Routing Attacks and Countermeasures in the RPL-Based Internet of Things

TLDR

RPL is a routing protocol for low‑power, lossy networks, but securing IPv6/RPL 6LoWPANs is difficult because devices are resource‑constrained, connected to an untrusted Internet, and use novel IoT technologies. The paper analyzes IoT security capabilities and shows how IPv6 features can be leveraged for intrusion detection through a lightweight heartbeat protocol. The authors implemented known RPL routing attacks in Contiki and simulated them in Cooja, and also developed a lightweight heartbeat protocol for detecting intrusions. The simulations confirm that the attacks succeed against RPL networks, and the heartbeat protocol effectively demonstrates a practical intrusion‑detection approach.

Abstract

The Routing Protocol for Low-Power and Lossy Networks (RPL) is a novel routing protocol standardized for constrained environments such as 6LoWPAN networks. Providing security in IPv6/RPL connected 6LoWPANs is challenging because the devices are connected to the untrusted Internet and are resource constrained, the communication links are lossy, and the devices use a set of novel IoT technologies such as RPL, 6LoWPAN, and CoAP/CoAPs. In this paper we provide a comprehensive analysis of IoT technologies and their new security capabilities that can be exploited by attackers or IDSs. One of the major contributions in this paper is our implementation and demonstration of well-known routing attacks against 6LoWPAN networks running RPL as a routing protocol. We implement these attacks in the RPL implementation in the Contiki operating system and demonstrate these attacks in the Cooja simulator. Furthermore, we highlight novel security features in the IPv6 protocol and exemplify the use of these features for intrusion detection in the IoT by implementing a lightweight heartbeat protocol.