# Securing IoT: Mitigating Sybil Flood Attacks with Bloom Filters and Hash Chains
## 2 Background
### Overview of RPL  
Routing Protocol for Low-Power and Lossy Networks (RPL) is a distance vector routing protocol specifically designed for IPv6 communication in Low-Power and Lossy Networks (LLNs) [5]. It facilitates the creation of a Destination-Oriented Directed Acyclic Graph (DODAG) by leveraging an objective function and a set of configurable parameters. This objective function guides the network in computing the 'best' path for data transmission, considering factors such as energy consumption, hop count, or other application-specific metrics.  
RPL establishes a DODAG, a tree-like structure where all nodes have a single root, typically a border router or a collector node (LBR); routes are directed towards this root. This structure ensures loop-free routing and minimizes control overhead within the network. An example of a simple DODAG network can be seen in Figure 1.  
The RPL protocol utilises several control messages to create and maintain its topology. These messages, including DODAG Information Objects (DIOs) and Destination Advertisement Objects (DAOs), allow nodes to discover neighbouring nodes, learn about the DODAG structure, and advertise their own reachability towards the root. A third type of control message used in RPL is DODAG Information Solicitation (DIS). Nodes that have not yet joined the network and are seeking to establish themselves within the DODAG structure utilize DIS messages.  
The RPL protocol leverages a key mechanism called the Trickle timer algorithm to optimize control message exchange and minimize energy consumption. This timer dynamically adjusts the interval between control message transmissions, balancing network responsiveness with energy efficiency. During normal operation, nodes gradually increase the interval between transmissions as the network stabilizes, reducing unnecessary control traffic and preserving battery life.  
Despite its efficiency, RPL control messages can be abused by malicious actors [10; 11]. One such vulnerability lies in the DIS message. Nodes that have not yet joined the network utilize DIS messages to discover existing DODAGs and request routing information. While this mechanism facilitates seamless node integration, it also presents an opportunity for Denial-of-Service (DoS) attacks [12].  
A malicious node can exploit the network's discovery mechanism to launch a sybil-flood attack. This attack combines the creation of fake identities (sybil attack) with a flood of control messages (flood attack). Specifically, the attacker utilizes a large number of fake nodes in order to bombard the network with a continuous stream of DIS messages.  
Upon receiving a DIS message, a neighboring node resets its Trickle timer to its fastest rate and immediately responds with a DIO message. This behavior, while intended to facilitate network discovery, can be manipulated by attackers. The constant barrage of DIS messages from the sybil nodes forces honest nodes to repeatedly reset their Trickle timers, leading to a surge in control message transmissions and a significant drain on network resources.  
This excessive control traffic can overwhelm the network, causing several issues:  
Figure 1: DODAG visualisation.  
* Saturation: Communication channels become congested, hindering legitimate data transmission.
* Resource Depletion: Frequent control message exchange rapidly drains the finite battery resources of participating nodes.  
The effectiveness of any flooding attack highlights the importance of incorporating security measures into RPL implementations. These measures can involve techniques for identifying and filtering out malicious messages, thereby protecting network integrity and ensuring efficient operation.