Security in Mobile Wireless Sensor Networks – A Survey <s> E. Access Privacy <s> Automation of the way we pay for goods and services is already underway, as can be seen by the variety and growth of electronic banking services available to consumers. The ultimate structure of the new electronic payments system may have a substantial impact on personal privacy as well as on the nature and extent of criminal use of payments. Ideally a new payments system should address both of these seemingly conflicting sets of concerns. <s> BIB001 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> E. Access Privacy <s> We present Greedy Perimeter Stateless Routing (GPSR), a novel routing protocol for wireless datagram networks that uses the positions of routers and a packet's destination to make packet forwarding decisions. GPSR makes greedy forwarding decisions using only information about a router's immediate neighbors in the network topology. When a packet reaches a region where greedy forwarding is impossible, the algorithm recovers by routing around the perimeter of the region. By keeping state only about the local topology, GPSR scales better in per-router state than shortest-path and ad-hoc routing protocols as the number of network destinations increases. Under mobility's frequent topology changes, GPSR can use local topology information to find correct new routes quickly. We describe the GPSR protocol, and use extensive simulation of mobile wireless networks to compare its performance with that of Dynamic Source Routing. Our simulations demonstrate GPSR's scalability on densely deployed wireless networks. <s> BIB002 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> E. Access Privacy <s> The owner and users of a sensor network may be different, which necessitates privacy-preserving access control. On the one hand, the network owner need enforce strict access control so that the sensed data are only accessible to users willing to pay. On the other hand, users wish to protect their respective data access patterns whose disclosure may be used against their interests. This paper presents DP 2 AC, a Distributed Privacy- Preserving Access Control scheme for sensor networks, which is the first work of its kind. Users in DP 2 AC purchase tokens from the network owner whereby to query data from sensor nodes which will reply only after validating the tokens. The use of blind signatures in token generation ensures that tokens are publicly verifiable yet unlinkable to user identities, so privacy- preserving access control is achieved. A central component in DP 2 AC is to prevent malicious users from reusing tokens. We propose a suite of distributed techniques for token-reuse detection (TRD) and thoroughly compare their performance with regard to TRD capability, communication overhead, storage overhead, and attack resilience. The efficacy and efficiency of DP 2 AC are confirmed by detailed performance evaluations. <s> BIB003 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> E. Access Privacy <s> Existing mechanisms for querying wireless sensor networks leak client interests to the servers performing the queries. The leaks are not only in terms of specific regions of interest but also of client access patterns. In this article we introduce the problem of preserving the privacy of clients querying a wireless sensor network owned by untrusted organizations. We first propose an efficient protocol, SPYC, that ensures full client privacy in settings where the servers providing access to the network are honest-but-curious and whose collaboration does not extend beyond well-defined administrative purposes. Furthermore, we study the same query privacy problem in a setting where servers exhibit malicious behavior or where powerful external attackers have access to sensor network traffic information. In this setting we propose two metrics for quantifying the privacy achieved by a client's query sequence. We then extend SPYC with a suite of practical algorithms, then analyze the privacy and efficiency levels they provide. Our TOSSIM simulations show that the proposed extensions are communication efficient while significantly improving client privacy levels. <s> BIB004
In some scenarios (such as ORION [60] , NOPP [61] and IOOS [62] ), owners and users of the sensor networks are different. To compensate for the cost of operating and maintenance, the owner of a network may enforce access control that only authorized users can access the sensed data. In particular, users may want to keep their privacy when accessing the sensed data in which they are interested, or from which nodes the data is obtained. For instance, an oil company interested in the data of an ocean sensor network [60] -[62] may want to hide its network regions of interest from both the owner and other users of the network (who might be potential business competitors BIB004 ). To guarantee access privacy of network users, the authors in BIB004 have proposed target-region mix schemes such as uniform, randomized and hybrid transformation, which mix the target-region of the query based on predefined mix functions. The basic idea is to hide the targetregion by mapping the target-region into k regions, such that the target-region is hided in the k regions where the owner and other users of the network cannot distinguish the target-region from the other uninteresting regions. In the Union Transform (UT), the target-region of query is transformed into a set of regions. Then, the set of regions is sent to the based station instead of the target-region. The base station answers the data of region in the set. Consequently, it only knows that the target-region of the user is included in the set, but cannot distinguish it from other regions. For example, assuming that R = (R 1 , R 2 , · · · , R k ) is a set of regions, the whole set of regions is sent to the base station to query data if the user wants to query the data from one region R i ∈ R. In the Randomized Transform (RT), the user also sends a set of regions to the base station, instead of the target-region. However, the difference is that the set which consists of regions is selected randomly rather than pre-defined in UT. The Hybrid Transform (HT) is a combination of UT and RT. To the best of our knowledge, BIB004 is the first publication that takes into consideration the access privacy of network users in WSNs. However, the scenarios where network users query data via one or several base stations do not exist in MWSNs and thus the scheme proposed in BIB004 is not suitable for MWSNs. The authors in BIB003 have proposed a Distributed Privacy-Preserving Access Control (DP 2 AC) scheme that considers a MWSN scenario where the base station may or may be not available. DP 2 AC enables to disconnect the mapping between a user's identity and the query of the user by using the blind signature BIB001 . A user who wants to access the network needs to buy some tokens from the network owner with blind signatures. If the user wants to access the network, she needs to send the pre-purchased tokens to the network for obtaining the access rights. Let us consider Alice as an example. After purchasing tokens from the network owner, Alice can query data from any sensor node, denoted as node A. When node A receives a token, it first checks whether the token is valid, then grants the access right to Alice if it is valid. Moreover, since the validation of the token is verified by checking the signature of the network owner, the token can still be checked as a valid token if it is used before. To prevent token reuse, the authors in BIB003 have also proposed a group of four schemes for Token-Reuse Detection (TRD). They begin by describing a network-wide flooding scheme called Scheme 1 in their paper in which each node is its own witness and records all the tokens that have been used by itself or by others. To reduce large storage overhead, each node has to store a replication of the used token, and to reduce large communication overhead caused by flooding, a Randomized Mapping scheme (called Scheme 2) has been proposed. In this scheme, upon receiving a token T , node A sends a TRD request including T to β witness selected nodes using a geographic routing scheme such as GPSR BIB002 . Since the results of Scheme 2 are unsatisfactory, they have proposed a Randomized Mapping Plus (called Scheme 3), which allows each node within the transmission range of its forwarding path and thus can overhear the TRD request sent by node A, to return a TR alarm to A if it stores T . Compared with Scheme 2, the TRD probability of Scheme 3 is improved significantly for the same β without additional storage cost. However, with regard to both Scheme 2 and Scheme 3, there is a tradeoff between the TRD probability and storage overhead as well as communication overhead. The larger the β, the higher the TDR probability and the larger storage and communication overhead. Thus, they have further proposed a Double Ruling (DR) scheme without the aforementioned limitations (called Scheme 4), which is motivated by the DR  techniques. The basic idea of DR is storing the sensed data along a continuous curve, called replication curve that follows the horizontal line, instead of storing data replication in one or several isolated nodes. As regards network users, they query data along the other continuous curve (called query curve) that follows a vertical line. The data can be retrieved if the two curves intersect. Let us consider a simple case. Assume the network is a two-dimensional grid (see Fig. 6 ). The token storage curves follow the horizontal lines (red/dark line). The TRD request travels alone the query curves that follow the vertical lines (blue/gray line). Suppose that Alice wants to reuse token T at node A. Upon receiving T , node A sends a TRD request traveling alone the blue line in both up and down directions. When the query curve hits the replication curve, the intersect node can send a TR alarm to node A. Consequently, Alice fails to reuse token T .