## 3 Time Tampering in TTHCA  
The TTHCA wormhole detection algorithm is predicated on the assumption that a wormhole route will exhibit an unrealistically high PTT per HC. Wormhole nodes however, can potentially prevent TTHCA from detecting infected routes by adding a fictive packet processing time \(\Delta T_{F}\) to the \(\Delta T_{TOT}\) parameter of the RREP packet. It is important to stress that time tampering is not a modification attack _per se_ as the PM wormhole node never alters any routing packet parameters, but instead produces false measurement information. This means schemes designed to prevent packet alteration by for example, encrypting all routing packet parameters, will be ineffectual against a TTHCA time tampering attack. As a wormhole infected route has a high PTT/HC, the malicious nodes must artificially produce a lower PTT than in reality for that route to avoid detection and this can be accomplished by increasing \(\Delta T_{TOT}\). Since \(\Delta T_{TOT}>>PTT\) and \(\Delta T_{i}\) may incur large fluctuations due to for example, variable network traffic loads, it is difficult for the wormhole nodes to be aware of exactly how to set \(\Delta T_{F}\) as it must be precisely defined within the narrow time window that exists to effectively achieve time measurement tampering. This window is bounded by:  
\[(RTT-\Delta T_{TOT}-2 HC\,\frac{R}{S})\ \leq\ \Delta T_{F}\ \leq(RTT-\ \Delta T_{TOT}) \tag{4}\]  
So if the tampered \(\Delta T_{F}\) is too small, TTHCA is still able to detect the route as a wormhole because PTT/HC is higher than the threshold in Equation (3). Conversely, if \(\Delta T_{F}\) is made too high the resulting PTT at the source node will be negative. Pragmatically it is not feasible for a malicious node to exactly know the time tampering window since it can only be aware of the values of \(R\) and \(S\) in Equation (4). Successful time tampering is still feasible however, if the malicious nodes (M\({}_{1}\) and M\({}_{2}\)) can estimate the RTT of the wormhole link (\(RTT_{WH}\)). In an I-B link, \(RTT_{WH}\) can have high variations due to variable packet processing times at the nodes through which the wormhole is tunnelled, making the precise estimation of \(RTT_{WH}\) challenging. One approach for estimating \(RTT_{WH}\) for PM wormhole links is to use tightly synchronized clocks. During route discovery, wormhole node M\({}_{1}\) adds exact time information as an adjunct parameter within the tunnelled packet as it forwards the RREQ to the other malicious node M\({}_{2}\). Upon receiving this tunnelled RREQ, M\({}_{2}\) estimates the precise propagation delay of the RREQ through the wormhole \(t_{RREQ}\) by comparing the received time information with its own clock. A similar process occurs when M\({}_{2}\) returns RREP to M\({}_{1}\), with time information again being added as the RREP is tunnelled to M\({}_{2}\). When [PERSON]\({}_{1}\) receives the tunnelled RREP, it calculates \(t_{RREP}\) to give:  
\[RTT_{WH}=t_{RREQ}+t_{RREP} \tag{5}\]  
M\({}_{1}\) then adds the fictive time value \(\Delta T_{F}\) defined as:  
\[\Delta T_{F}=RTT_{WH}-2\frac{R}{S} \tag{6}\]  
to \(\Delta T_{TOT}\) of the RREP in addition to its own \(\Delta T_{i}\). Alternatively, the wormhole nodes can split the time tampering attack into two steps. Firstly, [PERSON]\({}_{2}\) adds the fictive value:  
\[\Delta T_{F1}=t_{RREQ}-\frac{R}{S} \tag{7}\]  
before M\({}_{1}\) adds:  
\[\Delta T_{F2}=t_{RREP}-\frac{R}{S} \tag{8}\]  
So \(\Delta T_{F}=\Delta T_{F1}+\Delta T_{F2}\) is then added to \(\Delta T_{TOT}\). To illustrate the conditions that must exist for TTHCA time tampering to be achieved, consider the MANET example in Figure 1, where a PM I-B wormhole is formed by nodes M\({}_{1}\) and M\({}_{2}\) which tunnel routing packets between each other via I\({}_{2}\) and I\({}_{3}\). It is assumed for simplicity that all nodes are in an idle state, have identical hardware and the inter-node distance is the same, so the \(t_{i}\) and \(\Delta T_{j}\) values are constant.