Overview of Sensor Network Security Yang Liu Graduate student, University of Tennessee 2003 spring group seminar.

Overview of Sensor Network Security

Yang LiuGraduate student, University of Tennessee

2003 spring group seminar

• Hostile environmentso Battlefield sensing/actuation

• Safety-critical applicationso Sensors in reactor complex

• Privacy intrusionso Employee tracking/monitoring

• Uncontrolled access

Motivation


2

• Wireless Communicationo Bring eavesdropping, unauthorized access, spoofing,

replay and denial-of-service attacks;

• Resource-constrained sensor nodeso Limit the degree of encryption, decryption, and

authorization on the individual sensor nodes;

• Compromised sensor nodeso Denial-of-service attacks;

Challenges


3

• Confidentialityo only intended receivers can recover the meaning

• Authenticity• Integrity• Freshness

o a message is not a replay of a previous message

• Scalability and Availability• Other Considerations

o Traffic analysiso Sensor data accuracy

4

Desired security properties


Security Attacks


5

Passive Attacks

Attacks

Active Attacks

Release of Message contents

Traffic analysis

Masquerade

Replay

Modification of messages

Denial of service

Attack Threads


6

• Spoofed, altered, or replayed routing information

• Selective forwarding• Sinkhole attacks• Sybil attacks

o A single nodes presents multiple identities

• Wormholes• HELLO flood attacks see illustration

Attacks against routing protocols


7

Protocol Relevant attacksTinyOS beaconing Bogus routing information, select

forwarding, sinkholes, Sybil, wormholes,HELLO floods

Directed diffusion and itsmultipath variant

Bogus routing information, selectforwarding, sinkholes, Sybil, wormholes,HELLO floods

Geographic routing(GPSR,GEAR)

Bogus routing information, selectforwarding, Sybil

Minimum cost forwarding Bogus routing information, selectforwarding, sinkholes, wormholes, HELLOfloods

Clustering basedprotocols(LEACH,TEEN,PEGASIS)

select forwarding, HELLO floods

Rumor routing Bogus routing information, selectforwarding, sinkholes, Sybil, wormholes,HELLO floods

Energy conserving topologymaintenace(SPAN,GAF,CEC,AFECA)

Bogus routing information, Sybil,HELLOfloods

8

Cryptography Review


• Symmetric ( secret key )o Shared secret

o Confusion and diffusion

o E.g., RC5, DES, AES

• Asymmetric( public key )o One-way functionso E.g., RSA, ElGamal, Elliptic-Curve

• Use of public key cryptography in a manner that takes advantage of its asymmetric nature to minimize power consumption

• Use of secret key (symmetric) cryptography within tamper-resistant sensors in a manner that efficiently emulates public key functionality (i.e., key notarization and symmetric-key certificates)

• Efficient key management techniques, including adaptive selection and use of group keying

• Use of special-purpose hardware to accelerate selected cryptographic operations

9

Cryptographic Mechanism


10

Security Services


Efficient cryptographic mechanisms

Securityservices

Auth

enti

cati

on

Confidenti

al it

y

Oth

er

Key

Managem

ent

Oth

er

PK

IEquiv

ale

nt

I nte

gri

ty

Security support services

• Provide for essential authentication, integrity, and confidentiality services• Provide security support services, including efficient sensor equivalent of a public key infrastructure (PKI)

11

Related work


• Security Considerations• Energy-Efficiency• Key Algorithm• Secure Routing• Intrusion Detection and Tolerant

• NAI Labo “Constraints and Approaches for Distributed Sensor

Network Security”

• OSUo “Security Considerations in Wireless Sensor

Networks”

• Univ. of Virginiao “Denial of Service in Sensor Networks”

12

Security Considerations


13

Review


• NAI Labs has developed novel key management protocols specifically designed for the distributed sensor network environment, including Identity-Based Symmetric Keying and Rich Uncle. They have analyzed both existing and NAI Labs-developed keying protocols for their suitability at satisfying identified requirements while overcoming battlefield energy constraints. They also implemented a sensor network simulator.o Secret-key-based protocols are generally energy-efficient o Public key algorithms consume a great deal of computational

and communications energy o group keying protocols can reduce key management and

communications energy consumption o a mix of public key-based protocols, including pairwise, group

keying, and distribution keying, provide an energy-efficiency superior to using just a single protocol

14

Review


• Denial of Service Attacks and Defenses

• Univ. of Marylando “Design Space Exploration for Energy-Efficient

Secure Sensor Network”

• Univ. of Twenteo “Assessing Security-Critical Energy-Efficient Sensor

Networks”

• NAI LABo “Energy-Efficient and Low-latency Key Management

For Sensor Networks”

15

Energy-Efficiency


16

Review


• UMDo Two observations

— Unbalanced computation load for decryption and encryption— Large variety of data processing requirement( The

forwarding messages need not be processed)o Propose dynamic voltage scaling(DVS) for energy-

efficient DSN.— DVS varies the supply voltage and clock frequency based on

the computation load to provide performance with minimal amount of energy consumption

• EYESo Propose a unified assessment framework based on

system profiles, system parameters:— Data Confidentiality— Tamper Resistance— Public Key Cryptographic Capability— Rich Uncles

• NCSUo “Efficient Distribution of Key Chain Commitments

for Broadcast Authentication in Distributed Sensor Networks”

• UMDo “A key-management scheme for distributed sensor

networks”

17

Key Algorithm


18

Review


• UMDo Pre-key distribution ( chose n keys randomly from a large k pools

at for a node and save them )o Share-key discovery ( During DSN initialization, each node

discover the neighbor nodes which can share keys )o Path-key establishment ( If the node pair cannot share keys, but

they are connected with the links in which all nodes share key, they can be assigned a key.

• UC. Berkeleyo “SPINS: Security Protocols for Sensor Networks”o “Secure Routing in Wireless Sensor Network:

Attacks and Countermeasures”

• UMBCo “Security For Sensor Network”

• UCLAo “On communication Security in Wireless Ad-Hoc

Sensor Network”

19

Secure Protocols


20

Review


• SPINS has two secure blocks: SNEP and µTESLA.o SNEP includes: data confidentiality, two-party data

authentication and evidence of data freshness– Semantic security, coding with randomized counter– Data Authentication, MAC( message authentication code)

using shared secret key– Replay authentication, MAC includes counter value– Low communication overhead, 8 bit per messages

o µTESLA provides authenticated broadcast– One way function

• UCLA communication Security Schemeo Define three types of data in sensor network, which is mobile

code, location information and application specific informationo For each of them apply for different security levels protection,

master key for mobile code, group key for location information and low overhead key for application data.

• Univ. of Colorado, Bouldero “INSENS: Intrusion-Tolerant Routing in Wireless

Sensor networks”

• Palo Alto Research Center o Jessica Staddon, Dirk Balfanz and Glenn Durfee.

“Efficient tracing of failed nodes in sensor networks”

21

Intrusion Detection and Tolerant


22

Review


• Intrusion toleranceo Constrain the type of commutations. Individual nodes are

not allowed to broadcast to the entire networko Prevent advertisement of false routing data. Control

routing information must be authenticatedo Symmetric key is choseno Redundant multipath routing is built into the system to

achieve secure routing

• Intrusion Detection ( tracing the false nodes)o Base station need know near neighbors of each nodeo Establish network topologyo Subdivision-Based tracing

23

Research Fields

• Security under resource constraints, e.g., energy, bandwidth, memory, and computation constraints; • Key management;• Authentication and access control; • Intrusion detection and tolerance;• Secure location services;


24

Research Fields (Cont.)

• Trust establishment, negotiation, and management;• Privacy and anonymity; • Secure routing; • Secure MAC protocols;• Denial of service; • Prevention of traffic analysis;


25

Future Topics

• Introduction to Cryptography

• Overview of Ad hoc Network Security

• Introduction to Intrusion Detection System

• Overview of routing protocols in Sensor Network

• Key Exchange, Distribution and management

• Security in Mobile Agent

• Sensor Network Simulation


26

Reference

• [1] D. W. Carman, P. S. Kruus and B. J. Matt. “Constraints and Approaches for Distributed Sensor Network Security”. dated September 1, 2000. NAI Labs Technical Report #00-010• [2] Adrian Perrig, Robert Szewczyk, Victor Wen, David Culler, J. D. Tygar. “SPINS: Security Protocols for Sensor Networks”, in Wireless Networks Journal (WINE), September 2002• [3] Prabal K. Dutta, “Security Considerations in Wireless Sensor Networks”, Sensors Expo, San Jose, CA • [4] Sasha Slijepcevic, Miodrag Potkonjak,Vlasios Tsiatsis, Scott Zimbeck, Mani B. Srivastava. “On communication Security in Wireless Ad-Hoc Sensor Network” Eleventh IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE'02) June 10 - 12, 2002 Pittsburgh, Pennsylvania, USA • [5] Chris Karlof and David Wagner, “Secure Routing in Wireless Sensor Networks: Attacks and Countermeasures”, to appear First IEEE International Workshop on Sensor Network Protocols and Applications, May 2003 • [6] Anthony D. Wood, John A. Stankovic. “Denial of Service in Sensor Networks”. IEEE Computer, 35(10):54-62, 2002• [7] Lin Yuan, Gang Qu. “Design Space Exploration for Energy-Efficient Secure Sensor Network”. The IEEE International Conference on Application-Specific Systems, Architectures, and Processors (ASAP'02) July 17 - 19, 2002 San Jose, California


27

Reference(Cont.)

• [8] Jeffery Undercoffer, Sasikanth Avancha, Anupam Joshi, and John Pinkston, “Security for Sensor Networks”2002 CADIP Research Symposium.• [9] Donggang Liu and Peng Ning “Efficient Distribution of Key Chain Commitments for Broadcast Authentication in Distributed Sensor Networks”, The 10th Annual Network and Distributed System Security Symposium. San Diego, California. February 2003• [10] Adrian Perrig, Robert Szewczyk, Victor Wen, David Culler, J. D. Tygar. “SPINS: Security Protocols for Sensor Networks”. in Proceedings of Seventh Annual International Conference on Mobile Computing and Networks MOBICOM 2001, July 2001• [11] Adrian Perrig, Robert Szewczyk, Victor Wen, Alec Woo. “Security for SmartDust Sensor Network”• [12] Stavan Parikh, Tracy Barger, David Friedman “ Security in Sensor Network”, lecture of CS 588 Cryptography, Dec. 2001• [13] Jessica Staddon, Dirk Balfanz and Glenn Durfee. “ Efficient tracing of failed nodes in sensor networks”. In Proceedings of the first ACM international workshop on Wireless sensor networks and applications (WSNA), pages 122-130, ACM Press, 2002


Illustration


28

HELLO flooding

Warmhole and sinkhole

Spoofing

Sybil

Overview of Sensor Network Security Yang Liu Graduate student, University of Tennessee 2003 spring group seminar.

Documents

spring group seminar

confidentiality o

security attacks

diffusion o

sensor nodes o denial

spring group seminar

secret o confusion

wireless communication