Cracking the TSCH Channel Hopping in IEEE 802.15.4e

Industrial networks typically connect hundreds or thousands of sensors and actuators in industrial facilities, such as steel mills and oil refineries. Although the typical industrial applications operate at low data rates, they pose unique challenges because of their critical demands for reliable and real-time communication in harsh industrial environments. IEEE 802.15.4 based Wireless Sensor-Actuator Networks (WSANs) technology is appealing for use to construct industrial networks because it can be deployed and maintained inexpensively. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in industrial facilities without running cabling for communication and power. To address the stringent real-time and reliability requirements, WSANs adopt a set of novel design choices such as employing the Time-Synchronized Channel Hopping (TSCH) technology that distinguish themselves from traditional Wireless Sensor Networks (WSNs) that require only best effort services. The equation-based channel hopping used in TSCH simplifies the network operations at the cost of security. Our case study shows that an attacker can reverse engineer the channel hopping sequence by silently observing the channel activities and then perform smart collision attacks. In this poster proposal, we describe our target problem and present our case study based on a publicly accessible implementation of TSCH.