Li Tie Yan

1
Flagship project SmartCondo-gtSecureSensor
Security in Sensor network (A preview)
Li Tie Yan InfoComm Security Department
(ICSD) Institute for Infocomm Research
(I2R) 10th, Jun. 2004
2
Outline

• Objective
• Security architecture
• Practical issues
• Light weight crypto-algorithms
• Secure (robust) routing protocols
• Research issues
• Security (attacks) analysis on distributed
  sensor network
• Key management schemes for distributed sensor
  network
• Other issues
• Secure location (context aware security)
• Secure data fusion (secure information
  aggregation)
• Schedule

3
Objective
There are rich design proposals on securing
(distributed) sensor networks as well as
practical appliances, however we have relatively
less experience on pragmatic security issues.

• Practically, we will build strong (enough)
  security for the current project. For example, we
  may study the security requirements of the
  current project. Based on that, we design
  security architecture and develop relevant
  security protocols and tools of ensuring
  communication security, network security and
  application security.
• Theoretically, we will study potential research
  issues beyond the current solution. Briefly, we
  focus on dynamic, large scale of sensor networks
  and the Sybil or DoS attacks on them. We also
  investigate location aware security and data
  fusion security.

4
Security architecture
5
Practical issues

• Light weight crypto-algorithms
• Goal Point-to-Point authentication and
  encryption not relying on hardware.
• Constraint Based on TinyOS of Berkeley Mote
  (Mica Motes feature a 4MHz processor, 128K of
  program space 4k RAM, 36 byte packets, and
  run on 2 AA batteries).
• Light-weight Less overhead per packet
  (conventionally, the overhead is 16 byte).
• Assumption Keys are pre-distributed and shared
  by sensors (simplest solution).
• Analysis Cryptanalysis, attack analysis
• Attacks TinyOS Bless protocols (suffer Bogus
  routing information, selective forwarding,
  sinkholes, Sybil, wormholes, HELLO floods)

• Related works
• 802.15.4, New standard supported by ChipCon
  2240.
• TinySec, Link layer encryption mechanism of U.C.
  Berkeley

6
Practical issues (I)
Secure routing protocol
TinyOS active message
Light Weight Crypto-algorithms
AM
len
data
MAC
IV
dest
Key Differences No CRC -2 bytes No group ID
-1 bytes MAC 4 bytes IV 4 bytes Total
5 bytes
7
Practical issues (II)

• Secure routing protocol
• TinyOS Bless protocols (suffer Bogus routing
  information, selective forwarding, sinkholes,
  Sybil, wormholes, HELLO floods)

• Wormhole attack
• Tunnel packets from one part of the network and
  replay them in a different part.

• Hello flood attack
• Broadcast really loudly then everyone will think
  you are near them.

8
Research issues

• Attacks on sensor networks
• Denial of Service, by Wood et al. in IEEE
  Computer2002.
• Routing security, by Karlof et al. in 1st IEEE
  workshop SNPA03.
• Sybil attack, by Newsome et al. in ACM IPSN04.
• Key management schemes
• Key management, by Eschenauer et al. in ACM
  CCS02.
• SPINS, by Perrig et al. in Wireless Networks
  Journal (WINE), 2002.
• Random Key Assignment, by pietro et al. in ACM
  SASN '03.
• Establishing Pairwise Keys, by Liu et al. in ACM
  CCS03.
• LEAP, by Zhu et al. in proc. of ACM CCS03.
• Pairwise Key Pre-distribution, by Du et al. in
  ACM CCS03.
• Random Key Predistribution, by Chan et al. in
  IEEE SP03
• Deployment knowledge, by Du et al. in IEEE
  INFOCOM'04.

9
Other issues

• Location aware security (a problem of context
  aware security)
• Privacy-Aware Location, Gruteser et al. in
  USENIX HOTOS IX, 2003.
• Location-Based Pairwise Key Establishments, Liu
  et al. in ACM SASN '03.
• Location claims, by Sastry et al. in ACM
  WiSe03.
• Data fusion security (a problem known as False
  data injection)
• SIA, by Przydatek et al. in proc. of ACM
  SenSys03.
• Secure aggregation, by Hu et al. in workshop on
  security and assureance in Ad hoc Networks, 2003.
  
• Witeness, by Du et al. in proc. of IEEE
  GLOBECOM03.
• SEF, by Ye et al. in proc. of IEEE INFOCOM04.
• Integrity protection, by Vogt et al. in
  technical report no. 434, ETH Zrich.
• IHA, by Zhu et al. in proc. of IEEE SP04.
• uTESLA, by Perrig et al. in proc. of ACM
  Mobicom01.
• LEAP, by Zhu et al. in proc. of ACM CCS03.

Authentication based
10
Challenges

• Software only cryptography (best balance of
  security and performance)
• Efficient key management (support random key
  pre-distribution, PKC)
• Robust multi-hop routing protocols (against node
  compromise DoS attacks)
• Location aware security (or context aware
  security)
• Secure and resilient aggregation (towards False
  data injection)

11
Schedule
12
Website
http//www.i2r.a-star.edu.sg/icsd/SecureSensor/
Thank you! Q A