AbstractâUnlike in conventional networks, node positions in mobile ad hoc networks (MANETs) usually change over time. As a side effect of managing routes, ...
Location Tracking Attack in Ad hoc Networks based on Topology Information Sergey Chapkin, Boto Bako, Frank Kargl, Elmar Schoch Dept. of Media Informatics University of Ulm, Germany Email: {sergey.chapkin|boto.bako|frank.kargl|elmar.schoch}@uni-ulm.de
Abstract— Unlike in conventional networks, node positions in mobile ad hoc networks (MANETs) usually change over time. As a side effect of managing routes, routing protocols to some extent also disseminate neighborship and topology information in the network, thereby disclosing at least some information on a node’s own position to other nodes. Due to the wireless nature of ad hoc networks, this information can become available even to third parties which are not participating in the network. Using this information, location profiling may become possible, where attackers gather information on node positions or mobility patterns. This information may then be used for anything ranging from targeted advertisement to criminal activities. Therefore, location privacy is an important issue in ad hoc networks. In this paper, we analyze to what extent an attacker can track the precise location of a node, assuming a powerful attacker model where an attacker knows all neighbor relationships plus information on node distances. We present a new approach which uses these information and uses geometric constraints and heuristics to find node positions efficiently. The quality of our results is discussed and compared to other approaches. Based on the localization precision that such an ”omniscient” attacker can reach, we will be able to evaluate the quality of future, more realistic attack models.
I. I NTRODUCTION The technology of spontaneous ad-hoc networking will lead to exciting new application domains, be it in the automotive domain in form of Vehicular Ad hoc Networks (VANETs), Wireless Sensor Networks (WSNs), or in Ubiquitous Computing applications. Common characteristics of ad-hoc networks regarding position information are: • direct wireless communication is possible only over short ranges compared to the overall network dimensions • information about the own position is revealed to neighbors with a certain degree of accuracy • this information is disseminated in the network by routing protocol The problem is that this information might be misused for localization, tracking, and profiling. E.g. in VANETs, large petroleum companies may have an interest in detecting the routes which (potential) customers travel throughout the day. Using this knowledge, they could plan new petrol stations or adapt prices based on customer behavior. Using additional information gathered from electronic payment at petrol stations, these companies might even link cars to individual persons and start targeted advertisement for specific customer groups.
Whereas this scenario may have only a modest impact on the privacy of each individual1 , other scenarios with a more severe background seem far more threatening. Given that in the future we all will carry wireless network enabled devices all the day, government agencies could easily control where people go in a much more complete and reliable fashion as it is possible today with video surveillance and automatic image recognition. Likewise, criminals may be able to track and follow persons with no significant effort. One has to consider that location profiles may be accumulated over years and that one might become a suspect of a crime, just because of being detected near a crime scene. Additionally, location profiles may also allow behavior profiles. In summary, these new technologies might pose a significant threat to privacy and personal freedom. The extent of the threat depends heavily on the precision with which one can localize nodes in a network, if localization works only in direct radio range or for complete networks, and whether the mechanisms scale to large areas and large populations of nodes. In a worst case scenario, an attacker having only one single device attached to an ad hoc network spanning a whole city might reconstruct a map of all other attached devices in realtime. In this paper, we analyze to what extend such an attacker can track the precise location of a node assuming a powerful attacker model where an attacker knows all neighbor relationships plus information on node distances. Our approach takes these information and uses geometric constraints and heuristics to efficiently extrapolate node positions. Whereas such techniques are well known for general graphs, the scenario of ad hoc networks introduce additional challenges that need to be considered. MANET nodes often show high mobility and there might be a very large number of nodes. Our algorithm therefore needs to be efficient to finish processing before information might get outdated. As one cannot predict the time when position information becomes outdated, it might also be useful to interrupt the algorithm at any time and then use the partial results as position estimates. The algorithm should also be able to work in an incremental fashion, considering updates that are received after calculation has already started. Finally, the algorithm should work also when a less powerful attacker gathers only partial information on the network. 1 but
it may have an influence on gas prices we have to pay
Our algorithm assumes a complete knowledge of all links in the network as well as the received signal strength (RSS) per link. One might object that this model of an attack is rather unrealistic, because this information is normally only available in the direct neighborship of a node. Yet, an attacker might nevertheless gather this information with some effort. Some routing protocols like OLSR [1] flood topology information in the whole network. Assuming that the signal strength is used as a routing metric (instead or in addition to the hop count), such a protocol delivers all information an attacker needs. Besides, an attacker might also use software installed on nodes (as part of the networking stack or spread as a virus) to collect the necessary information. More important, even if our current setup seems unlikely, it will serve as a baseline for our further studies that will analyze the position accuracy which an attacker can accomplish when using partial information, e.g. gained from DSR [2] or AODV [3] routing protocols. II. L OCALIZATION USING G EOMETRIC C ONSTRAINTS Assuming that an attacker knows the links between all nodes in the network including the corresponding RSS, it can create an adjacency matrix of the network graph. Based on the RSS, the algorithm estimates the distance d between the nodes, assuming an error e caused by inaccuracies in measurement or additional fading due to obstacles, etc. The algorithm iteratively tries to find a graph layout that connects all adjacent nodes and best fits the distance constraints. It starts with two nodes and adds more nodes as long as this is possible in an unambiguous way. If no new node positions can be determined deterministically, it uses heuristics and constraint relaxation to proceed. Additionally, it considers absolute position from reference nodes if known. At the end, it provides a 2D map with node positions. Before describing the algorithm, some definitions in constraint solving are introduced. A. Constraint Solving Definitions A constraint is a value representing a relationship between several objects or a characteristic of a single object (e.g. a radius of a circle). A geometrical constraint represents a geometrical relation between two objects. A system of constraints is defined similar to a system of equations. A constraint is satisfied, if the objects connected to it satisfy the relationship. E.g. if a geometrical constraint is determined by a distance d between nodes P 1 and P 2, then it is satisfied if the distance between P 1 and P 2 is d. Thus, to satisfy a constraint, the positions of nodes may need to be changed. A system of constraints is solved – or satisfied – if all constraints are satisfied and none of them contradicts any other constraint in the system. A solution of the constraint system is a set of corresponding values of object characteristics which satisfy the system. A system can be under-, overand well-constrained, depending on the relationship between the geometric elements and the number of constraints. An under-constrained system has more than one possible solution,
resulting in ambiguity. An over-constrained system in general has no solution at all, that is – any set of values makes at least two constraints contradict. A well-constrained system has only one possible solution. For more details on the geometric constraint problem see [4] for example. B. The Localization Algorithm The input data is used to build a network of geometric constraints. This network is a graph G, whose vertices are points on a 2D plane, and edges are distance constraints between adjacent nodes. These constraints restrict the distance in the interval [d − e, d + e] where d is the respective distance estimation (obtained using RSS) and e is the error margin or the deviation. The algorithm needs a bounded error estimation, which should not be more than 40% as will be shown in the results section. The estimation error can result either from different radio fading patterns caused e.g. by obstacles on the radiopath, or from errors in measurement. It should be mentioned that only the upper bound of the distance can be estimated with precision, because a signal with certain strength can only be received over a certain distance, given the limitations of sender and receiver according to WLAN standards, for example. The lower bound, however, can be erroneous as even a strong signal can be faded by an obstacle, so the distance between nodes seems large although it is actually very small. Despite this fact, for simplicity upper and lower error boundaries are treated equally in this work. It should be mentioned that CSP (Constraint Satisfaction Problem) is in general a well-known NP complete problem, thus no polynomial solution has been found yet [5]. But in specific cases, the problem can be solved in polynomial time yielding good results, as we are going to demonstrate. Our approach to geometric constraint solving is a recursive analysis, graph-based method with constraint relaxation. The algorithm consists of 2 phases: 1) Deterministic constraint solving. Obtain first estimations for nodes’ positions 2) Constraint relaxation and heuristic improvements This approach is favored for three reasons. First, it makes it possible to interrupt solving at any time in the second phase (due to some time constraint) while still providing a valid partial solution of the system. Second, it is capable of solving constraints for a relatively large network, by dividing the constraint solving problem into groups of smaller subnets which can be solved independently and then merged. Third, it obtains preliminary estimations already after the first phase (which has O(n · n) complexity). 1) Phase 1 — Deterministic constraint solving: The first phase involves analysis of the constraint graph. This analysis determines if the problem is well-constrained or not, and it determines a sequence of steps for placing the geometric objects if the problem is well-constrained. If only a part (subnet) of the graph is well constrained then it is solved in this phase. This phase’s most important task is to calculate preliminary position estimations, which will be improved in the second phase.
The first phase begins by selecting any two nodes of the graph which are connected by a constraint edge. These two entities can be placed in some generic position, for instance, the first node is placed onto the coordinate origin and the second one is placed with an arbitrary angle at the corresponding distance. These two entities – also called anchors – are then considered known or fixed (the nodes 1 and 2 in Fig. 1). If those two nodes are both connected with a third node (node 6 in Fig. 1), we can solve both constraints and find the position of the third node, but obviously with some ambiguity. However, this ambiguity can not be resolved in general, because we do not have enough information at the beginning. The third point can lie in two areas resulting from intersection of both discs (see Fig. 1). The size of a disc is dependant on the deviation e (note that a nodes’ size is not dependent on deviation, in the figure nodes have accidentally a radius of e). For resolving such ambiguities, heuristics are used, which have shown to lead to correct result in most cases. 2e
2
The algorithm proceeds adding nodes to the solution one by one, finding nodes which can be resolved deterministically. A node can be resolved deterministically, if it is constrained by two or more constraints. If a node is constrained by two constraints, the ambiguity is resolved using the minimal distance heuristic. When there are no more nodes with at least two adjacent constraints available, which connect it to already resolved nodes, the algorithm searches for other subnets of the graph which then can be solved with the same algorithm. If no such nodes can be found, or the algorithm finds the system to be over- or under-determined, the first phase ends. 2) Phase 2 — Constraint relaxation and heuristic improvements: This phase provides mechanisms for dealing with overdetermined as well as under-determined systems. Constraint relaxation means that constraints, which already have been resolved, can be temporarily unresolved, so that the system can be changed. The relaxation phase begins with finding and adding nodes which can be positioned only partially. All nodes in our system can be categorized by their degree of freedom: •
3
• 1
4 6
5
• •
Fig. 1.
Choosing fixed points
The first heuristic: if a node in one position is closer than half of the radio distance R to one or more nodes with which it does not have a direct connection, then with high probability this position is incorrect, because otherwise there would be a connection. This heuristic is further referred to as ”minimal distance heuristic”. A value of 0.5 · R was selected as a heuristic threshold, because it yields rather good results as shown by our simulations. Of course, due to its heuristic nature, this assumption does not work in general, as there can be two nodes, which can stay very close to each other (closer than radio range) and still have no connection, e.g. because of a shielding obstacle between them. In Fig. 2, we see two possible positions for the node in question, which does not have a direct connection to node 1. That is why the position closer to node 1 is not selected, otherwise this node would have a radio link to 1 with high probability.
Degree 3 means that a node is not constrained at all. A node with Degree 2 is constrained to a circle (a part of its disc), by one constraint. With Degree 1 a node is constrained to an intersection of two circles. Degree 0 is used to mark a node which has been constrained by more than two non conflicting constraints.
All resolved nodes after the first phase have either 0 or 1 degrees of freedom. In phase two, a node is chosen which has only one constraint attached to it, and it is resolved partially, by placing it at a random angle to the constraining node on the constraining disc taking into consideration the minimum distance heuristic. This node is then considered as resolved, which means that it can resolve other nodes, but it has 2 degrees of freedom, which makes it possible to move it in its constrained area. 2
3
6
5
1
4
(a) 1
2
3
4
6 node X
5
(b) 1
1 P1
2
3
6
5
Distance chosen because of minimal distance heuristic
3 P2
Fig. 2.
4
2
Resolving ambiguities
(c) Fig. 3. a) Original network. b) The constraint conflict. c) New positions of nodes 6 and 5.
Choosing a random position can – and in most cases it will – lead to constraint conflicts. An example is shown in Fig. 3. As the topology of the original constraint network (Fig. 3a) does not allow complete positioning, the algorithm resolves the constraints partially yielding the result as shown in Fig. 3b – or a similar one due to randomly chosen values. The last two constraints conflict, as the last node P 6 must be also within a certain radius of P 1 which is impossible. This is the case where relaxation is used. The node in question (further referred to as node X) is placed onto the constraining disc of the first node, as shown in Fig. 3c. The new calculated positions of nodes 6 (X) and 5 are shown in gray. The place is chosen to satisfy three requirements: 1) conform to the constraint 2) conform to the ”minimum distance heuristic” 3) be the closest possible position to the previous position. In Fig. 3c), we see that the new location of node 6 is chosen closest to its original position in Fig. 3b). After this, the node is temporarily considered resolved and all other nodes are considered unresolved (this means, the corresponding constraints are relaxed and will be resolved again). The system is now being solved starting from this node, finding nodes connected to it, and resolving them. However, there are the following changes: 1) In case of a constraint conflict, the process stops (otherwise it could continue infinitely) 2) When resolving constraints, the algorithm does not choose random positions in case of ambiguity – it rather chooses positions which are closest to the position a node had before to minimize the changes to the system. The idea behind this is rather simple: the previous position has been calculated satisfying eventually all constraints considered before the conflict occurred. If we keep the change to this position minimal, we also keep the overall constraint violation minimal that results after this relaxation step. This consideration also enables us to reuse old position data if a new (updated) input has been received and there is a strong possibility, that the nodes’ positions have not changed tremendously. In this case the algorithm can be run skipping the first phase. The process terminates in the following cases: either the system was fully resolved starting from node X or there was a constraint conflict. For the first case, phase two is continued – trying to eventually find components of the graph not yet explored. If a conflict happened, the system is resolved again starting with normal start nodes (as in the beginning) and we measure the ”constraint error” of node X. The constraint error is the sum of deviations of the distance between any two nodes from the constraint value between them. Now the solving process is continued in turns, starting from node X or the original start nodes, until either a maximum of (log n)/2 turns have been made or node X was resolved, where n is the number of nodes in the network. (log n)/2 is selected as an upper bound, because our simulations have
Fig. 4.
Heuristic
shown that increasing the number of turns in this case does not lead to significant improvements. This leads to the overall complexity O(n·n·log n). Below, it is shown that two attempts with (log n)/2 steps each are made, resulting in O(log n) for the heuristic resolution. Each turn is made as described above, with the difference, that the ambiguity of node X is now resolved at random (in the range that previous constraints allow), which helps to avoid possible local maximums. If after making (log n)/2 turns the solution has not been found, additional (log n)/2 turns are made, exploring positions at 15% radio range distance from the position with the minimal ”constraint error”. In Fig. 4, the cross filled circle marks the ”best alternative”, the white nodes are from the first trial, and the black ones depict the second trial (nearest locations). This is the final stage of trying to resolve node X. If the solution can not be found, the node is placed onto the middle position between the constraining nodes and is considered as conditionally resolved. This means that this node can constrain other nodes, but if it comes to a conflict with others, it will be ignored. The log n turns which are made for every conflicting node make the overall complexity rise to n · n · log n. III. E XPERIMENTAL R ESULTS In our simulations we used a network of 100 uniformly and randomly placed nodes with an average degree of 4.5. A sample network is shown in Fig. 5. Connectivity is determined based on a maximum range R where links are established whenever the distance between two nodes is smaller than R. For the analysis, distance estimations are jittered by some error e (given as percent of radio range R). This represents the inaccuracy in distance measurements.
Fig. 5.
Original network
Percentage of nodes located within 20% of range
100 error in % percentage of nodes located within 20% of range 905 100 10 96 80 15 65 20 51 70 30 17 40 5 60 50 40 30 20 10 0 0
Average positioning error in % of R
350 results with 4 anchor nodes error in % average error of the result 5 300 10 15 20 250 30 40 200
10 19 40 65 160 300
100 50 0 5
10
15
20
25
30
35
40
15
20
25
30
35
40
45
Fig. 8. Percentage of nodes positioned within 20% deviation for a 100 nodes network with 4 anchors 10000
nodes 9000 runtime (ms) 100 50 8000 200 305 300 740 7000 400 1380 500 2242 6000 600 3323 700 4632 5000 800 6173 900 7950 4000 1000 9967 3000 rounded to 10 ms. 2000 1000 0 100
200
300
400
500
600
700
800
900
1000
Nodes
Fig. 9. Runtimes of the algorithm depending on the number of nodes on the network
average error of the result
150
45
Distance estimation error in %
Fig. 7.
10
Distance estimation error in %
We use 2 to 6 anchor nodes in our simulations, where the absolute position is known. A sample localization result is shown in Fig. 6, using 6 anchor nodes (marked green in the picture) and 10% error in distance estimation. The estimated positions are shown in red. We found that the average position error in this case is 18% of radio range. We see that in average case the longer the distance to anchor nodes the bigger is the error in position estimation. This is a normal behavior, as with each hop the error is being propagated over the network. As one can see, some of the nodes near the anchors were positioned rather exactly, despite erroneous distance estimation. This is the result of constraint relaxation in the second phase, due to which other anchors helped to correct the error by repositioning nodes.
0
5
Sample localization result using 6 anchor nodes
Runtime (ms)
Fig. 6.
Positioning errors for a 100 nodes network with 4 anchors
The graph in Fig. 7 shows the average position error, depending on the measurement accuracy, on a network with 4 anchor nodes. As we assume a small number of anchor nodes (less than 5% of all nodes) the data becomes unreliable at about 25% input error. However, we found that the deviation is rather high. While some nodes are positioned with errors of more than 100% of radio range, other nodes are still positioned within a reasonable deviation. That is why we consider another graph, shown in Fig. 8, which shows the percentage of the nodes still positioned within 20% deviation. As we see, even as the average error grows, the results for single nodes can still be used for our scenario – a location privacy attack. Our scenario requires a solution with high performance to be able to react quickly to changing input data, for example
the appearance of a new anchor, or changing connectivity information. In Fig. 9 the results of a runtime measurement are illustrated, conducted on a system with AMD Athlon XP 3200+ processor, approx. 2000 MHz frequency and 768MB RAM. As we can see, the solution scales well for networks with about 1000 nodes. In our future work, we will consider especially VANETs, where 1000 nodes is a normal working case, that is why it is important that the algorithm can also tackle such networks. IV. R ELATED W ORK Localization of nodes in ad hoc networks has been a topic of active research in recent years. Many approaches have been proposed for node localization, a good overview can be found in [6]. Along with constraint based approaches (e.g. by Doherty et al. [7]), there are also multi distance scaling based algorithms (MDS) presented by Shang et al. [8]. We analyzed many of this approaches and evaluated whether they are capable for node localization, regarding the requirements from our scenario. In the following, these approaches are described with their pros and cons, i.e. with their usefulness for our attacker model. Doherty’s approach in [7] uses constraint based systems to localize nodes in ad hoc sensor networks by constraining distance and/or angle between neighbor nodes. Semi–definite
programming with convex optimizations was used to solve the constraint system. The computational complexity is at O(n3 ), with n being the number of the nodes on the network. This approach provides good results, but the a relative large number of anchor nodes is required. With 10% of anchor nodes e.g. the estimation error lies around the communication range. As shown, our solution beats this accuracy. In Shang’s promising approach [8] an extension of Multi Distance Scaling has been used. As shown in simulations, very good results on position estimation are achieved at high connectivity, even with few anchors. However, heavy computational load of MDS pre-calculations makes it difficult to obtain partial results, which may be important for our use case. In the work of Hu et al. in [9] a very effective approach based on Monte Carlo Simulations is presented. Though this approach considers node mobility and achieves good results, it calculates the probabilistic distribution of a node’s possible location and needs cooperation of nodes towards achieving the goal. These suppositions do not seem a possible scenario in our case, when participants actually do not want to be discovered. Our assumption is that the localization must be possible under normal network conditions. In [10], Niculescu et al. present a very interesting multi-hop positioning approach. The method is partly based on euclidean propagation of distance estimation. Moving nodes propagate their knowledge of location information to the nodes in radio range. Special GPS nodes are assumed in the network, which can measure their exact position and propagate it to non-GPS nodes. This method also requires cooperative behavior of the network. As we concentrate on the security scenario discussed in the introduction, we actually must count on non-cooperative behavior of the participants. An interesting concept is explored in [11]. In this work a relative positioning system is presented, without the use of GPS. At each node a local coordinate system is created and is then merged in a global coordinate system. But this method is expensive in terms of number of messages and requires node cooperation too. An approach which performs well on networks with few anchors is presented in [12]. The algorithm is separated into two phases: start-up and refinement. In the start-up phase the Hop-TERRAIN algorithm is run once to achieve an initial estimation of the nodes’ locations. Afterwards the refinement algorithm is run to improve the position estimates. However, a higher connectivity then at our algorithm is required to achieve good position estimations. Furthermore node cooperation is also a precondition for this approach. V. C ONCLUSION We have shown that our algorithm for solving geometrical constraints can be used to locate nodes in ad-hoc networks. The algorithm delivers satisfactory preliminary results after its first, fast deterministic phase, which is improved in the second phase if there is time to do so. The algorithm can be
interrupted, and will in this case deliver a partial solution – a solution for some sub network of the original graph. As the experimental results demonstrate, very accurate position estimations can be achieved even with few (less then 5%) anchor nodes. Thus, this algorithm fulfills the requirements from our scenario. Particularly regarding its computation performance, it can be used for precise tracking of mobile nodes. This way an attacker could localize nodes very well, given that he knows the complete adjacency matrix including the received signal strength indicators for all links. As this is a rather strong assumption, we will next consider the quality of localization that can be reached when only limited information is available. A party of attacking nodes may gather this information e.g. by sending DSR ([13]) route requests into the network and analyzing the route replies. The interesting question is then, how good these results can get compared to the results of this study. In any case, it becomes clear that mere participation in a MANET will reveal information on the own location and may be misused. It is therefore absolutely necessary to include privacy protecting mechanisms in the design of MANET systems. R EFERENCES [1] P. Jacquet, P. Mhlethaler, T. Clausen, A. Laouiti, A. Qayyum, and L. Viennot, “Optimized link state routing protocol,” in IEEE INMIC’01, 28-30 December 2001, Lahore, Pakistan. IEEE, December 2001, pp. 62–68. [2] D. B. Johnson, D. A. Maltz, and J. Broch, “DSR: The Dynamic Source Routing Protocol for Multihop Wireless Ad Hoc Networks,” in Ad Hoc Networking, C. Perkins, Ed. Addison-Wesley, 2001, ch. 5, pp. 139–172. [3] C. E. Perkins and E. M. Royer, “Ad-hoc on-demand distance vector routing,” in Proceedings of the 2nd IEEE Workshop on Mobile Computer Systems and Applications, February 1999, pp. 90–100. [4] R. Joan-Arinyo, A. Soto-Riera, S. Vila-Marta, and J. Vilaplana, “On the domain of constructive geometric constraint solving techniques,” in SCCG ’01: Proceedings of the 17th Spring conference on Computer graphics. Washington, DC, USA: IEEE Computer Society, 2001, p. 49. [5] A. K. Mackworth, “Consistency in networks of relations.” Artif. Intell., vol. 8, no. 1, pp. 99–118, 1977. [6] J. Hightower and G. Borriello, “Location systems for ubiquitous computing,” IEEE Computer, vol. 34, no. 8, pp. 57–66, August 2001. [7] L. Doherty, K. S. J. Pister, and L. E. Ghaoui, “Convex position estimation in wireless sensor networks,” in Proc. IEEE Infocom, Anchorage, AK, Apr. 2001, pp. 1655–1663. [8] Y. Shang, W. Ruml, Y. Zhang, and M. P. J. Fromherz, “Localization from mere connectivity,” in MobiHoc ’03: Proceedings of the 4th ACM international symposium on Mobile ad hoc networking & computing. New York, NY, USA: ACM Press, 2003, pp. 201–212. [9] L. Hu and D. Evans, “Localization for mobile sensor networks,” in MobiCom ’04: Proceedings of the 10th annual international conference on Mobile computing and networking. New York, NY, USA: ACM Press, 2004, pp. 45–57. [10] D. Niculescu and B. Nath, “Ad hoc positioning system (aps),” in Proceedings of GLOBECOM, San Antonio, 2001. [11] S. Capkun, M. Hamdi, and J. Hubaux, “Gps-free positioning in mobile ad-hoc networks,” in HICSS ’01: Proceedings of the 34th Annual Hawaii International Conference on System Sciences ( HICSS-34)-Volume 9. Washington, DC, USA: IEEE Computer Society, 2001, p. 9008. [12] C. Savarese, J. M. Rabaey, and K. Langendoen, “Robust positioning algorithms for distributed ad-hoc wireless sensor networks,” in Proceedings of the General Track: 2002 USENIX Annual Technical Conference. Berkeley, CA, USA: USENIX Association, 2002, pp. 317–327. [13] D. B. Johnson and D. A. Maltz, “Dynamic source routing in ad hoc wireless networks,” in Mobile Computing, T. Imielinski and H. Korth, Eds. Kluwer Academic Publishers, 1996, vol. 353, ch. 5, pp. 153–181.
