1

A System-Theoretic Clean Slate Approach to

Provably Secure Ad Hoc Wireless Networking
Jonathan Ponniah*, Member, IEEE, Yih-Chun Hu*, Member, IEEE, and P. R. Kumar**, Fellow, IEEE

Abstract—Traditionally, wireless network protocols have been All the above protocols are designed on the assumption
designed for performance. Subsequently, as attacks have been that all nodes are “good,” and will conform to the protocol.
identified, patches have been developed. This has resulted in an Some nodes can however be malicious, deliberately intent
“arms race” development process of discovering vulnerabilities
and then patching them. The fundamental difficulty with this on disrupting the network, a vulnerability especially acute
approach is that other vulnerabilities may still exist. No provable since the very purpose of ad hoc networks is to allow any
arXiv:1309.2904v1 [cs.NI] 11 Sep 2013

security or performance guarantees can ever be provided. node to join a network. For wireless networks used in safety-
We develop a system-theoretic approach to security that critical applications, e.g., vehicular networks, vulnerabilities
provides a complete protocol suite with provable guarantees, can be dangerous. Moreover, many wireless networking pro-
as well as proof of min-max optimality with respect to any
given utility function of source-destination rates. Our approach tocols have been based on wireline protocols, with possible
is based on a model capturing the essential features of an ad- susceptibilities to novel over the air attacks.
hoc wireless network that has been infiltrated with hostile nodes. The assumption of benignness, implicit or explicit, has
We consider any collection of nodes, some good and some bad, been the traditional starting point of protocol development.
possessing specified capabilities vis-a-vis cryptography, wireless Systems have been first designed to provide high performance.
communication and clocks. The good nodes do not know the
bad nodes. The bad nodes can collaborate perfectly, and are Subsequently, as vulnerabilities have been discovered, they
capable of any disruptive acts ranging from simply jamming to have been patched on a case by case basis. For example, the
non-cooperation with the protocols in any manner they please. “wormhole” attack was discovered in [7], where an attacker
The protocol suite caters to the complete life-cycle, all the way sets up a false link between two nodes. It is countered by
from birth of nodes, through all phases of ad hoc network for- a fix using temporal and geographical packet leashes [7],
mation, leading to an optimized network carrying data reliably.
It provably achieves the min-max of the utility function, where [19]. The “rushing” attack against DSR was discovered in
the max is over all protocol suites published and followed by the [8], in which attackers manipulate the network topology. This
good nodes, while the min is over all Byzantine behaviors of the is countered by a fix using network discovery chains. The
bad nodes. Under the protocol suite, the bad nodes do not benefit “partial deafness” attack against 802.11 was discovered in [4],
from any actions other than jamming or cooperating. in which an attacker artificially reduces its link quality to draw
This approach supersedes much previous work that deals with
several types of attacks including wormhole, rushing, partial more network resources. It is countered by a fix using queue
deafness, routing loops, routing black holes, routing gray holes, regulation at the access point. Other attacks against DSR are
and network partition attacks. the routing loop attack in which an attacker generates forged
Index Terms—Ad hoc wireless networks, security. routing packets causing data packets to cycle endlessly; the
routing black hole attack in which an attacker simply drops
all packets it receives; and the network partition attack in
I. I NTRODUCTION which an attacker injects forged routing packets to prevent
UR focus is on the problem of security of ad-hoc,
O multi-hop, wireless networks. The wireless nodes in
these types of networks need to determine when to transmit
one set of nodes from reaching another. These attacks are
all countered in the Ariadne protocol [9] by the joint use of
routing chains, encryption, and packet leashes. Some protocols
packets and at what power levels, discover routes from sources such as Watchdog and Pathrater [14] try to pre-empt attacks
to destinations, and ensure overall end-to-end reliability, all by maintaining a blacklist that tracks malicious behavior, but
without any centralized controller guiding the process. This this backfires if an attacker maligns a good node, causing
requires a suite consisting of multiple protocols. other good nodes to add that node to their blacklists. These
Several candidate have been proposed. Medium access attacks are not targeted at violating privacy of communications
control protocols include IEEE 802.11 [10] and MACAW [2], between nodes, which can be avoided simply by encryption.
power control protocols include COMPOW [12] and PCMA Rather, they are generally Denial of Service attacks (DoS),
[15], routing protocols include DSDV [17], AODV [16], DSR which usually take advantage of algorithms that assume the
[11], and OLSR [5], and transport protocols include TCP [20] participating users are good or cooperative.
and variations for ad hoc networks [13], [6], [3], [21]. The basic problem with this arms race approach of harden-
ing algorithms initially designed for good performance is that
*CSL & ECE, Univ. of Illinois, 1308 West Main St., Urbana, IL 61801.
Email: {ponniah1,yihchun}@illinois.edu. Tel: 217-333-4220. one never knows what other vulnerabilities or attacks exist.
**Corresponding author: ECE, Texas A&M University, 3259 TAMU, Thus no guarantees can be provided about the security of the
College Station, TX 77843-3259. Email: [email protected]. Tel: 979-862-3376. protocols at any stage of the arms race process.
This paper is partially based on work supported by NSF under Contract Nos.
CNS-1302182, CCF-0939370 and CNS-1232602, AFOSR under Contract No. Our goal in this paper is to propose an alternate clean slate
FA-9550-13-1-0008, and USARO under Contract No. W911NF-08-1-0238. system-theoretic approach to security that provides provable
2

performance guarantees. We pursue a model-based approach, model, with provable guarantees provided at each step. Section
comprising a physical model of node capabilities, clocks, VII provides some such directions for model generalization.
cryptography, and wireless communication. It is an initial Second, though not merely asymptotic, the optimality is
attempt to holistically model the entire dynamics of an ad-hoc over a large time period, and the overhead of transient phases
wireless network that has been infiltrated with hostile nodes. of the protocol may be high. However, there is much scope
Our goal is to design a protocol suite for the complete for optimizing protocol overhead while preserving security.
life-cycle of the wireless system, all the way from the very Third, how should one view the proposed protocol suite?
birth of the nodes, and continuing through all phases of the The answer is layered. At a minimum, it can be regarded
network formation process, to a long-term operation where as a constructive existence proof that one can indeed pro-
the network is carrying data reliably from sources to their vide optimal performance while guaranteeing security, with
destinations. The good nodes don’t know who the bad nodes the identified model class only serving as an exemplar of
are, and are required to follow the published protocol suite. conditions under which this can be done. To a more receptive
Throughput all phases, the bad nodes can perfectly collaborate reader, the designed protocol suite is suggestive of of how one
and incessantly indulge in any disruptive behavior to make the can do so. The architectural decomposition into several phases
network formation and operation dysfunctional. They could could perhaps be kept in mind by future protocol designers.
just “jam,” or engage in more intricate behavior such as not At any rate, one hopes that this approach will trigger several
relay a packet, advertise a wrong hop count, advertise a wrong critical reactions among a skeptical readership, and lead to
logical topology, cause packet collisions, disrupt attempts at follow up work that designs protocols with guaranteed security
cooperative scheduling, drop an ACK, refuse to acknowledge and performance for more general model classes.
a neighbor’s handshake, or behave inconsistently. Section II describes the model, Section III the main results,
We design a protocol suite that is provably secure against Section IV an outline of the approach, Section V the protocol
all such attacks by the malicious nodes. Not only that, it suite, and Section VI proves feasibility and optimality.
guarantees min-max optimal performance. The performance
is described by a given utility function, which the good nodes
II. T HE M ODEL
wish to maximize by publishing a complete protocol suite and
conforming to it. The bad nodes on the other hand aim to The model of an ad-hoc wireless network infiltrated by
minimize this utility by indulging in all manner of “Byzantine” hostile nodes can be organized into four categories: the nodal
behavior described above not conforming to the protocol. model (N), communication model (CO), clock behavior (CL),
This leads to a zero-sum game. Since the good nodes first and cryptographic capabilities (CR).
announce the protocol, the best value of the utility function that Nodal model: (N1) There are n nodes, some good and some
the good nodes can hope to attain is its max-min, where the bad. Let G denote the set of good nodes, and its complement
maximization is over all protocol suites, and the minimization B the set of bad nodes. (N2) The good nodes do not know
is over all Byzantine behaviors of the bad nodes. We will prove who the bad nodes are a priori. (N3) The bad nodes are able
that the protocol suite designed attains this max-min to within to fully coordinate their actions, and are fully aware of their
any  > 0. Moreover, we establish three even stronger results. collective states (equivalent to unlimited bandwidth between
First, this game actually has a saddle point, i.e., the protocol them). (N4) The good nodes are all initially powered off, and
suite attains the min-max (to within any  > 0). (Generally, they all turn on within U0 time units of the first good node
min-max results in a higher utility than max-min, since the that turns on.
bad nodes have to first disclose their tactics). Communication model: (CO1) Each node i can choose
Second, the bad nodes can do no better than just jamming or from among a finite set of transmission/reception modes Mi
conforming to the published protocol suite on each “concurrent at each time. Each mode corresponds, if transmitting, to a
transmission vector,” a generalization of the notion of an joint choice of power level, modulation scheme and encoding
“independent set” of nodes that can simultaneously transmit. scheme for each other intended receiver node, or to just listen-
They do not benefit from more elaborate Byzantine antics. ing and not transmitting, or even to “jamming,” which simply
Third, the protocol optimally exploits any non-hostile be- consists of using its power output to emit noise. (CO2) The
havior of the bad nodes. If they behave suboptimally, i.e., are good nodes are half-duplex, i.e., cannot transmit and receive
not as hostile as they could be, then it will take advantage. simultaneously. (CO3) We call c = (c1 , c2 , . . . , cn ) denoting
This is a desirable feature since while one wants to design the mode choices of all the nodes made at a certain time, as
protocols that are guaranteeably secure in the worst case, one a “concurrent transmission vector” (CTV). (It is more general
would want them to exploit any benignness in the environment. than an independent set that is sometimes used to model
Some important qualifications need to be noted. First, the wireless networks). We will denote by cG = (ci : i ∈ G)
results are valid only for the postulated model of the network. and cB = (ci : i ∈ B) the vectors of choices of modes
Future research may identify technological capabilities outside made by the good and bad nodes respectively, with each
the model that can attack the protocol suite. Such discoveries ci ∈ Mi , and let CG and CB denote the sets of all such
will, one hopes, lead to the development of more general choices. We will denote by C := CG × CB , the set of all
models and procotols provably secure in them. The research CTVs. (CO4) Each c results in a “link-rate vector” r(c) of
enterprise will thereby be elevated to a higher level; instead of dimension n(n − 1). Its ij-th component, rij (c), is the data
reacting to each proposed protocol one reacts to each proposed rate at which bits can be sent from node i to node j at that
 3

time. Due to the shared nature of the wireless medium, the enable an attacker to forge, alter, or tamper with an encrypted
rate depends on the transmission mode choices made by all the packet generated with the corresponding private key. The
other nodes, as well as the geographic locations of the nodes, good nodes encrypt all their transmissions. (CR2) Each node
the propagation path loss, the ambient noise, and all other possesses the public key of a central authority. (CR3) Each
physical characteristics affecting data rate. A component rij (c) node possesses an identity certificate, signed by the central
may be zero, for example if the SINR at j is below a threshold authority, containing node i’s public key and ID number. The
value for decoding, or if node i is not transmitting to node j. certificate binds node i’s public key to its identity. (CR4) Each
(CO5) If a certain rate vector is achievable then lower rates are node possesses a list of all the other n node IDs.
also achievable. To state this, let Λ := {rij (c) : i 6= j, c ∈ C}
denote the finite set of all possible rates than can be achieved.
III. T HE M AIN R ESULTS
We suppose that for every c, and r0 ≤ r(c) (understood
component wise) with all elements in Λ, there is a choice Each time that the good nodes make a certain choice cG , the
c0 ∈ C such that r(c0 ) = r0 . This assumption is not strictly bad nodes could respond with some choice drawn only from
necessary, but it helps to simplify the statement that bad nodes a certain subset CB,cG ⊆ CB . In this way they could ensure
can claim to receive only at low rates. (CO6) In the case of that only the subset E := {(cG , cB ) : cG ∈ CG , cb ∈ CB,cG }
a bad node j, the rate rij (c) may be the result of some other is ever employed by the network. If so, we will say that E
bad node being able to decode the packet from i at that rate, is enabled, while its complement D := C \ {(cG , cB ) : cG ∈
and then passing on that packet to j, since bad nodes can CG , cb ∈ CB,cG } is disabled by the bad nodes. We will denote
collaborate perfectly. In the case of a bad node i, the rate by ∆ the set of all such sets D that they have the capability
rij (c) may be the result of some other bad node being able to to disable. For any set E of enabled CTVs, let R(E) :=
transmit the packet successfully to j at that rate, pretending to ConvexHull({r(c) : c ∈ E}) be the set of link rate-vectors
be i. Meanwhile, in either case, the bad node may be jamming. supported by E, i.e., generated by time sharing over E. Let
Thus a bad node can both jam and appear to be cooperating, G(E) be a directed graph over the nodes, where there is an
whether transmitting or receiving, at the same time. (CO7) edge ij if and only if rij (c) > 0 for some c ∈ R(E).
The bad nodes can claim to have received transmissions from We assume that the good nodes can communicate in a multi-
each other at any of the rates in the finite set Λ, as they please. hop fashion with each other over bidirectional links at some
To state this, for c = (cG , cB ), we will partition the resulting minimal positive rate, regardless of what the bad nodes do:
link-rate vector as r(c) = (rGG (c), rGB (c), rBG (c), rBB (c)), Connectedness Assumption (C): Let G ∗ := G(C \ D∗ ) be the
where rBG denotes the link-rates from the bad nodes to the graph resulting from the maximum set D∗ ∈ ∆ that the bad
good nodes, etc. We suppose that for every c = (cG , cB ) and nodes can disable. We will assume that the good nodes are
every r0 with all elements in Λ, there is a c0B ∈ CB such that connected in the subgraph of G ∗ that consists only of edges
r(cG , c0B ) = (rGG (c), rGB (c), rBG (c), r0 ). (CO8) The good ij for which both ij as well as ji are edges in G ∗ .
nodes know Λ, and an upper bound on the cardinalities of Denoting by Pij the set of all paths from i to j, the
the Mi ’s, but do not know the values of the vectors r(c) for multi-hop capacity region of n(n − 1)-dimensional end-to-
any c ∈ C. (CO9) The assumption that the link-rate vector end source-destination throughput vectors is defined in the
r(c) does not change with time implicitly assumes that nodes
P way as C(E) := {x : For some vector
standard Py ≥ 0 with
are not mobile to any significant extent. We comment further 0 ≤ p:`∈p yp ≤ r` for some r ∈ R(E), xij = p∈Pij yp for
about this assumption in Section VII, all 1 ≤ i, j ≤ n, j 6= i}.
Clock model: (CL1) Each good node i has a local We employ a utility function defined over the throughputs
continuous-time clock that it initializes to zero when it turns of any subset of source-destination pairs of interest:
on. Its time τ i (t) is affine with respect to some reference time Utility function assumption (U): For any subset S ⊆
t ≥ 0, i.e., τ i (t) = ai t + bi where ai and bi are called the {1, 2, . . . , n} and any throughput vector x, let U (x, S) depend
skew and offset respectively. Wlog, the time t above and in only on xij for i, j ∈ S. For every S, U (x, S) is continuous
(N4) is taken equal to the clock time of the first good node to and monotone increasing in the components of x.
turn on. (CL3) Denoting the relative skew and offset between We now consider the game where the good nodes wish to
nodes i and j by aij := aaji and bij := bi − aij bj , node i’s maximize it for the nodes perceived to be good, while the bad
time with respect to node j’s time s is τji (s) = aij s + bij . We nodes wish to minimize it over all their Byzantine behaviors.
assume 0 < aij ≤ amax . As a corollary of (N4,CL1,CL3), To obtain an upper bound on utility, suppose that the bad nodes
|bij | ≤ amax U0 , since τ i (U0 ) ≥ 0. (CL4) The good nodes do disable only the CTVs in D and reveal this choice to the good
not know their skew or offset a priori. (CL5) Finally, due to its nodes. Let E := C \ D. If G(E) has several strongly connected
digital processor, a good node i can only observe a quantized components, then, by the connectedness assumption (C), the
version of its continuous-time local clock τ i (t). good nodes are all in the same component, denoted by F (E),
and thus know that the nodes outside F (E) are bad. They will
Cryptographic capabilities: (CR1) Each node is assigned therefore only consider the utility accrued as U (x, F (E)), and
a public key and a private key; information encrypted by a maximize it over all x ∈ C(E). Hence an upper bound on
private key can only be decrypted with the corresponding achievable utility is min max U (x, F (C \ D)). Our main
public key. The private key is never revealed by a good D∈∆ x∈C(C\D)
result, elaborated on in Theorem 6.2, is:
node to any other node. Possession of a public key does not
4

Theorem 3.1: Consider a network that satisfies (N), (CO), all the nodes are good, and, second, also that the nodes know
(CL), (CR), (C) and (U). Given an arbitrary , where 0 <  < the network topology and other parameters, both of which
1, the protocol described in Section V ensures that all the good are false. This leads to the challenge: How to determine the
nodes obtain a common estimate of the component that they network, while under attack from bad nodes when one does
are all members of, and achieves the utility not know the network? We present a complete protocol suite
that proceeds through several phases to achieve this end result.
(1 − ) min max U (x, F (C \ D)). (1)
D∈∆ x∈C(C\D) After their birth, the nodes need to first discover who their
neighbors are. This requires a two-way handshake, which
Some important consequences are the following. Normally, presents one problem already. Two good nodes that are neigh-
one would expect that since the good nodes have to first bors can successfully send packets to each other if there are
declare their protocol and follow it, they can only attain “max- no primary (half-duplex) or secondary (collision) conflicts. To
min,” which is generally smaller than min-max. Since the latter achieve this we employ an Orthogonal MAC Code [18]. Next,
can be attained (arbitrarily closely), it shows firstly that the bad the two nodes need to update their clock parameters. After this,
nodes are unable to benefit from having a priori knowledge of the nodes propagate their neighborhood information so that
the protocol. Second, since all that the bad nodes can benefit everyone learns about the network topology. This also poses
from is deciding which sets to disable, they are effectively some challenges when there are intermediary bad nodes. This
limited to jamming and/or cooperating in each CTV. Other is addressed by a version of the Byzantine General’s algorithm
more Byzantine behaviors are not any more effective. of [1], by capitalizing on connectedness assumption (C). Next,
The example below shows why a bad node may prefer to even though all the good nodes converge to a common network
“conform” rather than jam for some utility functions. view, that view may be internally inconsistent, especially with
respect to clocks. To resolve this we employ a certain consis-
Example 3.1: Consider the network of Figure 1. Nodes 1 tency check algorithm. Next, the nodes proceed to determine
and 2 are good and in close proximity, while node 3 is bad and an optimal schedule for time sharing over the set of CTVs
located far away. Consider the “fairness-based ”utility function that have performed consistently from the very beginning, and
U (x) := min{x12 , x32 }. If node 3 jams, then the connected execute it. However, a bad node that has cooperated hitherto
component becomes {1, 2}, and the good nodes proceed to may not cooperate at this point. Hence the results of this
maximize only x12 , which node 3 can only slightly impinge operational phase need to be verified, the dysfunctional CTV
because it is so far away from node 2. However, if node 3 pruned, the schedule re-optimized, and the procedure iterated.
cooperates, then the connected component is {1, 2, 3}, and The reader may wonder: Why do we even need a notion of
the optimal solution for this “fair” utility function is to make “time”? First, without it, we cannot even speak of throughput
x32 = x12 . However, link 32 being weak, it requires much or thus of utility. Second, we use local clocks to schedule
more airtime than link 12, thus considerably reducing x12 . transmissions and coordinate activity (as is quite common,
e.g., time-outs in MAC and transport protocols). On the
other hand, dependence on distributed synchronized clocks
for coordinated activity opens yet another avenue for bad
nodes to sabotage the protocol – interfering with the clock
Fig. 1: Example 3.1. synchronization algorithm. Therefore, topics like scheduling,
clock synchronization, utility maximization, and security, are
deeply interwoven. Therefore one needs a holistic approach
IV. T HE O UTLINE OF THE A PPROACH that addresses all these issues at every stage of the operating
The heart of the approach is to investigate different CTVs, lifetime, and guarantees overall security and min-max opti-
exploiting the fact that the operation of the network consists of mality. This is the raison d’être for this paper.
invoking which such set to use at any given instant. If a good
node fails to receive a scheduled packet transmitted during a
V. T HE P HASES OF THE P ROTOCOL S UITE
CTV set, then that good node alerts the rest of the network
during a verification phase, and the offending CTV set is never The protocol suite consists of six phases: Neighbor Discov-
used again. After each such pruning the network then re- ery, Network Discovery, Consistency Check, Scheduling, Data
optimizes its utility over the remaining CTVs. The decreasing Transfer, and Verification. Proofs are deferred to Section VI.
sequence of remaining sets of CTVs necessarily converges to We first note the necessity for a key ingredient. Even two
an operational collection of CTVs, over which the utility is good nodes that are neighbors as in assumption (C) are only
optimized by time sharing. Since the set of disabled CTVs is guaranteed to be able to successfully send packets to each
determinable by the network, as we show, it is the same as other provided one is transmitting, the other is listening (since
if it were revealed to the good nodes a priori, which allows good nodes are half-duplex), and the remaining good nodes
achievement of min-max. It also shows why more complex are all silent. The Orthogonal MAC Code (OMC) of [18]
Byzantine behaviors than jamming or cooperating are not any ensures the simultaneity of all these events, even though the
more effective for the bad nodes. clocks of different nodes have different skews and offsets.
There are however several problems that lie along the way For each pair of nodes i, j, it defines certain zero-one valued
to realizing this scheme. First, all of the above presumes that functions of local time at each node, such that if i transmits
 5

a packet of duration W to j at that time, then the packet is Algorithm 1 The Neighbor Discovery Phase
successfully received, and the delay involved in waiting for procedure N EIGHBOR D ISCOVERY
Ni := {1, . . . , n} \ i
such an eventuality is never more than a certain TM AC (W ). while t ∈ S1 do
T X R X MAC(P RBi→Ni ,P RBNi →i )
U PDATE(Ni )
end while
A. The Neighbor Discovery Phase while t ∈ S2 do
T X R X MAC(ACKi→Ni ,ACKNi →i )
In this phase, each node i will determine the identity and end while
relative clock parameters of nodes in its neighborhood Ni , and while t ∈ S3 do
(1) (1)
T X R X MAC(T IMi→N ,T IMN →i )
include this data in a mutually authenticated link certificate. U PDATE(Ni )
i i

In the first two steps, each node i attempts a handshake with end while
while t ∈ S4 do
a neighbor node j by broadcasting a probe packet P RBij and (2) (2)
T X R X MAC(T IMi→N ,T IMN →i )
i i
waiting for an acknowledgement ACKji . The probe packet U PDATE(Ni )
end while
contains an identity certificate signed by a central authority. while t ∈ S5 do
Given Ni := {1, . . . , n}\i, an initial candidate for the set (1) (1)
T X R X MAC(LN Ki→N ,LN KN →i )
i i
of bidirectional neighbors of i (as in (C)), to indicate that U PDATE(Ni )
end while
node i transmits P RBij to each node j ∈ Ni via the while t ∈ S6 do
(2) (2)
OMC, and receives P RBjj from each node j ∈ Ni , we use T X R X MAC(LN Ki→N ,LN KN →i )
i i
U PDATE(Ni )
TxRxMAC(P RBi→Ni ,P RBNi →i ). If a probe packet is not end while
received from some node j, then j is pruned from Ni . end procedure

Next, node i transmits an acknowledgment ACKij to node

j containing a signed confirmation of the received probe
packet P RBj . Node i also listens for an acknowledgment
ACKji from node j. Node i further removes from Ni any B. The Network Discovery Phase
nodes that failed to return acknowledgements.
Then node i transmits to each node j ∈ Ni a pair of timing The purpose of this Phase is to allow the good nodes to
(1) (2) (1)
packets T IMi,j and T IMj,i that contain the send-times sij obtain a common view of the network topology and consistent
(2) estimates of all clock parameters. To accomplish this, the good
and sij respectively as recorded by its local clock τ j (t). Node
(1) nodes must disseminate their lists of neighbors to all nodes,
i also receives a corresponding pair of timing packets T IMi,j
(2) so that all can decide on the same topology view. However
and T IMj,i from node j, and records the corresponding good nodes do not know a priori which nodes are bad, and
(1) (2)
receive-times rji and rji respectively, as measured by the so bad nodes can selectively drop lists or introduce false lists
local clock τ i (t). Any node that fails to deliver timing packets to prevent consensus. We resolve this by using a version of
to node i is further removed from Ni . The timing packets are the Byzantine General’s algorithm of [1], requiring an EIG
(2) (1)
rji −rji tree data structure. Let Ti denote node i’s EIG tree, which by
used to estimate the relative skew aji by âji := (2) (1) .
sji −sji construction has depth n. The root of Ti is labelled with node
The relative skew is used at the end of the Network i’s neighborhood, i.e., the nodes in Ni and the corresponding
Discovery Phase, to estimate a reference clock with respect collection of link certificates. First node i transmits to every
to the local continuous-time clock. In the last two steps, node node j ∈ Nj in its neighborhood, the list of nodes in Ni
(1)
i creates a link certificate LN Kij containing the computed and corresponding link certificates, while receiving similar
relative clock skew with respect to node j, and transmits this lists from each node in Nj . Node i updates its EIG tree with
link to node j using the OMC. Node i also listens for a similar the newly received lists from its neighbors, by assigning each
(2)
link certificate LN Kji from node j. received list to a unique child vertex of the root of Ti . Node
Finally, node i verifies and signs the received link certificate, i then transmits the set of level 1 vertices of Ti to every node
(2)
and transmits the authenticated version LN Kij back to node in its neighborhood, receiving a set of level 1 vertcies from
j. Node i listens for a similar authenticated link certificate each neighbor in turn. The EIG tree Ti is updated again. This
(2)
LN Kji from j. Any nodes that fail to return link certificates process continues through all n levels of the EIG tree.
are removed from the set Ni . This set now represents the nodes (k)
The notation Ti in Algorithm 2 indicates the
in the neighborhood of node i with whom node i has estab-
k-level vertices of the EIG tree Ti . The notation
lished mutually authenticated link certificates. The Neighbor (k) (k)
TxRxMAC(Ti→Ni , TNi →i ) indicates that, using the OMC,
Discovery Phase’s pseudocode is shown in Algorithm 1. (k) (k)
One problem is that the algorithm must be completed in node i transmits Ti to each node j ∈ Ni , and receives Tj
a partially coordinated manner even though the nodes are from each node j ∈ Ni .
asynchronous; the completion of any stage in the Exponential We use UPDATE(Ti ), to update the EIG tree Ti after the
Information Gathering (EIG) algorithm (see below) depends arrival of new information, and the procedure DECIDE(Ti ) to
on the successful completion of the previous stages by all infer the network topology based on the EIG tree. The n-stage
other good nodes. Consequently, we assign increasingly larger EIG algorithm guarantees that if the subgraph of good nodes
intervals Sk := [tk , tk+1 ), k = 1, . . . 6, to each successive is connected, then each good node will decide on the same
protocol stage; see Section VI. topological view.
6

Algorithm 2 The EIG Byzantine General’s Algorithm Algorithm 3 Consistency Check Algorithm at Node i
procedure EIGB YZ MAC(Ni ) procedure C ONSISTENCY C HECK
(0)
Ti := Ni (n+1)(a )n+1 +(n+1)(a
max max )n+1 U0
ST ART := a
for k = 1, . . . n do for each cycle Cj do
while t ∈ S6+k do k =N EXT(Cj )
(k) (k)
T X R X MAC(Ti→N , TN →i ) m =P REV(Cj )
i i
U PDATE(Ti ) if i=L EADER(Cj ) and t ≥ ST ART then
end while T RANSMIT(T IMi→k )
end for else if i ∈ Cj then
D ECIDE(Ti ) R ECEIVE(T IMm→i )
end procedure T RANSMIT(T IMi→k )
end if
end for
end procedure

C. The Consistency Check Phase

Unfortunately, a fundamental difficulty is that malicious
nodes along a path 1, . . . , n may have generated false time the topology any link whose endpoints generate time-stamps
stamps in the Neighbor Discovery Phase, and thus corrupted inconsistent with its declared relative skew or violated the
the measured relative skews between adjacent nodes. There delay bound. The complete Phase is shown in Algorithm 4.
may be several connecting paths infiltrated by bad nodes that
thereby generate different values for the relative skew. It is Algorithm 4 The Network Discovery Phase at Node i
impossible to determine the correct path from the relative procedure N ETWORK D ISCOVERY
EIGB YZ MAC(Ni )
skews alone. Every pair of such inconsistent paths corresponds C ONSISTENCY C HECK
to an inconsistent cycle in which the skew product is not EIGB YZ MAC(Ti )
end procedure
equal to one. We use an algorithm called Consistency Check
to identify the path that generated the correct relative skew.
Consistency Check works by circling a timing packet around At the conclusion of Network Discovery Phase node i shares
every cycle in which the skew product differs from one by a common view of the network topology with all other good
more than a , a desired maximum skew error. At the conclu- nodes. As a result, the network can designate the node with
sion of the test, at least one link with a malicious endpoint smallest ID as the reference clock. Furthermore, each node i
will be removed from the cycle, eliminating a connecting path. has an estimate of the reference clock τir (t) with respect to its
During the test, each node in such a cycle is obliged to append local clock t using the formula τ̂ir (t) := âri t, where estimated
a receive time-stamp and a send time-stamp generated by the âri and actual relative skews ari differ by at most a .
local clock before forwarding the packet to the next node.
These time-stamps must satisfy a delay bound condition; the
send time and receive time cannot differ by more than 1 clock D. The Scheduling Phase
count. A node fails the consistency check otherwise, or if its In the Scheduling Phase the good nodes in the network
time stamps do not agree with its declared relative skew. The obtain a common schedule governing the transmission and
key idea is that if the test starts after a sufficiently large amount reception of data packets. A “schedule” is simply a sequence
of time has elapsed, the clock estimates based on faulty relative of CTVs, each with specified start and end times. Each node i
skews will have diverged so extensively from the actual clocks divides the Data Transfer Phase into time-slots, and assigns a
that at least one malicious node in the cycle will find it CTV to each time-slot so that the resulting throughput vector
impossible to generate time-stamps that are consistent with is utility optimal. All the good nodes independently arrive at
its declared relative clock skew and satisfy the delay bound the same schedule since they independently optimize the same
condition (all proofs are in Section VI):. utility function over the same C (ties broken lexicographically).
Theorem 5.1: Let Tj be the start-time of the Consistency Since the good nodes must conform to a common schedule,
Check for the jth inconsistent cycle, consisting of nodes each node i generates a local estimate of the reference clock
i1 , . . . , im . At least one malicious node in cycle j will violate a τ̂ir (t) with respect to its local clock t, as described in the
â ∗ (m+1)K+b
consistency check condition, if Tj > im ,i a where Network Discovery Phase. However, this estimate may not be
∗
i is the node with the smallest skew product âi∗ ,i1 . perfectly accurate; some of the nodes on a path along which
Algorithm 3 depicts Consistency Check. Given a cycle, relative skew is estimated may be malicious and can introduce
j, k and m denote nodes that follow and precede node i an error of at most a into the computed relative skew. To
respectively in the cycle. If node i is the leader of the cycle, address this, the time-slots are separated by a dead-time of
i..e., the node with smallest ID, then node i initiates the timing size D, where given any pair of nodes (i, j), D is chosen to
packet that traverses the cycle and transmits it to node k. satisfy |τ̂ir (t) − τ̂jr (τij (t))| ≤ D.
Otherwise, node i waits for the timing packet to arrive from Finally, n2 (n−1) time-slots are enough to guarantee that ev-
node m before forwarding it to node k. ery pair of nodes can communicate once in either direction, via
After all inconsistent cycles have been tested, each node multihop routing, during Data Transfer Phase. The algorithm
i disseminates the set of all timing packets Ti it received to UtilityMaximization(C) for the Scheduling Phase is depicted
other nodes. The EIG algorithm is used to ensure a common in Algorithm 5. At the end of Scheduling Phase, node i shares
view of the timing packets generated. Each node removes from a common utility maximizing schedule with other good nodes.
 7

Algorithm 5 The Scheduling Phase at Node i Algorithm 7 The Verification Phase at Node i
procedure S CHEDULING procedure V ERIFICATION
U TILITY M AXIMIZATION(C) EIGB YZ(Lk )
end procedure U PDATE(Ck+1 )
end procedure

E. The Data Transfer Phase

ness, it converges to a set of CTVs, and a utility-maximizing
In this Phase the nodes exchange data packets using the schedule over it. The overall protocol is in Algorithm 8.
generated schedule. It is divided into time-slots, with each
assigned a CTV, a rate vector, and set of packets for each Algorithm 8 The Complete Protocol
transmitter in the set. To prevent collisions resulting from N EIGHBOR D ISCOVERY
two nodes assigning themselves to different time slots due to N ETWORK D ISCOVERY
for k = 1, . . . , niter do
timing error, node i begins transmission D time-units after the S CHEDULING(Ck )
start of the time-slot. The transmitted packet is then guaranteed DATAT RANSFER(t)
V ERIFICATION
to arrive at the receiver in the same time slot, for appropriate end for
choice of D and time-slot size Bslot .
Algorithm 7 defines this phase, with mk denoting a message
to be transmitted or received by node i in the kth slot, Tstart VI. F EASIBILITY OF P ROTOCOL AND O PTIMALITY P ROOF
the start time of the phase measured by the local estimate of
For the distributed wireless nodes to exchange data over the
the reference clock τ̂ir (t)), Sk = [tk , tk+1 ), k = 1, . . . , N the
network, they must not only have the same topological view, in
time-slots of the phase with N = n2 (n − 1), t1 = Tstart , and
order to independently arrive at a common schedule, but they
tk+1 := tk + Bslot + 2D, and T X(k) and RX(k) the CTV,
must also have a consistent view of a reference clock so that
and receiving nodes during slot k.
any activity will conform to this common schedule. For this,
we consider the consistency check algorithm of Section V-C.
Algorithm 6 The Data Transfer Phase at Node i
Consider a chain network 1, . . . , n, where the endpoints,
procedure DATAT RANSFER(Tstart )
for k=1,. . . ,N do nodes 1 and n are good, and the intermediate nodes 2, . . . , n−
if t ∈ Sk and t ≥ tk + D and i ∈ T X(k) then 1 are bad. Note that this network can also be reduced to a cycle
T RANSMIT(mk )
else if t ∈ Sk and i ∈ RX(k) then of size n − 1 by making both endpoints the same node. We
R ECEIVE(mk ) assume that the two good endpoints do not know if any of the
end if
end for intermediate nodes are bad.
end procedure Now suppose that each pair of adjacent nodes (i, i − 1) for
i = 2, . . . , n has declared a set of relative skews and offsets
{âi,i−1 , b̂i,i−1 }, and that each node in the chain knows this set.
F. The Verification Phase The two good nodes wish to determine whether Qn the declared
skews are accurate, i.e., whether an,1 = i=2 âi,i−1 . Unfor-
However, malicious nodes may not cooperate in the Data
tunately, the good nodes have no way of directly measuring
Transfer Phase. So whenever a scheduled packet fails to arrive
an,1 . The estimate of an,1 is obtained from the skew product
at node j, it adds the offending CTV and associated packet
itself, which is the very quantity that needs to be verified.
number to a list, and disseminates the list in the Verification
So, instead, the good nodes carry out the consistency check
Phase using the EIG Byzantine General’s algorithm. These
described earlier. After waiting a sufficiently long time, node
CTVs are then permanently further pruned from the collection
1 initiates a timing packet that traverses the chain from left
of feasible CTVs. With Lk denoting the list that failed during
to right. Each node in the chain is obligated to forward the
the kth iteration of the Data Transfer Phase, the set Ck of
packet after appending receive and time-stamps that satisfy the
feasible CTVs during the kth iteration of the Scheduling Phase
skew consistency and delay bound conditions.
is updated to Ck+1 = Ck \ Lk in Algorithm 7.
In order to defeat this test, the bad nodes, having collectively
All communication can be scheduled into slots separated by
declared a false set of relative skews and offsets, must support
a dead-time of 2D. Within each of the n stages of the EIG
two sets of clocks for each node i ∈ {2, . . . , n}: a “left”
Byzantine General’s algorithm, there are n(n − 1) pairs of
clock τ i,l (t) to generate receive time-stamps, and a “right”
nodes that may communicate, and at most n nodes on the
clock τ i,r (t) to generate send-time stamps. Unlike the clocks
connecting path. Therefore, the total number of time slots
of the good nodes, the left and right clocks of the bad
required is n3 (n − 1).
nodes need not be affine with respect to the global reference
At the conclusion of the phase, the good nodes again share a
clock. In fact, the bad nodes are free to jointly select any
common view of the set of feasible CTVs for the next iteration
set of clocks {τ i,l (t), τ i,r (t), ∀i = 2, . . . , n − 1} that are
of the Scheduling Phase.
arbitrary functions of t, a much larger set than the affine
clocks being emulated. However, we will show that if node
G. The Steady State 1 waits sufficiently long enough, there is no set of clocks
The network cycles through Scheduling, Data Transfer, and {τ i,l (t), τ i,r (t), i = 2, . . . , n − 1} that can generate time-
Verification Phases for niter iterations. Eventually, by finite- stamps which satisfy both conditions of the consistency check.
8

   n+1,l 
ân,1 −1 τ (tn+1,l )−b̂n+1,n
Let ri,i−1 and si,i+1 denote the receive and send time- τ n,r (tn,r ) = ân,1 ân+1,n +
stamps generated by a bad node i with respect to the left Pn b̂i,i−1 
ân+1,n −1

n+1,l b̂n+1,n
+ τ̂ (tn+1,l ) + ân+1,n =
and right clocks τ i,l (t) and τ i,r (t) respectively. Let ti,l and  i=2 âi,1 ân+1,n
ân+1,1 −1 n+1 b̂
τ n+1,l (tn+1,l ) + i=2 i,i−1
P
ti,r denote the time with respect to the global reference clock ân+1,1 âi,1 , which follow from
at which the receive and send time-stamps are generated at the induction hypothesis above in the Lemma statement, and
node i. We have ri−1,i := τ i,l (ti,l ) and si,i+1 := τ i,r (ti,r ). the fact that τ n,r (tn,r ) ≥ τ n,l (tn,l ) and ai,1 ≥ 1 for all
Let t1 and tn denote the time with respect to the global 2 ≤ i ≤ n + 1 (that is, the coefficient âi,1 − 1 is negative).
reference clock at which the timing packet was transmitted We next Qjbound S1 in the special case when the reverse skew
by node 1 and received by node n respectively. We have product i=1 ân−(i−1),n−i ≤ 1 for all j ≥ 1.
s1,2 := τ 1 (t1 ),n−1,n := τ n (tn ). To simplify notation we will
Qj
Lemma 6.2: Suppose i=1 an−(i−1),n−i ≤ 1 for 2 ≤ j ≤
define left and right clocks at the endpoints so that t1,r := Pj
n − 1. Then i=1 (τ n−(i−1),l (tn−(i−1),l ) − τ n−i,r (tn−i,r )) ≤
t1 , tn,l := tn and τ 1,r (t1,r ) := τ 1 (t1 ), τ n,l (tn,l ) := τ n (tn ). Pn−1
(ân,n−j − 1) τ n−j,r (tn−j,r ) + b̂n,n−1 + i=n−j+1 ân,i b̂i,i−1 .
In order to prove that both conditions of the consis- Proof: We have by definition τ n−(k−1),l (tn−(k−1),l ) :=
tency check cannot be satisifed by any set of clocks ân−(k−1),n−k τ n−k,r (tn−k,r ) + b̂n−(k−1),n−k . For j = 1,
{τ i,l (t), τ i,r (t), i = 2, . . . , n − 1}, we will assume that the τ n,l (tn,l ) − τ n−1,r (tn−1,r ) = (an,n−1 − 1)τ n−1,r (tn−1,r ).
first condition is satisfied, and show that second must fail. Now assume the Lemma P holds for j. We will show that
Therefore, the clocks must satisfy: j+1 n−(k−1),l
it must hold for j + 1: k=1 (τ (tn−(k−1),l ) −
j
τ n−k,r (tn−k,r )) n−(k−1),l
P
τ i,l (ti,l ) = ai,i−1 τ i−1,r (ti−1,r ) + bi,i−1 for i ≤ 2 ≤ n. (2) = k=1 (τ (t n−(k−1),l ) −
n−k,r n−j,l n−(j+1),r
τ (tn−k,r )) + τ (tn−j,l ) − τ (tn−(j+1),r ) ≤
In addition, by virtue of causality, we also have: Pn−1
(ân,n−j −1)τ n−j,r (tn−j,r )+b̂n,n−1 + k=n−j+1 ân,k b̂k,k−1 +
τ i,l (ti,l ) ≤ τ i,r (ti,r ). (3) τ n−j,l (tn−j,l ) − τ n−(j+1),r (tn−(j+1),r ) ≤ (ân,n−j −
Pn−1
1)τ n−j,l (tn−j,l ) + b̂n,n−1 + k=n−j+1 ân,k b̂k,k−1 +
We prove that delay bound condition must be violated if node n−j,l n−(j+1),r
τ (tn−j,l ) − τ (tn−(j+1),r ) ≤ (ân,n−(j+1) −
1 waits for a sufficiently large period of time before before Pn−1
initiating the timing packet, i.e., if τ 1 (t1 ) is sufficiently large, 1)τ n−(j+1),r (tn−(j+1),r ) + b̂n,n−1 + k=n−j ân,k b̂k,k−1 .
then for some i, we have τ i,r (ti,r ) − τ i,l (ti,l )
> K. More pre- The above follow from induction hypothesis in Lemma 6.2,
Pn−1 since τ i,l (ti,l ) ≤ τ i,r (ti,r ) and ân,n−j ≤ 1 for 1 ≤ j ≤ n − 1
cisely, we show i=2 τ i,r (ti,r ) − τ i,l (ti,l ) > nK, which
(that is, the coefficient ân,n−j − 1 is negative), and from
implies that some node has violated delay bound condition.
Pn−1 i,r
substitution into τ n−j,l (tn−j,l ) and simplification.
The sum i=2 τ (ti,r ) − τ i,l (ti,l ) cannot be directly We will combine both special cases in Lemma 6.1 and
evaluated because the left and right clocks {τ i,l (t), τ i,r (t)} Lemma 6.2 to obtain an upper bound on S1 . First we define i∗
are arbitrary functions of t. However, we have the as the node with the smallest skew product âi∗ ,1 in the chain
following equality by P repeated addition and subtraction network, that is less than one. That is, âi∗ ,1 = min âk,1 and
n

τ n,l (tn,l ) = τ 1,r (t1,r ) + i=2 τ
i,l (ti,l ) − τ i−1,r (ti−1,r ) = âi∗ ,1 ≤ 1. If no such node exists, set i∗ = 1.
k
Pn−1 i,l
i=2 τ (ti,l ) − P τ i−1,r (ti−1,r ) = τ 1,r (t1,r ) +
S1 + S2 , Now we consider an arbitrary set of skews {âi,i−1 , i =
n i,l i−1,r
where S1 :=
Pn−1 i,l i=2 τ (ti,l
) − τ (ti−1,r ) , S2 := 2, . . . , n}. Next we show that if i∗ ≥ 2 then the forward skew
i−1,r
i=2 τ (ti,l ) − τ (ti−1,r ) . The value S2 is the sum product starting from i∗ is greater than 1, and the reverse skew
of the forwarding delays. We will use (2) and (3) to obtain an product starting from i∗ − 1 is always less than one.
upper bound on S1 . Inserting this upper bound and using the Lemma 6.3: If i∗ ≥ 2 then âj,i∗ ≥ 1 for i∗ + 1 ≤ j ≤ n
fact that τ n,l (t) and τ 1,r (t) are both affine functions of t, will and âi∗ ,i∗ −k+1 ≤ 1 for 1 ≤ k ≤ i∗ . Otherwise, âj,1 ≥ 1 for
allow us to obtain a lower bound on S2 . The proof will then 2 ≤ j ≤ n.
follow easily. We now Q obtain an upper bound on S1 when the Proof: Consider i∗ ≥ 2, and suppose the first part of the
j
forward skew product i=2 âi,i−1 ≥ 1 for all j ≥ 2. assertion is false. I.e., for some j 0 , âj 0 i∗ < 1. It follows that
Lemma 6.1: Suppose
Qj
ai,i−1 ≥ 1 for 2 ≤ âj 0 1 = âj 0 i∗ âi∗ 1 ≤ âi∗ 1 . But then j 0 is a node with a smaller
Pn i=2 i,l i−1,r skew product âj1 than node i∗ , which contradicts the definition
i ≤ n. Then i=2 (τ (ti,l ) − τ (ti−1,r )) ≤
ân,1 −1 n,l
Pn b̂i,i−1 of i∗ . Now suppose that the second part of the assertion is
τ (t n,l ) .
ân,1 i=2 âi,1 false. I.e., for some j 0 we have âi∗ j 0 > 1. It follows that âi∗ 1 =
Proof: We have by definition τ n+1,l (tn,l ) := âi∗ j 0 âj 0 1 ≥ âj 0 1 . But then j 0 is a node with a smaller skew
ân+1,n τ n,r (tn,r ) + b̂n+1,n . For n = 2, we have product than node i∗ , which again contradicts the definition
of i∗ . Now consider the case when i∗ = 1. Then by definition
 
a2,1 −1 b
τ 2,l (t2,l ) − τ 1,r (t1,r ) = a2,1 τ 2,l (t2,l ) + a2,1 .
Now assume the lemma is true for n. We
2,1
will of i∗ it follows that âj1 ≥ 1 for all 2 ≤ j ≤ n.
Pn+1 i,l We now obtain an upper bound on S1 for arbitrary skews.
show that it also holds for n + 1: i=2 (τ (ti,l ) −
n Lemma 6.4: Suppose i∗ ≥ 2. We have the follow-
τ i−1,r (ti−1,r )) = i,l i−1,r
P
i=2 (τ (t i,l ) − τ  (ti−1,r )) + Pn
 ing inequality: τ (t ) − τ j−1,r (tj−1,r ) ≤ (âi∗ ,1 −
j,l
τ n+1,l n,r
(tn+1,l ) − τ (tn,r ) ≤
ân,1 −1
τ n,l (tn,l ) +  j=2  j,l
ân,1 â ∗ −1 b̂n,1
Pn b̂i,i−1 1)τ 1,r (t1,r ) + n,i ân,i∗ τ n,l (tn,l ) + ân,i ∗
.
+ τ n+1,l (tn+1,l ) − τ n,r (tn,r ) ≤ Proof:
Pn
τ j,l
(t ) − τ j−1,r (tj−1,r )
 i=2 âi,1 j=2 j,l
ân,1 −1 n b̂ Pi∗ j,l
τ n,r (tn,r ) + + τ n+1,l (tn+1,l ) −
P i,i−1 n
j−1,r j,l
P
ân,1 i=2 âi,1 j=2 τ (tj,l ) − τ (tj−1,r ) + j=i∗ +1 τ (tj,l ) −
 9

τ j−1,r (tj−1,r ) =  (âi∗ ,1 − 1)τ 1,r (t1,r ) + b̂i∗ ,i∗ −1 intervals [tk , tk+1 ) and corresponding schedule that guarantees
Pi∗ â ∗ −1 Pn b̂ any message of size W transmitted (via OMC) by node i in the
+ j=2 âi∗ ,j b̂j,j−1 + n,i τ n,l (tn,l )+ i=i∗ +1 âi,i−1 =
 ân,i∗  i,i∗
interval [tk , tk+1 ) (as measured by i’s clock) will be received
â ∗ −1 n â b̂j,j−1
(âi∗ ,1 − 1)τ 1,r (t1,r ) + n,i τ n,l (tn,l ) + j=2 n,j
P
ân,i∗ ân,i∗ by node j in the same interval as measured by node j’s clock.
Proof: Set tk+1 := (amax )2 tk + 2(amax )3 U0
 
1,r ân,i∗ −1 n,l b̂n,1
= (âi ,1 − 1)τ (t1,r ) + ân,i∗ τ (tn,l ) + ân,i∗ .which
∗

follow by applying Lemma 6.2 and Lemma 6.1, by multiplying + (amax )3 TM AC (W ). Suppose a message from node i to
â ∗ node j during [tk , tk+1 ) is transmitted (via the OMC) at
the terms in each summation by ân,i and simplifying, and
(i)
n,i∗ ts := amax tk + (amax )2 U0 with respect to node i’s clock. By
from the definitions of b̂ij and dji . ˆ
substitution and simplification it follows that τij (ts ) ≥ tk and
Now that we have an upper bound on S1 , we can obtain a τij (ts +TM AC (W )) < tk+1 . Hence τij ([ts , ts +TM AC (W ))) ⊂
lower bound on S2 , the sum of the forwarding delays. [tk , tk+1 ), and so j receives this message during the same
Lemma 6.5: The sum P of forwarding delays in
the interval with respect to j’s clock.
n−1 j,l j,r
chain network satisfies: j=2 τ (tj,l ) − τ (tj,r ) ≥ Theorem 6.1: After Network Discovery, the good nodes
(an,1 −ân,1 ) 1,r (b −b̂n,1 ) have a common view of the topology and consistent estimates
ân,i∗ τ (t1,r ) + n,1 .
Pn−1 j,l ân,i∗ j,r
(to within a ) of the skew of the reference clock.
Proof: j=2 τ (tj,l ) − τ (tj,r ) = τ n,l (tn,l ) −
n Proof: From Lemma 6.6 all good nodes will proceed
τ n,r (tn,r ) − j=2 τ j,l (tj,l ) − τ j−1,r (tj−1,r ) ≥ τ n,l (tn,l )
P
−
â ∗ −1
through each stage of Neighbor and Network Discovery Phases
τ n,r (tn,r ) − (âi∗ ,1 − 1)τ 1,r (t1,r ) − n,i ân,i∗ τ n,l (tn,l ) − together, and therefore establish link certificates with their
b̂n,1 τ n,l (tn,l ) b̂n,1 τ n,l (t1,r ) good neighbors. Since they form a connected component, the
ân,i∗ = ân,i∗ − âi∗ ,1 τ 1,r (t1,r ) − ân,i ∗
≥ ân,i∗ −
good nodes obtain a common view of their link certificates
1,r b̂n,1 an,1 τ 1,r (t1,r )+bn,1 1,r
âi∗ ,1 τ (t1,r ) − ân,i∗ = ân,i∗ − âi∗ ,1 τ (t1,r ) − using the EIGByzMAC algorithm and the schedule in Lemma
b̂n,1 (an,1 −ân,1 ) 1,r (bn,1 −b̂n,1 ) 6.6. The good nodes can therefore infer the network topology
ân,i∗ = ân,i∗ τ (t1,r ) + ân,i∗ , which follow
by noting from repeated and the relative skews of all adjacent nodes based upon the
Pn addition and subtraction that
collection of link certificates. Using Consistency Check, the
τ n,l (tn,l ) = τ 1,r (t1,r ) + j=2 τ j,l (tj,l ) − τ j−1,r (tj−1,r ) +
Pn−1 j,l j,r

good nodes can eliminate paths along which bad nodes have
j=2 τ (tj,l ) − τ (tj,r ) , by applying Lemma 6.4, be-
provided false skew data. The good nodes can disseminate this
cause tn,l ≥ t1,r since node n could not have received the
information to each other using the EIGByzMAC algorithm
timing packet before node 1 transmitted it, and since node n’s
and Lemma 6.6 and thus obtain consistent estimates of the
clock is relatively affine with respect to node 1’s clock.
reference clock to within a .
We now complete the proof of consistency check for a
Lemma 6.7: The sequence of adjacent intervals [tj , tj+1 ),
chain network. We show that if the start time of the con-
j = 0, . . . , k is contained in [t0 , c1 t0 + c2 W ) where constants
sistency check is sufficiently large, and the left and right
c1 and c2 depend on amax , k, U0 , and n.
clocks {τ i,l (ti,l ), τ i,r (ti,r )} satisfy the parameter consistency
Proof: For the OMC TM AC (W ) ≤ cW , where c depends
condition, then at least one node will violate delay bound
on amax , and n. The result for k = 1 follows from definition
condition. Hence there are no left and right clocks that can
of tk , and substitution of cW into TM AC (W ), and for general
pass both conditions of consistency check if start time is large.
k by induction and definition of tk .
Proof: We assume node 1 is a good node. Now
(an,1 −ân,1 ) 1,r (b −b̂n,1 )
Lemma 6.8: The time to complete Neighbor and Network
ân,i∗ τ (t1,r ) + n,1 ân,i∗ > nK. But by Lemma 6.5 Discovery Phases Tnei + Tnet is less than c1 log Tlif e + ca2
the LHS of this inequality P is the lower bound of the
sum where c1 , c2 depend only on n, amax , U0 .
n
of the delays in the chain j=2 τ j,l (tj,l j,r

) − τ (tj,r ) . By Proof: From Algorithms 1, 2, 3 and 4 there are at
Pn j,l j,r
substitution, j=2 τ (tj,l ) − τ (tj,r ) > nK. It follows most 6 + n + n|C| + n protocol stages in the Neighbor
that for some malicious node j ∈ {2, . . . , n}, τ j,l (tj,l ) − and Network Discovery Phases. Hence the time required is
τ j,r (tj,r ) > K which violates the delay bound condition. at most c1 t0 + c2 W , where W is the size of a message
Now we can show that neighbor and network discovery to be transmitted, and c1 , c2 are constants depending on the
phases together allow the good nodes to form a rudimentary number of protocol stages amax , U0 , n. The maximum size of
network, where the good nodes have the same topological a message is proportional to the timing packet size log Tlif e .
view and consistent estimates of a reference clock. The first To account for the effect of the minimum start-time Ts for
obstacle is that the protocol is composed of stages that must be the consistency check, we can assume the worst case that the
completed sequentially by all the nodes in the network, even Ts comes into effect during the first protocol stage (instead of
prior to clock synchronization. Suppose that [tk , tk+1 ) is the later in the Network Discovery Phase). From Theorem 5.1 the
interval allocated to the kth stage. Any messages transmitted consistency check start-time is at most ca , where c depends
between adjacent good nodes must arrive in the same interval on U0 , amax , n. Substitution into t0 proves the lemma.
they were transmitted. Since send-times are measured with Lemma 6.9: The time required for the Data Transfer Phase
respect to the source clock, and receive-times with respect is at most c3 B + c4 D where B is the time spent transmitting
to the destination clock, the intervals must be chosen large data packets, D is the size of the dead-time separating time
enough to compensate for the maximum clock divergence slots, and c3 , c4 depend on n alone.
caused by skew aij ≤ amax and offset bij ≤ amax U0 . Proof: The total number of time-slots for data transfer
Lemma 6.6: There exists a sequence of adjacent time- between all source-destination pairs is n2 (n − 1), each sup-
10

porting data transfer of size Bs and a dead-time D. secure wireless networking, and there are several open issues.
Lemma 6.10: The time required for the Verification Phase An important potential generalization is to allow probabilistic
is at most c5 D where c5 depends on n alone. communication. Since the protocol presented has poor tran-
Proof: In each stage of the EIG Byzantine General’s sient behavior, though overall optimal, it needs to be explored
algorithm, there are at most n! vertex values that must be how to increase efficiency in the transient phase.
transmitted with each node in the neighborhood. The value of Much further work remains to be done.
a vertex is a list of CTVs. There are at most 2n CTVs and at
most n nodes in a CTV. Therefore the size of any message to R EFERENCES
be transmitted by a node during EIG algorithm is at most cD, [1] A. Bar-Noy, D. Dolev, C. Dwork, and H. R. Strong. Shifting gears:
where c is a constant dependent on n. Since there are n(n−1) changing algorithms on the fly to expedite Byzantine agreement. PODC
’87, pages 42–51, New York, NY, USA, 1987. ACM.
possible source-destination pairs, there are at most n(n − 1) [2] V. Bharghavan, A. Demers, S. Shenker, and L. Zhang. Macaw: a
time slots in each stage, separated at the beginning and end media access protocol for wireless lan’s. In ACM SIGCOMM Computer
by a dead-time D. Therefore the duration of each stage is at Communication Review, volume 24, pages 212–225. ACM, 1994.
[3] K. Chandran, S. Raghunathan, S. Venkatesan, and R. Prakash. A
most cD + n(n − 1)2D. There are at most n stages. feedback-based scheme for improving TCP performance in ad hoc
We can now prove the main theorem of this paper. wireless networks. IEEE Personal Communications Magazine, 8(1):34–
Theorem 6.2: The protocol ensures that the network pro- 39, Feb. 2001.
[4] J. Choi, J. T. Chiang, D. Kim, and Y.-C. Hu. Partial deafness: A novel
ceeds from startup to a functioning network carrying data. denial-of-service attack in 802.11 networks. In Security and Privacy in
There exists a selection of parameters niter , D, B, a and Communication Networks, volume 50 of Lecture Notes of the Institute
Tlif e that achieves min-max utility over the enabled set, to for Computer Sciences, Social Informatics and Telecommunications
Engineering, pages 235–252. Springer Berlin Heidelberg, 2010.
within a factor , where the min is over all policies of the bad [5] T. Clausen and P. Jacquet. Optimized link state routing protocol (OLSR).
nodes that can only adopt two actions in each CTV: conform RFC 3626, Oct. 2003.
to the protocol and/or jam. The achieved utility is -optimal. [6] Z. Fu, B. Greenstein, X. Meng, and S. Lu. Design and implementation
of a tcp-friendly transport protocol for ad hoc wireless networks. In
Proof: We begin by choosing parameters so that the IEEE International Conference on Network Protocols’02, 2002.
protocol overhead, which includes Neighbor Discovery, Net- [7] Y.-C. Hu, A. Perrig, and D. Johnson. Packet leashes: a defense against
work Discovery, Verification, all dead-times, and iterations wormhole attacks in wireless networks. In INFOCOM 2003, volume 3,
pages 1976 – 1986 vol.3, march-3 april 2003.
converging to the final rate vector, is an arbitrarily small [8] Y.-C. Hu, A. Perrig, and D. B. Johnson. Rushing attacks and defense
fraction of the total operating lifetime. With τ̂ir (t) := âri t in wireless ad hoc network routing protocols. WiSec ’03, pages 30–40,
the estimate of reference clock r with respect to the local 2003.
[9] Y.-C. Hu, A. Perrig, and D. B. Johnson. Ariadne: a secure on-demand
clock at node i, the maximum difference in nodal estimates is routing protocol for ad hoc networks. Wirel. Netw., 11(1-2):21–38, Jan.
bounded as |τ̂ir (τ i (t)) − τ̂kr (τik (τ i (t)))| ≤ 2(amax )2 a Tlif e + 2005.
(amax )2 U0 . With kr be the number of rate vectors in the [10] IEEE Protocol 802.11. Draft standard for wireless lan: Medium access
control (MAC) and physical layer (PHY) specifications. IEEE, July
rate region, we can choose niter , D, B, a and Tlif e to 1996.
niter B
satisfy: niter +2n kr ≥ 1 − l , c1 log Tlif e + c2 +B+c3 D+c4 D ≥ [11] D. Johnson, Y. Hu, and D. Maltz. The dynamic source routing protocol
a
(dsr) for mobile ad hoc networks for ipv4. RFC 4728, Feb. 2007.
1 − d , niter ((c1 log Tlif e + ca2 + B + c3 D + c4 D) ≤ Tlif e , [12] V. Kawadia and P. R. Kumar. Principles and protocols for power
2(amax )2 a Tlif e + (amax )2 U0 ≤ D. These ensure that the control in wireless ad-hoc networks. IEEE Journal on Selected Areas
rate loss due to failed CTVs is arbitrarily small, the time in Communications, 23:76–88, 2005.
[13] J. Liu and S. Singh. ATCP: TCP for mobile ad hoc networks. IEEE
spent transmitting data is an arbitrarily large fraction of the J-SAC, 19(7):1300–1315, July 2001.
duration of that iteration, the operating lifetime is large enough [14] S. Marti, T. J. Giuli, K. Lai, M. Baker, et al. Mitigating routing
to support niter protocol iterations, and the dead-time D is misbehavior in mobile ad hoc networks. In International Conference on
Mobile Computing and Networking: Proceedings of the 6 th annual in-
large enough to tolerate the maximum divergence in clock ternational conference on Mobile computing and networking, volume 6,
estimates caused by skew error a . pages 255–265, 2000.
Let {D(t)} be the decreasing sequence of sets of disabled [15] J. P. Monks, V. Bharghavan, and W.-M. Hwu. A power controlled
multiple access protocol for wireless packet networks. In INFOCOM
CTVs, with limit D̄ attained at some finite time T . Suppose x 2001. Twentieth Annual Joint Conference of the IEEE Computer and
achieves the maximum utility for D̄ over the nodes in the same Communications Societies. Proceedings. IEEE, volume 1, pages 219–
component as the good nodes. No protocol can do better when 228. IEEE, 2001.
[16] C. Perkins, E. Belding-Royer, and S. Das. Ad hoc on demand distance
D̄ is disabled. The proposed protocol attains x(1 − d )(1 − l ). vector (aodv) routing. RFC 3561, July 2003.
[17] C. E. Perkins and P. Bhagwat. Highly dynamic destination-sequenced
distance-vector routing. In SIGCOMM, pages 234–244, London, UK,
VII. C ONCLUDING R EMARKS Aug. 1994.
[18] J. Ponniah, Y.-C. Hu, and P. R. Kumar. An orthogonal multiple access
We have presented a complete suite of protocols that enables coding scheme. Communications in Information and Systems, 12:41–76,
a collection of good nodes interspersed with bad nodes to form 2012.
a functioning network from start-up, operating at a utility- [19] M. Poturalski, P. Papadimitratos, and J.-P. Hubaux. Secure neighbor
discovery in wireless networks: formal investigation of possibility.
optimal rate vector, regardless of what the bad nodes conspire ASIACCS ’08, pages 189–200, New York, NY, USA, 2008. ACM.
to do, under a certain system model. Further, the attackers [20] W. R. Stevens and G. R. Wright. TCP/IP Illustrated: Vol. 2: The
cannot decrease the utility any more than they could by just Implementation, volume 2. Addison-Wesley Professional, 1995.
[21] F. Wang and Y. Zhang. Improving TCP performance over mobile ad-hoc
conforming to the protocol or jamming on each CTV. networks with out-of-order detection and response. In Proceedings of
This paper is only an initial attempt to obtain a theoretical the third ACM international symposium on Mobile ad hoc networking
foundation for a much needed holistic all-layer approach to and computing, pages 217–225. ACM Press, 2002.