Grey-Hole Attack Detection in Low Power Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting grey-hole attacks in Low Power and Lossy Networks (LLNs) is challenging due to the prohibitive overhead of encrypting and decrypting each message, which is critical for mitigating malicious node behavior that discards packets and falsifies acknowledgments.
Innovation Solution
A security device compares unique identifications of packets sent and acknowledged between nodes to determine if acknowledgments are genuine, using a low-computation method that maintains running lists of packet identifications and sends them periodically to a security device for comparison, without the need for extensive encryption or decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the head-end signs and encrypts each acknowledgment message to mitigate grey-hole attacks, then network security is improved, but computational overhead becomes prohibitive for low power processors in LLNs
Solution Approach 1:
The patent extracts the security verification function from the head-end and relocates it to intermediate nodes along the packet path. Each intermediate node independently verifies packet integrity using pre-shared keys, eliminating the need for the head-end to encrypt/decrypt each acknowledgment message while maintaining security.
Solution Approach 2:
The patent uses cryptographic hash functions to create compact digital fingerprints (hash values) of packet data. These hash copies are attached to packets and verified at intermediate nodes, providing security verification with minimal computational overhead compared to full encryption/decryption of acknowledgment messages.
2Difficulty of detecting and measuring
If the head-end encrypts each message to prevent grey-hole attacks, then detection capability is improved, but processing capability becomes insufficient for LLN devices
Solution Approach 1:
The patent employs lightweight cryptographic hash functions that consume minimal processing power and can be executed efficiently on resource-constrained LLN devices. These hash-based verification mechanisms provide adequate detection capability without requiring the substantial processing power needed for symmetric encryption/decryption operations.
Solution Approach 2:
The computationally intensive encryption/decryption operations are extracted from LLN devices and centralized at the head-end or performed using pre-computed hash values at intermediate nodes, allowing resource-constrained devices to maintain detection capability without exceeding their processing capabilities.
3Reliability
If packet encryption is implemented to mitigate grey-hole attacks, then security verification is improved, but message flow overhead increases
Solution Approach 1:
The patent attaches compact cryptographic hash values (digital fingerprints) to packets instead of encrypting the entire message content. These hash copies occupy minimal space compared to encrypted data, providing security verification while keeping message flow overhead low for bandwidth-constrained LLNs.
Solution Approach 2:
The patent transforms the security verification approach from encrypting/decrypting full messages (high overhead) to verifying cryptographic hash values (low overhead). This parameter change in the verification method maintains security while dramatically reducing the quantity of data that must be transmitted and processed.
Data Source
AI summary
In one embodiment, a security device receives one or more first unique identifications of packets sent by a first device to a second device for which a corresponding acknowledgment was purportedly returned by the second device to the first device. The security device also receives one or more second unique identifications of packets received by the second device from the first device and acknowledged by the second device to the first device. By comparing the first and second unique identifications, the security device may then determine whether acknowledgments received by the first device were truly returned from the second device based on whether the first and second unique identifications exactly match.