New Security Threats and Protection Techniques in Mobile Ad Hoc Networks

New Security Threats and Protection Techniques in Mobile Ad Hoc Networks

• 1.
  1 New Security Threatsand Protection Techniques in Mobile Ad Hoc Networks Srinivasan Venkataramani Abstract—The security threats are critical in Mobile Ad Hoc Networks (MANETs), when deploying secure applications especially considering the confidentiality of the data that can be compromised. In usual communication networks, there is a need to establish ad hoc temporary connections in many scenarios. Data transfer in this ad hoc wireless network is important and it is not easy to establish the large infrastructure. When data is highly confidential, then it is a challenging task to provide security particularly in the malicious environment. Many papers proposed various solutions as to counter-act internal and external security attacks. However, most solutions have certain trade-offs. There are some methods designed only to counter-act specific attacks. Others provide solutions to counter- act general attacks but consider the factors such as delay, high resource utilization. This paper surveys many security solutions that have been developed from in the past years. We present the current approaches in the development of secured systems. These methods can be used by simple approaches to enhance the security with small complexity. To the best of our knowledge,there is no other surveys that discusses the new secured methods in the literature. Index Terms—ecurity Threats, Mobile Ad Hoc Networksecu- rity Threats, Mobile Ad Hoc NetworksS I. INTRODUCTION The development of smaller and more powerful mobile devices enables mobile ad hoc networks (MANETs) to become one of the fastest growing areas of research. As a new type of self-organizing network combines wireless communication with high mobility, they are unlike traditional wired networks and have no fixed infrastructure (base stations, centralized management points, etc.). The combination of nodes forms an any topology. This make easy for many applications in military, where the network topology may change rapidly to reflect a team’s movements, and in disaster recovery operations, where the existing fixed infrastructure may be disconnected. The ad hoc organization makes them useful for virtual conferences, where setting up a traditional network infrastructure is time-consuming. To make it work in well-organized way, the discovery of shortest and least congested routes in the varying topologies need to figure out first. But here lies another problem that MANET uses the wireless shared medium and where there is a shared medium there are chances of interference, snooping and annihilation of information as well as the network’s physical entities. So it raised the need for data’s confidentiality and integrity before exchanging it in the network and also the system’s physical security. There are many other immense challenges and security re- quirements which we need to contemplate before deploying MANETs. Many researchers proposed their solutions [1], [2] which provide excellent security but they require very complex computations and consume a lot of resources like memory, bandwidth etc. They have reduced the effect of various attacks but still they are insufficient and become compromised in some attacks [3], [4]. Other solutions [8], [24], [34], [35] are better Easwari Engineering College, TamilNadu, India. Email: DrSrinivasan- [email protected] in terms of providing some extent of quality of services (low memory utilization, low bandwidth, low power etc.) but they are also promising with certain type of attacks [24], [25]. This has become a big tradeoff between choosing those secured methods that consume a huge amount of resources (large mem- ory, high bandwidth utilization and heavy processors for high computations), and those methods that consume fewer resources but are susceptible to various attacks. In this paper, we have explored different approaches of those secured methods which use a large number of resources and computations (encryption/ decryption/ digital signatures etc.) and those which uses simple methods (trust/ observation/ reputation etc.). Then we surveyed most common types of attacks and different solutions proposed for their alleviation. Following we have summarized the secure methods, their assertions, assumptions, metrics, positive and negative aspects. We have tried to extract out the expedient information from the reviewed papers and then finally we have presented our outlooks on the various research areas that can be defined and explored based on the problems we will discuss. From this survey paper, researchers who are interested in the area of security aspects of MANETs will have the distinct notion about security issues and different approaches which can be used for providing better security. Further study can be initiated from a clear perspective of choosing which methods are appropriate according to the area of interest. II. SURVEY OF PROPOSED SOLUTIONS Frequently changing wireless links in MANETs makes it sus- ceptible to attack. Thus, the first step before sharing information is to discover the most secured routes which can be only accessed by the authorized users. Many protocols proposed claim their approaches to be most secured. Security routing protocols can be cryptographic based, trust based, observation based, reputation based and others. In cryptographic based techniques [1], [5], [19], asymmetric and symmetric keys are distributed among nodes to protect the messages from being tampering and losing their integrity. But encryption/decryption schemes are not suitable for resource-constrained devices. A. Trusted Certificate Server Approach [19] proposed the use of a trusted certificate server to generate cryptographic certificates for each node that wants to enter into the network and a public key which is known to all legal nodes. Keys are created and exchanged through an existing relationship between server and each node. Before arriving in to the network, each node must request a certificate from server. Each node obtains exactly one certificate after securely verifying their identity to server. All nodes must retain fresh certificates with the trusted server. Using this certification, source verifies that the intended target was reached. In this process, when a node gets route discovery message, it sets up a reverse track back to the source by recording the neighbor’s id from which it received the route discovery message. The destination then uncast the route reply message through that reverse track back to the source. Each node in the track checks the previous node’s signature, updates its routing table with the address of the node that send it RDP packet, signs the original contents of the message, removes
• 2.
  2 its certificate andsignature and attaches its own certificate and then forward the message. This is done to prevent alterations in the route discovery packets in transit. Figure 1 shows its route discovery mechanism. B. Public/Private Key Approach [1] proposed a protocol with each mobile node has a pub- lic/private key pair which is certified from a certificate author- ity. Every pair of source/destination has a shared secret key. TESLA is used as an authentication protocol. To use TESLA for authentication, each sender chooses a random initial key and generates a one-way key chain by computing a oneway hash function again and again. To authenticate any received value on the one-way chain, an equation is applied to verify if the computed value matches an earlier known authentic key on the chain. Each sender predetermines a time schedule at which it discloses each key of its one-way key chain, in the reverse order from their creation. It is assumed that each node can obtain an authentic TESLA key from the distribution center. Legitimate keys are bootstrapped between pairs of nodes. Route discovery process is initiated by key distribution centre with a special reserved address as target. This address is not the address of any real node. It then uses each returned path to send legitimate keys to each node in the network. This process repeats when a node requests a shared key with any other node and also to KDC, in route reply that node sends the list of nodes for which it requests keys. Before sending the packet, the sender adds a message authentication code (MAC) computed using key. Since the receiver knows the sender’s clock may be faster by 1, packet is discarded if the key has already been published or unless it is received at least 1 before the scheduled key release time. When it is verified that the packet’s key is not yet published, receiver buffers the packet and waits for the sender to publish key. C. Node-capture Attack Detection [34] provided two methods to detect the node capture: Simple Distributed Detection (SDD) which uses local information on nodes and Cooperative Distribution Detection (CDD) which uses the local nodes cooperation. These two methods are based on the simple observation that if a node (e.g. node A) does not re-meet another node (e.g. node B) within a specific time then it is possible that node B has been captured. This protocol uses random way- point mobility model [35] and specifically trusts on the honest node re-meeting time to collect overall information about the presence of other nodes in network. The SDD is an event based method. Each node set the corresponding meeting time to the value of its internal clock and starts the corresponding time-out that expires after k seconds. When two nodes meet, they execute the method, SDD-Meeting. If it is received before the Maximum Interval Time (MIT), then the counter for node B is reset to 1 and if received after MIT, then the counter is incremented by 1. It is to avoid false positive alarms. In CDD, nodes share information only when cooperative nodes are present within the same range of communication. It uses the same method trace used for SDD. If two nodes e.g. node A and node B are tracing the third node e.g. node C, then the two nodes compare their meeting time with third node when they last met. D. Forged Routing Messages Detection [33] proposed Intrusion detection system based on OLSR (optimized link state routing) protocol. This protocol tries to thwart attack which is made by legitimate nodes present in the network. It also works where cryptographic based solution doesn’t work. It can be implemented on all nodes in the network. Nodes continuously evaluate the semantics of routing message and then act accordingly. When an intruder is spotted, alerts are signaled and they are banned. It checks before taking its decision- is untrusted node an intruder or not? And accordingly implies a low false positive rate. It focuses on detection of generation of fake topology control (TC) messages because they can create confusions in the whole network if disseminated. When a node receives a TC message, according to its local topology statistics, it checks if the initiator of this TC message is 1-hop distance from the common announced MPR selector node or if the common announced MPR selector node had actually nominated the TC originator node as MPR and then assigns one of the three statuses (normal, suspected or intruder) to its originator. After updating its topology table, receiver then forwards its TC message. E. Misbehaving Watchdog [8] explain that Watchdog recognizes misbehaving nodes and a Pathrater supports the routing protocols to avoid these nodes. It is supposed that all routing nodes do not misbehave. When a node forwards the packet, Watchdog promiscuously listens in the network and confirms that the next node in the path also forwards the packet. If the next node does not forward the packet, then it is confirmed as misbehaving. By using this information, Pathrater selects which route is best to deliver the packets. They have implemented the watchdog by maintaining a buffer of newly sent packets and compare each listened packet with the packet stored in the buffer to see if there is a match. There is certain failure threshold, if it is excesses, then the node is determined to be misbehaving and source is notified about it. Pathrater calculates the negative value path metric to indicate the presence of suspected nodes in the path. The nodes having negative ratings are suspended for some time until their ratings are increased to nonnegative values. Pathrater uses Send extra Route Request (SRR) to find a new routes if the well-known route holds only misbehaving nodes. F. Route Request Packet Approach [32] explain that security mechanism is made into the route request packets. Sender sends route request packets with some metric based on its security and authenticity. On receiving this packet, Intermediate nodes check this packet’s security level. If they find it authentic, they forward or reply accordingly otherwise drop it. After discovering the secured route by testing the required security metric on each intermediate node, route reply message is sent back by the receiver node. In this protocol, packets are encrypted using a symmetric encryption/decryption key which is generated with respect to different trust levels. Nodes can only read the route request packets or route reply packets of their trust level. Moreover the floating packets of higher or lower trust level are supposed to be dropped if they are interrupted by a malicious node because node filters packets that belong to its trust level. So this mechanism of broadcasting the routing packets by confirming their trust levels can help in the discovery of attacks by eavesdroppers. It also offers some cryptographic techniques like digital signatures and encryption to check alteration. This protocol finds the assured secured route between two nodes. G. Redundant Routing Message Approach [30] proposed protocol that uses redundant copies of routing messages to spot internal attacks. Pair wise secret keys are used between source and destination and intermediate nodes along the established path to protect route discovery messages. Also based on the observations, the node builds the trust on its neighboring nodes by creating a local Certificate Repository. It is assumed that each node in the network is initialized with a unique address and pair of public/private keys embedded into it. Also they can form a self-organized Public Key Infrastructure by relating the current CR and present maintenance methods for public key management. When a node starts a route discovery process, it chooses a random number, signs it with its private
• 3.
  3 key and useskey hash function to protect the route discovery message. Finally, the signature and key hash value is appended to the route discovery message which is sent to its neighbors hop by hop until it gets reached to target. To choose a more optimal path, if two nodes show same level of trust, then hop counts are measured, if hop counts are also same then their performance is checked. When receiver (intermediate) gets route request message, it computes the trustworthiness quality index (TQI) and appends it to the route request message along with QoS information before forwarding to next hop. H. Reputation Approach [43] proposed protocol that uses reputation based scheme. The protocol observes the behavior of other nodes and rates each node accordingly. Rating is first set to zero, which increments by +1 on every positive action and decrements by -2 on every negative action. Negative threshold is set to -40 below which the node is added to a list of faulty nodes. The source node forwards the data packets to the highest reputation node. Intermediate nodes also forward the data packet to the highest reputation hop till it reaches to the destination node. The destination node acknowledges a signed DACK (data Acknowledgment packet) to the source that modifies its reputation values table by rec- ommending +1 to the first hop of reverse route. Subsequently all the intermediate nodes in the route recommends +1 to their corresponding next hop in the route. Each node stores a Route Ranker Table to store the reputation values of each node based on its direct observations on that node. If two next-hop nodes have the same reputation values then randomly anyone is chosen by the source node and that information is also stored in sent- table. If DACK is not received by source node in specified time set by source’s timer, it recommends -2 to the first hop of that route and removes its entry from the sent-table after the time-out expires. Intermediate nodes also recommend -2 to their next hop in the route up to that selfish node who dropped the packet and removes the corresponding entries from their tables on time-out expire. If the reputation value of the next hop falls below -40 (threshold value) then it is temporally suspended from the node’s routing table and an error message is sent to the upcoming nodes in its path. Later this suspended node can re-join the network with the reputation value initialized to zero. This process aims to prevent selfish nodes from dropping packets because source nodes only choose the nodes with higher reputation values to forward their data packets and selfish nodes need to maintain their reputation constant in order to receive the packets. I. Firewalls [39] focus on attack which tries to drain the battery of nodes in the network. This scheme is based on ROFL (Routing as the Firewall Layer) mechanism [40] and sets some constraints on the network nodes and the services provided to these nodes. When a service is advertisement to some particular network, only nodes of that particular network can access that service. They cannot access services which are not advertised for them. Before passing any service announcement to a node, the node is first been checked that whether it is authorized to access or not. To stop the advertised service, the routing metric M is set to infinity, and then this infinity route is advertised. Destination address provides services to only those nodes that come under the list of approved source prefixes. Immediately, the packet is dropped if it is forwarded from a source address which is not listed in the source prefix filtering (SPF) constraints of a corresponding route. This packet filtering is applied by layering it on top of routing. Underlying routing protocol provides the pattern (i.e. unicast, multicast or broadcast) for distributing routing information. Once a path between source and destination node is created by underlying routing protocol, each node in that path refers to its local routing table to match the routing announcement and if the same matched announcement is found, then its source prefix constraint is extracted i.e. data packet’s header contents (source, destination address and destination port number) and checked before the receiver takes its forwarding decision. If it is forwarded from an authorized node, then it is passed to upper layer otherwise it is discarded. To implement this scheme in AODV, only route reply packet’s information of AODV is replaced with service specific announcement (SPF constraints, destination port address, service port address etc.). And then this route announcement is distributed into the network on getting route request and in case of OLSR, these announcements are distributed by flooding Topology Control (TC) messages into the network. J. Double-layer Transport Layer [42] used double-layer scheme that detects attacks at the transport layer but responds to them at the network layer. It implements four modules. First is watch nodes (LS) module that monitors and detect misbehavior nodes, second is node isolation algorithm (NIA) that isolates the infected nodes from the honest node’s list. Third is congestion window surveillance (CWS) module that verifies if the node has fault or compromised because CW size may be increased due to congestion in network. Last is alternate route finder (ARF) module. If CWS sees any abnormalities, it calls ARF to find or build a new path. LS module builds a list that contains each node’s first-hop neighbors and neighbors of each first hop’s neighbor in the end of neighbor discovery process. This is created to first monitor the presence of any malicious nodes and later isolate them from the network using NIA. This process is assumed to be secure and it is done only once in the whole life span of a node. There is no exchange of packets between the nodes which are not neighbors. The node maintains information of its second-hop neighbor to verify if a received packet forwarded from its one hop neighbor has actually forwarded from its second hop neighbor or not. A watch buffer and a malicious counter are maintained in the each node to monitor the packets exchanged between its neighbors. Each entry in the buffer is time stamped and has a time threshold. Malicious counter monitors the length of sliding window and it increments for the node which is detected as malicious by the watch node. These increments depend upon the type i.e. either the packet is fabricated or dropped by the malicious node. To avoid failures (intentionally or by fault) caused by a legitimate node, a node is declared as a misbehavior node and revoked from its neighbor’s list, if its malicious counter exceeds threshold. It is done by announcing an authenticated alert message to each of its neighbors using shared keys to prevent from false announcements. III. FUTURE RESEARCH DIRECTIONS The flexibility of MANETs are very attractive for military and disaster recovery applications. Moreover mobile devices are getting smaller, cheaper, more powerful and more mobile every day. In the future MANETs will likely be a part of our lives. There has been much research on this promising new networking. Security is one of the hot topics in the area due to new security threats MANETs have introduced. The threats to MANETs have been examined in many research papers. However more research needs to be done on identifying new security threats. We believe that with the increase in the use of MANETs, new intrusions are going to emerge continuously. MANETs are prone to attacks from the intruders. Different security mechanisms have been proposed in the past to provide security in MANETs. In this paper we have tried to compare the advantages and drawbacks of several approaches. The purpose of doing so is to provide a guideline towards development of a secure routing protocol and the conditions that make the environment so
• 4.
  4 prone to attacks.So in future maintaining rate of node’s mobility and topologies in the network is required. Also distributing use of batteries and other power resources and eliminating tradeoffs between rate of battery consumption and updating nodes due to frequent topological changes is also required. Some other factors also should be taken into account like distribution and use of available bandwidth, providing physical safety to the network bodies, increasing size of network, signal fading and jittering due to large number of multi hops and setting up of minimum and maximum rate of transmission power, eliminating tradeoffs between packet delivery and time delay, eliminating tradeoffs between bandwidth capacity and congestion and distributing authorized access to every node in the network. The methodology or the protocol which is to be developed should also take care of the other aspects of the network which are very important as far as providing security or avoiding threats are concerned. These are provision of security in all seven layers of OSI, detecting number of malicious nodes and formulating malicious activities in the network, Maintaining traffic rate of control/data packets according to the type of traffic (Constant Bit Rate or Varying) and setting up the minimum- maximum rate, routing load balancing, Medium Access Control methods for channel contention, reducing tradeoffs between application aspects and security aspects, focusing maximum route availabilities and finding shortest route from them and maintaining periodic routing table information proactively and reactively. REFERENCES [1] Y.C. HU, A. Perrig, and D. B. Johnson, “ARIADNE: a secure on- demand routing protocol for ad hoc networks,” in Proc. MOBICOM, 2002, pp. 12-23. [2] P. Papadimitratos and Z. Haas, “Secure routing for mobile ad hoc networks,” in Proc. CNDS, 2002. [3] Y.-C. HU, A. Perrig, and D.B. Johnson, “PACKET LEASHES: a defense against wormhole attacks in wireless networks,” in Proc. INFOCOM, 2003, pp.1976-1986. [4] Y.-C. HU, A. Perrig, and D. B. Johnson, “Rushing attacks and defense in wireless ad hoc network routing protocols,” in Proc. WISE, 2003, pp. 30-40. [5] D. Liu and P. Ning, “Efficient distribution of key chain commitments for broadcast authentication in distributed sensor networks,” in Proc. NDSS, 2003, pp. 263-276. [6] B. Awerbuch, D. Holser, C. Nita-rotaru, and H. Rubens, “An On demand secure routing protocol resilient to byzantine failures,” in Proc. WISE, 2002, pp. 21-30. [7] S. Buchegger and J.Y. Le boudec, “Nodes bearing grudges: towards routing security, fairness, and robustness in mobile ad hoc networks,” in Proc. PDP, 2002, pp. 403-410. [8] S. Marti, T. Giuli, k. Lai, and M. Baker, “Mitigating routing misbehavior in mobile ad hoc networks,” in Proc. MOBICOM, 2000, pp. 255-265. [9] W. Yu, Y. Sun, and K. J. R. Liu, “Hadof: defense against routing disruptions in mobile ad hoc networks,” in Proc. INFOCOM, 2005, pp. 1252-1261. [10] Pradip M. Jawandhiya, Mangesh Ghonge, M.S. Ali and J.S. Desh- pande, “A Survey of Mobile Ad Hoc Network Attacks“, IJEST, 2010, pp. 4063-4071. [11] L.Tamilselvan, V.Sankaranarayanan, “Prevention of Black hole Attack in MANET,” Proc. AusWireless, 2007, pp. 21- 26. [12] S.Lee, B.Han, and M.Shin, “Robust Routing in Wireless Ad Hoc Networks,” ICPP Workshop, 2002, pp. 73-78. [13] M.A.Shurman, S.M.Yoo, and S.Park, “Black Hole Attack in Mobile Ad Hoc Networks,” ACM SE, 2004, pp. 96-97. [14] S.Kurosawa, H.Nakayama, N.Kato, A.Jamalipour, and Y.Nemoto, “Detecting Black hole Attack on AODV-Based Mobile Ad Hoc Networks by Dynamic Learning Method,” IJNS, 2007, pp. 338-346. [15] Y.C.Hu, A.Perrig, and D.Johnson, “Wormhole Attacks in Wireless Networks,” IEEE JSAC, 2006, pp. 370-380. [16] L. Qian, N. Song, and X. Li, “Detecting and Locating Wormhole Attacks in Wireless Ad Hoc Networks Through Statistical Analysis of Multi-path,” IEEE WCNC, 2005, pp.2106-2111. [17] X.Su, R.V.Boppana, “On Mitigating In-band Wormhole Attacks in Mobile Ad Hoc Networks,” Proc. ICC, 2007, pp. 1136-1141. [18] M.A.Gorlatova, P.C.Mason, M.Wang, L.Lamont, R. Liscano, “De- tecting Wormhole Attacks in Mobile Ad Hoc Networks through Protocol Breaking and Packet Timing Analysis,” Proc. MILCOM, 2006, pp. 1-7. [19] K. Sanzgiri, D. LaFlamme, B. Dahill, B. N. Levine, C. Shields and E. M. Belding-Royer, “A Secure Routing Protocol for Ad Hoc Networks,” in Proc. ICNP , 2002, pp. 78-87. [20] W. Yu, Y. Sun, and K. J. R. Liu, “Hadof: defense against routing disruptions in mobile ad hoc networks,” in Proc. INFOCOM, 2005, pp. 1252-1261. [21] Joshua Wright, GCIH, CCNA, 2003, Detecting wireless LAN MAC addresses spoofing, technical document. [22] Gayathri Chandrasekaran, John-Austen Deymious,Vinod Ganapa- thy, Marco Gruteser, Wade Trappe, “Detecting Identity Spoofs in 802.11e Wireless Networks“, In Proc. GLOBECOM, 2009, pp.4244- 4147. [23] S. Murphy, “Routing Protocol Threat Analysis,” Internet Draft, draft-murphy-threat-00.txt, 2002. [24] J. F. Raymond, “Traffic Analysis: Protocols, Attacks, Design Issues and Open Problems,” in Proc. Wksp. Design Issues in Anonymity and Unobservability, Berkeley, CA, 2000, pp. 7-26. [25] J. Hubaux and E. W. Knightly, “Denial of service resilience in ad hoc networks,” in Proc. MOBICOM, 2004, pp. 202-215. [26] Lin, R.Lu, H.Zhu, P.H.Ho, X.Shen and Z.Cao, “ASRPAKE: An Anonymous Secure Routing Protocol with Authenticated Key Ex- change for Wireless Ad Hoc Networks,” in Proc. ICC, 2007, pp. 1247 - 1253. [27] Kejun Liu, Jing Deng, Member, Pramod K. Varshney and Kashyap Balakrishnan,”An Acknowledgment-Based Approach for the Detec- tion of Routing Misbehavior in MANETs“, IEEE TMC, 2007. [28] C. Kaufman, R. Perlman, and M. Speciner, “Network Security Private Communication in a Public World“, Prentice Hall PTR, A division of Pearson Education, Inc., 2002. [29] Ming Yu , Mengchu Zhou and Wei Su , “A Secure Routing Protocol Against Byzantine Attacks for MANETs in Adversarial Environments“,in Proc. IEEE Vehicular Technology Society, 2009 pp. 449 - 460. [30] S. Albert Rabara and S.Vijayalakshmi, “Rushing attack mitigation in multicast manet (RAM3)“, in Proc, IJRRCS, 2010, pp. 131-138. [31] Xu Su, Dissertation, “Integrated prevention and detection of Byzan- tine attacks in mobile ad hoc networks“, University of Texas at San Antonio, 2009. [32] S. Yi, P. Naldurg, and R. Kravets, “A Security-Aware Routing Protocol for Wireless Ad hoc Networks“, in Proc. MOBIHOC, 2002 pp. 286-292. [33] A. Fourati; K. Al Agha, “Detecting forged routing messages in Adhoc networks“, Springer published on nov, 2008, pp.205 - 214. [34] M. Conti, R. Di Pietro, L. V. Mancini, and A. Mei, “Emergent properties: Detection of the node-capture attack in mobile wireless sensor networks“, ACM WiSec, 2008 pages 214-219. [35] J. Broch, D. A. Maltz, D. B. Johnson, Y.-C. Hu, and J. Jetcheva. “A performance comparison of multi-hop wireless ad hoc network routing protocols“ in Proc. MOBICOM, 1998, pages 85-97. [36] S. Ganeriwal, S. Capkun, C. C. Han and M. B. Srivastava. Secure time synchronization service for sensor networks. In WiSe, 2005, pages 97-106. [37] K. Sun, P. Ning, and C. Wang, “Fault-tolerant cluster-wise clock synchronization for wireless sensor networks“ TDSC, 2005, pg.177- 189. [38] S. Bansal and M.Baker,” Observation-based Cooperation Enforce- ment in ad hoc network“, July 2003. [39] H. Zhao and S. M. Bellovin, “High Performance Firewalls in MANETs“ Proc. MSN, 2010 pages 154-160. [40] H. Zhao, C.-K. Chau, and S. M. Bellovin, “ROFL: Routing as the firewall layer,” in New Security Paradigms Workshop, September 2008. [41] T. Eissa; S. A. Razak; R. H. Khokhar; N. Samian, “Trust- Based Routing Mechanism in MANET: Design and Implementation“, Springer, Mobile Networks and Applications June 2011. [42] H. N. Saha, D. Bhattacharyya, A. K. Bandhyopadhyay and P. K. Banerjee, “Two-Level Secure Re-routing (TSR) in Mobile Ad Hoc Networks“ Proc. MNCAPPS, 2012 Pages 119-122.