Routing Attacks and Countermeasures in the RPL-Based Internet of Things

By Linus Wallgren, Shahid Raza, Thiemo Voigt. Int. J. Distributed Sens. Networks, 2013

467 citations recorded by the source corpus.

The Routing Protocol for Low-Power and Lossy Networks (RPL) is a novel routing protocol standardized for constrained environments such as 6LoWPAN networks. Providing security in IPv6/RPL connected 6LoWPANs is challenging because the devices are connected to the untrusted Internet and are resource constrained, the communication links are lossy, and the devices use a set of novel IoT technologies such as RPL, 6LoWPAN, and CoAP/CoAPs. In this paper we provide a comprehensive analysis of IoT technologies and their new security capabilities that can be exploited by attackers or IDSs. One of the major contributions in this paper is our implementation and demonstration of well-known routing attacks against 6LoWPAN networks running RPL as a routing protocol. We implement these attacks in the RPL implementation in the Contiki operating system and demonstrate these attacks in the Cooja simulator. Furthermore, we highlight novel security features in the IPv6 protocol and exemplify the use of these features for intrusion detection in the IoT by implementing a lightweight heartbeat protocol.

Subfields: Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/f2397b7fba51573918ef19ea19091942b5552996

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

Citations in the corpus

A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges (2020, methodology): “Therefore, the networks in this phase are often called as Low and Lossy Networks (LLN) [3].”
Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations (2019, background): “[109] observed huge traffic passing through the attacker nodes.”
Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices (2020, background): “Wallgren et al. [29] investigated the protection capabilities of the RPL against selective forwarding attacks.”
Secure routing for internet of things: A survey (2016, background): “Table 1 Summary of RPL attacks and countermeasures Attacks Classification of attacks Effect on network performance Proposed protocols addressing attacks Rank Confidentiality & Integrity Low packet delivery ratio and packet delay; generation of non-optimal path and loop Use of IDS based solutions [60”
Survey on Collaborative Smart Drones and Internet of Things for Improving Smartness of Smart Cities (2019, methodology): “On the other hand, securing the application layer calls for several techniques such as a simple object access protocol, a constrained application protocol [142] and intrusion detection systems [148].”
A Comprehensive Study of Security of Internet-of-Things (2017, background): “VOLUME 5, NO. 4, OCT.-DEC. 2017 593 4) Hello Flood: A Hello Flood attack is based on the fact that a node must broadcast “HELLO PACKETS” to show its presence to neighbors.”
Cellular, Wide-Area, and Non-Terrestrial IoT: A Survey on 5G Advances and the Road Toward 6G (2021, background): “Routing attacks against low power wide-area networks are a wellstudied topic as well [279].”
A survey of intrusion detection in Internet of Things (2017, methodology): “Wallgren et al. (2013) investigated the protection capabilities of the RPL against many types of routing attacks: sinkhole, selective forwarding, hello flood, wormhole, clone ID, and sybil attacks.”
Security in Internet of Things: issues, challenges, taxonomy, and architecture (2017, background): “There are some specific attacks on 6LoWPAN and RPL which exploit the rule based routing implemented in RPL [54].”
Network Intrusion Detection for IoT Security Based on Learning Techniques (2019, background): “Concerning selective forwarding attack [38], is a data forwarding misbehavior where an attacker selectively forwards malicious packets while discarding genuine and important packets.”