## 3 Attacks on HWMP
### Internal Attacks  
Internal attackers are users authorized to join the WMN. Internal attackers have all of the required security keys. Link-based security measures are unable to prevent internal attacks. The goals of internal attacks are different than external attacks. Most likely, internal attackers will not flood the WMN because they are also legitimate users of the network. Moreover, they most likely have different reasons for attacking the network compared to external attackers. Greedy users will try to deny the access of other users to obtain a better share of the network's bandwidth [33]. This denial of access can be performed by creating a blackhole that sinks the data packets of the other mesh STAs. This type of attack will prevent other users from using the network, but it will not disrupt the operation of the network. In the end, the attacker will be able to monopolize all of the network's bandwidth resources. Another type of internal attack involves creating a wormhole to spy on data packets [33]. For example, a company staff member might be interested in his/her company's private secrets. The wormhole can be used to collect data packets to obtain private information. The network operation will not be disrupted, but the attacker will be able to collect the information that he/she wants. As discussed earlier, blackholes and wormholes attack data packets instead of the data link layer's frames. The blackhole or the wormhole can be created by exploiting HWMP with a path diversion attack. Path metrics, sequence numbers, originator addresses, and target addresses can all be manipulated to enable the path diversion attack. Importantly, the security requirements to prevent external _versus_ internal attacks are different from each other because internal attackers have the required security keys to authenticate the frames. From the insider attack on AODV [15], we can easily identify the vulnerabilities of the reactive mode HWMP frames and PREQ frames by the destination node in hybrid mode HWMP. Tables 4-6 list the message misuses and achievable misuse goals for PREQ, PREP, and PERR, respectively. Most of attack activities are on NMFs [15]. Therefore, the integrity and source origination authentication of the NMFs must be provided. such as the Pairwise Transient Key/Group Temporal Key (PTK/GTK). These keys can be used to authenticate frames. Non-authenticated frames will not be serviced by other mesh STAs. Note that PTK/GTK is only used for a point-to-point link protection. Most of the external attacks can be protected with data-origin authentication and data integrity service. Hereafter we call \"data-origin authentication\" and \"data integrity\" service as \"authentication and integrity\" service. A message authentication code (_MAC_ not to be confused with MAC which stands for medium access control) or a digital signature scheme can provide integrity and authentication service [34]. _MAC_ is one-way hash function with key dependency. _MAC_ is generated just like a one-way hash function but a symmetric key is also included. Only an entity with the same symmetric key can verify the _MAC_. So the verifier can get integrity and authentication service. Digital signature schemes with public-key cryptography and one-way hash function is also a good tool to authenticate the signer and the integrity of the signed message. The message is hashed first and a signer encrypts the hash with her/his private key, thereby signing the message. Because the signer's public key is made public, any entity with the message and the corresponding signature can verify the signature. Suppose that an unauthenticated frame had been transmitted and subsequently captured by an attacker. The attacker can then modify the contents of the frame and retransmit it. This modified frame will be considered as a legal frame by a receiving node or a destination node because it is not able to detect the modification. If _MAC_ or digital signature were attached to the frame, this type of attack can be protected.