Abstract
1. Introduction
“
One of the important applications of IoT is for data acquisition in sensor networks: a set of spatially distributed sensors that are used to monitor physical or environmental conditions, and transmit their data to a data concentrator (periodically, or triggered by some events). These data are transmitted by way of a multihop network and where the intermediary hops (routers) in that network are the sensor devices themselves. The collection of all paths from each sensor to the data concentrator forms a
This paper describes a protocol for constructing such a collection tree in multihop sensor networks, where the protocol ensures that the resulting collection tree contains bidirectional paths between each sensor and the data concentrator. The protocol is defined as an extension to a reactive protocol: the LOADng routing protocol [1], which provides point-to-point routes between any two devices in a sensor network. Deploying both in unison permits efficient construction of both point-to-point routes and collection trees, by way of the same, simple protocol mechanisms.
1.1. Background and History
Since the late 90s, the Internet Engineering Task Force (IETF) (http://www.ietf.org) has embarked upon a path of developing routing protocols for networks with increasingly more fragile and low-capacity links, with less predetermined connectivity properties and with increasingly constrained router resources. In ′97, the MANET (Mobile Ad hoc Networks) working group was charted, then subsequently in 2006 and 2008, 6LoWPAN (IPv6 over Low Power WPAN) and ROLL (Routing over Low Power and Lossy Networks) working groups were charted.
After acquiring operational experiences, the MANET working group commenced by developing successors to OLSR and AODV, denoted by OLSRv2 and DYMO (Dynamic MANET On-Demand Routing). Whereas a relatively large and active community pushed OLSRv2 towards standardisation [5, 6], the momentum behind DYMO withered in the MANET working group http://tools.ietf.org/wg/manet/minutes?item=minutes81.html).
Several proposals for routing were presented in 6LowPAN, for each of these philosophies, including LOAD (6LoWPAN Ad hoc On-Demand Distance Vector Routing [7]). LOAD was a derivative of AODV but was adapted for link layer addresses and mesh-under routing, with some simplifications over AODV (e.g
The emergence of LLNs thus triggered a renewed interest in AODV-derived protocols for specific scenarios, resulting in work within the IETF [1, 13] for the purpose of standardisation of a successor to LOAD—denoted by LOADng (the Lightweight On-Demand Ad hoc Distance Vector Routing Protocol-Next Generation). LOADng incorporates the experiences from deploying LOAD—including, but not only, LLNs—and has been accepted as part of an update to the G3-PLC (Power Line Communication) ITU-T (International Telecommunication Union—Telecommunication Standardization Sector) standard for communication in the “smart grid” [14].
1.2. Statement of Purpose
There have been a lot of protocols proposed for data acquisition in sensor networks. In [15], the authors proposed collection tree protocol that uses ETX (expected transmission count) as the routing metric to construct one-way collection tree. A CDS-based network backbone for data collection is introduced in [16], to balance energy consumption and prolong the router lifetime in the backbone. A Pareto based multioptimization approach POCTP (Pareto Optimal Collection Tree Protocol) is discussed in [17] to ensure QoS such as transmission throughput, delay, and loss of packets. In [18], an average transmission time (ATT) metric is applied to routing protocol, under which real-time events are transferred along the routes with the shortest transmission time expectation. Multichannel is also used in [19] to reduce interference. Those protocols, some of them only support one-way traffic from sensor routers to one concentrator like [15], or hard to be extended for general sensor-to-sensor communications [16, 17]. Some of the protocols like [19] require specific support from lower layers, which are hard to be applied to normal sensor equipment.
The LOADng core specification aims at finding a route between any originator-destination pairs. This kind of point-to-point traffic pattern matches the basic traffic model of the Internet. However, in the world of smart grid, another important traffic pattern, called sensor-to-root, or multipoint-to-point exists. In such kind of scenarios, there are one or more concentrators that play as “root,” and all the other routers communicate with the root. If routes from all the other routers to the root are required, it is more efficient to build a “collection tree,” which is a directed graph that all edges are oriented toward and terminate at one root router.
This paper proposes an extension to a reactive routing protocol LOADng, denoted by LOADng Collection Tree Protocol (LOADng-CTP), for building a “collection tree” in environments, constrained in terms of computational power, memory, and energy. An example of the design target for LOADng-CTP is the ESB (Embedded Sensor Board [20]), with a TI MSP430 low-power microcontroller, an 1 MHz CPU, 2 kB RAM, and 60 kB flash ROM. The link layers typically used in LLNs impose strict limitations on packet sizes: in IEEE 802.15.4, the maximum physical layer packet size is 127 bytes and the resulting maximum frame size at the mac-layer is 102 bytes. If link-layer security is used, this may consume up to a further 21 bytes, which leaves just 81 bytes for upper layer protocols.
The LOADng-CTP presented in this paper is thus designed to meet the following requirements:
effectively building a route from all sensors to the root and the route from the root to the sensors if required; unidirectional links being avoided in these routes; low overhead, easy collection tree maintenance; easy extension to LOADng, such that routers using only LOADng (without collection tree extension) can join the collection tree.
Although the specification in this paper is designated for LOADng, its basic mechanism can be applied to general reactive protocol, like AODV also.
The remainder of this paper is organized as follows. In Section 2, the LOADng-CTP specification is introduced, including related message format and main operations. The protocol is further analysed in Section 3, from the aspect of routing complexity, security, and interoperability. The simulation study is performed in Section 4, in which LOADng, LOADng-CTP, and RPL are compared. Section 5 concludes this paper.
2. LOADng-CTP Protocol Specification
LOADng Collection Tree Protocol (LOADng-CTP) is based on the operation and packet format of LOADng. Therefore, the current LOADng implementation can be easily extended to the collection tree protocol. In the following, the basic operation of LOADng is introduced briefly, followed by the single message and protocol processing required for collection tree building and maintenance.
2.1. LOADng Basic Operation
LOADng contains two main operations:
Compared to AODV, LOADng has the following characteristics.
Modular design: the core specification defines the simple and lightweight core functions of the protocol. LOADng is extensible, by way of a flexible packet format permitting addition of arbitrary attributes and information via new message types and/or TLV (type-length-value) blocks. The LOADng protocol core is detailed in this section, with subsequent sections illustrating the use of the flexible architecture of LOADng for developing (interoperable and backwards compatible) protocol extensions. Optimised flooding: It can reduce the overhead incurred by RREQ forwarding. Jitter is employed, to reduce the probability of losses due to collisions on lower layers [21]. Flexible addressing: address lengths from 1 to 16 octets are supported (i.e., IPv6, IPv4, 6LowPAN short addresses, Layer-2 MAC addresses, and so forth are all supported by LOADng). The only requirement is that, within a given routing domain, all addresses are of the same address length. Metrics: different metrics are supported, to make use of link information from different layers. Destination replies: intermediate LOADng routers are explicitly prohibited from responding to RREQs, even if they may have active routes to the sought destination. All messages (RREQ or RREPs) generated by a given LOADng router share a single unique, monotonically increasing sequence number. This also eliminates Gratuitous RREPs while ensuring loop freedom. The rationale for this simplification reduced complexity of protocol operation and reduced message sizes—found to be without significant influence in the performance [22]. Allowing only the destination to reply to an RREQ also simplifies the task of securing the protocol, because the destination can thus sign the RREP message, and the originator could verify that it is the “real” destination that replies. Reduced state: a LOADng router is not required to maintain a precursor list; thus when forwarding a data packet to the recorded next hop on the path to the destination fails, an RERR is sent only to the originator of that data packet. The rationale for this simplification is an assumption that few overlapping routes are in use concurrently, and delay is not a critical issue in a given network.
2.2. Message for LOADng-CTP
LOADng-CTP introduces two flags to RREQ messages, carried by a so-called RREQ flag.
RREQ COLLECTION_TREE_TRIGGER: when set, a receiving router will be triggered to discover with which of its neighbours it has bidirectional links. RREQ COLLECTION_TREE_BUILD: when set, a receiving router will build the route to the root.
In addition, a HELLO message [5] is used, which includes all the 1-hop neighbours of the router generating the HELLO message. The HELLO messages are broadcast and never forwarded. Bidirectional neighbours are identified by the exchange of HELLO messages.
2.3. Router Parameters for LOADng-CTP
LOADng-CTP uses the following parameters for protocol functioning.
NET_TRAVERSAL_TIME: it is the maximum time that a packet is expected to take when traversing from one end of the network to the other. RREQ_MAX_JITTER: it is the maximum jitter for RREQ message transmission. Jitter is a randomly modifying timing mechanism to control traffic transmission in wireless networks to reduce the probability of transmission collisions [21]. HELLO_MIN_JITTER: it is the minimum jitter for HELLO message transmission. HELLO_MIN_JITTER must be greater than 2 HELLO_MAX_JITTER: it is the maximum jitter for HELLO message transmission. RREP_REQUIRED: it is the flag to define if an RREP message is required on receiving RREQ_BUILD message, to build routes from the root to sensors.
2.4. LOADng-CTP Procedures
The collection tree is, then, built by way of the following procedure—initiated by the router wishing to be the root of the collection tree.
When an RREQ_TRIGGER is generated, an RREQ with COLLECTION_TREE_BUILD flag set (henceforth, denoted by RREQ_BUILD) is scheduled to be generated in 2
It records the address of the sending router (i.e., the neighbour, from which it received the RREQ_TRIGGER) in its If no earlier copy of that same RREQ_TRIGGER has been previously received,
the RREQ_TRIGGER is retransmitted, subject to a jitter of RREQ_MAX_JITTER, to reduce the chance of collisions (except the root router); it schedules generation of a HELLO message, subject to a jitter of between HELLO_MIN_JITTER and HELLO_MAX_JITTER. When the scheduled HELLO message is generated, it lists the addresses of all the 1-hop neighbours, from which it has received a RREQ_TRIGGER.
On receiving a HELLO message, a router does the following.
If it finds its own address listed in the HELLO message, it records the address of the sending router (i.e., the neighbour, from which it received the HELLO) in its The HELLO message is never forwarded but discarded silently.
Thus, each router will learn with which among its neighbour routers it has a bidirectional (SYM) or unidirectional (HEARD) link.
On receiving a RREQ_BUILD, a router does the following.
It verifies if the RREQ_BUILD was received from a neighbour with which it has a bidirectional (SYM) link. If not, the RREQ_BUILD is silently discarded. Otherwise, if no earlier copy of that same RREQ_BUILD has been previously received, or the RREQ_BUILD indicates a short path to the root,
a new routing entry is inserted into the routing table, with
the RREQ_BUILD is retransmitted, again subject to a jitter of RREQ_JITTER.
Thus, each router will record a route to the root, and this route will contain only bidirectional links. The collection tree is built, enabling upward traffic. Figure 1 illustrates the RREQ_BUILD processing.

LOADng-CTP RREQ_BUILD message processing.
The sensors that require root-to-sensor traffic must have their RREP_REQUIRED flag set to be true. On receiving the RREQ_BUILD message, all the sensor routers with RREP_REQUIRED flag set must initiate an RREP message with content of
The RREP is thus unicast to the root, subject to jitter RREP_JITTER. On receiving the RREP message, a routing tuple is created in the routing table with
Figure 2 depicts an example of root-sensor message exchange sequences by illustrating the four steps of LOADng-CTP protocol (collection tree triggering, bidirectional neighbour discovery, collection tree build, and root-to-sensor path building). In the example, the

Message exchange of LOADng-CTP between root and sensors.
2.5. Collection Tree Maintenance
Based on the operation introduced in Section 2.4, a collection tree is built to enable data traffic transmission between the root router and all the other sensors. However, route failure could still happen, due to the “lossy” nature of sensor networks or topology changes, such as
loss of control message during the collection tree building process; routing entries expire because of not updated timely; participation of new sensors; Sensors quit the network because of movement or battery drain.
LOADng-CTP supports per-path maintenance when a path failure is detected, without rebuilding the whole collection tree. A new route discovery is initiated according to usual procedures of route discovery if
the data packet to be forwarded cannot find a routing tuple to the desired destination in the routing table, or the link to the “next hop” indicated by the routing table is detected broken.
To avoid RREQ being broadcast through the whole network and take benefits from that “most of other neighbour routers might have an available route to the root,” a
Figure 3 gives an example of path maintenance in collection tree. Router

An example of route maintenance. Router
With smart route request, as shown in Figure 3(b), routers
When a link on an active route to a destination is detected as broken (by way of inability to forward a data packet towards that destination), an RERR (route error) message is unicast to the source of the undeliverable data packet. Both this intermediate router and the source router need to initiate a new route discovery procedure.
3. LOADng-CTP Protocol Analyses
This section analyzes the main features of the LOADng-CTP, including protocol complexity, security considerations, and its interoperability with LOADng protocol.
3.1. Protocol Complexity
Unlike link-state routing protocols such as OSPF [23] or OLSR [6], which require keeping a network topology locally and run the Dijkstra algorithm, LOADng and LOADng-CTP concern only the basic additive operation when calculating link metrics. Therefore, the computational complexity is negligible. A very important concern of routing protocol for sensor networks is its routing overhead: the message required to maintain the routing table.
For simplicity, a balanced tree model is considered: there is a single root in the tree, with total height of

An example of balanced tree. Every parent has 2 children (
The number of nodes at height
In LOADng-CTP, the message required for collection tree building is the sum of RREQ_TRIGGER, HELLO, and RREQ_BUILD:
If root-to-sensor paths are required, every sensor also has to unicast an RREP message to the root.
The number of RREP messages forwarded by all the routers at height
The total number of RREP can thus be given by
Considering (1), the total number of RREP forwarding is
Considering
For the basic LOADng protocol, by which only point-to-point route build is supported, the number of RREQ messages forwarding required to build path from all the sensors to the root is
The RREP message is always needed in LOADng basic operation, which is the same as (5).
Based on (2), (5), and (6), it can be concluded that LOADng-CTP reduced routing overhead from
3.2. Security Considerations
The receiving order can be expected if those parameters are set correctly; however, in real implementations, there might exist misconfigured routers, or even compromised routers that emit messages out of order. For example, if a router sends a HELLO message before it receives all the RREQ_TRIGGER messages from its neighbours, or an RREQ_BUILD message is received before the HELLO message exchange finished, the router cannot identify its bidirectional neighbours correctly—thus it is not able to join the collection tree as expected.
In addition to message misordering, LOADng-CTP is also prone to attacks like block-hole or spoofing attacks [24, 25]. Malicious control traffic can have severe impact on the network stability.
The IETF has standardized a security framework for protocols using the message and packet format defined in [26], which is used by LOADng-CTP. (Note that this framework is currently being revised in a succeeding document that will obsolete RFC6622 once approved: http://tools.ietf.org/html/draft-ietf-manet-rfc6622-bis). Reference [27] specifies a syntactical representation of security-related information in TLVs for use with [26] addresses, messages, and packets. That specification does not represent a stand-alone protocol but is intended for use by MANET routing protocols, or security extensions thereof, such as LOADng-CTP.
Figure 5 depicts the architecture of a module for LOADng-CTP that provides integrity and nonrepudiation for LOADng, using the framework specified in [27].

Relationship with RFC5444, RFC6622, and LOADng-CTP.
Incoming RFC5444 packets are first parsed by the RFC5444 parser that demultiplexes messages and sends them to the protocol “owning” the message type. As each RFC5444 packet may contain multiple messages that are used by different protocols on a router, the message type is used to demultiplex and send the message to the appropriate protocol instance. A message intended for LOADng-CTP will then be forwarded to the security extension module that verifies the signature contained in a signature TLV inside the message. As the TLV contains additional information, such as the hash function (e.g., SHA-256, Secure Hash Algorithm) and the cryptographic function (e.g., AES, Advanced Encryption Standard), the module can choose the correct key and verify the integrity protection. If the message signature is correct, the message is handed over to the LOADng-CTP module; otherwise it is rejected. Similarly, outgoing messages from LOADng-CTP are handed over to the security module, which in turn adds the TLV containing the digital signature of the message. Then the message is handed over to the RFC5444 module that multiplexes it into a packet.
During the message signature generation as well as verification process, [27] takes special consideration for mutable fields, such as hop count and hop limit. In addition to hop count and limit, the route metric contained in a metric TLV is also updated along the path of a message and can therefore not be protected by a digital signature. LOADng-CTP lists these mutable fields explicitly. While this is a security problem that needs to be addressed in addition to a pure message signature (and is not discussed in this paper), based on the message format of LOADng-CTP messages, at least the calculation of signature is easy. This is because the message size does not change as no field is added or removed during the forwarding process of a message through the network (and therefore no other fields, such as message size or TLV block size, need to be recalculated). The metric can simply be replaced by a sequence of zeros before calculating the signature and is then restored afterwards.
In addition to message integrity, packets may also be digitally signed. As packets are used hop-by-hop, that is, are never forwarded, this is useful to authenticate the previous hop along the path of a message. Otherwise, a router not having any credentials may, for example, simply forward a correctly signed RREP message from one adjacent router to another and increase the hop count. As the hop count is excluded from the signature calculation, the message integrity would still be valid. Packet signatures mitigate this problem at the expense of increased overhead on the channel. Note also that it is difficult to detect simple forwarding of a frame without modifying the content, also known as “wormhole attack.”
3.3. Interoperability Considerations
As sensor networks and low-power and lossy networks are generally decentralized system, devices would possibly work in a heterogeneous environment: there might be old devices with basic functions, and newly jointed devices with extensions in the same routing domain. This requires interoperability between routers using LOADng-CTP and LOADng routers without collection tree extension (denoted by LOADng-core router).
A LOADng-core router will forward RREQ_TRIGGER and RREQ_BUILD message as normal RREQ messages, so it will not affect the collection tree building process of other routers in the network. But because LOADng-core routers cannot generate HELLO messages themselves and are not able to be verified as bidirectional neighbour, therefore, LOADng routers will not join the collection tree during the collection tree building process described in this section. However, these routers can participate in the collection tree by initiating a new RREQ message to the root and thus join the collection tree as “leaf nodes” (i.e., nodes without children), as shown in Figure 6.

An example of interoperability between LOADng-CTP (white nodes) and LOADng-core routers (grey nodes).
During the collection tree building process, LOADng-core routers will not be able to function as parents of other routers. As depicted in Figure 6, router
The existence of LOADng-core routers will possibly increase the routing overhead in the network by initiating more route discoveries. But with the smart RREQ introduced in Section 2.5, the RREQ dissemination can be kept locally, thus without introducing much influence in the networks.
4. Simulation and Performance Analyses
4.1. Simulation Settings
In order to understand the performance impact of the collection tree extension to LOADng, this section presents a set of ns2 simulations, comparing LOADng, LOADng-CTP, and RPL, with the parameters of the trickle timer in RPL being set according to [8]. Simulations were made with varying numbers of routers from 63 to 500 and placed statically randomly in a square field. The networks have consistent density of nodes; that is, the simulation field grows as the number of routers increases: 1100 m × 1100 m for 63 nodes, 1580 m × 1580 m for 125 nodes, 2230 m × 2230 m for 250 nodes, and 3160 m × 3160 m for 500 nodes. This simulates smart grid in suburban areas. As the size of the network grows, the scalability of the protocol can be tested.
The network is subject to sensor-to-root traffic, like periodic meter reading: all routers generate traffic, for which the destination always is a single, fixed router in the network. Each data source transmits a 512-byte data packet every 5 seconds, in bursts lasting for 80 seconds each, for a total simulation time of 100 s.
For the purpose of this study, router mobility was not considered. Simulations were conducted using the TwoRayGround propagation model and the IEEE 802.11 MAC. Although there are various low-layer technologies more commonly (and, perhaps, more viably) used for LLNs (power line communication, 802.15.4, low-power wifi, Bluetooth low energy, etc.), 802.11 provides basic distributed mechanisms for channel access, such as DCF (distributed coordination function), CSMA/CA (carrier sense multiple access with collision avoidance). Therefore, general behaviour of a protocol can be inferred from simulations using 802.11.
In the simulations, three types of routing protocols are compared.
LOADng core specification [1], referred to as LOADng in the following section. The routes are built reactively when there are data packets need to be sent. LOADng with collection tree extension, referred to as LOADng-CTP. The collection tree is triggered and built before the sending of data packets. RPL with trickle timer, referred to as RPL. The parameters of trickle timer are set according to [8].
4.2. Simulation Results
Figure 7 depicts the delivery ratio of three protocols. Both LOADng-CTP and RPL obtain delivery ratios close to 100%, regardless of number of nodes. LOADng, initiating route discovery for every router (network-wide broadcast), incurs a high number of collisions on the MAC layer (shown in Figure 8), and thus a lower data delivery ratio, especially in larger scenarios.

Packet delivery ratio.

Number of MAC layer collisions.
Figure 9 illustrates the average end-to-end delay. LOADng has longer delay mainly because the route discovery is performed reactively; that is, the data packets have to wait the finish of route discovery before being sent out. LOADng-CTP and RPL have routes a priori available, thus exhibiting identical delays.

Average end-to-end delay.
For the sensor networks, the routing overhead is also a crucial consideration. Figures 10 and 11 show the number of overhead packets per router and average overhead of network (bytes/second), respectively, which the networks are needed to converge to a stable state; that is, every router has a route to the root.

Number of overhead packets transmitted by each router.

Overhead bytes per second in the whole network.
The overhead packets of LOADng-CTP and RPL grow linearly with RPL sending twice as many packets as LOADng-CTP and RPL sending 10 times more bytes/s as compared to LOADng-CTP, due to the RPL control packets (mainly, the DIOs) being bigger [10]: a DIO packet takes up to 40 octets in these scenarios, whereas a LOADng-CTP RREQ and RREP packet typically are 10 octets (base header of 24 octets, plus other options and addresses). The overhead of LOADng grows exponentially as the number of nodes increases, up to 700,000 packets for scenarios of 500 nodes (not drawn in the figure). The point-to-point based basic LOADng mechanism is not optimized for sensor-to-root traffic.
5. Conclusion
This paper has presented an extension, LOADng-CTP, to the reactive LOADng routing protocol, permitting efficient and on-demand construction of collection trees for supporting sensor-to-root traffic types. LOADng-CTP permits finding paths between a root router and all the other sensor routers in the network using bidirectional links. The protocol supports per-path route maintenance without rebuilding the whole collection tree. Another key aspect of LOADng-CTP is that any router can at any time determine that it needs to act as a root for sensor-to-root traffic and spawn a collection tree construction; this, without requiring that said router is specifically provisioned for this purpose (no extra state, processing power, required).
The main features of LOADng-CTP are analysed. The routing overhead is reduced to
The performance of this extension has been studied; revealing delays and data delivery rations, comparable with RPL, are obtained while at the same time yielding considerably lower control traffic overheads. Compared to basic LOADng, the performance of the LOADng-CTP extension yields better performance: lower overhead, higher data delivery ratios, and lower delays.
