PaperlayerView exact revision on arXiv

Source-linked AI summary

Security of RPL Based 6LoWPAN Networks in the Internet of Things: A Review

Abhishek Verma, Virender Ranga

arXiv:2303.00265v1cs.NIcs.CR

TL;DR

Resource-constrained IoT nodes and RPL-based LLNs are exposed to attacks that threaten security, privacy, resources, and performance. The paper surveys RPL attacks and defenses, classifies existing solutions, and examines cross-layered approaches. It reports findings from the surveyed defenses and identifies open challenges for securing RPL networks.

  • Problem

    Resource-constrained IoT nodes and RPL networks face attacks that expose security and privacy, consume resources, and degrade performance.

  • Method

    The paper surveys RPL attacks and defense mechanisms, classifies defenses into secure protocols and intrusion-detection systems, and discusses cross-layered solutions.

  • Results

    The survey reports that existing defenses can achieve strong detection performance in some settings, while mobility, energy overhead, and traffic-trace requirements remain important constraints.

  • Takeaways & Limitations

    RPL security research requires solutions that address mobility and resource limits, including lightweight cryptography and broader security analysis for integrated RPL-based networks.

Abstract

from arXiv · show

Internet of Things (IoT) is one of the fastest emerging networking paradigms enabling a large number of applications for the benefit of mankind. Advancements in embedded system technology and compressed IPv6 have enabled the support of IP stack in resource constrained heterogeneous smart devices. However, global connectivity and resource constrained characteristics of smart devices have exposed them to different insider and outsider attacks, which put users' security and privacy at risk. Various risks associated with IoT slow down its growth and become an obstruction in the worldwide adoption of its applications. In RFC 6550, the IPv6 Routing Protocol for Low Power and Lossy Network (RPL) is specified by IETF's ROLL working group for facilitating efficient routing in 6LoWPAN networks, while considering its limitations. Due to resource constrained nature of nodes in the IoT, RPL is vulnerable to many attacks that consume the node's resources and degrade the network's performance. In this paper, we present a study on various attacks and their existing defense solutions, particularly to RPL. Open research issues, challenges, and future directions specific to RPL security are also discussed. A taxonomy of RPL attacks, considering the essential attributes like resources, topology, and traffic, is shown for better understanding. In addition, a study of existing cross-layered and RPL specific network layer based defense solutions suggested in the literature is also carried out.

I. INTRODUCTION

IoT and RPL enable IP-based networking in resource-constrained LLNs, but these constraints and connectivity expose networks to attacks. This survey reviews RPL attacks, defenses, cross-layer solutions, and open security challenges.

  • Motivation: LLNs use low-power, resource-constrained devices over high-loss, low-throughput links, limiting traditional networking technologies.Nodes have limited energy, memory, and computational capability.
  • RPL context: RPL was standardized as an efficient network-layer routing protocol for LLNs such as 6LoWPAN.It supports resource-constrained IoT nodes, different topologies, and quality of service.
  • Security motivation: Insider attacks evade traditional security mechanisms because compromised nodes already belong to the network, motivating energy-efficient RPL security solutions.Such attacks can expose IoT users’ security and privacy.
  • Contributions: The survey reviews RPL-specific attacks and countermeasures, including secure-protocol and intrusion-detection approaches.It also discusses cross-layered security solutions.
  • Contributions: The paper proposes a taxonomy of RPL attacks and defenses and identifies open issues, challenges, and future research directions.Defense solutions are compared using different evaluation metrics.

A. Secure Protocol based defense mechanisms

The survey organizes its discussion around RPL attack defenses and the broader structure of the paper, including cross-layered security and open research challenges.

  • Defense organization: The paper includes a section on intrusion-detection systems as part of its discussion of RPL attack defenses.The supplied organization labels identify intrusion detection as a major defense category.
  • Survey organization: Cross-layered security solutions specific to RPL are treated as a separate section of the survey.This section follows the taxonomy of RPL defense solutions.
  • Research agenda: Open issues, research challenges, and future directions are addressed after the survey’s cross-layered security discussion.The organization labels identify these topics as a dedicated section.
  • Related work: The paper compares related surveys in a dedicated table.The supplied table label identifies it as a comparison with related survey papers.

C. Organization of the survey

The survey first introduces IoT architectures and RPL, then presents attacks, defenses, cross-layered security, and future research directions. It also explains common IoT architectural layers and their roles.

  • Organization: The paper is organized from IoT architecture and RPL overviews through attack taxonomy, defense taxonomy, cross-layered security, and open research issues.The conclusion follows the discussion of future directions.
  • IoT architecture: The commonly referenced three-layer IoT architecture consists of perception, network, and application layers.Its simple and abstract structure supports easier application implementation.
  • Perception Layer: The perception layer collects physical-environment data and converts analog input into digital form for transmission.Examples include temperature, pressure, and humidity.
  • Network Layer: The network layer processes sensed data, supports secure transmission, and provides addressing and routing across IoT devices.6LoWPAN uses IPv6 to provide unique addressing.
  • Application Layer: The application layer delivers processed network data to users and supports IoT application development and services.The paper also discusses fog and edge architectures for data-processing limitations.

III. OVERVIEW OF RPL PROTOCOL

RPL builds and maintains routing structures in resource-constrained LLNs, but its control mechanisms expose it to insider and outsider attacks. These attacks manipulate routing information, topology maintenance, or control-message behavior, degrading routing efficiency and network performance.

  • RPL operation: RPL constructs DODAG-based routing structures using objective functions, metrics, and constraints across mesh and tree topologies.A gateway or sink acts as the DODAG root, and multiple DODAGs can form an RPL instance.
  • Attack surface: RPL-specific attacks exploit control messages, routing metrics, fault-tolerance mechanisms, and insufficient verification of parent-provided information.The review extends an existing taxonomy and categorizes attacks by their effects on routing operations and network resources.
  • Control-message attacks: Neighbor or replay attacks duplicate DIO messages, potentially causing nodes to select out-of-range neighbors as preferred parents.Favorable replayed routing information, such as rank, can make a victim accept a false parent.
  • DAO attacks: Forged DAO information can create false downward routes, increasing packet delay and control overhead, reducing packet delivery, or filling routing-table buffers.Routing-table falsification can also block the creation of legitimate optimized routes.
  • Additional attacks: RPL also faces version-number, local-repair, DODAG-inconsistency, ETX-manipulation, and DIS attacks that exploit repair, metric, or control-message procedures.The supplied passages identify these attack classes as part of the broader RPL attack taxonomy.
  • Control-message attacks: DIO suppression replays a legitimate DIO at least k times, preventing victims from updating preferred parents or distances and potentially creating unoptimized routes and network partitions.The suppression threshold is denoted k, while Trickle timing increases after receiving k consistent DIOs.

V. TAXONOMY OF RPL ATTACK DEFENSE MECHANISMS

The reviewed defenses are organized into secure-protocol mechanisms and intrusion-detection systems, with cryptography, trust, and threshold approaches embedded in or supporting RPL security. The taxonomy emphasizes adapting defenses to constrained IoT nodes and RPL’s operating conditions.

  • Defense taxonomy: RPL defense solutions are divided into secure-protocol mechanisms and intrusion-detection systems.Secure-protocol approaches are further categorized as cryptography-, trust-, and threshold-based mechanisms.
  • Defense taxonomy: Cryptographic defenses authenticate routing information, trust-based defenses evaluate node trustworthiness, and threshold-based defenses modify how the Trickle timer is reset.These mechanisms are intended to improve defensive behavior while maintaining network performance.
  • Intrusion detection: Traditional intrusion-detection systems cannot be applied directly to IoT networks because nodes, topologies, and operating conditions are resource constrained.The review therefore treats IoT-specific IDS design as a distinct defense challenge.
  • Cryptographic defenses: VeRA uses hash chains to authenticate rank and version-number changes, but it can be bypassed through rank-forgery and replay attacks.The scheme targets illegitimate version-number and rank changes with low-time-complexity hash operations.
  • Scope of review: The review’s taxonomy presents attacks and defense mechanisms alongside network-performance impacts and related privacy concerns.The supplied table is captioned as classifying attacks and their effects on network performance.
  • Cryptographic defenses: SRPL uses hash-chain authentication and rank thresholds to detect manipulated rank changes while targeting sinkhole, blackhole, selective-forwarding, and rank attacks.Its design validates rank changes and does not limit node movement between DODAGs.

Secure-RPL (SRPL):

SRPL is a secure RPL variant that authenticates rank changes with hash chains and thresholds to detect several routing attacks. Its principal limitation is the substantial resource cost of its computational operations.

  • SRPL operation: SRPL’s rank-update process verifies changes against prior information and an acceptable rank-change threshold.The mechanism uses authenticated rank and threshold values across initiation, verification, and rank-update phases.
  • Limitation: SRPL’s major limitation is that its computationally expensive operations consume substantial node resources.This limitation is especially relevant to the resource-constrained setting targeted by RPL security mechanisms.
  • Related defenses: Trust-based RPL defenses select or evaluate parents using node behavior, including rank consistency and packet-drop rates.The reviewed mechanisms use neighbor observations or packet-drop behavior to identify potentially malicious nodes.

Lightweight Trust-Aware RPL:

Trust-aware RPL defenses evaluate node behavior or routing conditions to detect malicious activity, but their security benefits often trade off against energy, hardware, or configuration costs.

  • Trust-aware schemes: SecTrust-RPL computes neighbor trustworthiness from direct and recommended trust values to detect and isolate rank and Sybil attackers.Its design incorporates five modules for secure communication and malicious-node handling.
  • Trust-aware schemes: MRTS establishes secure routing paths with the Extended RPL Node Trustworthiness metric and Trust Objective Function during RPL topology construction and management.Its TPM introduces a single point of failure and additional hardware cost.
  • Trust-aware schemes: TIDS detects Sinkhole and Selective forwarding attacks through neighbor monitoring, subjective-logic trust values, and root-side analysis.It reports approximately 100% detection while requiring about 5Kb-6.4Kb ROM and 0.7Kb-1Kb RAM.
  • Open concerns: The surveyed trust and threshold solutions leave energy consumption, single points of failure, node mobility, and attack coverage as important design concerns.Several schemes require promiscuous operation, and threshold-based work addresses only a limited set of attacks.
  • Threshold-based schemes: Threshold defenses adapt packet-count limits to mitigate DODAG inconsistency, Forced blackhole, and DAO falsification attacks.AT requires prior configuration parameters, while DT avoids that calculation and outperforms AT in energy consumption, PDR, and end-to-end delay; SecRPL still requires an optimal threshold.

SecRPL:

RPL defense literature includes secure-protocol and intrusion-detection approaches, but threshold-based methods cover only a narrow attack set and signature-based IDS may depend on weak training data.

  • SecRPL: Threshold-based defenses in the literature address DODAG inconsistency, Forced blackhole, and DAO falsification attacks, leaving other RPL attacks insufficiently covered.The reviewed solutions also generally do not consider node mobility.
  • Intrusion detection: IDS-based RPL defenses are summarized as a distinct class of mechanisms for detecting routing attacks.The paper compares secure-protocol and intrusion-detection solutions using different evaluation metrics.
  • Intrusion detection: Centralized and hybrid IDS designs use packet patterns, compression-header features, auxiliary IDS nodes, or monitored traffic to detect attacks.Examples include Suricata-based DoS detection, CHA-IDS, signature-based detection, and SOMIDS.
  • Intrusion detection: Some signature-based approaches rely on outdated or simulated attack signatures, while real-network signatures may improve classifier training.These methods can show promising metrics but remain dependent on the quality of their training signatures.

2) Anomaly Based IDS:

Anomaly-based IDS approaches detect RPL attacks through centralized, distributed, or hybrid monitoring, often achieving useful detection performance at substantial deployment and resource costs.

  • Anomaly Based IDS: SVELTE uses centralized Mapper, Analyzer, Detector, and Mini-firewall modules at the 6BR to identify spoofed information, Sinkhole, and Selective forwarding attacks.Child nodes send RPL information to the 6BR for illegitimate-traffic filtering.
  • Anomaly Based IDS: Distributed monitoring architectures use dedicated monitoring nodes and RPL multi-instance networks to observe DODAG inconsistency and Version number attacks.The extended architecture shares monitoring information for global detection but assumes one attacker and excludes mobility.
  • Anomaly Based IDS: An extended SVELTE design combines ETX-based and geographical-parameter detection to handle ETX manipulation, rank attacks, and cases where the primary methods fail.The combined approach achieves a high true positive rate and requires 5, 570, and 6 Bytes of RAM and ROM, respectively, as reported.
  • Anomaly Based IDS: Anomaly-based IDS solutions often impose extra communication, computation, memory, energy, deployment, or module-placement costs and remain vulnerable to coordinated attacks.These costs are especially problematic for resource-constrained networks.

3) Specification Based IDS:

Specification-based IDS methods model expected RPL behavior with state machines or rank rules, offering lightweight detection but relying on restrictive assumptions and incomplete evaluations.

  • Specification Based IDS: InDReS monitors adjacent-node packet drops and ranks within a cluster-tree topology to detect Sinkhole attacks.Its performance was evaluated through an NS-2 implementation.
  • Specification Based IDS: Specification-based architectures use EFSM or FSM models to compare observed RPL behavior with normal and malicious states.They monitor parameters such as parent selection, rank, state changes, and neighbor transmissions.
  • Specification Based IDS: A rank-based wormhole detector identifies abnormal DIO messages using Rank Threshold and Rank Diff attributes.The method reports 100% precision, recall, and accuracy without additional wormhole-detection requirements.
  • Specification Based IDS: The wormhole detector does not consider node mobility, and it does not analyze PDR, end-to-end delay, or energy consumption.These omissions limit assessment beyond its reported classification measures.

IDS to defense Routing choice intrusion Intrusion:

The paper reviews IDS and other security defenses for RPL networks, highlighting detection mechanisms, evaluation considerations, and unresolved deployment challenges. Solutions address attacks through specification, anomaly, signature, hybrid, and cross-layer approaches, but overhead, delayed detection, mobility, and limited evaluation remain concerns.

  • Specification-based IDS: SBIDS detects rank attacks using RPL rank and parent-switching parameters, achieving 100% accuracy in static networks but lower accuracy with mobile nodes.It adds 48-bit DAO information and increases average node power consumption.
  • Specification-based IDS: Specification-based IDS development is constrained by the availability of quality traffic traces for generating adequate specifications.Several approaches also omit power-consumption analysis, while mobility support remains challenging.
  • Hybrid IDS: RIDES combines distributed Bloom-filter signature matching with CUSUM anomaly detection to identify DoS attacks in IP-based WSNs.Its distributed placement reduces communication, memory, and computational overhead, but interpacket delay slows detection and energy consumption is not studied.
  • Hybrid IDS: A hybrid framework deploys specification-based modules on routers and an unsupervised Optimum-Path Forest clustering module at the gateway to detect sinkhole, selective-forwarding, and wormhole attacks.The design combines local router analysis with gateway-level anomaly detection.
  • Evaluation and cross-layer security: Comparative evaluation reports maximum improvements and maximum or minimum achieved values across security solutions and evaluation metrics.The paper also considers MAC-layer confidentiality, integrity, and replay protection as part of RPL security.

VII. OPEN ISSUES, RESEARCH CHALLENGES AND FUTURE

The paper identifies open RPL-security problems involving newly emerging attacks, scalability, mobility, cryptographic overhead, machine learning, encryption, coordination, key management, and cross-layer deployments. Future defenses should remain lightweight while supporting dynamic, large-scale, heterogeneous IoT environments.

  • Emerging and coordinated attacks: RPL security remains challenged by newly developed, coordinated, and silently degrading routing attacks, including DIO suppression, routing choice intrusion, and ETX manipulation.Existing IDS such as SVELTE are described as vulnerable to coordinated attacks.
  • Scalability: Existing defenses are often tested only on small networks, although practical IoT deployments contain large, heterogeneous populations of resource-constrained nodes.Performance may degrade as network scale increases.
  • Scalability: Fast-reacting, lightweight defenses are needed for delay-sensitive applications without degrading QoS or scalability.The paper proposes highly scalable lightweight defense solutions as a research direction.
  • Mobility: RPL lacks standardized mobility support, while many secure protocols and IDS solutions assume static topologies and may not apply to dynamic environments.Mobility increases link disconnections, collisions, and packet loss, and other attacks under mobility remain insufficiently studied.
  • Cryptography and key management: Cryptographic key management and traditional security mechanisms impose computational, memory, and energy overheads that can reduce node lifetime in resource-constrained IoT devices.The paper calls for lightweight cryptography and efficient key-management mechanisms.
  • Node security: Tamper-proof node design remains an open area because compromised nodes can be reprogrammed to manipulate ranks, skip checks, or expose shared secret keys.TPM-based protection may add costs that are infeasible for some IoT applications.
  • Encrypted traffic: IoT IDS research commonly assumes non-encrypted traffic, while encryption can also help attackers evade detection.This creates a need for security monitoring over encrypted traffic.
  • Future directions: Future directions include moving-target IPv6 defense, collaborative IDS, fog-assisted security, and security mechanisms for 6TiSCH-integrated RPL deployments.These directions must preserve low complexity and low message overhead for constrained nodes.

VIII. CONCLUSION

The paper surveys RPL attacks and defenses for IoT networks, organizing attacks by their primary targets and identifying research challenges. It emphasizes that RPL’s usefulness for efficient LLN routing is accompanied by vulnerabilities requiring continued security research.

  • Review scope: The review classifies RPL attacks by primary targets including resources, topology, and traffic, and surveys RPL-specific defense solutions.It also identifies research challenges, open issues, and future directions from the literature.
Loading 2303.00265v1…