Stéphane Lohier
email: lohier@univ-mlv.fr

Abderrezak Rachedi
email: rachedi@univ-mlv.fr

Ismail Salhi
email: salhi@univ-mlv.fr

Erwan Livolant
email: livolant@univ-mlv.fr

Multichannel Access for Bandwidth Improvement in IEEE 802.15.4 Wireless Sensor Networks

Keywords: Multichannel, Wireless Sensor Networks, IEEE 802.15.4 I

In this paper, we propose a new multichannel allocation protocol for ZigBee/IEEE 802.15.4 networks. The main goal is to improve the global throughput which is basically insufficient to satisfy high bandwidth requirements for applications like monitoring or traffic control. The solution is based on the availability of multiple channels on current lowcost, low-energy radio transceivers, such as CC2420, which can be easily tuned dynamically to different frequencies. This possibility can be exploited to increase the number of simultaneous transmissions on adjacent links. The allocation of the different channels is centralized and distributed by the coordinator thanks to a function designed to compute the channel offset between two successive children routers. In the nodes, the switching process between the transmission and the reception channels is triggered starting from the PHY primitive available on the transceiver. The evaluation shows that the proposed protocol improves the global throughput by a factor between 2 and 5, depending on the scenario, compared to the single-channel solution or a random channel allocation.

INTRODUCTION

The bandwidth available in Wireless Sensor Networks (WSN) is generally insufficient to satisfy greedy applications such as low/medium resolution video monitoring. For instance, the theoretical throughput in prevalent WSN standards such as ZigBee or 6LowPan is upper-bounded to250kbps. As wireless sensor networking evolves toward multimedia sensing, it becomes necessary to find new mechanisms to transmit more efficiently audio or video flows.

This study considers realistic application scenarios with high bandwidth requirements and takes into account the characteristics of existing sensing technologies. These scenarios are typically part of the paradigm that is Multimedia Sensor Networking [START_REF] Akyildiz | A survey on wireless multimedia sensor networks[END_REF] wherein sensing devices are more powerful and embedded with CMOS cameras and audio sensors. In such networks, nodes are deployed in a specific area in order to provide various services like traffic congestion control, video monitoring, object tracking and recognition, etc. In this work, we consider an IEEE 802.15.4 wireless sensor network with a hierarchical topology: coordinator, router and terminal divided in several levels of clusters. The transmissions use the 802.15.4 non-beaconed mode which allows the best bandwidth utilization [START_REF] Petrova | Performance study of IEEE 802.15.4 using measurements and simulations[END_REF].

In addition, we are interested here only on single interface solutions. Multiple interface schemes are not adapted to ZigBee devices because of their energy consumption limitations. In WSNs standards, much smaller packet sizes are used (e.g. ~100 bytes for IEEE 802.15.4) compared to those in wireless ad hoc networks (e.g. 1500 bytes in IEEE 802.11). The solutions with control packets like RTS/CTS in IEEE 802.11will not be adopted as they can lead to an important overhead.

Current low-cost, low-energy radio transceivers, such as CC2420 [START_REF]Datasheet for Chipcon/Texas Instruments CC2420 2.4 GHz IEEE 802.15.4/ZigBee-Ready RF Tranceiver[END_REF] can be tuned dynamically to different frequencies allowing PHY protocols to operate on different radio channels. The availability of multiple channels on the wireless medium can be exploited to increase the number of simultaneous transmissions between different pairs of transmitter/receiver. Thus, the global network throughput can potentially be increased. However, no channel switching protocol is proposed in IEEE 802.15.4 standard. That is why, in this paper, we propose a new protocol for the channels assignment named MASN (Multichannel Access for Sensor Networks), based on an offset function comparable to the one used in the hierarchical ZigBee addressing. Channels on the different links are successively allocated by the coordinator after the association process, starting from the first children routers and toward the end terminals. The proposed protocol ensures that two neighboring links will not be affected by the same channel. In addition, the protocol introduces a switching process between transmission and reception channels. This process is triggered starting from the PHY primitive available into the transceiver.

Insofar as the protocol does not modify the medium access method but only adds channel allocation and channel switching process in the nodes, it can be easily implemented in IEEE 802.15.4 device. The MASN protocol is thus designed in accordance with the 802.15.4/ZigBee networks standard which is not the case of many proposed solutions in literature.

The rest of the paper is divided into five sections. In section 2, we sum up the existing works dealing with multichannel access in wireless networks. We present our MASN protocol in section 3. Section 4 is dedicated to the performance evaluation of the proposed protocol. The fifth section concludes our paper and presents the future works.

II. RELATED WORKS

In many studies designed for general wireless networks [START_REF] Maheshwari | Multichannel MAC Protocols for Wireless Networks[END_REF][START_REF] So | Multi-channel mac for ad hoc networks: Handling multi-channel hidden terminals using a single transceiver[END_REF][START_REF] Zhang | TMMAC: An Energy Efficient Multi-Channel MAC Protocol for Ad Hoc Networks[END_REF], transmission are divided into two period: a control period with a common channel to exchange information between all nodes about free channels or to schedule channels available for future data exchanges (this period is often called ATIM window for Ad Hoc Traffic Indication Messages window); a period for simultaneous data transmissions between several pair of sender/receiver in a channel selected during the control period. These protocols are not adapted to an 802.15.4 context as all nodes' interfaces have to listen to the common channel during frequent and periodic negotiations which can be very greedy in terms of energy consumption.

The SSCH protocol [START_REF] Bahl | SSCH: Slotted seeded channel hopping for capacity improvement in ieee 802.11 adhoc wireless networks[END_REF] proposes a different approach where each node computes a channel schedule which contains the list of channels that a node plans to switch to in subsequent slots (the time spent on a single channel). To ensure that communications with neighbors are possible in some slots, each node has to maintain a list of the channel schedules for all other nodes it is aware of. The principal drawbacks of this approach in our WSN context is the high control traffic used by all nodes to periodically broadcast the channel schedule and the necessity of synchronization between nodes.

In order to consider more specifically the WSNs constraints, other works are proposed. As for MMAC [START_REF] So | Multi-channel mac for ad hoc networks: Handling multi-channel hidden terminals using a single transceiver[END_REF], the TFMAC protocol [START_REF] Jovanovic | TFMAC: Multi-channel MAC Protocol for Wireless Sensor Networks[END_REF] divides time into a fixed number of slots and allows each node to use different frequencies within different time slots to send data packets to its neighbors. The authors propose to create a TDMA frame with contention period and contention-free period which already exist in the 802.15.4 standard with the superframe in the beaconed mode. No indication is given on how to synchronize the TDMA frame between the nodes (in IEEE 802.15.4, the coordinator synchronizes the superframe on a common channel).

The MMSN protocol presented in [START_REF] Zhou | MMSN: Multi-Frequency Media Access Control forWireless Sensor Networks[END_REF] is also especially designed for WSNs and consists of two aspects: frequency assignment and media access with a specific design, different from the classical CSMA. The global throughput is significantly improved with MMSN, but the comparisons are carried out with a theoretical CSMA MAC layer and not with a real MAC IEEE 802.15.4 layer. Moreover, selected topologies are not hierarchical and the traffic pattern is many-to-many and not many-to-one like in usual WSNs or more specifically in MWSNs.

Soroush et al. proposed a hybrid TDMA/FDMA MAC protocol called HYMAC [START_REF] Soroush | HyMAC: Hybrid TDMA/FDMA Medium Access Control Protocol for Wireless Sensor Networks[END_REF] in which data gathered by sensor nodes are delivered to a base station (many-to-one traffic). The transmissions take place in a fixed-length TDMA cycle divided into several fixed time slots. The base station assigns an appropriate frequency (FDMA) and a specific time slot(s) to each node (TDMA) by running a scheduling algorithm. The simulation results show that HYMAC outperforms MMSN for the number of potential conflicts but these performances are obtained by adding time slots when the number of frequency is insufficient which increases the risk of interferences. Consequently, the MAC layer is specific and not directly compatible with the IEEE 802.15.4 MAC layer or another CSMA/CA MAC layer.

In [START_REF] Wu | Realistic and Efficient Multi-Channel Communications in Wireless Sensor Networks[END_REF], Wu et al. propose TMCP, a tree-based multichannel protocol. The main idea is to assign channels to different subtrees instead of nodes in order to avoid interference between nodes of different subtrees (inter-tree) without the need for time synchronization. A comparison shows that the performances of TMCP and MMSN [START_REF] Zhou | MMSN: Multi-Frequency Media Access Control forWireless Sensor Networks[END_REF] are very close. The main drawback of TMCP protocol, according to our selected context, is the lack of coordination between the tree-based channel assignment scheme and the hierarchical association process already existing in ZigBee networks.

MCMAC [START_REF] Chen | A Multi-Channel MAC Protocol for Wireless Sensor Networks[END_REF] is another protocol designed for multichannel access where the sensor network is divided into clusters like in a hierarchical ZigBee network. The proposed protocol increases the network energy efficiency and the data throughput thanks to a time slotted access in a synchronous beaconed mode. Even if the average throughput is better than that obtained with a mono-channel access, the performances of the beaconed mode remain globally insufficient [START_REF] Petrova | Performance study of IEEE 802.15.4 using measurements and simulations[END_REF] for multimedia flows.

III. MASN PROTOCOL

A. Context and goals

As mentioned above, this study takes into consideration the technical characteristics of existing WSNs and relates to sensor networks with high bandwidth demand in which data are destined to a unique sink. Such context imposes some assumptions for the network and its components:  hierarchical ZigBee routing for many-to-one transmissions (different from a reactive ad hoc routing for many-to-many communications which is the case of many studies on the subject [START_REF] Maheshwari | Multichannel MAC Protocols for Wireless Networks[END_REF][START_REF] So | Multi-channel mac for ad hoc networks: Handling multi-channel hidden terminals using a single transceiver[END_REF][START_REF] Zhang | TMMAC: An Energy Efficient Multi-Channel MAC Protocol for Ad Hoc Networks[END_REF][START_REF] Bahl | SSCH: Slotted seeded channel hopping for capacity improvement in ieee 802.11 adhoc wireless networks[END_REF][START_REF] Jovanovic | TFMAC: Multi-channel MAC Protocol for Wireless Sensor Networks[END_REF][START_REF] Zhou | MMSN: Multi-Frequency Media Access Control forWireless Sensor Networks[END_REF]);


 a single radio interface by node (except for the ZigBee coordinator which serves as sink);

 the IEEE 802.15.4 technology proposes a total of 16 non-overlapping channels the 2,4GHz band; one control channel is dedicated to the association process (channel 11) and 15 channels are used for the data transmissions (channel 12 to 26);

 the change of channel respects the switching time of the radio transceiver (typically 200µs for the CC2420);

 the CSMA/CA access method in the non-beaconed mode is chosen as it provides the best throughput [START_REF] Petrova | Performance study of IEEE 802.15.4 using measurements and simulations[END_REF].

Furthermore, we chose neither to use a temporal window on a common control channel to negotiate periodically a data channel between receivers and transmitters [START_REF] Maheshwari | Multichannel MAC Protocols for Wireless Networks[END_REF][START_REF] So | Multi-channel mac for ad hoc networks: Handling multi-channel hidden terminals using a single transceiver[END_REF][START_REF] Zhang | TMMAC: An Energy Efficient Multi-Channel MAC Protocol for Ad Hoc Networks[END_REF] nor control MAC frames (RTS/CTS), as these solutions consume time and energy (cf. section II).

Finally, the proposed protocol must be able to be easily integrated on usual sensors equipped with a CC2420 transceiver (for example TelosB, MicaZ and Imote2 provided by MEMSIC, formerly Crossbow, [START_REF]MEMSIC Company[END_REF]) without important modification of the MAC layer: the medium access method is not modified (case of the algorithms with a control window).

B. MASN Overview 1) Channel allocation

The algorithm proposed for the channel allocation is inspired by the hierarchical address allocation process used in the ZigBee networks. In this process, the Cskip function is used to compute the address offset between two successive children routers for a given network depth, d:

( ) { ( )
Lm being the maximum depth in the network, Cm the maximum number of children a parent may have and Rm the maximum number of routers a parent may have as children.

Then, network addresses are assigned to end-devices in a sequential manner with the address, given by the following equation:

( ) Where ( ) and
represents the address of the parent.

In ZigBee specifications [START_REF] Zigbee | Zigbee Specification[END_REF], three roles are possible for a node: ZC is the Coordinator, ZR is a Router (these two roles corresponding to an 802.15.4 MAC Full Function Device) and ZED is an End Device (Reduced Function Device).

In our algorithm, like in HYMAC [START_REF] Soroush | HyMAC: Hybrid TDMA/FDMA Medium Access Control Protocol for Wireless Sensor Networks[END_REF], the coordinator distributes the channels after the node-association process. The channel allocation is related to the ZigBee network parameters Lm, Cm, Rm. Insofar as the values of these three parameters characterize the size of the network, the frequencies allocation is also directly limited by these values.

Each node uses one channel to send data (CHS) towards its single parent. In our solution, the number of reception channels (CHR) for a ZR is also limited to one. This limitation avoids a commutation algorithm between several CHR based on TDMA multiplexing or on advertising frames sent on the common channel. Indeed, these two solutions would involve additional delays and would be difficult to integrate in a standard device. Moreover, the first solution (TDMA) would be contrary to the initial choice which is to use a CSMA mode in order to optimize the global throughput. The number of possible channels (n CHS and n CHR ) for the different roles is summarized in the example depicted in figure 1

( ) { ∑ ∑
Then, the CHR values are assigned to the ZR in a sequential manner with the n th channel, CHR n , given by the following equation:

{ [ ( ) ( )] [ ] [ ( ) ( )]
This allocation is illustrated in figure1 with the different values of CHskip(d) at different depths and with the successive allocated channels. Let us note that the solution combines a channel assignation not only to different subtrees, like in TMCP [START_REF] Wu | Realistic and Efficient Multi-Channel Communications in Wireless Sensor Networks[END_REF], but also to the different hops in the same subtree. It is demonstrated in [START_REF] Österlind | Approaching the Maximum 802.15.4 Multi-hop Throughput[END_REF] that a multihop multichannel allocation scheme is efficient in an 802.15.4 network.

With these equations, the channel distribution does not directly guarantee, like in MMSN [START_REF] Zhou | MMSN: Multi-Frequency Media Access Control forWireless Sensor Networks[END_REF], that two neighboring links will have a different CHR (the offset can be equal to 15 which is the number of possible channels) but the probability is weak with 15 channels and a hierarchical distribution (2 routers associated to the same parent will always have two distinct channels). However, to avoid this case, the algorithm attributes CHR = n+1 instead of CHR = n for a ZR having a neighboring router of the same parent and with CHR = n.

In addition, as for the hierarchical addressing process, the centralized channels allocation can be reorganized if the network is modified because of the transition to idle state, the stop or the displacement of a node.

Finally, the algorithm validated on a ZigBee network with one ZC can be extended to the other ZigBee networks considered then as clusters with ZC acting as Cluster Head which distributes channels on the links.

2) Channel switching CHR is selected by default on a ZR. On reception of a PHY primitive PD_DATA_REQUEST() indicating a data frame transmission request, ZR switches to CHS (if it is not receiving). The change of channel is effective after the device switching time (figure 2). ZR returns to CHR when the MAC acknowledgment is received, after another switching time. A timeout is triggered for all the data transmissions, at expiration of this timeout and in the absence of a MAC acknowledgment, the node automatically returns to CHR.

As in any ZigBee network, it is necessary to be able to reassociate a node which becomes orphan because of a link failure due to the extinction of the parent node or to interferences in the vicinity. The control channel is thus periodically switched following a command sent by the coordinator to all the nodes.

ZR

IV. PERFORMANCE EVALUATION

A. Simulation scenario

The parameters used in NS2 simulator [START_REF]The Network Simulator NS-2[END_REF] are adapted from those of the CC2420 transceiver, in particular for the channel switching time (200µs). They are summarized in table 1. The selected scenario is described in figure 3, it corresponds to a hierarchical clustered topology with a maximum depth of 4 hops (Lm=4) and a maximum of 3 children by router including 2 children routers (Cm=3 and Rm=2). The distances between nodes are chosen so that each node has 1 or 2 hops neighbors. The CBR sources are distributed in the ZED of the different clusters with a maximum of 25 sources and a maximum CBR frequency of 30 packets/s; these values are selected to reach the saturation of the network.

Four solutions are compared: mono-channel; our MASN protocol; a random allocation of the 15 data channels (named Random) and an allocation of a different channel for each subtree of the network (named Subtree) comparable with the one used in TMCP [START_REF] Wu | Realistic and Efficient Multi-Channel Communications in Wireless Sensor Networks[END_REF] but without the tree building process which is carried out in our solution by the ZigBee protocol. For the two last solutions, as for MASN, only one reception channel is allocated for each child router.

B. Simulation Results

Figure 4 shows the evolution of the network global throughput according to the CBR sources frequency, when almost 50% of the sources (12/25) are activated. For the monochannel solution, the throughput is always lower than 60kbps and decreases for frequencies greater than 8 packets per second. The numerous contentions on the data common channel induce important latencies related to the CSMA/CA algorithm. The global throughput obtained with MASN protocol increases linearly to reach a value close to 190kbps at a frequency of 30pkts/s, this threshold is not the maximum but beyond, the delivered packets ratio becomes lower than 50%. This ratio is represented in figure 5 for the four solutions. The saturation in the mono-channel is confirmed by this measurement: delivered packets ratio is lower than 80% for frequencies greater than 8pkts/s. This ratio remains higher than 90% up to a frequency of 10pkts/s in the multichannel solution, which shows the weak number of contentions and thus the efficiency of the solution.

The random allocation gives intermediate performances insofar as it does not avoid identical channels on adjacent or neighboring links, which can involve conflicts. For the Subtree solution, the performances are close to those obtained with MASN for weak traffics (CBR frequencies lower than 15pkts/s). For higher traffics, the throughput and the delivered packets ratio decrease because of the numerous conflicts on the subtrees sharing the same channel. In this case, the difference in performance between the solutions is less important, in particular for the Subtree solution (the progressive activation of the CBR sources favors this solution) but MASN protocol gives a much higher throughput for a delivered packets ratio close to 90%. We have studied and tested a multichannel allocation solution for hierarchical ZigBee/IEEE 802.15.4 networks corresponding to realistic situations (less than 50 nodes with a hierarchical routing and many-to-one transmissions) with as main objective the bandwidth improvement. The principal interest of this solution resides in its simplicity and the facility to integrate it in IEEE 802.15.4 devices insofar as the modifications of the MAC layer are light. This solution is efficient: according to the intensity of the traffic, the global throughput is multiplied by a variable factor between 2 and 5 in comparison with the mono-channel solution and with packets loss ratio much smaller. The throughput is also improved by an average factor equal to 2 compared to a random channel allocation or to a simple subtree distribution.

We currently work on several improvements. The first consists in allocating in a centralized way several channels on each link, the selection of the channel being done dynamically starting from the LQI or the RSSI available on CC2420. The second idea consists in improving the CC2420 transceiver packet forwarding process in the case of multihop links.

Besides, the following stage is the implementation and the test of the multichannel solution on our real sensor network platform made up of MicaZ, TelosB and Imotes2.

Figure 2 .

 2 Figure 2. Channel switching Timing

  Figure 3. Simulated Network

Figure 4 .Figure 5 .

 45 Figure 4. Global Thoughput/CBR Sources Frequency

Figure 6 .

 6 Figure 6. Global Thoughput/Number of CBR Sources

Figure 7 .

 7 Figure 7. Packet Delivery Ratio/Number of CBR Sources V. CONCLUSION

  . Insofar as the allocation of the CHR is necessary only for the ZR (as indicated previously, the ZC can have several radio interfaces with one channel per interface), CHskip(d) depends on Rm and not on Cm. For a given value of Lm and Rm, for example Lm=4 and Rm=2 as in figure1, CHskip(d) can be computed as follows:

	CHR ≠ CHS n CHS =n CHR =1 ZR 13 Channel 14 Lm=4 Cm=3 Rm=2 13 CHS CHR ZC 12 13 +8 +8 CHR	1 ≤ n CHR ≤ 15 n CHS =0* 20 21 21	d=0, CHskip(0)=8 d=2, CHskip(2)=3 d=1, CHskip(1)=8
			14	14	+3	17	17	22	d=3, CHskip(3)=1
	15	15	+1	16	ZED 18 18 CHS	n CHS =1 n CHR =0*	d=Lm=4
			* Except to send or receive acknowledgments
				Figure 1. Example of Channel Allocation
	A function comparable to Cskip(d), named CHskip(d) is
	used to compute the channel offset between two successive
	children ZR. ( )
				( )				( )	(	)
	Finally, we can generalize the CHskip(d) expression:

TABLE 1 :

 1 SIMULATION PARAMETERS

	Physical Channel	802.15.4 -2.4GHz
	Data Rate	250 kbps
	Reception range (Capture Threshold)	15m
	Detection range (Carrier Sense Threshold)	30m
	Maximum surface	100x100m
	Number of nodes	46
	Propagation Model	TwoRayGround
	CBR packet size	97Bytes
	Routing Protocol	ZBR
	Simulation Time	60s


A Rachedi

A Benslimane

H Otrok
email: hotrok@ciise.concordia.ca

N Mohammed

M Debbabi
email: debbabi@ciise.concordia.ca

A Mechanism Design-Based Secure Architecture for Mobile Ad Hoc Networks

Keywords: MANET security, mechanism design, certificate authority and clustering

To avoid the single point of failure for the certificate authority (CA) in MANET, a decentralized solution is proposed where nodes are grouped into different clusters. Each cluster should contain at least two confident nodes. One is known as CA and the another as register authority RA. The Dynamic Demilitarized Zone (DDMZ) is proposed as a solution for protecting the CA node against potential attacks. It is formed from one or more RA node. The problems of such a model are:

(1) Clusters with one confident node, CA, cannot be created and thus clusters' sizes are increased which negatively affect clusters' services and stability. (2) Clusters with high density of RA can cause channel collision at the CA. (3) Clusters' lifetime are reduced since RA monitors are always launched (i.e., resource consumption). In this paper, we propose a model based on mechanism design that will allow clusters with single trusted node (CA) to be created. Our mechanism will motivate nodes that do not belong to the confident community to participate by giving them incentives in the form of trust, which can be used for cluster's services. To achieve this goal, a RA selection algorithm is proposed that selects nodes based on a predefined selection criteria function and location (i.e., using directional antenna). Finally, empirical results are provided to support our solutions.

I. INTRODUCTION

In wired/wireless infrastructure networks, a trusted third party, known as Certification Authority (CA), is needed to certify users' digital certificate that contains users' public key and identity. It is needed to provide a secure communication among users and ensure some security requirements, such as; authentication, confidentiality and integrity of transited data. In classical Public Key Infrastructure (PKI) [START_REF] Chokhani | Internet x.509 public key infrastructure certificate policy and certification practices framework[END_REF], a Registration Authority (RA) is used to collect and analyze users' requests before forwarding them to a CA to certify, issue and renew user's digital certificate. In Mobile Ad hoc Networks (MANETs), a decentralized certificate authority approach [START_REF] Capkun | Self-organized public-key management for mobile ad hoc networks[END_REF], [START_REF] Dong | Providing distributed certificate authority service in mobile ad hoc networks[END_REF], [START_REF] Satizabal | Building a virtual hierarchy to simplify certification path discovery in mobile adhoc networks[END_REF] is proposed, due to MANET characteristics, as a solution to avoid single point of failure, MANET attacks and consider nodes' mobility. To handle these requirements, a distributed clustering algorithm is proposed in [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF] to cluster nodes based on a set of trusted nodes that belong to a confident community. A head cluster is selected among trusted nodes to play the role of CA. To overcome a single point of failure attack against CA, a set of one-hop nodes, RA, are selected from the set of trusted nodes to form a Dynamic Demilitarized Zone (DDM Z). The role of these nodes, besides registration authority, is to protect the CA by filtering CA's incoming requests and monitoring the behavior of nodes in the cluster. The approach is suitable once the confident community size is large enough to grant at least two trusted nodes per cluster (i.e., one CA and another RA).

The first limitation of the approach given in [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF] is its inability to form clusters with single trusted node (CA) and to form the DDMZ from non-confident community. This will decrease the number of clusters and increase clusters' size which affect clusters' services and MANET stability. The second limitation is clusters' lifetime since all selected RA nodes are required to run their monitor and consume resources. Moreover, a high density DDM Z can increase the probability of channel collision at CA. Finally, DDM Z formation is a limitation since RA nodes are selected ignoring CA coverage area. This violates the role of DDM Z since it allows an adversary to launch attacks against CA from RA's uncovered zones.

To overcome these limitations, a robust DDM Z must be built based on nodes from non-confident community. To build a robust model that can cover the CA coverage area, nodes must be cooperative and selected by the CA based on specific selection criteria where some of the parameters of the selection-criteria are considered as private information. The limitation of such a proposition is that nodes might behave selfishly in order not to be selected as RA and consume resources. This will be done by revealing a fake selectioncriteria information. To solve such a problem, incentives must be given to nodes to motivate them to participate and serve as RA. The problem that arises here is: How to design the incentives to motivate nodes to participate and reveal truthful information to build a robust DDM Z?

In this paper, we design a unified model that is able to:

• Motivate nodes from non-confident community to serve as RA and build a robust DDM Z. • Prevent nodes from revealing fake information by designing incentives based on Vickrey, Clarke and Groves (VCG) mechanism where truth telling is the dominant strategy among all nodes. • Increase the CA protection through the design of robust DDM Z formation condition that can select RA nodes based on their location.

• Increase the clusters' lifetime by selecting the RA nodes based on a specific selection-criteria function.

• Increase the number of clusters and reduce the cluster's size. This will help to efficiently serve the nodes of the cluster and effect network stability. Moreover, it increases the probability of detecting the misbehaving nodes. The rest of the paper is organized as follows. In Section II, we discuss the related work on certification authority in MANET and application of mechanism design to networks. In Section III, we provide the problem statement. In Section IV, MANET clustering and CA selection algorithm is given. The robust DDM Z model is given in Section V where the RA election model, selection criteria function, mechanism model and RA election algorithm are illustrated followed by an example. Section VI presents empirical results. Finally, Section VII concludes the paper.

II. RELATED WORK

This section reviews related work on the distribution of the certificate authority in MANET. Moreover, mechanism design and its application to networks is given.

A. Certification Authority in MANET

In [START_REF] Budakoglu | Hierarchical key management for mobile ad-hoc networks[END_REF], the authors proposed a system based on the distribution of the certification authority among specific nodes by using the threshold cryptography scheme [START_REF] Shamir | How to share a secret[END_REF] with several threshold levels to offer nodes flexibility in selecting an appropriate security level for a given application. With this approach the fault tolerant and hierarchical key management services are ensured. Unfortunately, the approaches based on threshold cryptography have some drawbacks: Firstly, the n nodes must be initialized by a trusted authority which is responsible for introducing the partial secret of CA role. On the other hand, an external administration is necessary to configure the system and establish the architecture. Secondly, the number k must be a trade-off between availability and robustness, it must be frequently updated. Thirdly, the system overloads the network since the node must send at least k requests instead of sending only one request to obtain a certificate or revocation (i.e., k-1 messages are needed).

A few works tried to introduce the fully CA distribution without using the threshold cryptography. We quote the Hubaux et al.'s [START_REF] Capkun | Self-organized public-key management for mobile ad hoc networks[END_REF] approach and Satizabal et al.'s [START_REF] Satizabal | Building a virtual hierarchy to simplify certification path discovery in mobile adhoc networks[END_REF] system. In these systems, each user is able to generate a certificate for other users. Certificates are stored and distributed by the users themselves. In this system, each user maintains a local certificate repository. When two users want to check the public keys of each other, they merge their local certificate repositories to find appropriate certificate chains. The drawback of this approach is the assumption that trust is transitive and the system becomes more vulnerable to malicious nodes.

Several works introduce the cluster concept for security in MANETs particularly for the CA distribution. Dong et al. [START_REF] Dong | Providing distributed certificate authority service in mobile ad hoc networks[END_REF] and Bechler et al. [START_REF] Bechler | A clusterbased security architecture for ad hoc networks[END_REF] propose the distribution of the CA service by using threshold cryptography and introduce the cluster structure. The cluster concept is adopted to provide the CA service and proactive secret shared update protocol. In Bechler et al.'s [START_REF] Bechler | A clusterbased security architecture for ad hoc networks[END_REF] approach, the certification of any guest node must possess a certain number (W ) of warranty certificates from warrantor nodes. Then, it must request at least (k) certificates from different cluster heads (CHs), whose association gives the network certificate. Unfortunately, this approach is not realistic because the warrantor nodes do not have any information about the new node to be guaranteed. To overcome this problem, the authors of [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF] proposed a distributed architecture which divides the network into clusters and distributes the CA in each cluster to secure the network. They defined a new trust model and new concept of Dynamic Demilitarized Zone (DDMZ) to secure the CA node in each cluster against a single point failure and to monitor the nodes in the cluster.

B. Mechanism Design Application

Mechanism design is a sub-field of microeconomics and game theory [START_REF] Mas-Colell | Microeconomic Theory[END_REF]. It uses game theory tools to achieve a desired goal. The main difference between game theory and mechanism design is that the former is used to study what could happen when independent players act selfishly, whereas mechanism design allows us to define the game in such a way that the outcome of the game, known as the Social Choice Function (SCF), will be played by independent players according to the rules set by the mechanism designer. Mechanism design has been used in computer science by Nisan and Ronen [START_REF] Nisan | Algorithmic mechanism design[END_REF] for solving least cost path and task scheduling problems using algorithmic mechanism design. Distributed mechanism design based on VCG is first introduced in [START_REF] Feigenbaum | A BGP based mechanism for lowest-cost routing[END_REF] to compute the lowest cost routes for all source-destination pairs and payments for transit nodes on all the routes. It is a direct extension of Border Gateway Protocol (BGP), which causes modest increases in routing table size and convergence time.

Currently in MANET, mechanism design is mainly used for routing purposes. In [START_REF] Anderegg | Ad hoc-VCG: A truthful and costefficient routing protocol for mobile ad hoc networks with selfish agents[END_REF], the authors present a truthful adhoc-VCG mechanism to find the most cost-efficient route in the presence of selfish nodes. In [START_REF] Chen | iPass: an incentive compatible auction scheme to enable packet forwarding service in MANET[END_REF], the authors provide an incentive compatible auction scheme to enable packet forwarding service in MANET using VCG. A continuous auction process runs to determine who should obtain how much of the bandwidth and at what price. Incentives are in the form of monetary rewards. On the other hand, mechanism design is recently used for intrusion detection in MANET [START_REF] Otrok | A game-theoretic intrusion detection model for mobile ad-hoc networks[END_REF]. The authors propose a distributed election mechanism that selects the most cost efficient node to play the role of leader IDS in a cluster. To motivate nodes to behave normally during the election process, the authors design incentives, based on VCG, in the form of reputation where intrusion detection service is offered to nodes according to their reputation. To catch misbehaving leader after election, a catch an punish model is proposed. As an extension for their work, the authors proposed in [START_REF] Mohammed | A mechanism design-based multi-leader election scheme for intrusion detection in manet[END_REF] a distributed leader-IDS election mechanism that can elect the most cost efficient leaders without running any clustering algorithm.

III. PROBLEM STATEMENT

To protect the CA node, a set of trusted (T m = 1) nodes (one-hop) are selected to play the role of RA and form the Dynamic Demilitarized Zone (DDM Z) [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF]. This is done by filtering the traffic of CA searching for attacks. Moreover, the role of these nodes is to monitor the behavior of other nodes in the cluster. The problems facing this model are: First, the cluster formation requires at least two trusted nodes which prevents clusters with one trusted node to be created. This will lead nodes to join other clusters which increases the number of nodes in the cluster and negatively affect the cluster's services (i.e., routing, intrusion detection, key distribution and certification). Second, all trusted nodes are required to monitor and play the role of RA to ensure security robustness which causes nodes to consume a lot of resources and decrease the cluster's lifetime. Additionally, the more is the RA, the more is the probability of channel collision at CA. Third, it is not granted that the CA coverage area is always monitored by the RA nodes. This is because the DDM Z formation condition did not consider the CA coverage area which can be violated by an attacker.

Solving these problems will start by proposing a solution for cluster formation condition where clusters can be created using one trusted node which is selected as CA. This proposition faces the following challenges: First, nodes that will be selected to play the role of RA, to form DDM Z, are no more belonging to the confident community which can lead nodes to behave selfishly. We define selfish node as an economically rational node whose objective is to maximize its benefits (payoffs). Second, RA selection will be based on specific criteria such as energy level, trust level, mobility and connectivity degree. Some of these information are considered as private where nodes can reveal fake information in order not to be selected and preserve their resources. Incentives must be given in the form of trust in order to motivate nodes to reveal their private information. The question arises here is: How to design the incentive in such a way where truth telling is the dominant strategy for all nodes? Third, to increase the cluster's lifetime and to avoid channel collision, a specific number of nodes must be selected to form the DDM Z. Moreover, these nodes should be able to monitor the CA coverage area by filtering all the CA traffic. The question that we address is: What is the minimum number of RA nodes needed to achieve this goal?

Here, we propose a new DDM Z formation condition where RA nodes will be selected by the CA based on their selectioncriteria function which is defined in terms of nodes' private information. Here, we assume that the CA is equipped with an antenna that can work as directional or omni-directional. RA election algorithm is designed where the directional antenna is used to create the DDM Z by selecting a set of RA nodes that meet the selection criteria. This will increase the robustness of DDM Z. On the other hand, omni-directional antenna is used to overhear the RA nodes and monitor their behavior. Moreover, we propose a model based on VCG mechanism [START_REF] Hurwicz | Designing Economic Mechanisms[END_REF] to motivate nodes to reveal truthfully their private information. Payments are issued in the form of trust to motivate nodes to say the truth. These propositions will help to increase the cluster's lifetime and reduce channel collision at the CA.

IV. MANET CLUSTERING AND CA ELECTION

ALGORITHM In this section, we devise a clustering algorithm that clusters MANET and elects a CA in each cluster. To ensure the security, it is assumed that set of the nodes belong to a confident community. For clusters with more than one trusted node, the CA is selected among these nodes based on node's stability which increases cluster's lifetime. Furthermore, the clustering algorithm ensures the authentication and integrity of the transited data during the election process.

Each trusted node sends two successive hello message in order to calculate the Relative Mobility (RM ), after that, it announces itself as CA with a certain cluster's size (khop). When a trusted node receives a beacon, from one of its neighbors, it executes clustering algorithm 1 to change its status from cluster-head (CA) to cluster-member. The decision to change the status from CA to cluster-member depends on two main parameters: Security and stability. A CA is considered as more stable than others if it has a low relative mobility. Any trusted node with relative mobility more than a specific threshold is considered as unstable and thus will not be considered during the CA selection. The nodes situated between two adjacent clusters can become gateway (GW) [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF]. The following algorithm is executed by each node that belongs to confident community.

Algorithm Once the CA node is elected per cluster, it starts to transmit cluster's beacon in order to inform the cluster's member nodes about its availability. The cluster's nodes that are not receiving any beacon from a CA for a predefined period of time is considered as unavailable.

V. A ROBUST DDM Z MODEL

In this section, we present our RA election mechanism for truthfully electing the RA nodes that will serve as DDM Z and belong to non-confident community. In Subsection V-A, we describe the RA election model followed by the selection criteria function F for electing RA nodes is given in Subsection V-B. Subsection V-C formulates our mechanism model using with the payment function followed by an example.

A. RA Election Model

Once the CA node of each cluster is selected, it elects a set of RA nodes that belongs to non-confident community with a certain trust-level. The RA nodes are located at one-hop from the CA node. The role of RA nodes is to protect CA node against attack from unknown nodes such as Denial of Service (DoS). Any packet destined to CA node must be analyzed and filtered by RA nodes. To achieve this goal, a robust DDM Z should be created by selecting the best RA nodes based on nodes' selection criteria function and according to nodes location. This will increase the performance of DDM Z since the CA coverage area is protected by RA nodes. Selecting RA nodes according to their location requires a secure localization algorithm [START_REF] Capkun | Secure positioning in wireless networks[END_REF]. To avoid running such algorithm, directional antenna is used by the CA where the CA's zone is divided into 6 sectors [START_REF] Hu | Using directional antennas to prevent wormhole attacks[END_REF]. The sectors are numbered from 1 to 6 starting with zone 1 heading east as shown in figure 1. Dividing the CA zone to 6 sectors with 250 m omni transmission range leads to 450 m of directional transmission range [START_REF] Hu | Using directional antennas to prevent wormhole attacks[END_REF]. With such type of antenna, the CA node can allocate the location of one-hop nodes. This proposition allows us to prolong cluster's lifetime by electing the minimum number of RA nodes that covers the 6 sectors. With 250 m of omni transmission range, each RA node can cover its own sector and the left and right sectors. This means that 3 RA nodes are required to form a robust DDM Z where RA nodes are selected from disjoint sectors. This means that RA nodes cannot be selected from the same sector or from two consecutive sectors. For example, if a CA chooses node N 3 then nodes from sectors 1, 2 or 3 cannot be selected. Thus, DDMZ can be formulated by selecting nodes from sectors {1, 3, 5} or {2, 4, 6}. The selection between both combination depends on the selection criteria function F () given in subsection V-B. This formation condition will increase the monitoring coverage area for the cluster and thus the DDMZ is efficiently able to protect the CA node from attacks originated from different directions. The objective of maximizing the selection-criteria function (F) of DDM Z can be expressed by the following Social Choice Function (SCF):

SCF = S(C) = max i∈N F i (1)
This means that the summation of F given in Subsection V-B of the selected RA nodes has to be maximum overall the set of possible combination. Clearly, to maximize the summation, the nodes need to reveal their truthful function F. In the next subsection, we design a mechanism design based incentive

B. Selection Criteria Function (F )

The selection criteria function has the following parameters: Trust Level/Metric (Z 1 ): This metric determines the confident level of nodes which is evaluated by the monitoring mechanism. Each node has a reputation generated by the monitoring mechanisms according to its contribution in the network like forwarding ratio or others network' services.

Stability Metric (Z 2 ): RA node's stability is based on the relative mobility according to the CA node (it is the private information of a node). The mobility metric is based on the power level (received signal strength) detected at receiving node RxPr, it is indicative of the distance between the transmitting and receiving node pairs. The ratio of RxPr between two successive packets transmissions gives a good knowledge about the relative mobility between two neighboring nodes. The relative mobility metric at node Y with respect to X is defined by RM rel y (x) [START_REF] Basu | A mobility based metric for clustering in mobile ad hoc networks[END_REF].

RM rel Y (X) = 10 log 10 RxP r new X→Y RxP r old X→Y (2)
Residual Energy Metric (Z 3 ): This metric determines the residual energy level of the nodes. This is also a private information of a node.

Connectivity Degree (Z 4 ): It is the number of links a node is connected with. In other word, connectivity degree is the number of one hop neighbors of a node. A node having greater connect degree means that it can cover more nodes for monitoring in the cluster.

Based on the above four parameters, our selection criteria function F is defined as follows:

F = 4 i=1 W i Z i (3)
where W i is the weight of each parameter i. According to the security context, the weight of the trust metric (W 1 ) must be greater than others metrics. However, the stability (W 2 ) and the residual energy (W 3 ) have the same weight, because both metrics have the same importance in the model. When the stability metric is low, the RA node cannot be insured for its role for long time. On the other hand, when the residual energy metric is low, the RA will not be able to do its task for long time. Finally, the connectivity degree metric (W 4 ) has the lowest weight since it does not impact the security of the cluster. If the connectivity degree is low, then more RA nodes are needed for coving the whole cluster. Therefore, we can establish the relation between metrics' weight as follows:

W 1 > W 2 = W 3 > W 4 and 4
i=1 W i = 1. The stability and residual energy are the private information, which needs to be truthful in order to have a truthful calculated function F . We give incentive in terms of reputation so that nodes are motivated to participate and reveal their truthful function F (). To achieve this goal, the payment should be designed in such a way truth-telling is the dominant strategy for each node.

C. Mechanism Model

We treat the RA election as a game where the N mobile nodes are the agents/players. Each node plays by revealing its own private information (selection criteria function (F )) which is based on the node's type θ i . The type θ i is drawn from each player's available type set Θ i ={Normal, Selfish}. Each player selects his own strategy/type according to how much the node values the outcome (i.e., The amount of reputation granted). If the player's strategy is normal then the node reveals the true selection criteria function F . We assume that each player i has a utility function [START_REF] Mas-Colell | Microeconomic Theory[END_REF]:

u i (θ i ) = p i -v i (θ i , o(θ i , θ -i )) (4)
where,

• θ -i is the type of all the other nodes except i.

• v i is the valuation of player i of the output o ∈ O, knowing that O is the set of possible outcomes. In our case, if the node is elected then v i is the value of the selection criteria function F i . • p i ∈ ℜ is the payment given by the mechanism to the elected node. Payment is given in the form of reputation. Nodes that are not elected receive no payment. Note that, u i (θ i ) is what the player usually seeks to maximize. It reflects the amount of benefits gained by player i if he follows a specific type/strategy θ i . Players might deviate from revealing the truthful value of the function F if that could lead to a better payoff. Therefore, our mechanism must be strategy-proof where truth-telling is the dominant strategy. To play the game, every node declares its corresponding function F , where each node's reported function value is the input for our mechanism (i.e., input vector). For each input vector, the mechanism calculates its corresponding output o = o(θ 1 , . . . , θ n ) and a payment vector p = (p 1 , . . . , p n ). Payments are used to motivate players to behave in accordance with the mechanism goals. The goal of our mechanism is to motivate nodes to say the truth and compute the output o that is equal to the SCF defined in Equation 1.

Payment Design: Based on the selection criteria function revealed by all the nodes to the mechanism, CA elects a set of nodes according to the requirement to play the role of RA that forms the DDM Z. Our mechanism provides payments to the elected RAs for running their monitor and forming a DDM Z. The nodes that are not elected will not not receive any payment. The payment is in the form of reputations, which are then used to increase the trust level and allocate the cluster's services. Hence, any node will strive to increase its reputation in order to increase the trust level.

According to VCG [START_REF] Anderegg | Ad hoc-VCG: A truthful and costefficient routing protocol for mobile ad hoc networks with selfish agents[END_REF], the following design of payment is strategy proof where truth-telling is the dominant strategy:

p i = F i + i∈N v i (o * ) - j∈N v j (o * ) (5)
where o * is the optimal selection of nodes that maximizes the sum of all the agent's declared function value. Here, j∈N v j (o * ) denotes the second maximum summation assuming without node i.

D. RA Election Algorithm

Once the CA node is determined by Algorithm 1, it elects the RA nodes for the cluster. Initially, the CA sends Start -Election message to each sector according to Algorithm 2 using the directional antenna. Then, the CA waits for the reply from the member nodes for a fixed interval of time, T 1 . On expiration of T 1 , it sends the Start -Election to the next sector. Thus, steps 2 and 3 are repeated for all the 6 sectors. At the end of T 6 , the CA accumulates all the values of function F from the member nodes. Then, it determines the RAs according to the equation 1 and calculates the payment according to equation 5. Finally, CA sends a P aymentconf irmation message to the elected RAs. Wait for the reply from the member nodes; 4. End For 5. Determine the RA nodes for DDM Z; 6. Send P aymentconf irmation to the RAs;

On the other hand, member nodes wait for the Start -Election message from CA. Once received, it calculates the function value, F and sends it to CA for optimal RA determination. The member nodes then wait for the election results from the CA. Elected RA nodes receive a P aymentconf irmation message from the CA and it launches its monitor to perform the role of RA.

E. Example

To illustrate the RA election scheme, we consider the cluster of Figure 1. Since our model is repeatable, we present the election process at the 10 th round. The reputation at the 9 th round is given in the first row of Table I. To elect the RA nodes in the 10 th round, the CA node sends Start -Election message to all the sectors one after another. Upon receiving the Start -Election message, the member nodes send their function value, F to the CA node according to Algorithm 2 and 3. The corresponding function values are given in the second row of Table I. Then, the CA node elects the RA nodes based on RA selection model (Section V-A).

Here, the winners (or elected RAs) are nodes N 3 , N 4 and N 5 since the summation of their function value is maximum, which is 20. Moreover, the CA calculates the payments of the elected RAs according to equation 5. For example, the payment for the node N 3 is P 3 = 5 + (20 -16) = 9. This is because if node N 3 did not participate then the winners would have been nodes N 1 , N 2 and N 6 and thus the maximum summation would have been 16. Similarly, the payments for the node N 4 is P 4 = 8 + (20 -16) = 12 and N 5 is P 5 = 7 + (20 -19) = 8. Finally, the CA sends a P aymentconf irmation message to the elected RA nodes and increases the reputation of the nodes which is shown in the third row of Table I. On receiving the confirmation, the elected nodes launches the monitors to play to role of RA.

VI. SIMULATION RESULTS

In this section, we evaluate and compare the performance of the new proposed secure clustering algorithm (SDCA V 2 ) with the previous model SDCA V 1 [START_REF] Rachedi | A secure architecture for mobile ad hoc networks[END_REF]. We have implemented our clustering algorithm as described previously. We use the Network Simulator (NS-2) [START_REF]The network simulator ns-2[END_REF] with CMU wireless extensions to simulate our algorithm. Simulation scenarios were generated with parameters listed in table II.

At first, we motivate our work showing the impact of selfish nodes on the network. As mentioned before, nodes can behave selfishly before the election. A node shows selfishness before election by refusing to serve as RA. This selfishness has a serious impact on resource consumption of the normal nodes. Figure 2 depicts the impact of selfish nodes on the life of normal nodes. The result indicates that normal nodes will carry Fig. 2. Impact of selfish node on the lifetime of Network out more the duty of RA and die faster whenever the number of selfish nodes increase. Thus, the presence of selfish node effect the lifetime of the entire network.

After we illustrated the impact of selfishness on the lifetime of normal nodes, we need to show the performance of our model on both: number of clusters and DDMZ formation. In Figure 3.(a), we show the average number of CA nodes that can create clusters. The figure shows that as the transmission range increases the number of clusters decreases for both models. Due to the new cluster formation conditions, the number of CA nodes of our model SDCA V 2 is greater than the previous one SDCA V 1 . In SDCA V 1 , clusters are formulated by at least two trusted nodes, where as in SDCA V 2 , cluster formation needs one trusted node. Hence, we can conclude that the new model (SDCA V 2 ) is more flexible than the previous one with respect to cluster's formation. Thus, nodes' CA service will be enhanced and probability of detecting the misbehaving nodes can be increased since nodes will be distributed over more number of CAs. Now, we need to show that the selection criteria function F and the directional antenna selection are needed to form a robust DDMZ. First, we analyze the distribution of the RAs in each cluster according to our proposed directional antenna selection model. Our clustering algorithm divides 50 nodes over 5 clusters when the transmission range is 250m. Figure 3.(b) illustrates the number of potential RA nodes in each cluster's sector. We notice that cluster 5 does not have enough RAs to form a robust DDMZ. Selecting the nodes based on the selection criteria can still be valid and nodes will be motivated to reveal their function F but selected RA nodes cannot cover the CA coverage area. On the other hand, the other clusters Finally, we show how the value of function F () is used to select RAs. Figure 3.(c) shows the maximum value reached by the function F () in each clusters' sector. This information is useful for the CA in order to select the RA nodes since the function F () determines the ability of the RA nodes to form a robust DDMZ. We notice that in cluster 3, sector 3 has the maximum value of F () among all the sectors. However, F () value is null in sectors 2 and 4. Hence, the CA will choose RA from sector 1, 3, 5. Thus, the CA nodes select the RAs not only based on the function F (), but also based on the location (the sectors in which it belongs to) of the RA nodes in order to form a robust DDMZ.

VII. CONCLUSION

The Dynamic Demilitarized Zone (DDMZ) is previously proposed as a solution for protecting the CA node against potential attacks. It is formed from one or more RA nodes where the CA and RA nodes belong to the confident community. Clusters with one confident node, CA, cannot be created and thus clusters sizes are increased which negatively affect clusters services and stability. Moreover, clusters with high density of RA can cause channel collision at the CA. Additionally, clusters lifetime are reduced since RA monitors are always launched and thus more resources are consumed. Thus, we proposed a model based on mechanism design that allow clusters with single trusted node (CA) to be created. The mechanism is able to motivate nodes that does not belong to the confident community to participate by giving them incentives in the form of trust, which can be used for clusters services. Moreover, a RA selection algorithm is proposed that selects nodes based on a predefined selection criteria function (F) and nodes location. This will lead to a robust DDMZ that is able to preserve the security of CA and prolong the lifetime of clusters. Simulation results indicate that our model lead to more number of clusters and robust DDMZ can be created based on both: selection criteria function F and directional antenna selection model.

Fig. 1 .

 1 Fig. 1. Cluster of 10 nodes divided into 6 Sectors

Algorithm 2 :

 2 Executed by CA node 1. For Sector 1 to 6: 2.Sends Start -Election message to its neighbors; 3.

Algorithm

Fig. 3 .

 3 Fig. 3. (a) The average CA node versus transmission range (b) The potential RA node number/sector (transmission range=250m) (c) The maximum value reached by F()/sector with transmission range=250m and w 1 = 0.5, w 2 = w 3 = 0.2 and w 4 = 0.1

  else if (RM j < RM i ) OR (DN j > DN i ) then node j remains as CA candidate; else if (RM i == RM j ) AND (DN j == DN i ) then apply Lowest-ID; end where, P acket -Authentication -Integritychecking() is the function which consists to check the integrity and the authentication of the election packet. HopCount indicates the hop number of the election packet.RM i is the relative mobility of node i and DN i is the degree of the neighbors nodes of the node i.

1: Clustering Algorithm (SDCA V 2 ) When node j receives an election packet from node i; begin Packet-Authentication-Integrity-checking(); if (HopCount >= k) then No -Competition; Goto(end); else if (RM i < RM j ) OR ((RM i == RM j ) AND (DN j < DN i )) then Accept node i as CA;

3 :

 3 Executed by Member nodes 1. Receive Start -Election message from CA; 2. Calculate and Send the Function value F to CA node; 3. If node receive P aymentconf irmation from CA; 4. Play the role of RA; 5. end If;

of Selfish Nodes Time taken for the first node to die (secs)

					TABLE II
			SIMULATION PARAMETERS
	Parameter				Value in our simulation
	Number of nodes (N) 50
	Network size (mxn)		670x670m2
	Mobility				[0-20 m/sec]
	Transmission Range		50 m -250 m
	Pause time				3.0 s
	Simulation time			200 s
							10 Nodes
	900
	850
	800
	750
	700
	650
	600
	550
	500	0	5	10	15	20	25	30	35	40	45	50
						%


Abderrezak Rachedi
email: abderrezak.rachedi@univ-avignon.fr

Abderrahim Benslimane
email: abderrahim.benslimane@univ-avignon.fr

Smart Attacks based on Control Packets Vulnerabilities with IEEE 802.11 MAC *

Smart attacks based on control packets vulnerabilities with IEEE 802.11 MAC

Abderrezak Rachedi, Abderrahim

I. INTRODUCTION

With the growing popularity of MANETs, it is reasonable to expect that users will demand a high security level for them. Many recent works proposed a security solution based on the monitoring mechanisms such as: Watchdog mechanism [START_REF] Marti | Mitigating Routing Misebehavior in Mobile Ad Hoc Networks[END_REF] and others [START_REF] Zhang | Intrusion detection in wireless ad-hoc networks[END_REF] [START_REF] Rachedi | A Confident Community to Secure Mobile Ad-Hoc Networks[END_REF]. The monitoring process is defined as the set of actions that are useful to supervise the behaviour of nodes. These actions depend on the services we want to monitor (routing, authentication, integrity, etc). The monitoring process is a part of the Intrusion Detection System (IDS). Therefore, without any IDS of misbehaving nodes, it has been shown that the results of misbehaviour have shown that they dramatically decreased the performance of the network [?] and produced the denial of service (DoS). However, the IDS solutions proposed for MANETs [START_REF] Marti | Mitigating Routing Misebehavior in Mobile Ad Hoc Networks[END_REF] [START_REF] Zhang | Intrusion detection in wireless ad-hoc networks[END_REF] are not efficient for the certain hidden vulnerabilities, particularly the cross-layer attacks. These attacks are based on the MAC layer and propagate to the upper layer. Some researchers already studied MAC vulnerabilities and the cross-layer attacks [START_REF] Radosavac | Cross-layer attacks in wireless ad hoc networks Conference on Information Sciences and Systems[END_REF] [START_REF] Guang | On MAC Layer Misbehavior in Wireless Networks: Challenges and Solutions[END_REF], but they only focused on the back-off, DIFS and SIFS manipulations. In this work, we do not focus on the back-off vulnerability, but we show new MAC layer' vulnerabilities based on the packet control format and on the new challenge for IDS that is the detection of these smart attacks.

The contribution of this work consists on the illustration of the new hidden vulnerabilities at the MAC layer, particularly the control packets which have a negative impact on the network's performance. These vulnerabilities are different than the problem of false RTS [START_REF] Ray | On False Blocking in RTS/CTS-Based Multihop Wireless Networks Vehicular Technology[END_REF]. However, in our case we focus on the control packets format vulnerabilities and the different attacks which can be exploited against the network and particularly the monitoring process. Furthermore, we discuss the difficulty to detect the attackers and the attacks based on the CTS and ACK packets. Moreover, we show the impact of the attacks on the network and we discuss their effect on the monitoring process based on the forwarding approach (Watchdog mechanism [START_REF] Marti | Mitigating Routing Misebehavior in Mobile Ad Hoc Networks[END_REF]). The attackers' goals can be focused on the network's performance, that means they want to disturb the monitoring process to punish the nodes that well-behave by reducing their reputation. The attacks' implementation and their simulations are presented. In addition, we do not limited to the simulations' result, but the real experimentations are done and the obtained results confirm the simulations' results. Almost all works in the literature propose only analytical analyses and/or simulations rare are those which implement their proposals for a security issues in a testbed. In spite of the problems related to the hardware and system, our initiative to implement our proposals deserves to be introduced into this paper and constitutes a beginning with other experiments.

The rest of the paper is organized as follows. In section 2, we present the hidden vulnerabilities with RTS-CTS handshake protocol: control packets format vulnerabilities, the false CTS and the false packet's validation based on the false ACK are illustrated. In section 3, we show the impact of these attacks on the network with the simulations. The fourth section is devoted to the experimentations' results and to their analysis. In section 5, we propose a security analysis. The last section is the conclusion and we also present our future works.

II. HIDDEN VULNERABILITIES

In this section, we illustrate the hidden vulnerabilities at the MAC layer which have a negative impact on the monitoring mechanism. We show how these vulnerabilities may be exploited by the attackers.

A. The RTS-CTS handshake mechanism

The RTS-CTS mechanism is used to avoid the hidden node's problem [START_REF] Rahman | Hidden Problems with the Hidden Node Problem[END_REF]. The basic idea of the RTS-CTS mechanism consists in transmitting the RTS packet from the sender to the receiver node. When the receiver node receives the RTS packet, it answers by the CTS packet, in order to inform its neighbours about the transmission duration and to avoid the hidden nodes' problem. As illustrated in figure 1(a), node C overhears the RTS packet and defers its own transmissions by the NAV(RTS). So, the NAV (Network Allocator Vector) is the transmission duration which is calculated by sender node A.

N AV (RT S) = 3.T SIF S + T CT S + T DAT A + T ACK [START_REF] Rachedi | A Confident Community to Secure Mobile Ad-Hoc Networks[END_REF] where T CT S , T DAT A and T ACK are the propagation times of transmission packets CTS, DATA and ACK respectively. The T SIF S is the Short InerFrame Spacing 1 .

Node D defers its own transmission when it receives the CTS packet with NAV(CTS) in the duration packet field, as illustrated in figure 1

B. Control packets' format vulnerabilities

Figure 2 shows the RTS, CTS and ACK packets' format [START_REF]The editors of IEEE 802.11, Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) specification[END_REF]. We notice that, in order to optimize the packets' size, the CTS and ACK packets do not contain the source address of the transmitter node. However, with an RTS/CTS mechanism, when the node sends the RTS packet to the destination node, all nodes in its transmission range become silent except the destination one, that will answer by CTS without its address in the packet. When the sender node receives the CTS packet, it deduces that the packet is from the destination node without checking the address (identity) of the source node, that sends the CTS. In IEEE 802.11, the node cannot communicate with more than one node at the same time [START_REF]The editors of IEEE 802.11, Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) specification[END_REF]. Furthermore, the ACK packet cannot be authenticated by the node which receives it. The malicious nodes can exploit this vulnerability by producing some attacks without being identified by the IDS. The attacker can generate the false RTS in order to block its neighbours. According to the RTS packet format, many solutions may be proposed to detect this attack, like the RTS 1 In IEEE 802.11, the T SIF S = 10us validation proposed in [START_REF] Ray | On False Blocking in RTS/CTS-Based Multihop Wireless Networks Vehicular Technology[END_REF]. However, this solution is limited to the RTS packet and cannot avoid the problem. For example, the attacker can only generate the false CTS and sophisticated false ACK, in order to disturb the network's operation. The scenario of these attacks is explained hereinafter.

C. Virtual jamming based on the false CTS

The false CTS packet can be generated by the attacker, in order to create a false blocking situation (virtual jamming) [START_REF] Ray | On False Blocking in RTS/CTS-Based Multihop Wireless Networks Vehicular Technology[END_REF]. When the nodes in the transmission range of the attacker node receive a false CTS packet, they are futilely blocked during the presumed transmission duration NAV(CTS), even if they did not receive the RTS packet (it considers itself as a hidden node). The false CTS attack can block the nodes in the transmission range of the attacker but it can also block the nodes outside the transmission range of the attacker and inside the interference range of EIFS (Extended Inter-Frame Spaces)2 [START_REF]The editors of IEEE 802.11, Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) specification[END_REF]. That means that the nodes receive a false CTS but cannot decode it correctly. We can say that the impact of this attack is not limited to the transmission range of the attacker node but is extended to its interference range. Another important problem with this attack is that even if the monitor node detects the false CTS, it is not able to detect the attacker according to the packet format's vulnerability. That means that the attacker can easily escape the punishment procedure, for example, by reducing its trust level or reputation level. That's why the attacker node can easily exploit this vulnerability and frequently attack its neighbors.

In figure 3 we show the false CTS attack algorithm as flow chart. We notice that the attacker checks if the NAV matches zero, then, it will check the channel status. If the channel is busy, it will wait for DIF S + Backof f , otherwise it will create the false CTS with a false destination address and start the attack.

D. False packet validation based on the false ACK

The false ACK packet can be exploited by the attacker, in order to disturb the network's operation such as the routing process or the monitoring mechanism, etc. The false ACK attack cannot be detected and the negative impact is more significant. The idea consists in validating the packet of the sender although the packet is not received correctly by the receiver node. The impact of this false validation of the packet is that the sender will not retransmit the packet because it received the ACK packet.

B min = N AV (CT S)-(TACK +TSIF S ) 2 B max = N AV (CT S) -(T ACK + T SIF S + T JAM )
where T JAM is the propagation time of the packet which will create the collision at node B. Generally, this packet has a small size, like the ACK or CTS packets. Then, T JAM is equivalent to T ACK or T CT S . The reason why we chose a random value for T coll is that we wanted to escape any anomaly detection by the monitor node (an IDS). In the second part, the attacker sends the false ACK to node A at the time T valide . This duration is calculated as follows:

T valide = N AV (CT S) -T ACK -T SIF S .
When sender node A receives the ACK packet before a certain timeout T Out 2 , it does not realize the presence of any anomaly or false ACK packet. T Out 2 is the maximum time between the time when the sender node starts to transmit DATA and the reception of the ACK packet. The T Out 2 is calculated as follows:

T Out 2 = T DAT A + M P D + T SIF S + T ACK + M P D (3)
where MPD is the propagation delay 3 . So, the T valide must be less than T Out 2 , otherwise the sender can detect the problem and retransmit the packet. Once the T coll timer is finished, the attacker sends the packet to node D in order to create a collision. Then, then the T validate timer is finished the attacker send the false ACK to the sender in order to validate the DATA packet transmission.

A. Attacks' simulation and impact's evaluation

In this section, we investigate on the impact of the false CTS and false ACK (false validation) on the network. We implemented these attacks in an NS2 [START_REF]The network simulator ns-2, Part of the VINT project[END_REF] and we simulated them in different cases.

First, we simulate the simple topology illustrated in figure 6. In this scenario, we have two sets of nodes, S 1 = {0, 1, 2, 3} and S 2 = {4, 5, 6, 7, 8}. In each set, the nodes can hear and communicate directly with nodes belonging to the same set but the nodes in S 1 are not reachable by the nodes in S 2 and vice versa. In both sets, we have two CBR flows (the packet's size equals 1000 bytes and the rate reaches 50 packets/second). However, in set S 1 , there is no attacker and in set S 2 ; node 8 reacts as a malicious node and it can use the false CTS and false packet validation's attacks (false ACK). We chose the throughput as metric, in order to show the impact of these attacks on the network. In figure 7, we plot the average throughput of the network according to the simulation time. In the case of the false ACK, we remark a significant difference between a throughput with no attacker in the network and one with one attacker in the network. However, in the case of a false CTS, we note the same observation as in the first case: the throughput decreases with the attendance of the attacker in the network. However, the false ACK has a more negative impact on the throughput than the false CTS, because the false CTS just creates a blocking situation for a certain time around the attacker node, whereas the false ACK attack creates a collision at the receiver node and then sends the false ACK packet, in order to get the packet validated by the sender node and to avoid the retransmission. In order to compare both attacks, we can say that the false ACK attack is more complex to implement than the false CTS, and the false ACK has a more negative impact on the network than the false CTS.

In order to study the impact of these attacks in the general case, we simulate a network with 50 nodes uniformly and randomly distributed in the area of 800×800m 2 with 25 CBR connections and with a different number of attacker nodes in the network. Figures 8 and9 show the throughput in the normal case and in the case of 10 and 20 attackers in the network with both cases false ACK and false CTS. We note that, when the number of attackers increases, the throughput quickly decreases. However, the case of false CTS is illustrated in figure 9, and we remark some difference with the case of of the different numbers of attackers from 0 to 25 malicious nodes (corresponding to 0 to 50%) in the network with a simulation time of 150 seconds. In the case of 5 attackers in the network, we note that the throughput decreases in the same way in both cases false ACK and false CTS. However, when the number of attackers is 10, we note that the throughput of the network decreases more than in the case of false CTS.

We have the same observation when the number of attackers is between 15 and 25. We can summarize as follows: the number false ACK attackers has a more negative impact than the number of false CTS attackers.

B. Real attacks' experimentation and their impacts

In order to illustrate the feasibility to exploit the described vulnerabilities, we decided to realize these attacks and experimented them. To reach this goal, we experienced the simple attack scenario by using the open source MadWifi drivers (Multiband Atheros Driver for Wireless Fidelity) [9] available for Linux. For compatibility with MadWifi, we used wireless network interface cards based on the Atheros chipsets [10]. For experimentation' equipments, we used the Atheros AR5005G 802.11abg NIC Chipset of TP-Link as wireless network interface and Intel Pentium 4 2.4GHz, 512KB cache L2 and 512MB of RAM memory for attacker and others computers. Furthermore, the CTS and RTS attacks algorithms are implemented on MadWifi. In figure 11, we show the simple experimentation scenario, where the machines A and B want to communicate and M is a malicious machine. The ping process consists in two ICMP messages: a request from A and a reply from B. After a successfully request/reply message from A to B, node M overhears the communication and obtains the transmission duration (NAV), and then, it starts to manage its attack. Once, the channel is idle, it sends a false CTS packet with N AV (CT S) in the duration field as described in CTS attack's algorithm. The N AV (CT S) can be either a constant or a random value, but it cannot exceed 32767µSec [START_REF]The editors of IEEE 802.11, Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) specification[END_REF]. Using the analyzer Wireshark [11] to listen and monitor the network traffic, we obtained result which is plotted in figure 12. We notice that after the first successful communication between nodes A and B, node M starts its attacks at 30 seconds and it successfully sends a false CTS. Then, we remark that neither node A nor node B can communicate during false N AV (CT S). The attacker node M continues to transmit the false CTS and dominates the channel by creating the blocking situation. We focus on the period between 30 and 35 seconds and we plot in figure 12 the number of packets according to experience times. Then, we illustrate that the first false CTS packet is transmitted and after false NAV duration, others false CTS are transmitted by the attacker in order to keep the blocking situation as long as possible. When attacker M stops to send the false CTS at 320 seconds, node A can send its packet to node B and the channel's situation is back to normal. In order to study the false CTS attack with TCP communication, we introduced the SSH connection between nodes A and B. Figure 13 shows the result obtained by using the Wireshark analyzer in the case of the SSH connection. The SSH connection is represented by TCP flows in figure 13. We remark that when the attacker manages to have access to the channel and successfully sends the false CTS packet at 39 seconds, then the communication between nodes A and B is broken during the false NAV. Since, the attacker can transmit successfully the false CTS and it continues to disturb the communication between nodes. With these results, we illustrate the efficiency of the false CTS attack and its real negative impact in the network. 2) Case of false RTS attack: In order to illustrate the impact of the false RTS by the experimentation, we implemented this attack with MadWifi and the results obtained are shown in figure 14. We notice that when the attacker success to transmit the false RTS, it blocks nodes A and B for the random N AV (RT S) chosen by the attacker. At 68.5 seconds node A success to access to the channel but few after node M success to send its false RTS and blocks again the nodes A and B. The attacker M is in competition with nodes A and B to transmit the false RTS. In comparison between the results of false RTS and false CTS attacks, we remark that the false CTS has more negative impact than the false RTS, because the collision with CTS packet is less than the collision with RTS packet. However the CTS packet' size is 38 bytes and it is smaller than the RTS packet's size which is 44 bytes. As conclusion, we can say that the false CTS is more efficient and difficult to detect than the false RTS attack. According to the experimentation's results, we illustrated the feasibility of implement these attacks and study their real impact on the network. Furthermore, we plan to extend this experimental platform to more complex scenarios.

IV. SECURITY ANALYSIS

The design of the detection and the reaction mechanisms against described attacks without modification of IEEE 802.11 standard is a real challenge. The problem is related to the vulnerability of the CTS and ACK packets' format. more, these attacks have a negative impact on the network. For instance, with a false packet validation, the routing protocol can easily be disturbed: the nodes cannot establish the routing table. Another important negative impact of the false packet validation attack is that it disturbs the monitoring process.

The problem with the false CTS and false ACK, is that the attacker does not need to spoof the source address, because the conception of these packets does not require the source address. In addition, the attacker can easily escape the punishment procedure and continue its attack frequently. Unlike the false RTS attack, the attacker creates a false RTS in order to create the virtual jamming. In this case, the jammer can be detected by the IDS and reduces the effect of its attack. The random RTS validation is proposed by Ashikur [START_REF] Rahman | Hidden Problems with the Hidden Node Problem[END_REF] to alleviate the impact of this attack. If the attacker chooses the false RTS attack, it needs to spoof the source address in the RTS packet sent by the victim node's address, in order to escape the punishment reaction of the IDS.

Every of false CTS and false ACK can create suspicion situations, each node in the attacker's transmission range suspects other nodes in its transmission range. In order to avoid any false RTS, false CTS and false ACK (or false validation packet), we need to answer the following question. How authenticate and check the integrity of the control packets such as: RTS, CTS and ACK? Many answers and solutions with and without cryptography concept can be proposed to deal with this problem. However, the investigation of the tradeoff between the security cost of the secure control packets and the quality of service (QoS) is needful which is the extension of this work.

V. CONCLUSION

In this paper, we have shown some new hidden vulnerabilities in IEEE 802.11 and the possible attacks that could exploit them. These vulnerabilities at the MAC layer are analysed, like the false CTS and false packet validation attacks which exploit the CTS and ACK packets format vulnerability. The negative impacts of these attacks on the network are illustrated by the analytical, simulation's and experimentation's results. Another important negative effect of the false validation packet based on the false ACK attack affects not only the the network performance but also the monitoring process. The attacker can easily reduce the reputation of well-behavioring nodes and disturb the existing trust model. Furthermore, the routing operation can be dramatically affected by the false ACK attack or false packet validation. The real implementation of these attacks particularly false RTS and false CTS demonstrate the feasibility to exploit the vulnerabilities on IEEE 802.11.

As future work, we plan to study some efficient solutions with and without cryptography concept and their security cost estimation including energy consumption and throughput.

  (a). The NAV(CTS) is calculated by receiver node B, and is based on the NAV(RTS) in the RTS packet N AV (CT S) = N AV (RT S) -(T SIF S + T CT S ) (2) Sender node A does not start the transmission of the data before it receives the CTS packet. The receiver node answers by the ACK packet, once it has received the DATA packet correctly, as indicated in figure 1(b).

Fig. 1 .

 1 Fig. 1. The RTS-CTS mechanism

Fig. 2 .

 2 Fig. 2. The RTS, CTS and ACK packets' format

Fig. 3 .

 3 Fig. 3. The false CTS flow chart

Fig. 4 .

 4 Fig. 4. The false ACK disturbs the monitoring process Figure 4 illustrates the scenario of the false ACK. Node A wants to send a packet to node B, node M is an attacker located in the transmission ranges of node A and node B. Node M needs to know the address of nodes A and B and also needs to know the NAV(RTS) or NAV(CTS) to create this attack. When node M overhears the RTS packet, it gets the address of nodes A and B and the NAV(RTS). According to the NAV(RTS) or NAV(CTS), node M can determine the time T coll it will start the attack. The attack is divided into two parts. In the first part, the attacker sends the packet to node B at T coll , in order to create a collision at node B. The T coll is the random value in the interval [B min , B max ] where

Fig. 5 .

 5 Fig. 5. The false packet validation flow chart

Fig. 6 .

 6 Fig. 6. Simple topology

Fig. 7 .Fig. 8 .Fig. 9 .

 789 Fig. 7. The average throughput versus time

Fig. 10 .

 10 Fig. 10. The impact of the attackers number on throughput

Fig. 11. Experimentation scenario 1 )

 1 Fig. 11. Experimentation scenario

Fig. 12 .

 12 Fig. 12. Impact of false CTS attacks on ICMP message between A and B

Fig. 13 .

 13 Fig. 13. Impact of false CTS attacks on SSH connection between A and B

Fig. 14 .

 14 Fig. 14. Impact of false RTS attacks on ICMP message between A and B

The EIFS is estimated at

364µs when using a 1 Mbps channel bit rate

In the IEEE 802.11 with the direct sequence spread spectrum (DSSS), the M P D = 2us

This work is supported by the ANR "Agence Nationale de la Recherche -France" within the project framework ARA/CLADIS.