International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 Key Recovery Based Preventing Method for Blocking Attacks M.Kavitha1, A.V.D.N.Murthy2, P. Suresh Babu3 1 1,2,3 Final M.Tech Student , 2Assistant Professor, 3Associate Professor Department Of Computer Science & Engineering, Kaushik College of Engineering, Visakhapatnam, Andhra Pradesh. Abstract: Data transferring/exchanging is more happening process in present days, well as the network problems also there in present communications. Such as protocol, collisions of packets when transferring, Daniel of Service etc. From these problems we have to achieve more security over the network to exchange data. There are so many methods to secure data from these problems. These methodologies are different types such as based on network layer, transport layer etc. Under theses methodologies the data is converted to un format using some cryptographic and key exchanging methods. We introduced a methodology that contains key recovery, this is secure process that the key which is used to covert data is not exchanged between the users but reveals by the users. Most of the data is captured by attacking on keys in the network. That’s why we introduced this technique, adding to this symmetric cryptographic algorithm is used to send data more secure. I.INTRODUCTION In computing, a denial-of-service attack (Daniel of Service attack) or distributed denial-of-service attack (Daniel of Service attack) is an attempt to make a machine or network resource unavailable to its respective users. And also that means to carry out and motives for and targets of a Daniel of Service attack may vary and it is generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet[1][13]. A denial-of-service attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using the service. There are two types forms of Daniel of Service attacks: those that crash services and those that flood services. A Daniel of Service attack can be perpetrated in so many ways. There are five types of attack are: 1. Consumption of computational resources are bandwidth and disk space or processor time. 2. Disruption of configuration information is routing information. 3. Disruption of state information is unsolicited resetting of TCP sessions. 4. Disruption of physical network components. ISSN: 2231-5381 5. Obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately. A Daniel of Service attack may include execution of malware intended to Max out the processor's usage of preventing any work from occurring. It finds errors in the microcode of the machine. It finds errors in the sequencing of instructions and to force the computer into an unstable state or lock-up. Exploit errors in the operating system that cause resource starvation and/or thrashing that is to use up all available facilities so no real work can be accomplished or it can crash the system itself Crash the operating system itself. In most cases Daniel of Service attacks involve forging of IP sender addresses (IP address spoofing) so that the location of the attacking machines cannot easily be identified and to prevent filtering of the packets based on the source address. Anyone with a transceiver can eavesdrop on wireless transmissions that inject spurious messages or jam legitimate ones. While eavesdropping and message injection can be prevented using cryptographic methods and jamming attacks are much harder to counter. Since RF (radio frequency) is essentially an open medium is jamming can be a huge problem. Jamming is one of many exploits used compromise the wireless environment and it is by denying service to authorized users as legitimate traffic is jammed by the overwhelming frequencies of illegitimate traffic. A very technical knowledge attacker with the right tools can easily jam frequency in a way and that reduces the signal to a level where the wireless network cans no longer function. The processing time of jamming is the fact that it may not be caused on demand as other forms of wireless technology are relying on the frequency. Some widely used consumer products include cordless phones and Bluetooth-enabled devices and baby monitors are all capable of disrupting the signal of a wireless network and faltering traffic. Jamming mostly relates to older wireless local area networks as they are not fully equipped to make the adaptation to more types of interference and those networks reglarly call for an administrator to manually adjust each access point through http://www.ijettjournal.org Page 4147 International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 trial and error. To avoid this daunting task and best practice is to invest into a new wireless local network system. These environments offer real-time management features capable of identifying and adapting to unintentional interference. If an attacker truly wanted to compromise your LAN and wireless security and most effective approach would be to send random unauthenticated packets to every wireless station in the network. It is easily achieved by purchasing hardware off the shelf from an electronics retailer and downloading free software from the internet. In some cases and simply impossible to defend against jamming as an experienced attacker may have the ability to flood all available network frequencies. There is a case If the major concern relates to malicious jamming as an intrusion prevention and detection system may be your best option. This type of system should be able to detect the presence of an RPA (Rogue Access Point) or any authorized client device in your wireless network. Very efficient systems can prevent unauthorized clients from accessing the system and then alter configurations to maintain network performance in the presence of an attack that the blacklist certain threats and pinpoint the physical location of a rogue device to enable faster containment. It doesn't what type of interference you're experiencing; the network must have the ability to detect it and that reacts and quickly make adjustments. To minimize the impact of an unintentional disruption, and it is important to identify its presence. It makes itself known at the physical layer of the network, more commonly known as Media Access Control layer and increased noise floor results in a faltered noise-to-signal ratio and which will be indicated at the client. It is measurable from the access point where network management features should able to effectively report noise floor levels that exceed a predetermined threshold. There is an access points must be dynamically reconfigured to transmit channel in reaction to the disruption as identified by changes at the physical layer. Consider that if the attack occurred on an RF corresponding to channel 1 and the access point should switch to channel 6 or 11 in order to avoid the attack. Selecting a different channel does not always eliminate the issue of interference. A very intelligent attacker will often use all available channels in the attack. When this happens that’s your only option may be to physically hunt down the attacker and confront them face to face. II. RELATED WORK Although several studies have targeted jammingstyle attacks, the definition of this type of attack remains un- clear. A common assumption is that a jammer continuously emits RF signals to fill a wireless channel and so that strict traffic will be completely blocked. We believe that a broader range of behaviours can be adopted by a ISSN: 2231-5381 jammer. Consider an example and that a jammer may remain quiet when there is no activity on the channel, and start interference as soon as it detects a transmission. The common characteristic for all jamming attacks is that their communications are not compliant with MAC protocols.[1] Therefore, we define a jammer to be an entity who is purposefully trying to interfere with the physical transmission and reception of wireless communications. The objective of a jammer is to interfere with legitimate wireless communications. A jammer fulfil his/her goal by either preventing a real traffic source from sending out a packet or by preventing the reception of legitimate packets. Let us assume that A and B denote two legitimate wireless participants, and let us denote X to be the jammer. A legitimate participant may be unable to send out packets for many reasons. To name just a couple, X can continuously emit a signal on the channel so that A will never sense the channel as idle, or X can keep sending out regular data packets and force A to receive junk packets all the time. On the other hand, however, even if A successfully sends out packets to B, it is possible for X to blast a radio transmission to corrupt the message that B receives. We thus define the following two metrics to measure the effectiveness of a jammer: Packet Send Ratio (PSR): The ratio of packets that are successfully sent out by a legitimate traffic source compared to the number of packets it intends to send out at the MAC layer. Suppose A has a packet to send. There are so more wireless networks employ some form of carriersensing multiple access control before transmission may be performed. For example, in the MAC pro- tocol employed by Mica2, the channel must be sensed as being in an idle state for at least some random amount of time before A can send out a packet. Further, different MAC protocols have different definitions on an idle channel. Some simply compare the signal strength measured with a fixed threshold, while others may adapt the threshold based on the noise level on the channel. A radio interference attack may cause the channel to be sensed as busy, causing A's transmission to be delayed. If too many packets are buffered in the MAC layer, the newly arrived packets will be dropped. It is also possible that a packet stays in the MAC layer for too long, resulting in a timeout and packets being discarded. If A intends to send out n messages, but only m of them go through, the PSR is m n . The PSR can be easily measured by a wireless device by keeping track of the number of packets it intends to send and the number of packets that are successfully sent out. Packet Delivery Ratio (PDR): The ratio of packets that are successfully delivered to a destination compared to the number of packets that have been sent out by the sender. Even after the packet is sent out by A, B may not be able to decode it correctly, due to the interference introduced by X. Such a scenario is an unsuccessful delivery. The PDR may be measured at the receiver B by calculating the ratio of the http://www.ijettjournal.org Page 4148 International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 number of packets that pass the CRC check with respect to the number of packets (or preambles) received. PDR may also be calculated at the sender A by having B send back an acknowledge packet. In either case, if no packets are received PDR is defined to be 0. A) Types of jamming A. Physical Jamming (Physical Layer) Physical or Radio jamming in a wireless medium is a simple but disruptive form of Daniel of Service attack. These attacks are launched by either continuous emission of radio signals or by sending random bits onto the channel. The jammers causing these attacks can deny complete access to the channel by monopolizing the wireless medium. The no destroying to communicate has an unusually large carrier sensing time waiting for the channel to become idle. This has an adverse propagating effect as the nodes enter into large exponential back-off periods. B. Virtual Jamming (MAC Layer) In IEEE 802.11 based MAC protocols and the virtual carrier sensing is used at the MAC layer to determine the availability of the wireless medium. The process Jamming can be launched at the MAC layer through attacks on the RTS/CTS frames or DATA frames. A significant advantage of MAC layer jamming is that the adversary node consumes less power in targeting these attacks as compared to the physical radio jamming. Here, we focus on Daniel of Service attacks at the MAC layer resulting in collision of RTS/CTS control frames or the DATA frames [4][9] C. Synchronization Signal Jamming (SSJ) When a UE wants to connect to an Node, it has to first go through a series of synchronization steps. Initially it detects the Primary Synchronization Signal which allows the UE to synchronize to each slot and gives it the cell ID. Next, it detects the Secondary Synchronization Signal (SSS) which tells the UE the cell ID group which method of duplexing is used and the cyclic prefix length. The SSS also allows the UE to detect when each radio frame starts. After synchronizing with the PSS and SSS, the UE receives more information about the cell by decoding the Master Information Block (MIB). The MIB contains information essential for initial access to a cell. It consists of 14 bits that contain the downlink system bandwidth and Physical Control Format Indicator Channel (PHICH) size, and information allowing frame synchronization and mapped to the central 72 subcarriers that appear in slot 1 of each frame. There are three signals and they are not present in all ten sub-frames, but they are always mapped to the same subcarriers. The Synchronization Signal Jamming (SSJ) attack is designed to deny the UE access to the PSS, SSS, and MIB. The jamming waveform used for the SSJ attack is noise that spans the centre 73 subcarriers. For the usage of complexity the DC sub carriers are included and even ISSN: 2231-5381 though it does not contain information. The Synchronization Signal Jamming attack does not involve jamming specific symbols and so that the jammer does not have to be synchronized to the Node. The SSJ attack is simply a brute force method of denying the UE three different mechanisms that it needs to access a cell. The act of only jamming some of subcarriers that allows the SSJ attack to have roughly a 3 dB gain over traditional barrage jamming and the which can be thought of as an increase in jamming radius for a jammer that is power constrained. D. Primary Synchronization Signal Jamming Detecting the PSS is the first step a UE takes in accessing a cell. It uses a sequence length of 63 and centre element is null because the downlink DC subcarrier is never used for transmission. There are three PSS sequences used in LTE, and each one corresponds to one of the three sectors. The UE must detect the PSS without any knowledge of the channel therefore it finds the timing offset that corresponds to the maximum cross correlation for each of the three sequences, and uses it to synchronize in the time domain. For FDD, the PSS only occurs in slots 0 and 10 (there are 20 total slots per frame). The SSJ attack discussed previously injects noise into the subcarriers that contain the PSS. An attack that only targets the PSS can be realized by only jamming the symbols that contain the PSS. Jammer would have to cause a fairly high jammer-to-signal ratio, because the PSS is designed to be detected at high interference levels and so that the UE can also detect neighbouring cells. A more effective method of causing a PSS attack would be to simply transmit one of the three PSS sequences thus create a corruted PSS. If the jammers received power at the UE is greater than the Node's, then the UE is most likely going to synchronize to the bogus PSS. This is because a cross-correlation process is used to detect the PSS non-coherently. A jammer using this method would not need receiving capability but it would simply start the bogus PSS transmission at a random time and the leading to uniformly distributed timing relative to the correct PSS signal. If the UE synchronized to the corrupted PSS, then is not synchronized in time to the Node, and it will not know when each OFDM symbol starts, and hence will not be able to detect the SSS or decode the MIB. This attack appears to work, until considering the cell re-selection procedure. If a cell does not provide a certain level of quality, after that UE begins the cell reselection procedure, where it tries to access the cell with the next strongest signal. Jammer can transmitting three bogus PSSs only has to transmit six symbols in every frame, on 62 subcarriers. A downside to PSS jamming is that it will not immediately cause Denial of Service (DANIEL OF SERVICE). It will prevent new UEs from accessing the cell(s), and cause UEs in idle mode to reselect a corrupted cell. Therefore PSS jamming is not effective for an attack intended on causing immediate http://www.ijettjournal.org Page 4149 International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 DANIEL OF SERVICE. However, it is sufficient for an attack that will last a long period of time. The jammer barely has to transmit anything, the PSS jamming attack offers roughly 20 dB of gain relative to the barrage jamming attack. This results in an extremely efficient jammer. This type of attack can be prevented by employing a cell reselection implementation that is able to blacklist corrupted synchronization signals by keeping track of the time-delay in the cross correlation. A)Basic Statistics to detect jamming attacks Detecting jamming attacks is important because it is the first step towards building a secure and dependable wire- less network. It is challenging because jammers can employ different models and often difficult to differentiate a jamming scenario from legitimate scenarios. Specifically, we need to differentiate a jamming scenario from various network conditions: congestions that occur when the aggregated traffic load exceeds the network capacity so that the packet send ratio and delivery ratio are affected; the interrupt of the communication due to failures at the sender side, etc[8][5]. Signal Strength One seemingly natural measurement that can be employed to detect jamming is signal strength, or ambient energy. The rationale behind using this measurement is that the signal strength distribution may be affected by the presence of a jammer. In practice, since most commodity radio devices do not provide signal strength or noise level measurements that are calibrated (even across devices from the same manufacturer), it is necessary for each device to employ its own empirically gathered statistics in order to make its decisions. Each device should sample the noise levels many times during a given time interval. By gathering enough noise level measurements during a time period prior to jamming, network devices can build a statistical model describing normal energy levels in the network. We now explore two basic strategies that employ signal strength measurements for detecting a jamming attack. The first approach uses either the average signal value or the total signal energy over a window of N signal strength measurements. This is a simple approach that extracts a single statistic for basing a hypothesis test upon. Since a single statistic loses most of the shape characteristics of the time series, a second strategy would seek to capture the shape of the time series by representing its spectral behaviour. The second strategy that we discuss uses N samples to extract spectral characteristics of the signal strength for the basis of discrimination. In the discussion below, we assume that we have measured the channel's received energy levels s(t) at different times and ISSN: 2231-5381 collected N of these samples to form a window of samples fs(k); s(k ¡ 1); s(k ¡ N + 1)g. Basic Average and Energy Detection We can extract two basic statistics from signal strength readings, namely, the average signal strength and the energy for detection. In both cases, the statistical hypothesis testing problem is binary and essentially involves deciding between signal absent and signal present hypotheses. The use of the signal average arises naturally when the jammer emits a constant amplitude signal. In this case, the detection statistic is T(k) = ( Pk j=k¡N+1 s(j))=N. The use of the signal energy arises when the jammer emits a powerful noise-like signal, such as a white Gaussian process. Here, the detection statistic is T(k) = ( Pk j=k¡N+1 s(j)2)=N. In either case, the detection decision is made by comparing T(k) to a threshold ° that is suitably chosen by considering tradeoffs between probability of detection and false alarm, such as through application of NeymanPearson theorem. In the existing approaches the methods based on the cryptographic approaches[7] and applied on the layers, for example application and network layer. In the previous techniques symmetric cryptographic techniques are used. In the next section we presented more securable techniques for jamming attacks. III. PACKET HIDING TECHNIQUES In this first we present packet hiding technique for jamming, we used key recovery technique for revealing the secret key. Because random key is embedded in the puzzle, if any attack on packet the random key will reveal, leads to leakage of message. For any random seed generation sender and receiver requests for service provider only. Service provider is an authenticated server that always monitors and helps secure communication between the users. In our method we use key exchanging protocol and any key agreement method. For key exchanging protocol we use diffie Hellman key exchanging algorithm. In this first phase sender and receiver consider one random challenge that is say ‘g’, and they consider another random integer n, then sender generates one secret key then generates public key. Receiver also follows same procedure then the public keys exchange each other. Then using the received public keys sender and receiver generates one common key that is session key. Initial step of this process is both Alice and Bob agree upon a prime number and another number that has no factor in common. Consider a prime number as p and the other number as g and also g is also known as the generator and p is known as prime modulus. Then since eve is sitting in between and listening to this communication so eve also gets to know p and g. http://www.ijettjournal.org Page 4150 International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 ISSN: 2231-5381 1 Processing Time After that modulus arithmetic says that r = (g x) mod p. So r will always produce an integer between 0 and p. The first trick here is that given x (with g and p known) , it is very easy to find r. But given r(with g and p known) it is difficult to deduce x. This is not that much of difficult work to crack but what if the value of p is a very huge prime number? Well, if this is the case then deducing x (if r is given) becomes almost next to impossible as it would take thousands of years to crack this even with supercomputers. Coming back to the communication all the users such as Bob, Alice and eve now know g and p. Now, Alice selects a random private number xa and calculates (g to the power xa) mod p =ra. This resultant ra is sent to Bob through the communication channel. Intercepting in between, eve also comes to know ra. Similarly Bob selects random private number xb, calculates (g to the power xb) mod p = rb and sends this rb to Alice through the same communication channel and generally eve also comes to know about rb. So eve came to know the information about g, p, ra and rb. Now comes the heart of this algorithm. Alice calculates (rb to the power xa) mod p = Final key which is equivalent to (g to the power (xa*xb) ) mod p . Similarly Bob calculates (ra xb) mod p = Final key which is again equivalent to (g to the power(xb * xa)) mod p. Then Alice and Bob were able to calculate a common Final key without sharing each other private random number and eve sitting in between will not be able to determine the Final key as the private numbers were never transferred. Following this key exchanging process sender encrypts and generates signature using RSA and sends to receiver. Then receiver decrypts the encrypted message then sends acknowledgement to sender. The generation process is not by individual , in between them there is a mediator called service provider. All the random challenges are done by authenticated service provider only. A) Key Recovery based hiding In proposed system we introduced key recovery process we are using exchanging and key agreement protocol to exchange the message. The processing time for existing methods is very high for the large packets. We studied the previous methods and as concerned with them the plotted the graph and shown below: Strong Hiding 0.5 Puzzle Hiding Proposed 0 Packet Hiding Methods IV.CONCLUSION Our proposed work prevents jamming attacks efficiently .The issue of detecting the presence of jamming attacks, and examined the ability of different measurement statistics to classify the presence of a jammer. We showed that by using signal strength, carrier sensing time, or the packet delivery ratio individually and it is one is not able to definitively conclude the presence of a jammer. Most of the attacks are mainly focus on the content and the keys used to hide the data. So our process has no problem for loss of keys. The content also very secure when transferring the network. REFERENCES [1] T.X. Brown, J.E. James, and A. Sethi, “Jamming and Sensing of Encrypted Wireless Ad Hoc Networks,” Proc. ACM Int’l Symp. Mobile Ad Hoc Networking and Computing (MobiHoc), pp. 120-130, 2006. [2] M. Cagalj, S. Capkun, and J.-P. Hubaux, “Wormhole-Based Anti- Jamming Techniques in Sensor Networks,” IEEE Trans. Mobile Computing, vol. 6, no. 1, pp. 100-114, Jan. 2007. [3] A. Chan, X. Liu, G. Noubir, and B. Thapa, “Control Channel Jamming: Resilience and Identification of Traitors,” Proc. IEEE Int’l Symp. Information Theory (ISIT), 2007. [4] T. Dempsey, G. Sahin, Y. Morton, and C. Hopper, “Intelligent Sensing and Classification in Ad Hoc Networks: A Case Study,” IEEE Aerospace and Electronic Systems Magazine, vol. 24, no. 8, pp. 23-30, Aug. 2009. [5] Y. Desmedt, “Broadcast Anti-Jamming Systems,” Computer Networks, vol. 35, nos. 2/3, pp. 223-236, Feb. 2001. [6] K. Gaj and P. Chodowiec, “FPGA and ASIC Implementations of AES,” Cryptographic Engineering, pp. 235-294, Springer, 2009. [7] O. Goldreich, Foundations of Cryptography: Basic Applications. Cambridge Univ. Press, 2004. [8] B. Greenstein, D. Mccoy, J. Pang, T. Kohno, S. Seshan, and D. Wetherall, “Improving Wireless Privacy with an IdentifierFree Link Layer Protocol,” Proc. Int’l Conf. Mobile Systems, Applications, and Services (MobiSys), 2008. [9] IEEE, IEEE 802.11 Standard, http://standards.ieee.org/ http://www.ijettjournal.org Page 4151 International Journal of Engineering Trends and Technology (IJETT) – Volume 4 Issue 9- Sep 2013 getieee802/download/802.11-2007.pdf, 2007. [10] A. Juels and J. Brainard, “Client Puzzles: A Cryptographic Countermeasure against Connection Depletion Attacks,” Proc. Network and Distributed System Security Symp. (NDSS), pp. 151-165, 1999. [11] Y.W. Law, M. Palaniswami, L.V. Hoesel, J. Doumen, P. Hartel, and P. Havinga, “Energy-Efficient Link-Layer Jamming Attacks against WSN MAC Protocols,” ACM Trans. Sensor Networks, vol. 5, no. 1, pp. 1-38, 2009. [12] L. Lazos, S. Liu, and M. Krunz, “Mitigating Control-Channel Jamming Attacks in Multi-Channel Ad Hoc Networks,” Proc. Second ACM Conf. Wireless Network Security, pp. 169-180, 2009. [13] G. Lin and G. Noubir, “On Link Layer Denial of Service in Data Wireless LANs,” Wireless Comm. and Mobile Computing, vol. 5, no. 3, pp. 273-284, May 2004. [14] X. Liu, G. Noubir, and R. Sundaram, “Spread: Foiling Smart Jammers Using Multi-Layer Agility,” Proc. IEEE INFOCOM, pp. 2536-2540, 2007. [15] Y. Liu, P. Ning, H. Dai, and A. Liu, “Randomized Differential DSSS: Jamming-Resistant Wireless Broadcast Communication,” Proc. IEEE INFOCOM, 2010. [16] R.C. Merkle, “Secure Communications over Insecure Channels,” Comm. ACM, vol. 21, no. 4, pp. 294-299, 1978. [17] G. Noubir and G. Lin, “Low-Power Daniel of Service Attacks in Data Wireless Lans and Countermeasures,” Mobile Computing and Comm. Rev., vol. 7, no. 3, pp. 29-30, 2003. [18] OPNET “OPNET Modeler 14.5,” http://www.opnet.com/, 2011. [19] C. Perkins, E. Belding-Royer, and S. Das, “RFC 3561: Ad Hoc On- Demand Distance Vector (AODV) Routing,” Internet RFCs, 2003. [20] C. Po¨pper, M. Strasser, and S. _Capkun, “JammingResistant Broadcast Communication without Shared Keys,” Proc. USENIX Security Symp., 2009. [21] R. Rivest, “All-or-Nothing Encryption and the Package Transform,” Proc. Int’l Workshop Fast Software Encryption, pp. 210-218, 1997. Sri. P.Suresh Babu, completed his B.Tech,M.E. He is working as a Associate Professor in Department Of Computer Science & Engineering in Kaushik College of Engineering, Visakhapatnam, Andhra Pradesh. His Teaching Experience: 14 Years Industrial Experience: 4 Years [22] Alejandro Proan˜o and Loukas Lazos Packet-Hiding Methods for Preventing Selective Jamming Attacks,2012. BIOGRAPHIES M.Kavitha completed her MCA, she pursuing MTech in kaushik college of engineering.Her Interested area of research is network security. Mr. A.V.D.N.Murthy completed M.C.A, M.Tech. He is working as a Assistant Professor in Department Of Computer Science & Engineering in Kaushik College of Engineering,Visakhapatnam, Andhra Pradesh. His Teaching Experience: 6 Years and Industrial Experience: 1.2 Years ISSN: 2231-5381 http://www.ijettjournal.org Page 4152