{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:26:06Z","timestamp":1750220766626,"version":"3.41.0"},"reference-count":62,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2020,7,31]],"date-time":"2020-07-31T00:00:00Z","timestamp":1596153600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"NSF","award":["CRII-1657275"],"award-info":[{"award-number":["CRII-1657275"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2020,8,31]]},"abstract":"<jats:p>Industrial networks typically connect hundreds or thousands of sensors and actuators in industrial facilities, such as manufacturing plants, steel mills, and oil refineries. Although the typical industrial Internet of Things (IoT) applications operate at low data rates, they pose unique challenges because of their critical demands for reliable and real-time communication in harsh industrial environments. IEEE 802.15.4-based wireless sensor-actuator networks (WSANs) technology is appealing for use to construct industrial networks because it does not require wired infrastructure and can be manufactured inexpensively. Battery-powered wireless modules easily and inexpensively retrofit existing sensors and actuators in industrial facilities without running cables for communication and power. To address the stringent real-time and reliability requirements, WSANs made a set of unique design choices such as employing the Time-Synchronized Channel Hopping (TSCH) technology. These designs distinguish WSANs from traditional wireless sensor networks (WSNs) that require only best effort services. The function-based channel hopping used in TSCH simplifies the network operations at the cost of security. Our study shows that an attacker can reverse engineer the channel hopping sequences and graph routes by silently observing the transmission activities and put the network in danger of selective jamming attacks. The cracked knowledge on the channel hopping sequences and graph routes is an important prerequisite for launching selective jamming attacks to TSCH networks. To our knowledge, this article represents the first systematic study that investigates the security vulnerability of TSCH channel hopping and graph routing under realistic settings. In this article, we demonstrate the cracking process, present two case studies using publicly accessible implementations (developed for Orchestra and WirelessHART), and provide a set of insights.<\/jats:p>","DOI":"10.1145\/3372881","type":"journal-article","created":{"date-parts":[[2020,7,7]],"date-time":"2020-07-07T12:39:34Z","timestamp":1594125574000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Cracking Channel Hopping Sequences and Graph Routes in Industrial TSCH Networks"],"prefix":"10.1145","volume":"20","author":[{"given":"Xia","family":"Cheng","sequence":"first","affiliation":[{"name":"State University of New York at Binghamton, Binghamton, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Junyang","family":"Shi","sequence":"additional","affiliation":[{"name":"State University of New York at Binghamton, Binghamton, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2701-0159","authenticated-orcid":false,"given":"Mo","family":"Sha","sequence":"additional","affiliation":[{"name":"State University of New York at Binghamton, Binghamton, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2020,7,31]]},"reference":[{"volume-title":"Retrieved","year":"2013","key":"e_1_2_1_1_1"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2906388.2906403"},{"key":"e_1_2_1_3_1","first-page":"4","article-title":"A security analysis for wireless sensor mesh networks in highly critical systems","volume":"40","author":"Alcaraz Cristina","year":"2010","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/MASS.2012.6502531"},{"volume-title":"Proceedings of the 10th ACM\/IEEE International Conference on Information Processing in Sensor Networks. IEEE, 175--186","year":"2011","author":"Boano Carlo Alberto","key":"e_1_2_1_5_1"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/MASS.2015.100"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302505.3310075"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2010.2068576"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11276-013-0673-y"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.5555\/1765991.1766015"},{"volume-title":"Retrieved","year":"2002","author":"Dunkels Adam","key":"e_1_2_1_11_1"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/DCOSS.2017.29"},{"volume-title":"Retrieved","year":"2018","author":"Duquennoy Simon","key":"e_1_2_1_13_1"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2809695.2809714"},{"key":"e_1_2_1_15_1","unstructured":"FTE. 2019. FTE comprobe bpa 600. Retrieved from http:\/\/www.fte.com\/products\/BPA600.aspx.  FTE. 2019. FTE comprobe bpa 600. Retrieved from http:\/\/www.fte.com\/products\/BPA600.aspx."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2017.8057049"},{"key":"e_1_2_1_17_1","unstructured":"HART. 2019. HART Communication Protocol and Foundation (Now the FieldComm Group). Retreived from https:\/\/fieldcommgroup.org\/.  HART. 2019. HART Communication Protocol and Foundation (Now the FieldComm Group). Retreived from https:\/\/fieldcommgroup.org\/."},{"volume-title":"Retrieved","year":"2018","author":"IETF.","key":"e_1_2_1_18_1"},{"key":"e_1_2_1_19_1","unstructured":"ISA100. 2018. ISA100. Retrieved from http:\/\/www.isa100wci.org\/.  ISA100. 2018. ISA100. Retrieved from http:\/\/www.isa100wci.org\/."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1031495.1031515"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1514274.1514299"},{"volume-title":"Retrieved","year":"2013","author":"Levis Philip","key":"e_1_2_1_22_1"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCPS.2016.7479131"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2735960.2735983"},{"volume-title":"Proceedings of the ACM\/IEEE 4th International Conference on Cyber-Physical Systems (ICCPS\u201913)","author":"Li Bo","key":"e_1_2_1_25_1"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2015.2497161"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2013.146"},{"volume-title":"Disruptive Technologies: Advances that will Transform Life, Business, and the Global Economy.","year":"2013","author":"Manyika James","key":"e_1_2_1_28_1"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2009.090404"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2012.69"},{"key":"e_1_2_1_31_1","unstructured":"Raspberry Pi. 2019. Raspberry Pi. Retrieved from https:\/\/www.raspberrypi.org\/.  Raspberry Pi. 2019. Raspberry Pi. Retrieved from https:\/\/www.raspberrypi.org\/."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.5555\/1833515.1833818"},{"volume-title":"Smart Dust: Autonomous Sensing and Communication in a Cubic Millimeter.","year":"2010","author":"Pister Kristofer S. J.","key":"e_1_2_1_33_1"},{"volume-title":"Proceedings of the IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE","author":"Kristofer S.","key":"e_1_2_1_34_1"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2010.100608"},{"volume-title":"Heppelmann","year":"2014","author":"Porter Michael E.","key":"e_1_2_1_36_1"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2010.5502322"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2011.41"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/MPRV.2008.6"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.5555\/1740954.1740989"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2210241"},{"volume-title":"Retrieved","year":"2012","author":"RPL.","key":"e_1_2_1_42_1"},{"key":"e_1_2_1_43_1","unstructured":"Mike Ryan. 2013. Bluetooth: With low energy comes low security. In Presented as Part of the 7th USENIX Workshop on Offensive Technologies. USENIX Washington D.C. https:\/\/www.usenix.org\/conference\/woot13\/workshop-program\/presentation\/Ryan  Mike Ryan. 2013. Bluetooth: With low energy comes low security. In Presented as Part of the 7th USENIX Workshop on Offensive Technologies. USENIX Washington D.C. https:\/\/www.usenix.org\/conference\/woot13\/workshop-program\/presentation\/Ryan"},{"volume-title":"Retrieved","year":"2016","author":"Sha Mo","key":"e_1_2_1_44_1"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2013.013014.131037"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/1824766.1824772"},{"volume-title":"TelosB Datasheet provided by MEMSIC. Retrieved","year":"2018","author":"B.","key":"e_1_2_1_47_1"},{"key":"e_1_2_1_48_1","unstructured":"Adam Thierer and Andrea Castillo. 2015. Projecting the Growth and Economic Impact of the Internet of Things. Retrieved from https:\/\/www.mercatus.org\/publication\/projecting-growth-and-economic-impact-internet-things.  Adam Thierer and Andrea Castillo. 2015. Projecting the Growth and Economic Impact of the Internet of Things. Retrieved from https:\/\/www.mercatus.org\/publication\/projecting-growth-and-economic-impact-internet-things."},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2467391"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3241052"},{"volume-title":"Wireless Cyber-Physical Simulator (WCPS). Retrieved","year":"2018","author":"Cyber-Physical Wireless","key":"e_1_2_1_51_1"},{"key":"e_1_2_1_52_1","unstructured":"Wi-Spy. 2018. Wi-Spy USB Spectrum Analyzer. http:\/\/www.wi-spy.co.uk\/index.php\/products.  Wi-Spy. 2018. Wi-Spy USB Spectrum Analyzer. http:\/\/www.wi-spy.co.uk\/index.php\/products."},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/1998412.1998422"},{"key":"e_1_2_1_54_1","unstructured":"WirelessHART. 2019. WirelessHART. Retrieved from https:\/\/fieldcommgroup.org\/technologies\/hart\/hart-technology.  WirelessHART. 2019. WirelessHART. Retrieved from https:\/\/fieldcommgroup.org\/technologies\/hart\/hart-technology."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2002.1039518"},{"volume-title":"Proceedings of the 24th IEEE International Real-Time Systems Symposium (RTSS\u201903)","year":"2003","author":"Wood Anthony D.","key":"e_1_2_1_56_1"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/SAHCN.2007.4292818"},{"key":"e_1_2_1_58_1","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1109\/MNET.2006.1637931","article-title":"Jamming sensor networks: Attack and defense strategies","volume":"20","author":"Xu Wenyuan","year":"2006","journal-title":"IEEE Network"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/1062689.1062697"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1023646.1023661"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJSNET.2011.042767"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2018.8538705"}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372881","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372881","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372881","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:41:09Z","timestamp":1750200069000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372881"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,7,31]]},"references-count":62,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2020,8,31]]}},"alternative-id":["10.1145\/3372881"],"URL":"https:\/\/doi.org\/10.1145\/3372881","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"type":"print","value":"1533-5399"},{"type":"electronic","value":"1557-6051"}],"subject":[],"published":{"date-parts":[[2020,7,31]]},"assertion":[{"value":"2019-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-11-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-07-31","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}