Analysing Routing Protocols: Four Nodes Topologies Are Sufficient

Abstract

Abstract. Routing protocols aim at establishing a route between nodes on a network. Secured versions of routing protocols have been proposed in order to provide more guarantees on the resulting routes. Formal methods have proved their usefulness when analysing standard security protocols such as confidentiality or authentication protocols. However, existing results and tools do not apply to routing protocols. This is due in particular to the fact that all possible topologies (infinitely many) have to be considered.In this paper, we propose a simple reduction result: when looking for attacks on properties such as the validity of the route, it is sufficient to consider topologies with only four nodes, resulting in a number of just five distinct topologies to consider. As an application, we analyse the SRP applied to DSR and the SDMSR protocols using the ProVerif tool.

Formal Analysis of Privacy for Routing Protocols in Mobile Ad Hoc Networks

“…Another direction is the enrichment of our attacker model, so as to model fully compromised nodes which disclose their long-term keys or fresh nonces generated during the execution of the protocols, and active attackers able to forge messages and interact with honest agents. Finally, from the point of view of the verification, a reduction result on network topologies as presented in [11] would make the perspective of automated proofs of anonymity easier.…”

“…Our calculus is actually inspired from some other calculi (e.g. [17,6,11]) which allow mobile wireless networks and their security properties to be formally described and analysed. We adapt those formalisms in order to be able to express privacy-type properties such as those studied in this paper.…”

A More Realistic Model for Verifying Route Validity in Ad-Hoc Networks

“…We use the CBS [12] calculus to model routing protocol, and the transition rules introduced in [2] to model the communications between nodes, after updating them to handle the behaviour of the non-cooperative malicious nodes instead of the cooperative ones. Then, we revisit the work presented by Cortier et al in [6], where they show that when looking for attacks on route validity under the cooperative model it is enough to check only five particular small topologies. We show that the same result is also valid in case the of non-cooperative model: first, we show that if there is an attack on a routing protocol in a certain topology under the non-cooperative model, then there is an attack on this protocol in a smaller topology obtained from the original one by a simple reduction.…”

“…It can control only a finite number of nodes (typically one or two), and thus it can listen to the communication of its neighbours but it is not possible to listen beyond the neighbouring nodes. Cortier et al [6] proposed a reduction proof when looking for route validity property under the cooperative attacker model, i.e. a model that allows distant malicious nodes to communicate using out-of-band resources, and thus to share their knowledge.…”

A Program Logic for Verifying Secure Routing Protocols

“…Networking Protocol Verification. Recently, several papers have investigated the verification of route authenticity properties on specific wireless routing protocols for mobile networks [2,3,11]. They have showed that identifying attacks on route authenticity can be reduced to constraint solving, and that the security analysis of a specific route authenticity property that depends on the topologies of network instances can be reduced to checking these properties on several four-node topologies.…”