6TiSCH Minimal Scheduling Function (MSF)

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on March 16, 2021.¶

Copyright Notice

Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

1. Introduction

The 6TiSCH Minimal Scheduling Function (MSF), defined in this specification, is a 6TiSCH Scheduling Function (SF). The role of an SF is entirely defined in [RFC8480]. This specification complements [RFC8480] by providing the rules of when to add/delete cells in the communication schedule. This specification satisfies all the requirements for an SF listed in Section 4.2 of [RFC8480].¶

MSF builds on top of the following specifications: the Minimal IPv6 over the TSCH Mode of IEEE 802.15.4e (6TiSCH) Configuration [RFC8180], the 6TiSCH Operation Sublayer Protocol (6P) [RFC8480], and the Minimal Security Framework for 6TiSCH [I-D.ietf-6tisch-minimal-security].¶

MSF defines both the behavior of a node when joining the network, and how the communication schedule is managed in a distributed fashion. When a node running MSF boots up, it joins the network by following the 6 steps described in Section 4. The end state of the join process is that the node is synchronized to the network, has mutually authenticated with the network, has identified a routing parent, and has scheduled one negotiated Tx cell (defined in Section 5.1) to/from its routing parent. After the join process, the node can continuously add/delete/relocate cells, as described in Section 5. It does so for 3 reasons: to match the link-layer resources to the traffic, to handle changing parent and to handle a schedule collision.¶

MSF works closely with the IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL), specifically the routing parent defined in [RFC6550]. This specification only describes how MSF works with the routing parent; this parent is referred to as the "selected parent". The activity of MSF towards the single routing parent is called a "MSF session". Though the performance of MSF is evaluated only when the "selected parent" represents the node's preferred parent, there should be no restrictions to use multiple MSF sessions, one per parent. The distribution of traffic over multiple parents is a routing decision that is out of scope for MSF.¶

MSF is designed to operate in a wide range of application domains. It is optimized for applications with regular upstream traffic, from the nodes to the Destination-Oriented Directed Acyclic Graph (DODAG [RFC6550]) root.¶

This specification follows the recommended structure of an SF specification, given in Appendix A of [RFC8480], with the following adaptations:¶

• We have reordered some sections, in particular to have the section on the node behavior at boot (Section 4) appear early in this specification.¶
• We added sections on the interface to the minimal 6TiSCH configuration (Section 2), the use of the SIGNAL command (Section 6), the MSF constants (Section 14) and the MSF statistics (Section 15).¶

2. Interface to the Minimal 6TiSCH Configuration

In a TSCH network, time is sliced up into time slots. The time slots are grouped as one or multiple slotframes which repeat over time. The TSCH schedule instructs a node what to do at each time slot, such as transmit, receive or sleep [RFC7554]. In case of a slot to transmit or receive, a channel is assigned to the time slot. The tuple (slot, channel) is indicated as a cell of TSCH schedule. MSF is one of the policies defining how to manage the TSCH schedule.¶

A node implementing MSF SHOULD implement the Minimal 6TiSCH Configuration [RFC8180], which defines the "minimal cell", a single shared cell providing minimal connectivity between the nodes in the network. The MSF implementation provided in this specification is based on the implementation of the Minimal 6TiSCH Configuration. However, an implementor MAY implement MSF based on other specifications as long as the specification defines a way to advertise the EB/DIO among the network.¶

MSF uses the minimal cell for broadcast frames such as Enhanced Beacons (EBs) [IEEE802154] and broadcast DODAG Information Objects (DIOs) [RFC6550]. Cells scheduled by MSF are meant to be used only for unicast frames.¶

To ensure there is enough bandwidth available on the minimal cell, a node implementing MSF SHOULD enforce some rules for limiting the traffic of broadcast frames. For example, the overall broadcast traffic among the node and its neighbors SHOULD NOT exceed 1/3 of the bandwidth of minimal cell. One of the algorithms that fulfills this requirement is the Trickle timer defined in [RFC6206] which is applied on DIO messages [RFC6550]. However, any such algorithm of limiting the broadcast traffic to meet those rules is implementation-specific and is out of the scope of MSF.¶

3 slotframes are used in MSF. MSF schedules autonomous cells at Slotframe 1 (Section 3) and 6P negotiated cells at Slotframe 2 (Section 5) ,while Slotframe 0 is used for the bootstrap traffic as defined in the Minimal 6TiSCH Configuration. The same slotframe length for Slotframe 0, 1 and 2 is RECOMMENDED. Thus it is possible to avoid the scheduling collision between the autonomous cells and 6P negotiated cells (Section 3). The default slotframe length (SLOTFRAME_LENGTH) is RECOMMENDED for Slotframe 0, 1 and 2, although any value can be advertised in the EBs.¶

3. Autonomous Cells

MSF nodes initialize Slotframe 1 with a set of default cells for unicast communication with their neighbors. These cells are called 'autonomous cells', because they are maintained autonomously by each node without negotiation through 6P. Cells scheduled by 6P transaction are called 'negotiated cells' which are reserved on Slotframe 2. How to schedule negotiated cells is detailed in Section 5. There are two types of autonomous cells:¶

• Autonomous Rx Cell (AutoRxCell), one cell at a [slotOffset,channelOffset] computed as a hash of the EUI64 of the node itself (detailed next). Its cell options bits are assigned as TX=0, RX=1, SHARED=0.¶
• Autonomous Tx Cell (AutoTxCell), one cell at a [slotOffset,channelOffset] computed as a hash of the layer 2 EUI64 destination address in the unicast frame to be transmitted (detailed in Section 4.4). Its cell options bits are assigned as TX=1, RX=0, SHARED=1.¶

To compute a [slotOffset,channelOffset] from an EUI64 address, nodes MUST use the hash function SAX as defined in Section 2 of [SAX-DASFAA] with consistent input parameters, for example, those defined in Appendix A. The coordinates are computed to distribute the cells across all channel offsets, and all but the first slot offset of Slotframe 1. The first time offset is skipped to avoid colliding with the minimal cell in Slotframe 0. The slot coordinates derived from a given EUI64 address are computed as follows:¶

• slotOffset(MAC) = 1 + hash(EUI64, length(Slotframe_1) - 1)¶
• channelOffset(MAC) = hash(EUI64, NUM_CH_OFFSET)¶

The second input parameter defines the maximum return value of the hash function. Other optional parameters defined in SAX determine the performance of SAX hash function. Those parameters could be broadcasted in EB frame or pre-configured. For interoperability purposes, the values of those parameters can be referred from Appendix A.¶

AutoTxCell is not permanently installed in the schedule but added/deleted on demand when there is a frame to be sent. Throughout the network lifetime, nodes maintain the autonomous cells as follows:¶

• Add an AutoTxCell to the layer 2 destination address which is indicated in a frame when there is no 6P negotiated Tx cell in schedule for that frame to transmit.¶

• Remove an AutoTxCell when:¶

  • there is no frame to transmit on that cell, or¶
  • there is at least one 6P negotiated Tx cell in the schedule for the frames to transmit.¶

The AutoRxCell MUST always remain scheduled after synchronization. 6P CLEAR MUST NOT erase any autonomous cells.¶

Because of hash collisions, there will be cases that the AutoTxCell and AutoRxCell are scheduled at the same slot offset and/or channel offset. In such cases, AutoTxCell always take precedence over AutoRxCell. Notice AutoTxCell is a shared type cell which applies backs-off mechanism. When the AutoTxCell and AutoRxCell collide, AutoTxCell takes precedence if there is a packet to transmit. When in a back-off period, AutoRxCell is used. In case of conflicting with a negotiated cell, autonomous cells take precedence over negotiated cells, which is stated in [IEEE802154]. However, when the Slotframe 0, 1 and 2 use the same length value, it is possible for a negotiated cell to avoid the collision with AutoRxCell. Hence, the same slotframe length for Slotframe 0, 1 and 2 is RECOMMENDED.¶

4. Node Behavior at Boot

This section details the behavior the node SHOULD follow from the moment it is switched on, until it has successfully joined the network. Alternative behaviors may be involved, for example, when alternative security solutions are used for the network. Section 4.1 details the start state; Section 4.8 details the end state. The other sections detail the 6 steps of the joining process. We use the term "pledge" and "joined node", as defined in [I-D.ietf-6tisch-minimal-security].¶

5. Rules for Adding/Deleting Cells

Once a node has joined the 6TiSCH network, it adds/deletes/relocates cells with the selected parent for three reasons:¶

• to match the link-layer resources to the traffic between the node and the selected parent (Section 5.1)¶
• to handle switching parent or(Section 5.2)¶
• to handle a schedule collision (Section 5.3)¶

Those cells are called 'negotiated cells' as they are scheduled through 6P, negotiated with the node's parent. Without specific declaration, all cells mentioned in this section are negotiated cells and they are installed at Slotframe 2.¶

6. 6P SIGNAL command

The 6P SIGNAL command is not used by MSF.¶

7. Scheduling Function Identifier

The Scheduling Function Identifier (SFID) of MSF is IANA_6TISCH_SFID_MSF. How the value of IANA_6TISCH_SFID_MSF is chosen is described in Section 17.¶

8. Rules for CellList

MSF uses 2-step 6P Transactions exclusively. 6P transactions are only initiated by a node towards its parent. As a result, the cells to put in the CellList of a 6P ADD command, and in the candidate CellList of a RELOCATE command, are chosen by the node initiating the 6P transaction. In both cases, the same rules apply:¶

• The CellList is RECOMMENDED to have 5 or more cells.¶
• Each cell in the CellList MUST have a different slotOffset value.¶
• For each cell in the CellList, the node MUST NOT have any scheduled cell on the same slotOffset.¶
• The slotOffset value of any cell in the CellList MUST NOT be the same as the slotOffset of the minimal cell (slotOffset=0).¶
• The slotOffset of a cell in the CellList SHOULD be randomly and uniformly chosen among all the slotOffset values that satisfy the restrictions above.¶
• The channelOffset of a cell in the CellList SHOULD be randomly and uniformly chosen in [0..numFrequencies], where numFrequencies represents the number of frequencies a node can communicate on.¶

As a consequence of random cell selection, there is a non-zero chance that nodes in the vicinity installed cells with same slotOffset and channelOffset. An implementer MAY implement a strategy to monitor the candidate cells before adding them in CellList to avoid collision. For example, a node MAY maintain a candidate cell pool for the CellList. The candidate cells in the pool are pre-configured as Rx cells to promiscuously listen to detect transmissions on those cells. If IEEE802.15.4 transmissions are observed on one cell over multiple iterations of the schedule, that cell is probably used by a TSCH neighbor. It is moved out from the pool and a new cell is selected as a candidate cell. The cells in CellList are picked from the candidate pool directly when required.¶

9. 6P Timeout Value

The timeout value is calculated for the worst case that a 6P response is received, which means the 6P response is sent out successfully at the very latest retransmission. And for each retransmission, it backs-off with largest value. Hence the 6P timeout value is calculated as ((2^MAXBE)-1)*MAXRETRIES*SLOTFRAME_LENGTH, where:¶

• MAXBE, defined in IEEE802.15.4, is the maximum backoff exponent used¶
• MAXRETRIES, defined in IEEE802.15.4, is the maximum retransmission times¶
• SLOTFRAME_LENGTH represents the length of slotframe¶

10. Rule for Ordering Cells

Cells are ordered slotOffset first, channelOffset second.¶

The following sequence is correctly ordered (each element represents the [slottOffset,channelOffset] of a cell in the schedule):¶

[1,3],[1,4],[2,0],[5,3],[6,0],[6,3],[7,9]¶

11. Meaning of the Metadata Field

The Metadata field is not used by MSF.¶

12. 6P Error Handling

Section 6.2.4 of [RFC8480] lists the 6P Return Codes. Figure 1 lists the same error codes, and the behavior a node implementing MSF SHOULD follow.¶

       +-----------------+----------------------+
       | Code            | RECOMMENDED behavior |
       +-----------------+----------------------+
       | RC_SUCCESS      | nothing              |
       | RC_EOL          | nothing              |
       | RC_ERR          | quarantine           |
       | RC_RESET        | quarantine           |
       | RC_ERR_VERSION  | quarantine           |
       | RC_ERR_SFID     | quarantine           |
       | RC_ERR_SEQNUM   | clear                |
       | RC_ERR_CELLLIST | clear                |
       | RC_ERR_BUSY     | waitretry            |
       | RC_ERR_LOCKED   | waitretry            |
       +-----------------+----------------------+

The meaning of each behavior from Figure 1 is:¶

nothing:

Indicates that this Return Code is not an error. No error handling behavior is triggered.¶

clear:

Abort the 6P Transaction. Issue a 6P CLEAR command to that neighbor (this command may fail at the link layer). Remove all cells scheduled with that neighbor from the local schedule.¶

quarantine:

Same behavior as for "clear". In addition, remove the node from the neighbor and routing tables. Place the node's identifier in a quarantine list for QUARANTINE_DURATION. When in quarantine, drop all frames received from that node.¶

waitretry:

Abort the 6P Transaction. Wait for a duration randomly and uniformly chosen in [WAIT_DURATION_MIN,WAIT_DURATION_MAX]. Retry the same transaction.¶

13. Schedule Inconsistency Handling

The behavior when schedule inconsistency is detected is explained in Figure 1, for 6P Return Code RC_ERR_SEQNUM.¶

14. MSF Constants

Figure 2 lists MSF Constants and their RECOMMENDED values.¶

        +------------------------------+-------------------+
        | Name                         | RECOMMENDED value |
        +------------------------------+-------------------+
        | SLOTFRAME_LENGTH             |      101 slots    |
        | NUM_CH_OFFSET                |       16          |
        | MAX_NUM_CELLS                |      100          |
        | LIM_NUMCELLSUSED_HIGH        |       75          |
        | LIM_NUMCELLSUSED_LOW         |       25          |
        | MAX_NUMTX                    |      256          |
        | HOUSEKEEPINGCOLLISION_PERIOD |        1 min      |
        | RELOCATE_PDRTHRES            |       50 %        |
        | QUARANTINE_DURATION          |        5 min      |
        | WAIT_DURATION_MIN            |       30 s        |
        | WAIT_DURATION_MAX            |       60 s        |
        +------------------------------+-------------------+

15. MSF Statistics

Figure 3 lists MSF Statistics and their RECOMMENDED width.¶

                +-----------------+-------------------+
                | Name            | RECOMMENDED width |
                +-----------------+-------------------+
                | NumCellsElapsed |      1 byte       |
                | NumCellsUsed    |      1 byte       |
                | NumTx           |      1 byte       |
                | NumTxAck        |      1 byte       |
                +-----------------+-------------------+

16. Security Considerations

MSF defines a series of "rules" for the node to follow. It triggers several actions, that are carried out by the protocols defined in the following specifications: the Minimal IPv6 over the TSCH Mode of IEEE 802.15.4e (6TiSCH) Configuration [RFC8180], the 6TiSCH Operation Sublayer Protocol (6P) [RFC8480], and the Constrained Join Protocol (CoJP) for 6TiSCH [I-D.ietf-6tisch-minimal-security]. Confidentiality and authentication of MSF control and data traffic are provided by these specifications whose security considerations continue to apply to MSF. In particular, MSF does not define a new protocol or packet format.¶

MSF uses autonomous cells for initial bootstrap and the transport of join traffic. Autonomous cells are computed as a hash of nodes' EUI64 addresses. This makes the coordinates of autonomous cell an easy target for an attacker, as EUI64 addresses are visible on the wire and are not encrypted by the link-layer security mechanism. With the coordinates of autonomous cells available, the attacker can launch a selective jamming attack against any nodes' AutoRxCell. If the attacker targets a node acting as a JP, it can prevent pledges from using that JP to join the network. The pledge detects such a situation through the absence of a link-layer acknowledgment for its Join Request. As it is expected that each pledge will have more than one JP available to join the network, one available countermeasure for the pledge is to pseudo-randomly select a new JP when the link to the previous JP appears bad. Such strategy alleviates the issue of the attacker randomly jamming to disturb the network but does not help in case the attacker is targeting a particular pledge. In that case, the attacker can jam the AutoRxCell of the pledge, in order to prevent it from receiving the join response. This situation should be detected through the absence of a particular node from the network and handled by the network administrator through out-of-band means.¶

MSF adapts to traffic containing packets from the IP layer. It is possible that the IP packet has a non-zero DSCP (Diffserv Code Point [RFC2474]) value in its IPv6 header. The decision how to handle that packet belongs to the upper layer and is out of scope of MSF. As long as the decision is made to hand over to MAC layer to transmit, MSF will take that packet into account when adapting to traffic.¶

Note that non-zero DSCP value may imply that the traffic is originated at unauthenticated pledges, referring to [I-D.ietf-6tisch-minimal-security]. The implementation at IPv6 layer SHOULD rate-limit this join traffic before it is passed to 6top sublayer where MSF can observe it. In case there is no rate limit for join traffic, intermediate nodes in the 6TiSCH network may be prone to a resource exhaustion attack, with the attacker injecting unauthenticated traffic from the network edge. The assumption is that the rate limiting function is aware of the available bandwidth in the 6top L3 bundle(s) towards a next hop, not directly from MSF, but from an interaction with the 6top sublayer that manages ultimately the bundles under MSF's guidance. How this rate-limit is implemented is out of scope of MSF.¶

17. IANA Considerations

+----------------------+-----------------------------+-------------+
|  SFID                | Name                        | Reference   |
+----------------------+-----------------------------+-------------+
| IANA_6TISCH_SFID_MSF | Minimal Scheduling Function | RFC_THIS    |
|                      | (MSF)                       |             |
+----------------------+-----------------------------+-------------+

18. Contributors

• Beshr Al Nahas (Chalmers University, beshr@chalmers.se)¶
• Olaf Landsiedel (Chalmers University, olafl@chalmers.se)¶
• Yasuyuki Tanaka (Inria-Paris, yasuyuki.tanaka@inria.fr)¶

Appendix A. Example of Implementation of SAX hash function

Considering the interoperability, this section provides an example of implemention SAX hash function [SAX-DASFAA]. The input parameters of the function are:¶

• T, which is the hashing table length¶
• c, which is the characters of string s, to be hashed¶

In MSF, the T is replaced by the length of slotframe 1. String s is replaced by the mote EUI64 address. The characters of the string c0, c1, ..., c7 are the 8 bytes of EUI64 address.¶

The SAX hash function requires shift operation which is defined as follow:¶

• L_shift(v,b), which refers to left shift variable v by b bits¶
• R_shift(v,b), which refers to right shift variable v by b bits¶

The steps to calculate the hash value of SAX hash function are:¶

1. initialize variable h to h0 and variable i to 0, where h is the intermediate hash value and i is the index of the bytes of EUI64 address¶
2. sum the value of L_shift(h,l_bit), R_shift(h,r_bit) and ci¶
3. calculate the result of exclusive or between the sum value in Step 2 and h¶
4. modulo the result of Step 3 by T¶
5. assign the result of Step 4 to h¶
6. increase i by 1¶
7. repeat Step2 to Step 6 until i reaches to 8¶

The value of variable h is the hash value of SAX hash function.¶

The values of h0, l_bit and r_bit in Step 1 and 2 are configured as:¶

• h0 = 0¶
• l_bit = 0¶
• r_bit = 1¶

The appropriate values of l_bit and r_bit could vary depending on the the set of motes' EUI64 address. How to find those values is out of the scope of this specification.¶

Authors' Addresses