illustrating an example of the principles described herein. This example WSN removes the link to a malicious node at the second layer and creates new links to other nodes.

[0011] Figure 5 This is a component diagram of an example component of a detection node based on the principles described in this article.

[0012] Figure 6 A flowchart illustrating an example method for identifying potentially malicious nodes in a WSN, based on the principles described herein, is shown.

[0013] Figure 7 A flowchart illustrating an example method for identifying potentially malicious nodes in a WSN, based on the principles described herein, is shown.

[0014] Figure 8 A computing system diagram illustrating the configuration of a data center is shown, which can be used to implement various aspects of the techniques disclosed herein.

[0015] Figure 9 A computer architecture diagram is shown, illustrating an example computer hardware architecture for implementing various aspects of the technologies presented herein. Detailed Implementation

[0016] Overview

[0017] The invention is set forth in the independent claims and in the dependent claims. A feature of one aspect may be applied to any aspect alone or in combination with other aspects.

[0018] This disclosure describes techniques for identifying malicious nodes within a WSN or similar network. Furthermore, this disclosure describes techniques for identifying malicious nodes as black hole nodes. Further, the techniques described herein include disassociating one or more nodes from the black hole node to eliminate the loss of data packets to the black hole node, instead transmitting the data packets to the intended receiving node. The purpose of the systems and methods described herein is to uncover the causes of one or more paradoxes experienced in the field deployment of WSNs.

[0019] First, the link quality at the data link layer (e.g., layer 2 of the Open Systems Interconnection (OSI) model as defined by the International Organization for Standardization (ISO)) may be sufficient to transmit data packets between nodes 104 in WSN 100, but there may be an unusually large number of upper-layer retransmissions. In this case, the expected transmission count (ETX) may be sufficient. The Routing Protocol for Low-Power Lossy Networks (RPL) supports the following subset and aggregate metrics of routing metrics or constraints: (1) routing metrics, such as the ETX of the link between nodes 104, the delay of the link between nodes 104, and the directed acyclic graph (DAG) level; and (2) routing constraints, such as node states and attributes (NSA) and the node energy of node 104. The ETX metric can be defined as the number of transmissions that node 104 expects to reach its destination (e.g., another node 104 or border router 102) to successfully deliver data packets, and can be expressed using the formula To calculate, where D f It is the measured probability that a packet is received by its neighbor, and D r This is the probability measurement confirming that a packet was successfully received. Even if network congestion occurs, retransmissions will not be excessively frequent. Based on RPL, as long as a node 104 has good link quality and / or (one or more) routing conditions, even if there are many packet drops between the child node 104 and the parent node, the child node 104 may not reroute its data transmission to the new parent node. This leads to a situation where recovery from a black hole attack by a malicious node 104-6 is difficult, because when the malicious node 104-6 announces to other nodes 104 that its routing metrics are sufficient, the malicious node 104-6 continuously broadcasts false information. For example, in Figure 1In this scenario, malicious node 104-6 may claim (e.g., broadcast information) that it is a first-hop node from border router 102, possessing lower Personal Area Network (PAN) costs relative to other nodes 104, in order to attract traffic from node 104. However, in reality, malicious node 104 is at least three hops away from border router 102. If other nodes 104, including nodes 104-3, 104-4, 104-5, and / or 104-8, know the true location of malicious node 104-6, these nodes 104 can easily identify malicious node 104-6.

[0020] The examples described herein provide an apparatus comprising: one or more processors, and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: assigning a first rating to a plurality of nodes within a mesh network, and determining a number of messages sent to the first node that have been dropped. The operations further include: decrementing the first rating assigned to the first node based at least in part on determining the number of messages dropped over a period of time, determining whether the first rating assigned to the first node has fallen below a rating threshold, and indicating that the first node is a potentially malicious node based at least in part on determining that the first rating has fallen below the rating threshold.

[0021] The operation also includes: sending a first request to the first node for the first location information of the first node, sending a second request to the at least second node for the second location information of the at least second node, receiving the first location information of the first node from the first node, receiving the second location information of the at least second node from the at least second node, determining whether a first distance to the first node is greater than a distance threshold defined by the second distance to the at least second node, and identifying the first node as a malicious node based at least in part on the determination that the first distance to the first node is greater than the distance threshold.

[0022] The operation also includes: terminating communication with the first node, and selecting a new parent node from among the nodes other than the first node based on the assumption that any node other than the first node is non-malicious. The mesh network is a wireless network, a wireless mesh network, or a wireless sensor network. The operation also includes: determining whether an intermediate node exists within the network route to the first node, and, at least in part based on the determination that an intermediate node exists within the network route to the first node, instructing the intermediate node to perform the above operations. The distance threshold is twice the radius of the wireless communication distance of at least the second node. The operation also includes: reporting to at least a third node or a network control device that the first node is a malicious node.

[0023] The example described herein provides a method comprising: determining the number of dropped messages sent to a first node within a mesh network of multiple nodes, and at least in part based on the determination of the number of dropped messages over a period of time, decrementing a first rating assigned to the first node. The method further comprises: determining whether the first rating assigned to the first node has fallen below a rating threshold, and at least in part based on the determination that the first rating has fallen below the rating threshold, indicating that the first node is a potentially malicious node.

[0024] The method further includes: sending a first request to the first node based on first location information of the first node; sending a second request to at least the second node based on second location information of at least the second node; receiving the first location information of the first node from the first node; and receiving the second location information of the at least the second node from the at least the second node. The method may further include: determining whether a first distance to the first node is greater than a distance threshold defined by a second distance to the at least the second node; and identifying the first node as a malicious node based at least in part on the determination that the first distance to the first node is greater than the distance threshold.

[0025] The method further includes: terminating communication with the first node, and selecting a new parent node from among the multiple nodes other than the first node based on the assumption that any node other than the first node is non-malicious. The method also includes: determining whether an intermediate node exists within the network route to the first node, and, at least in part based on the determination that an intermediate node exists within the network route to the first node, instructing the intermediate node to perform the methods described above. The distance threshold is twice the radius of at least the wireless communication distance of the second node.

[0026] The method further includes reporting to at least a third node or network control device among multiple nodes that the first node is a malicious node. The first location information and the second location information are determined by at least one of the following algorithms: Distance Vector Hop (DV-Hop) algorithm, Approximate Triangle Interior Point (APIT) algorithm, or Centroid Localization algorithm.

[0027] The examples described herein provide a non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform the following operations: determining the number of dropped messages sent to a first node within a mesh network of multiple nodes, and at least partially based on the determination of the number of dropped messages over a period of time, decrementing a first rating assigned to the first node. The operation further includes determining whether the first rating assigned to the first node has fallen below a rating threshold, and at least partially based on the determination that the first rating has fallen below the rating threshold, indicating that the first node is a potentially malicious node. The operation also includes sending a first request to the first node for first location information, sending a second request to at least a second node for second location information of at least a second node, receiving the first location information of the first node from the first node, and receiving the second location information of the at least second node from the at least second node. The method further includes determining whether a first distance to the first node is greater than a distance threshold defined by a second distance to the at least second node, and at least partially based on the determination that the first distance to the first node is greater than the distance threshold, identifying the first node as a malicious node.

[0028] The operation further includes: assigning a first rating to multiple nodes within the mesh network before determining the number of messages dropped to the first node among multiple nodes. The operation also includes: terminating communication with the first node, and selecting a new parent node from any of the multiple nodes other than the first node based on the assumption that any node other than the first node is non-malicious. The operation further includes: determining whether an intermediate node exists within the network route to the first node, and instructing the intermediate node to perform the above operations, at least in part based on the determination that an intermediate node exists within the network route to the first node. The operation also includes: reporting to at least a third node among the multiple nodes or a network control device that the first node is a malicious node. The multiple nodes include sensing devices to sense at least one environmental event at the location of the multiple nodes, and the mesh network includes a low-power lossy network (LLN).

[0029] Furthermore, the techniques described in this disclosure can be performed as a method and / or executed by a system having a non-transitory computer-readable medium storing computer-executable instructions that perform the above techniques when executed by one or more processors.

[0030] Example Implementation

[0031] As described above, an LLN can include multiple nodes configured as, for example, a mesh network (e.g., a wireless mesh network (WMN) or a wireless sensor network (WSN)). The term WSN will be used herein as an example to describe a network topology. However, the systems and methods described herein are applicable to any type of network. Furthermore, the term "mesh network" will be used herein to describe the topology of the network depicted in the accompanying drawings. However, any type of network topology can be applied in this system and method. As used in this specification and the appended claims, the term "mesh network" is broadly understood as a local network topology in which infrastructure nodes (i.e., bridges, switches, and other infrastructure devices) are directly, dynamically, and non-hierarchically connected to any number of other nodes and cooperate with each other to efficiently route data. In some examples, these nodes may be coupled to multiple other nodes, thereby achieving a lack of dependency on a single node to allow each node to participate in the relay of information. In one example, a given node within a mesh network may be communicatively coupled to a single node, such that a parent / child relationship can be formed between two nodes. In one example, a mesh network may be communicatively coupled to multiple nodes 104, such that data can be transmitted to one or two nodes. In the examples described herein, nodes can dynamically self-organize and self-configure to provide reduced installation overhead. The ability to self-configure enables the dynamic distribution of workload in the event of failure of several nodes, or, in this context, the detection of malicious nodes along the communication path between a node and a border router or other final destination node / router. This, in turn, contributes to fault tolerance and reduced maintenance costs by allowing a node to remove its dependencies from a malicious node and reconfigure itself to transmit data to another node acting as its new parent. Although the term WSN will be used to describe the network topology described herein to provide context for the systems and methods, any network topology including the mesh network characteristics described herein can be employed. Furthermore, in one example, the topology of the WSN may include a multi-hop wireless mesh network.

[0032] A border router, gateway router, or other device can ultimately be communicatively coupled to a node within the WSN. The border router acts as a bridge between the WSN and another network. This allows data to be stored and processed by a device with more resources than the nodes within the WSN (e.g., a remote server). Wireless wide area networks primarily used for low-power devices can be referred to as low-power wide area networks (LPWANs). Therefore, the WSNs described herein can also include one or more characteristics of low-power lossy networks (LLNs).

[0033] As used in this specification and the appended claims, the term "Low Power Lossful Network (LLN)" is broadly understood to refer to any type of network in which routers (e.g., nodes) and their interconnections are restricted. Nodes within an LLN (e.g., those described herein) may operate under constraints on processing power, memory, and energy (e.g., battery power). The interconnection of nodes may exhibit characteristics of high loss rates, low data rates, and instability. An LLN consists of dozens to thousands of sensors / routers. Supported traffic flows include point-to-point (between devices within the LLN), point-to-multipoint (from a central control point to a subset of devices within the LLN), and multipoint-to-point (from devices within the LLN to the central control point). The system and method described herein can utilize IPv6 routing protocols for Low Power Lossful Networks (RPL). RPL provides a mechanism by which multipoint-to-point traffic from devices within the LLN to the central control point, as well as point-to-multipoint traffic from the central control point to devices within the LLN, can be supported. Point-to-point traffic is also supported.

[0034] Nodes within a WSN can be spatially distributed autonomous sensors to monitor physical or environmental conditions such as temperature, sound, and pressure, as well as numerous other environmental conditions. Nodes within a WSN collaboratively transmit their data across the network to a central location, including a border router. In one example, the WSN can be bidirectional, allowing for control over sensor activity. WSNs can be used in a wide range of use cases and situations, including: battlefield surveillance, industrial process monitoring and control, machine health monitoring, regionalization of autonomous and semi-autonomous utilities and machines, implantable, wearable, and environmentally embedded medical devices (e.g., human area networks), air pollution monitoring, forest fire detection, landslide detection, water quality monitoring, natural disaster monitoring and prevention, and more.

[0035] Like most network types, WSNs are susceptible to denial-of-service (DoS) attacks. As mentioned above, one such DoS attack that WSNs can be vulnerable to is the black hole attack. Such attacks can be detected and corrected when a malicious node is placed within communication distance of any legitimate node within the WSN, or when one of the original nodes within the WSN is compromised in terms of security and used as a malicious node.

[0036] Malicious nodes can access a WSN, for example, by using a stolen key (e.g., a group temporary key (GTK)). Once the key grants access to the malicious node, the user can instruct the malicious node to broadcast to one or more legitimate nodes within the WSN and advertise itself as a preferred parent node with high link quality (e.g., low packet drop rate), good routing costs (e.g., topological and / or physical proximity to border routers, receiver nodes, root nodes, etc.), low latency, and other efficiencies within the WSN related to data transmission. Thus, a malicious user may cause many nodes to accept the malicious node as their parent node and send their network traffic to it. Therefore, the purpose of the system and method described herein is to detect and circumvent malicious nodes within a WSN (or otherwise render them inoperable or irrelevant).

[0037] Some embodiments and examples of this disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are illustrated. However, these aspects may be implemented in many different forms and should not be construed as limited to the embodiments set forth herein. For example, while several exemplary drawings are shown to illustrate WSN or LLN, it is conceivable that the techniques described herein can be applied to other types of network topologies and communication protocols. As stated herein, this disclosure covers variations of the examples. The same reference numerals always denote the same elements.

[0038] Figure 1 A system architecture diagram of an example wireless sensor network (WSN) 100 for detecting malicious nodes 104-6, based on the principles described herein, is shown. WSN 100 may include any number of nodes 104-1, 104-2, 104-3, 104-4, 104-5, 104-6, 104-7, 104-8, 104-9, 104-10, 104-11, 104-12, 104-13, 104-N, where N is any integer greater than or equal to 1 (collectively referred to herein as node 104 unless otherwise specifically indicated). Node 104 may include, for example, any device capable of monitoring and recording any (one or more) physical conditions of the environment and storing and / or transmitting the collected data to a central location (e.g., border router 102). As described herein, node 104 may also measure environmental conditions in numerous applications, such as temperature, sound, pollution levels, humidity, wind, and many other environmental characteristics. In one example, nodes 104 communicate with each other via wireless communication technology. The wireless communication technology may include, for example, what is commonly referred to as Wireless technology standards (including) The IEEE 802.15.1 standard for low-power (BLE) wireless communication, the Near Field Communication (NFC) technology standard, commonly known as Wi-Fi TMAny of the IEEE 802.11a, b, g, n, ac, ax standards, cellular data service standards, low-power wide area network (LPWAN) communication standards, IPv6 (6LoWPAN) communication standards on low-power wireless personal area networks, other wireless communication technologies and combinations thereof.

[0039] Nodes 104 may be spatially distributed across a physical area served by WSN 100, enabling each node 104 to detect one or more environmental characteristics within its own area within WSN 100. Each node 104 may include a radio transceiver with an internal antenna or a connection to an external antenna for communicating with at least one other node 104 and / or border router 102 in WSN 100. Each node 104 may also include processing devices (e.g., microcontrollers) and electronic circuitry for providing stored data and transmitting data to other nodes 104. Nodes 104 may also include an energy source, such as a battery or an embedded form of energy harvesting (e.g., a photovoltaic device). As the functionality, size, and cost of nodes 104 vary, so do the constraints on the resources of nodes 104 (e.g., energy, memory, computing speed, and communication bandwidth).

[0040] Border router 102 may be included within WSN 100 and is ultimately communicatively coupled to nodes within WSN 100. Border router 102 acts as a bridge between WSN 100 and many other networks 106. Therefore, data collected by node 104 can be routed to border router 102, and border router 102 can send that data to another device within WSN 100, such as a remote server. This allows the collected data to be stored and processed by a device with more resources than node 104 within WSN 100, and allows users to seek final data processing. In one example, border router 102 may be any router that can function within an IoT network. In one example, border router 102 may be a low-power personal area network (6LoWPAN) router based on Internet Protocol version 6 (IPv6) and compatible with the IEEE 802.15.4 standard. In one example, IP does not compute routes, and route computation is performed by a routing protocol to maintain a routing table in the router. 6LowPAN routers can utilize an adaptation layer between the network (e.g., IPv6) and the data link layer (e.g., IEEE 802.15.4 MAC) to fragment and reassemble IPv6 packets.

[0041] In the example described herein, node 104-6 is a malicious node identified as such by other nodes 104, and this is indicated by the grayscale applied to node 104-6. Node 104-6 may be referred to as malicious node 104-6 in this document. Although malicious node 104-6 is referred to as malicious node 104-6 throughout the specification, initially, node 104 in WSN 100 is unaware that malicious node 104-6 is actually a malicious black hole node. By applying the techniques described herein, node 104 can identify malicious node 104-6 as a black hole node and can take actions to circumvent malicious node 104-6.

[0042] Malicious node 104-6 can be any device compromised by a malicious user to perform a black hole attack within WSN 100. Therefore, malicious node 104-6 can be referred to as a black hole node. In one example, malicious node 104-6 may have been compromised by an individual attempting to perform a black hole attack on WSN 100 using a stolen key (e.g., a group temporary key (GTK)). In this example, the malicious individual could reprogram node 104-6 to drop data packets transmitted from other nodes 104 to malicious node 104-6 instead of transmitting the data packets to the intended device (e.g., border router 102). In another example, malicious node 104-6 could be a device introduced into WSN 100 by a malicious individual using a stolen key. Regardless of how the malicious node 104-6 is introduced into WSN 100, this system and method attempt to identify and circumvent the malicious node 104-6 within WSN 100 (or otherwise render it inoperable or irrelevant) to allow data packets to reach the border router 102 via other unintruded nodes 104.

[0043] Now we will combine Figures 1 to 4 This describes the detection and avoidance of malicious node 104-6 within WSN 100. From... Figure 1To begin, and as an example, nodes 104-4 and 104-5 may attempt to send data packets representing physical or environmental conditions collected by nodes 104 within WSN 100 to border router 102. To enable many nodes 104 within WSN 100 to accept malicious node 104-6 as their parent and send their network traffic to malicious node 104-6, malicious node 104-6 may advertise itself as a preferred parent node. For example, malicious node 104-6 may advertise that it has high link quality, such as a low packet drop rate. Furthermore, malicious node 104-6 may advertise that it has good routing costs, such as being topologically close to border router 102 (the final destination of data packets), relatively close to border router 102 by hop count to border router 102, and / or physically close to border router 102. Further still, malicious node 104-6 may advertise that it has low latency. Malicious node 104-6 can advertise other efficiencies within the WSN related to the transmission of data packets within the WSN, regardless of whether malicious node 104-6 is actually capable of achieving these efficiencies. Because malicious node 104-6 can advertise in this way, a malicious user may cause many nodes 104 to accept malicious node 104-6 as their parent node and send their network traffic to malicious node 104-6.

[0044] exist Figure 1 In the example, nodes 104-3, 104-4, 104-5, and 104-8 have accepted malicious node 104-6 as their parent node. Furthermore, nodes 104-1 and 104-2 are grandchild nodes relative to malicious node 104-6, as they are communicatively coupled to nodes 104-3 and 104-4, respectively. In this way, malicious node 104-6, acting as a black hole node, is able to drop data packets transmitted from several nodes 104 within the WSN 100, including both child and grandchild nodes. Although in Figure 1 Only child nodes and grandchild nodes are depicted as using malicious nodes 104-6 to transmit data packets, but any number of nodes 104 can exist between leaf nodes (e.g., node 104 within WSN 100 without child nodes) and malicious nodes 104-6.

[0045] Detecting malicious nodes:

[0046] Node 104 within WSN 100 can detect the presence of a malicious node 104-6 by assigning the highest possible rating to multiple nodes 104 within the mesh network (e.g., WSN 100) and determining the number of messages dropped from multiple messages sent to the first node. From the perspective of a grandchild node, the first node can be either a malicious node 104-6 or an intermediate node. The first rating assigned to the first node can be lowered or reduced, at least in part, based on the determination of the number of messages dropped over a period of time. Furthermore, node 104 determines whether the first rating assigned to the first node has fallen below a rating threshold, and indicates that the first node is a potentially malicious node, at least in part, based on the determination that the first rating has fallen below the rating threshold.

[0047] Throughout this specification, node 104 (excluding malicious node 104-6) operates independently and is solely responsible for identifying and circumventing malicious node 104-6. Therefore, in the examples described herein, any given node 104 other than malicious node 104-6 can unilaterally execute / process the methods described herein without receiving instructions from a device (e.g., a control node or other processing device within WSN 100). In one example, each node 104 executes the techniques described herein by executing onboard software and / or firmware. This ensures that no other node or device within WSN 100 can be used to influence node 104 while it attempts to identify and circumvent malicious node 104-6. This allows for a degree of autonomy available to node 104. Figures 1 to 6 In the example, nodes 104-1, 104-2, 104-3, 104-4, 104-5, and / or 104-8 may be included as nodes performing detection and evasion of malicious node 104-6. Node 104 performing the detection and evasion techniques described herein may be referred to as detection node 104.

[0048] Regarding assigning the highest possible rating to multiple nodes 104 within a mesh network (e.g., WSN 100), detection node 104 may individually assign the highest rating or score to all other nodes within WSN 100, including malicious nodes 104-6. In one example, the highest score may include the highest value within a point system utilized by detection node 104, for example, 100 out of 100 available points. In another example, the highest score may include 100% of a percentage system utilized by detection node 104. In any example, the purpose of detection node 104 assigning the highest possible rating or score to each of the other nodes 104 within WSN 100 is to allow detection node 104 to assume that all other nodes 104 are not malicious before being proven to be malicious. Given that there are a very large number of nodes 104 within WSN 100 (e.g., hundreds or thousands of nodes 104) and it is unlikely that multiple nodes 104 could be compromised (if any), it can be assumed that the vast majority of nodes 104 within WSN 100 are non-malicious, uncompromised, and trustworthy and reliable. For example, it can be assumed that a single node can be identified as malicious among a thousand nodes (e.g., 0.1% of all nodes 104). The purpose of each node 104 is to determine whether a node upstream of its parent node or border router 102 is a malicious node, e.g., node 104-6. Therefore, any node 104 (except for malicious node 104-6) can be a detection node 104 and can independently perform the methods described herein.

[0049] Detection node 104 can determine the number of dropped messages sent from detection node 104 to malicious node 104-6 to detect malicious node 104-6 as a black hole device. For example, during communication between detection node 104 and malicious node 104-6, detection node 104 can send a two-layer message including a Layer 2 (L2) portion and a Layer 3 (L3) portion. The L2 portion may include a Media Access Control (MAC) protocol message, which, among other data, defines the address of the destination (e.g., malicious node 104-6 and / or border router 102) within WSN 100. The L3 portion may include data packets and data defining the address of border router 102.

[0050] Malicious node 104-6 can send an L2 acknowledgment (ACK) message to detection node 104 to indicate that the malicious node has received the message from detection node 104. In this way, malicious node 104-6 convinces detection node 104 that malicious node 104-6 has received the data packet and processed it accordingly, including forwarding the data packet upstream to border router 102. In reality, malicious node 104-6, performing the blackhole attack, discards the data packet instead of transmitting it to border router 102.

[0051] However, since the L3 ACK message originates from border router 102, malicious node 104-6 cannot send an L3 ACK. Furthermore, border router 102 does not send an L3 ACK because it never receives data packets sent by detection node 104 from malicious node 104-6. Therefore, in response to sending data packets upstream, detection node 104 will never receive L3 ACK messages. In the instance where detection node 104 does not receive an L3 ACK, detection node 104 can identify vulnerabilities such as indicating that malicious node 104-6 is located between detection node 104 and border router 102. It is worth noting that malicious node 104-6 could be one or more hops from detection node 104, making detection node 104 a child, grandchild, etc., of malicious node 104-6.

[0052] Based at least in part on the detection node 104's detection of instances where L3 ACK messages are not received, the detection node 104 can determine that such instances are the result of upstream nodes (e.g., malicious nodes 104-6 and / or any intermediate nodes 104) dropping data packets, and can reduce the highest possible rating to a relatively low rating (e.g., less than 100% or less than 100 points). For example, once the detection node 104 detects the first instance of dropped messages, the detection node 104 can reduce the rating from 100 to 99, and any subsequent instances can reduce the rating by 1 point. However, the examples described herein can follow any rating reduction arrangement when reducing the rating.

[0053] In one example, the rating can be based on the number of data packets dropped over a period of time. In this example, detection node 104 can determine whether a predetermined number of packets were dropped within a certain period of time. If the predetermined number of packets was dropped within a certain period of time, detection node 104 can decrement the rating.

[0054] Furthermore, in one example, detection node 104 can periodically perform the aforementioned detection process throughout the operation. In this example, detection node 104 can utilize a timer to determine when to perform the detection process to detect the dropping of data packets.

[0055] Then, detection node 104 can determine whether the rating has dropped below a rating threshold. The rating threshold can be predetermined or user-defined. As described above, based at least in part on determining that the rating is not lower than the rating threshold, detection node 104 can return to identify the dropping of data packets and decrement the rating. Based at least in part on determining that the rating has dropped below the rating threshold, detection node 104 can indicate that malicious node 104-6 is a potentially malicious node.

[0056] Specifically, an instance where the grandchild node of malicious node 104-6 is performing the above detection process can be exemplified by the process performed by node 104-2 (the grandchild node of malicious node 104-6 and the child node of node 104-4). When node 104-2 performs the above detection process, it will determine (1) that node 104-4 is not a malicious node; or (2) that malicious node 104-6 exists somewhere upstream of node 104-4, and will make this determination based on the same reason that node 104-4 knows that malicious node 104-6 exists upstream. Node 104-2 can relay an identification message indicating that node 104-2 believes that node 104-4 is a malicious node to node 104-4. Node 104-4 can receive the identification message from node 104-2, and the receipt of the identification message can trigger node 104-4 to perform its own malicious node detection process on the nodes upstream of node 104-4 (including malicious node 104-6). In this way, the detection of malicious node 104-6 can be iteratively moved closer to the actual source where the malicious packet was dropped.

[0057] Identify malicious nodes:

[0058] Once detection node 104 has detected malicious node 104-6 as a potentially malicious node, detection node 104 can execute a process to determine whether malicious node 104-6 is actually malicious (e.g., a black hole node). Therefore, detection node 104 performs a preliminary detection operation and a secondary identification operation, the preliminary detection operation detecting dropped data packets as described above, and the secondary identification operation used to clearly identify malicious node 104-6. Figure 2 A system architecture diagram 200 of an example WSN for detecting malicious nodes is shown, illustrating an example of the principles described herein. To specifically identify malicious node 104-6, detection node 104 can request location information relative to detection node 104 from a potential malicious node (e.g., malicious node 104-6). In the example described herein, node 104-2 can request location information from node 104-4, and node 104-4 can request location information from malicious node 104-6. Location information may include, for example, Cartesian coordinates as its position within WSN 100. Figures 1 to 4As shown, Cartesian coordinates can be taken as (x, y) associated with each node. x ,y y The coordinates are in the form of A to N, and are respectively labeled as the coordinates of nodes 104-1 to 104-N. In the example, the coordinates of nodes 104-2, 104-4, and malicious node 104-6 can be B(x) to N. b ,y b ), D(x d ,y d ) and F(x f ,y f As described in this paper, similar coordinates can be determined for the remainder of node 104. To determine these coordinates, various algorithms can be performed on node 104, including, for example, the Distance Vector Jump (DV-Hop) algorithm, the Approximate Triangle Interior Point (APIT) algorithm, the centroid algorithm, other algorithms, and combinations thereof.

[0059] The DV-Hop algorithm can be any algorithm that determines the optimal route for data packets within WSN 100 based on distance. The distance-vector routing protocol utilized by the DV-Hop algorithm measures the distance between the detection node 104 and another target node (e.g., malicious node 104-6, border router 102, and / or any other node 104 within WSN 100), which is the number of nodes to which a data packet is delivered, with one node counted as one hop. In one example, the nodes 104 within WSN 100 may exchange information with each other in the form of routing tables, for example, including hop counts and possibly other traffic information. The distance-vector routing protocol can utilize, for example, the Bellman-Ford algorithm and / or the Ford-Fulkerson algorithm to compute the optimal route within WSN 100. The term "distance vector" refers to the fact that the protocol manipulates a vector (array) of distances to other nodes in the network. Nodes 104 using the distance-vector routing protocol determine their distances to their destinations, and can do so as described above and as... Figure 1 The figure shown is (x) x ,y y Distance measurements are presented in the form of a multi-hop link. For example, the DV-Hop algorithm can convert the number of hops detected in a multi-hop link into a distance, for example, in meters, using a correction factor propagated by the nodes through the network. This assumes that N nodes 104 are available, and that each node 104 fully knows its own location and the locations of all other nodes 104 in the network, allowing them to calculate all true Euclidean distances between each other. Then, if the i-th and j-th nodes establish a communication path via the multi-hop link, they will be able to convert the hop count M in the route... ij The actual distance d between them ijCorrelate them to find the correction factor corresponding to the number of meters per jump, as shown below:

[0060]

[0061] If each node 104 in WSN 100 establishes a multi-hop link with all other nodes 104 (or a subset thereof), the total average correction factor can be obtained and broadcast to all nodes 104 in WSN 100.

[0062] In one example, the APIT algorithm can be used to determine the coordinates of node 104 within WSN 100. The APIT algorithm is a non-localized iterative algorithm that uses beacon transmissions from node 104. The APIT algorithm utilizes a region-based approach to perform location estimation by isolating the environment into triangular regions between nodes 104. The presence of a node inside or outside a triangular region allows the node to narrow down its possible habitat. By using combinations of node 104's locations, the diameter of the estimated habitat where node 104 resides can be reduced to provide an accurate location estimate. The in-triangle point (PIT) test used by the APIT algorithm can be repeated in different triplets of node 104 until all combinations are exhausted or the required accuracy is achieved. The APIT algorithm can calculate the centroid (CoG) of the intersections of all the triangles in which node 104 resides to determine its estimated location.

[0063] In one example, the centroid algorithm can be used to determine the coordinates of node 104 within WSN 100. The centroid algorithm does not use any type of signal measurement to infer distance or angle of arrival (AoA) information between nodes 104. For example, for nodes at coordinates (x... i ,y i There are N detection nodes 104 near nodes 104 (i = 1...N). Node 104 transmits and transmits their coordinates. After receiving the coordinates of other nodes, the detection node 104 can estimate its own position as the centroid of those points. The coordinates of the centroid of node 104 can be calculated as follows:

[0064]

[0065] The centroid algorithm is a non-local distributed scheme where the detection node 104 needs to be in the vicinity of N nodes 104. If there are no nodes initially in the vicinity of the detection node 104, iterative node propagation may be required.

[0066] like Figure 2As shown, the Cartesian coordinates of node 104, including the detection node 104, malicious node 104-6, and any neighboring nodes 104, can be identified using the DV-Hop algorithm, APIT algorithm, centroid algorithm, other algorithms, and combinations thereof. Note that malicious node 104-6, acting as a black hole node, may broadcast incorrect routing information, resulting in incorrect coordinates for itself. Any node 104 downstream of malicious node 104-6 will also have incorrect routing and coordinate information, as their corresponding coordinates depend on the incorrect coordinates of malicious node 104-6. However, within WSN 100, multiple nodes 104 downstream of malicious node 104-6 can communicatively reach other nodes 104 unrelated to malicious node 104-6, such as nodes 104-13, 104-11, 104-7, 104-9, and 104-N. For example, node 104-3 can communicate with nodes 104-13, 104-11, and 104-7. Similarly, node 104-8 can communicate with nodes 104-7, 104-9, and 104-N. Therefore, once the location of node 104 is determined, the detection node 104 can calculate the coordinates of all its neighbors as well as its own coordinates. In addition to other types of information, the detection node 104 can also detect information from its neighbors, such as Received Signal Strength Indicator (RSSI), Time of Arrival (ToA) value, Time Difference of Arrival (TDoA) value, Angle of Arrival (AoA) value, hop size, hop count, node assignment rating or score, and ETX value.

[0067] Furthermore, since it can be assumed that the number of malicious nodes (e.g., black hole nodes) within WSN 100 is small, the neighbors of node 104 may not be malicious. For example, the neighbors of node 104-3, which includes nodes 104-13, 104-11, and 104-7, may not be malicious. A similar situation may hold for the neighbors of nodes 104-1, 104-2, 104-4, 104-5, and 104-8. Figure 2 In this context, R is the radius of the wireless communication coverage area of ​​node 104, which defines the distance at which nodes 104 can communicate with each other. The detection node 104 can determine whether its location is correct using the detected locations of malicious node 104-6 and neighboring nodes 104. The detection node 104 can determine the distance between itself and its neighboring nodes 104 and malicious node 104-6 using the following equation.

[0068]

[0069] Because malicious node 104-6 provides incorrect information (including incorrect coordinates or location information) to other nodes 104, the coordinates of detection node 104 are also incorrect, as mentioned above. Therefore, in the example where node 104-3 is the detection node, because node 104-3 determines its location based on the incorrect coordinate information provided by malicious node 104-6, detection node 104-3 can determine that the distance between itself and its neighboring node 104 (e.g., not downstream of malicious node 104-6) unaffected by the black hole attack can be greater than a distance threshold, for example, 2*R. For example, based on Figure 2 The physical topology shown clearly indicates that detection node 104-3 is within the communication range of, for example, nodes 104-13, 104-11, and 104-7. Assume that detection node 104-3 knows that the distance between itself and its neighboring nodes is less than 2*R. Figure 2 As shown, the detection node 104-3 can determine that the malicious node 104-6 is actually a malicious black hole node.

[0070] Although node 104-3 is used as detection node 104 in the example above, any of nodes 104-1, 104-2, 104-4, 104-5, and / or 104-8 can be detection nodes. Essentially, any node 104 downstream of the malicious node 104-6 can act as a detection node and directly or indirectly discover which node in the WSN is the malicious node 104-6.

[0071] Once the detection node 104 identifies the malicious node 104-6, it can take action to circumvent the malicious node 104-6, so that the detection node 104 and any of its child nodes no longer send data packets to the border router 102 via the malicious node 104-6. Figure 3 A system architecture diagram of an example WSN 100, which is shown according to the principles described herein, is provided. This example WSN 100 removes the link to the malicious node 104-6 at the first level and creates a new link to the other node 104. Figure 4A system architecture diagram of an example WSN 100, illustrating the principles described herein, is shown. This WSN 100 removes the link to malicious node 104-6 at the second layer and creates new links to other nodes 104. To circumvent malicious node 104-6, detection node 104 can determine that, because its parent node is malicious node 104-6 (e.g., a black hole node), detection node 104-3 can also assume that all other nodes within WSN 100 are non-malicious. Therefore, detection node 104 can choose a node 104 other than malicious node 104-6 as its new parent node. In one example where node 104-3 is a detection node, detection node 104-3 can begin communicating with one of nodes 104-13, 104-11, or 104-7 as its new parent node replacing malicious node 104-6. Similarly, in the example where node 104-8 is the detection node, detection node 104-8 can begin communicating with one of nodes 104-7, 104-9, or 104-N as its new parent node replacing the malicious node 104-6. The large dashed arrow 302 between the malicious node 104-6 and both node 104-3 and node 104-8 indicates that those links are being cut or removed, so that nodes 104-3 and 104-8 will no longer communicate with the malicious node 104-6. Furthermore, the small dashed arrow 304 between node 104-3 and node 104-13 indicates that node 104-3 selects node 104-13 as its new parent node and begins communication between node 104-13 and node 104-3. Similarly, the dashed arrow 304 between nodes 104-8 and 104-9 indicates that node 104-8 selects node 104-9 as its new parent node and begins communication between nodes 104-9 and 104-8. In this way, the first-layer nodes can cut off communication with the malicious node 104-6.

[0072] In a similar way and as Figure 4As shown, second-level nodes such as nodes 104-2, 104-4, and 104-5 can begin to sever communication with the malicious node 104-6 and establish new communication links with other nodes 104 within WSN 100. Because nodes 104-2, 104-4, and 104-5 are not neighbors of nodes 104 that are not downstream of the malicious node 104-6, they must rely on nodes 104 that have stopped communicating with the malicious node 104-6. Therefore, before nodes 104-2, 104-4, and 104-5 can potentially have neighboring nodes that are not downstream of the malicious node 104-6, they may have to wait until nodes 104 such as nodes 104-3 and 104-8 first sever communication with the malicious node 104-6 and begin communicating with non-downstream nodes 104. For example, node 104-4 can sever its communication link with malicious node 104-6, as indicated by arrow 402 (large dashed line between malicious node 104-6 and node 104-4), and begin communication with node 104-3, as indicated by arrow 404 (small dashed line between nodes 104-4 and 104-3). This is possible because node 104-3 is now a non-downstream node relative to malicious node 104-6 and a neighbor node relative to node 104-4. Similarly, node 104-5 can sever its communication link with malicious node 104-6, as indicated by arrow 402 (large dashed line between malicious node 104-6 and node 104-5), and begin communication with node 104-8, as indicated by arrow 404 (small dashed line between nodes 104-5 and 104-8). This is possible because node 104-8 is now a non-downstream node relative to malicious node 104-6 and a neighbor node relative to node 104-8.

[0073] In one example, when node 104, downstream of malicious node 104-6, cuts off communication with malicious node 104-6 and begins communicating with non-downstream node 104, the rating or score used by node 104 to identify the malicious node can begin to increase. In one example, once node 104, downstream of malicious node 104-6, changes its parent node from a malicious node to a non-downstream node, the rating or score can increase to the highest rating or score. In one example, once node 104, downstream of malicious node 104-6, changes its parent node from a malicious node to a non-downstream node, the rating or score can increase incrementally as node 104 detects that data packets have been correctly relayed to border router 102. An increase in rating or score indicates fewer data packets being dropped in WSN 100 and / or detected.

[0074] In one example, all nodes 104 downstream of malicious node 104-6, which has severed communication with malicious node 104-6 and begun communicating with its new parent node, can broadcast information about malicious node 104-6 to their neighboring nodes 104. In one example, the information about malicious node 104-6 may include instructions for performing an inspection of malicious node 104-6. In one example, the information about malicious node 104-6 can be propagated through WSN 100 to a central device such as border router 102 or another device such as a software-defined networking (SDN) controller, cloud device, or another control device, so that other actions can be taken to permanently remove malicious node 104-6 from WSN 100, perform network forensics for security purposes, and / or reprogram the malicious node to act as a non-malicious black hole node but as a functional part of WSN 100, or a combination thereof.

[0075] Figure 5 Component Figure 900 shows an example component of a detection node 104, exemplified according to the principles described herein. As shown, the detection node 104 may include one or more hardware processors 502, or one or more devices configured to execute one or more stored instructions. The processors 502 may include one or more cores. Furthermore, the detection node 104 may include one or more network interfaces 504 configured to provide communication between the detection node 104 and other devices, such as node 104 within WSN 100, border router 102, and / or other systems or devices associated with and / or remote from the detection node 104. The network interface 504 may include devices configured to couple to a personal local area network (PAN), wired and wireless local area network (LAN), wired and wireless wide area network (WAN), etc. For example, the network interface 504 may include devices compatible with the wireless communication technologies and protocols described herein.

[0076] The detection node 104 may also include at least one or more sensor devices 506 to sense at least one environmental event at the physical location of the detection node 104. The sensor devices 506 may include devices capable of detecting at least one environmental event, and examples are described herein.

[0077] The detection node 104 may also include a computer-readable medium 508 storing various executable components (e.g., software-based components, firmware-based components, etc.). In addition to the various components discussed herein, the computer-readable medium 508 may also store components for implementing the functions described herein. Although not shown, the computer-readable medium 508 may store one or more operating systems for controlling the operation of one or more devices including the detection node 104. According to one example, the operating system includes a LINUX operating system. According to another example, the operating system(s) includes a WINDOWS SERVER operating system from Microsoft Corporation, Redmond, Washington. According to other examples, the operating system(s) may include one of a UNIX operating system or a variant thereof. It will be understood that other operating systems may also be utilized.

[0078] Additionally, the detection node 104 may include a data storage device 510, which may include one or more repositories or other storage locations for permanently storing and managing collections of data such as databases, simple files, binary data, and / or any other data. The data storage device 510 may include one or more storage locations that can be managed by one or more database management systems. The data storage device 510 may store, for example, data packets 512, for allocation to the upstream node 104 and the border router 102. Data packets 512 may include data defining at least one environmental event sensed by the sensor device 506 of the detection node 104 within the WSN 100.

[0079] Furthermore, data storage device 510 can store network data 514. Network data 514 may include any data obtained by detection node 104 regarding the number or rate of data packets dropped by upstream nodes (e.g., malicious nodes 104-6). Additionally, network data 514 may include the currently assigned rating or score of one or more nodes within WSN 100 based on the number or rate of data packets dropped by upstream nodes. Further, in addition to other data and data types relevant to the process described herein, network data 514 may also include data such as: location information of multiple nodes 104 within WSN 100, Cartesian coordinates of multiple nodes 104, RSSI data, ToA data, TDoA data, AoA data, hop size, hop count, and ETX value.

[0080] Computer-readable medium 508 may store portions or components of the malicious node detection service 516 described herein. For example, the malicious node detection service 516 of computer-readable medium 508 may include a drop rate detection component 518, which, when executed by processor(s) 502, is used to assign the highest rating or score to node 104 within WSN 100, track the rating or score of upstream nodes from the detected node 104 based on the dropped data packets described herein, and increase the assigned drop rate based on a decrease in detected dropped data packets.

[0081] The malicious node detection service 516 may further include a node location component 520, which, when executed by one or more processors 502, is used to obtain and / or calculate the physical and / or Cartesian coordinate locations of nodes within WSN 100 using at least one of the techniques described herein. The malicious node detection service 516 may also include a communication component 522, which, when executed by one or more processors 502, is used to sever communication links with the malicious nodes 104-6 and create new communication links with the new parent nodes.

[0082] Figure 6 A flowchart of an example method 600 for identifying potential malicious nodes 104-6 in WSN 100, based on the principles described herein, is shown. Figure 6 Method 600 may include, at 602, determining the number of dropped messages sent to a first node 104 of a plurality of nodes 104 within a mesh network (e.g., WSN 100). The detection node 104 may execute a drop rate detection component 518 of a malicious node detection service 516 to perform operation 602. Based at least in part on determining that some of the messages have been dropped over a period of time, the detection node 104 may, at 604, reduce the first rating assigned to the first node (e.g., an upstream node such as malicious node 104-6) by executing the drop rate detection component 518.

[0083] At 606, method 600 further includes: using detection node 104 to determine, by re-executing the drop rate detection component 518, whether the first rating assigned to the first node has fallen below a rating threshold. Based at least in part on detection node 104 determining that the first rating assigned to the first node has not fallen below the rating threshold (606, determined not), method 600 may return to 602, where method 600 again begins detecting the number of messages dropped sent to the first node.

[0084] However, based at least in part on the determination by detection node 104 that the first rating assigned to the first node has fallen below the rating threshold (606, determined to be so), method 600 may include indicating at 608 that the first node is a potentially malicious node. This allows detection node 104 to determine that a potentially malicious node exists upstream, in preparation for identifying which upstream node is actually the malicious node responsible for discarding messages (e.g., data packets) and acting as a black hole node.

[0085] Figure 7 A flowchart illustrating an example method 700 for identifying potential malicious nodes 104-6 in WSN 100, based on the principles described herein, is shown. Figure 7 Method 700 may include, at 702, using detection node 104 among multiple nodes within WSN 100 to identify potentially malicious nodes. In one example, Figure 6 Method 600 can be used to perform operation 702.

[0086] At 704, the first location information may be information about a first node received by the detection node 104 from a first node by the node location component 220 performing the malicious node detection service 516. In one example, the first node may include malicious nodes 104-6 identified as potential malicious nodes in operation 702. Similarly, at 706, and by performing the node location component 220, the detection node 104 may receive second location information from at least a second node. The operation at 706 may include receiving location information from multiple nodes 104 upstream of the malicious nodes 104-6, nodes downstream of the detection node 104, nodes adjacent to the detection node 104, and combinations thereof.

[0087] At 708, detection node 104 can determine whether a first distance to the first node is greater than a distance threshold defined by a second distance to at least a second node (e.g., any other node 104 within WSN 100). Based at least in part on the determination that the first distance to the first node is not greater than the distance threshold defined by the second distance to at least the second node (708, determined not to), the method can loop back to operation 702. However, in response to the determination that the first distance to the first node is greater than the distance threshold defined by the second distance to at least the second node (708, determined to be yes), the first node can be identified as malicious node 104-6 at 710.

[0088] To correct the impact of malicious node 104-6, method 700 may further include: at 712 terminating communication with the first node (e.g., malicious node 104-6) via the execution of communication component 522 of detection node 104. At 714, detection node 104 may execute communication component 522 to select a new parent node from any node other than the first node (e.g., malicious node 104-6) among the plurality of nodes 104 based on the assumption that any node other than the first node among the plurality of nodes 104 is non-malicious. Furthermore, at 716, by executing communication component 522 of malicious node detection service 516, detection node 104 may report that the first node is a malicious node to at least a third node 104 among the plurality of nodes 104 or a network control device (e.g., border router 102).

[0089] Figure 8 A computing system diagram illustrating the configuration of a data center 800 is shown, which can be used to implement various aspects of the techniques disclosed herein. Figure 8 The example data center 800 shown includes several server computers 802A to 802F (which may be referred to herein as "one server computer 802" in the singular or "a plurality of server computers 802") for providing computing resources. In some examples, the resources and / or server computers 802 may include or correspond to any type of networking device described herein. Although described as a server, server computer 802 may include any type of networking device, such as a server, switch, router, hub, bridge, gateway, modem, repeater, access point, etc.

[0090] Server computer 802 may be a standard tower, rack, or blade server computer appropriately configured to provide computing resources. In some examples, server computer 802 may provide computing resources 804, including data processing resources such as VM instances or hardware computing systems, database clusters, compute clusters, storage clusters, data storage resources, database resources, network resources, virtual private networks (VPNs), etc. Some servers 802 may also be configured to execute a resource manager 806 capable of instantiating and / or managing computing resources. For example, in the case of VM instances, resource manager 806 may be a hypervisor or another type of program configured to execute multiple VM instances on a single server computer 802. Server computers 802 in data center 800 may also be configured to provide network services and other types of services.

[0091] exist Figure 8In the example data center 800 shown, server computers 802A to 802F are also interconnected using appropriate LANs 808. It will be understood that the configurations and network topologies described herein have been greatly simplified, and more computing systems, software components, networks, and networking devices can be used to interconnect the various computing systems disclosed herein and provide the aforementioned functionality. Appropriate load balancing devices or other types of network infrastructure components can also be used to balance the load between data centers 800, between each server computer in each data center 800 (server computers 802A to 802F), and potentially between the computing resources of each server computer 802 in each of the server computers 802. It will be understood that references... Figure 8 The configuration of the data center 800 described is merely illustrative and may be implemented using other methods.

[0092] In some examples, server computer 802 and / or computing resource 804 may each execute / host one or more tenant containers and / or virtual machines to perform the techniques described herein.

[0093] In some instances, data center 800 can provide computing resources permanently or on demand, such as tenant containers, VM instances, VPN instances, and storage devices. Computing resources provided by the cloud computing network can be used to implement the various services and technologies described above, among other types of functionality. Computing resources 804 provided by the cloud computing network can include various types of computing resources, such as data processing resources (e.g., tenant containers and VM instances), data storage resources, network resources, data communication resources, network services, VPN instances, etc.

[0094] Each type of computing resource 804 provided by a cloud computing network can be general-purpose or available in multiple specific configurations. For example, data processing resources can be used as physical computers or VM instances in a variety of different configurations. VM instances can be configured to run multiple applications, including web servers, application servers, media servers, database servers, some or all of the aforementioned network services, and / or other types of programs. Data storage resources can include file storage devices, block storage devices, etc. Cloud computing networks can also be configured to provide other types of computing resources 804 not specifically mentioned herein.

[0095] The computing resources 804 provided by the cloud computing network, in one example, can be implemented by one or more data centers 800 (which may be referred to herein as "one data center 800" in the singular or "multiple data centers 800" in the plural). A data center 800 is a facility used to house and operate computer systems and related components. A data center 800 typically includes redundant and backup power supplies, communication, cooling, and security systems. Data centers 800 may also be located in geographically distinct locations. The following will focus on... Figure 9 The description provides an illustrative example of a data center 800 that can be used to implement the techniques disclosed herein.

[0096] Figure 9 A computer architecture diagram is shown, illustrating an example computer hardware architecture 900 for implementing various aspects of the computing devices that can be used to implement the various technologies presented herein. Figure 9 The illustrated computer hardware architecture 900 shows a server computer 802, network devices (e.g., border router 102, node 104, load balancer, data storage device, etc.), workstations, desktop computers, laptop computers, tablet computers, network devices, e-readers, smartphones, or other computing devices, and can be used to execute any of the software components presented herein. In some examples, computer 900 may correspond to the network devices described herein (e.g., border router 102 and / or node 104) and may include networking devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, etc.

[0097] Computer 900 includes a baseboard 902 or "motherboard," which is a printed circuit board to which multiple components or devices can be connected via a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (CPUs) 904 operate together with chipsets 906. The CPU 904 may be a standard programmable processor necessary to perform the arithmetic and logic operations required to operate computer 900.

[0098] The CPU 904 performs operations by manipulating switching elements that distinguish and change these states, transitioning from one discrete physical state to the next. These switching elements generally include electronic circuitry that maintains one of two binary states, such as flip-flops, and electronic circuitry that provides the output state based on a logical combination of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractor units, arithmetic logic units, floating-point units, and so on.

[0099] Chipset 906 provides an interface between the CPU 904 and the remaining components and devices on the substrate 902. Chipset 906 can provide an interface to RAM 908, which serves as the main memory in computer 900. Chipset 906 can also provide an interface to computer-readable storage media (e.g., read-only memory (ROM) 910 or non-volatile RAM (NVRAM)) to store basic routines that facilitate booting computer 900 and transferring information between various components and devices. ROM 910 or NVRAM can also store other software components necessary for the operation of computer 900 according to the configuration described herein.

[0100] Computer 900 can operate in a networked environment using logical connections to remote computing devices and computer systems via a network (e.g., WSN 100). Chipset 906 may include the functionality to provide network connectivity via a network interface controller (NIC) 912 (e.g., a Gigabit Ethernet adapter). NIC 912 enables computer 900 to connect to other computing devices via WSN 100. It is understood that multiple NICs 912 may be present in computer 900 to connect the computer to other types of networks and remote computer systems. In some examples, NIC 912 may be configured to perform at least some of the techniques described herein, such as packet redirection and / or other techniques described herein.

[0101] Computer 900 can be connected to storage device 918, which provides non-volatile storage for the computer. Storage device 918 can store operating system 920, programs 922, and data, which have been described in detail herein. Storage device 918 can be connected to computer 900 via storage controller 914 connected to chipset 906. Storage device 918 may include one or more physical storage units. Storage controller 914 can interface with physical storage units via interfaces such as Serial Attached SCSI (SAS) interface, Serial Advanced Technology Attachment (SATA) interface, Fibre Channel (FC) interface, or other types of interfaces used for physical connection and data transfer between the computer and physical storage units.

[0102] Computer 900 can store data on storage device 918 by transforming the physical state of physical storage units to reflect the stored information. In different configurations described herein, the specific transformation of the physical state depends on various factors. Examples of these factors may include, but are not limited to: the technology used to implement the physical storage units, whether storage device 918 is characterized as a primary storage device or a secondary storage device, etc.

[0103] For example, computer 900 can store information in storage device 918 by issuing instructions via storage controller 914 to change the magnetic properties of a specific location in a disk drive unit, the reflection or refraction properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are possible without departing from the scope and spirit of this specification; the examples above are provided merely for the purpose of description. Computer 900 can further read information from storage device 918 by detecting the physical state or characteristics of one or more specific locations in the physical storage unit.

[0104] In addition to the aforementioned storage device 918, computer 900 may access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will understand that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by computer 900. In some examples, operations performed by WSN 100 and / or any components included therein may be supported by one or more devices similar to computer 900. In other words, some or all of the operations performed by WSN 100, and or any components included therein, may be performed by one or more computer devices 900 operating in a cloud-based configuration.

[0105] By way of example and not limitation, computer-readable storage media can include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory or other solid-state memory technologies, optical disc ROM (CD-ROM), digital versatile disk (DVD), high-definition DVD (HD-DVD), Blu-ray, or other optical storage, cassette, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information in a non-transitory manner.

[0106] As briefly described above, storage device 918 can store operating system 920 used to control the operation of computer 900. According to one example, the operating system includes the LINUX operating system. According to another example, the operating system includes one from Microsoft Corporation in Redmond, Washington. The server operating system. According to other examples, the operating system may include a variant of the UNIX operating system or a variant thereof. It is understood that other operating systems may also be used. Storage device 918 may store other systems, applications, and data used by computer 900.

[0107] In one example, computer-executable instructions are encoded in storage device 918 or other computer-readable storage medium. When loaded into computer 900, these computer-executable instructions transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the examples described herein. As described above, these computer-executable instructions transform computer 900 by specifying how CPU 904 transitions between states. According to one example, computer 900 can access a computer-readable storage medium storing the computer-executable instructions, which, when executed by computer 900, perform the above-described actions. Figures 1 to 7 The various processes described herein. The computer 900 may also include a computer-readable storage medium having instructions stored thereon for performing operations of any other computer implementation described herein.

[0108] Computer 900 may also include one or more input / output controllers 916 for receiving and processing input from multiple input devices (e.g., keyboard, mouse, touchpad, touchscreen, electronic pen, or other types of input devices). Similarly, input / output controllers 916 may provide output to a display, such as a computer monitor, flat panel display, digital projector, printer, or other types of output device. It should be understood that computer 900 may not include... Figure 9 All components shown may include Figure 9 Other components not explicitly shown in the document, or those that can be utilized with Figure 9 The architecture shown is completely different.

[0109] As described herein, computer 900 may include one or more of a border router 102, node 104, or network devices (e.g., server computer 802, computing resources, routers, etc.). Computer 900 may include one or more hardware processors, such as CPU 904, configured to execute one or more stored instructions. CPU 904 may include one or more cores. Furthermore, computer 900 may include one or more network interfaces configured to provide communication between computer 900 and other devices, such as the communication performed by node 104 and border router 102 as described herein. Network interfaces may include multiple devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), etc. For example, network interfaces may include interfaces for Ethernet, Wi-Fi, etc. TM Compatible devices.

[0110] Program 922 may include any type of program or process for performing the techniques described in this disclosure, which use one or more BFD echo packets to determine connectivity in a multi-hop path. Program 922 may enable node 104 and / or border router 102 to perform a variety of operations.

[0111] In summary, one approach includes: using ratings assigned to nodes within a network to identify potentially malicious nodes, and decrementing the ratings based on detected dropped messages to identify potentially malicious nodes. Malicious nodes are identified based on location information obtained from nodes within the network and comparable distances to potential malicious nodes. The approach also includes: terminating communication with malicious nodes, and selecting a new parent node based on the assumption that any node among multiple nodes other than the malicious node is non-malicious.

[0112] Although this system and method are described with respect to specific examples, it should be understood that the scope of this system and method is not limited to these specific examples. Because other modifications and alterations made to suit specific operational requirements and environments will be apparent to those skilled in the art, this system and method are not to be considered limited to the examples chosen for disclosure purposes, but rather include all changes and modifications that do not constitute a deviation from the true spirit and scope of this system and method.

[0113] While this application describes examples with specific structural features and / or methodological actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions are merely examples illustrating that fall within the scope of the claims of this application.

Claims

1. An apparatus comprising: One or more processors; as well as One or more non-transitory computer-readable media store instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations including: The first rating is assigned to multiple nodes within the mesh network; Determine the number of messages dropped from the plurality of nodes sent to the first node. It is determined that the number of messages discarded exceeds a discard threshold within a certain period of time; At least in part, based on the fact that the number of messages dropped during the said time period exceeds the number of drop thresholds, the first rating assigned to the first node is reduced to the second rating assigned to the first node; The second rating assigned to the first node is determined to be below the rating threshold. The first node is determined to be a potentially malicious node, at least in part, based on the fact that the second rating is lower than the rating threshold. Receive first location information, the first location information indicating the first location of the first node; Receive second location information, which indicates the second location of the second node; The distance threshold is determined at least in part based on the second distance indicated by the second location information; Using the first location information, it is determined that the first distance to the first node is greater than or equal to the distance threshold; and The first node is identified as a malicious node, at least in part, based on the fact that the first distance to the first node is greater than the distance threshold.

2. The device according to claim 1, wherein the operation further includes: A first request is sent to the first node based on the first location information of the first node; as well as A second request is sent to at least the second node in response to the second location information of at least the second node.

3. The device according to claim 2, wherein the operation further includes: End communication with the first node; as well as The parent node other than the first node is selected from the plurality of nodes based on the assumption that any node other than the first node is non-malicious.

4. The device according to any one of claims 1 to 3, wherein, The mesh network is a wireless network, a wireless mesh network, or a wireless sensor network.

5. The device according to any one of claims 1 to 4, wherein the operation further comprises: It is determined that there is an intermediate node in the network route to the first node; as well as At least in part, based on the determination that the intermediate node exists in the network route to the first node, the intermediate node is instructed to perform an operation.

6. The device according to claim 2, wherein, The distance threshold is at least twice the radius of the wireless communication distance of at least the second node.

7. The device of claim 3, wherein the operation further includes reporting to a network control device or at least a third node of the plurality of nodes that the first node is a malicious node.

8. A method comprising: Determine the number of messages dropped when they are sent to the first node in a mesh network with multiple nodes; At least in part, based on determining the number of messages that have been discarded over a period of time, the first rating assigned to the first node is reduced to a second rating; The second rating assigned to the first node is determined to be below the rating threshold. The first node is determined to be a potentially malicious node, at least in part, based on the fact that the second rating is lower than the rating threshold. Receive first location information, the first location information indicating the first location of the first node; Receive second location information, which indicates the second location of the second node; The distance threshold is determined at least in part based on the second distance indicated by the second location information; Using the first location information, determine that the first distance to the first node is greater than or equal to the distance threshold; as well as The first node is identified as a malicious node, at least in part, based on the fact that the first distance to the first node is greater than the distance threshold.

9. The method according to claim 8, further comprising: A first request is sent to the first node based on the first location information of the first node; as well as A second request is sent to at least the second node in response to the second location information of at least the second node.

10. The method of claim 9, further comprising: End communication with the first node; as well as The parent node other than the first node is selected from the plurality of nodes based on the assumption that any node other than the first node is non-malicious.

11. The method according to any one of claims 8 to 10, further comprising: It is determined that there is an intermediate node in the network route to the first node; as well as At least in part, based on the determination that there is an intermediate node in the network route to the first node, the intermediate node is instructed to perform an operation.

12. The method according to claim 9, wherein, The distance threshold is twice the radius of at least the wireless communication distance of the second node.

13. The method of claim 10, further comprising reporting to a network control device or at least a third node of the plurality of nodes that the first node is a malicious node.

14. The method according to claim 9, wherein, The first location information and the second location information are determined by at least one of the following algorithms: Distance Vector Jump (DV-Hop) algorithm, Approximate Triangle Interior Point (APIT) algorithm, or Centroid Localization algorithm.

15. A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations, the operations comprising: Determine the number of messages to be discarded when they are sent to the first node in a multi-node network. It is determined that the number of messages discarded exceeds a discard threshold within a certain period of time; At least in part, based on the fact that the number of messages dropped during the said time period exceeds the number of drop thresholds, the first rating assigned to the first node is reduced to the second rating assigned to the first node; The second rating assigned to the first node is determined to be below the rating threshold. as well as The first node is determined to be a potentially malicious node, at least in part, based on the fact that the second rating is lower than the rating threshold. A first request is sent to the first node based on the first location information of the first node; A second request is sent to at least the second node in response to the second location information of at least the second node; Receive first location information, the first location information indicating the first location of the first node; Receive second location information, which indicates the second location of the second node; The distance threshold is determined at least in part based on the second distance indicated by the second location information; Using the first location information, determine that the first distance to the first node is greater than or equal to the distance threshold; as well as The first node is identified as a malicious node, at least in part, based on the determination that a first distance to the first node is greater than the distance threshold.

16. The non-transitory computer-readable medium according to claim 15, wherein, The distance threshold is at least twice the radius of the wireless communication distance of at least the second node.

17. The non-transitory computer-readable medium according to claim 15 or 16, further comprising: End communication with the first node; as well as The parent node other than the first node is selected from the plurality of nodes based on the assumption that any node other than the first node is non-malicious.

18. The non-transitory computer-readable medium according to any one of claims 15 to 17, wherein the operation further comprises: It is determined that there is an intermediate node in the network route to the first node; as well as At least in part, based on the determination that the intermediate node exists in the network route to the first node, the intermediate node is instructed to perform an operation.

19. The non-transitory computer-readable medium according to any one of claims 15 to 18, the operation further comprising reporting to a network control device or at least a third node of the plurality of nodes that the first node is a malicious node.

20. The non-transitory computer-readable medium according to any one of claims 15 to 19, wherein: The plurality of nodes include sensing devices within a mesh network to sense at least one environmental event at the location of the plurality of nodes; and The mesh network includes low-power lossy networks (LLN).

21. An apparatus comprising: A module for determining the number of dropped messages sent to the first node in a mesh network with multiple nodes; A module for reducing the first rating assigned to the first node to a second rating based at least in part on the number of messages that have been discarded over a period of time; A module used to determine that the second rating assigned to the first node is lower than the rating threshold; as well as A module for determining, at least in part, that the first node is a potentially malicious node based on the second rating being lower than the rating threshold; A module for receiving first location information, wherein the first location information indicates the first location of the first node; A module for receiving second location information, wherein the second location information indicates the second location of the second node; A module for determining a distance threshold based at least in part on a second distance indicated by the second location information; A module for determining, using the first location information, that the first distance to the first node is greater than or equal to the distance threshold; as well as A module for identifying a first node as a malicious node based at least in part on a first distance to the first node being greater than the distance threshold.

22. The apparatus of claim 21, further comprising a module for implementing the method of any one of claims 9 to 14.

23. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 8 to 14.

24. A computer-readable medium having stored thereon instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 8 to 14.

Images