Prevention of wormhole attacks in mobile commerce based on non-infrastructure wireless networks

A number of studies have made progress towards satisfying the vital security requirements of mobile commerce, including identifying and resolving most of the possible flaws. However, recent studies have asserted that a particular attack, called the wormhole attack, can seriously impair the routing protocol. This vulnerability exists in a wireless system and may also exist in ad hoc commerce systems. Although many attempts have been made to confront wormhole attacks in the field of wireless communications, the available solutions are still inadequate and need to be improved. For example, Ariadne-based methods have been confronted with the new insider attacks, but to date the vulnerability has not been fixed. Moreover, those solutions are not tailor-made for a mobile commerce environment. This paper identifies a possible new threat from wormhole attacks in an ad hoc mobile commerce environment and proposes an approach for handling this type of attacks in a way that is not impacted by the new problems facing Ariadne and endairA. Based on cryptographic theory, the proposed method that we discuss can nullify wormhole attacks coming from both the outside involving non-authorized and non-authenticated identities, and the inside for authorized and authenticated identities. The main features of our solution are: (1) in the routing request process, heavy computation can be parallelized among powerful servers; and (2) in the routing reply process, not every source node decrypts all the ciphertext transmitted by intermediate nodes and not every intermediate node needs to execute cryptographic computations. Through theoretical analysis, our approach is shown to be suitable for the mobile commerce environment, and more efficient and robust than Ariadne.