Security in Mobile Wireless Sensor Networks – A Survey <s> B. Data Survival (Countermeasures against Search-andErase ADV) <s> Unattended sensor networks operating in hostile environments might collect data that represents a high-value target for the adversary. The unattended sensor's inability to off-load - in real time - sensitive data to a safe external entity makes it easy for the adversary to mount a focused attack aimed at eliminating certain target data. In order to facilitate survival of this data, sensors can collectively attempt to confuse the adversary by changing its location and content, i.e., by periodically moving the data around the network and encrypting it. In this paper, we focus on data survival in unattended sensor networks faced with an adversary intent on surgically destroying data which it considers to be of high value. After motivating the problem and considering several attack flavors, we propose several simple techniques and provide their detailed evaluation. <s> BIB001 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> B. Data Survival (Countermeasures against Search-andErase ADV) <s> In recent years, wireless sensor networks (WSNs) have been a very popular research topic, offering a treasure trove of systems, networking, hardware, security, and application-related problems. Much of prior research assumes that the WSN is supervised by a constantly present sink and sensors can quickly offload collected data. In this paper, we focus on unattended WSNs (UWSNs) characterized by intermittent sink presence and operation in hostile settings. Potentially lengthy intervals of sink absence offer greatly increased opportunities for attacks resulting in erasure, modification, or disclosure of sensor-collected data. This paper presents an in-depth investigation of security problems unique to UWSNs (including a new adversarial model) and proposes some simple and effective countermeasures for a certain class of attacks. <s> BIB002 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> B. Data Survival (Countermeasures against Search-andErase ADV) <s> Some sensor network settings involve disconnected or unattended operation with periodic visits by a mobile sink. An unattended sensor network operating in a hostile environment can collect data that represents a high-value target for the adversary. Since an unattended sensor can not immediately off-load sensed data to a safe external entity (such as a sink), the adversary can easily mount a focused attack aiming to erase or modify target data. To maximize chances of data survival, sensors must collaboratively attempt to mislead the adversary and hide the location, the origin, and the contents of collected data. In this paper, we focus on applications of well-known security techniques to maximize chances of data survival in unattended sensor networks, where sensed data can not be off-loaded to a sink in real time. Our investigation yields some interesting insights and surprising results. The highlights of our work are: (1) thorough exploration of the data survival challenge, (2) exploration of the design space for possible solutions, (3) construction of several practical and effective techniques, and (4) their evaluation. <s> BIB003
Let us consider a scenario where a network of nuclear emission sensors are deployed in a recalcitrant country (under an international treaty) in order to monitor any potential nuclear activity BIB001 . If one of the sensors senses a value above a certain threshold, the sink can raise an alarm to report the emission. An adversary might want to find that value and erase it before it reaches the sink. This adversary, as discussed in Section III-C, is called Search-and-Erase ADV. If the network can tolerate some missing measurements (due to message failure or lost communication), the Search-and-Erase ADV remains undetected even if it succeeds. In BIB001 , later extended in BIB002 , the authors target a Search-and-Erase ADV to propose countermeasures. Recall that the main threat of a Search-and-Erase ADV is to prevent certain target data from reaching the sink. In other words, the idea of countermeasure can be simply described as how to keep the certain target data survival. Based on the idea described above, BIB001 proposed three data survival strategies: DO-NOTHING, MOVE-ONCE, and KEEP-MOVING. • DO-NOTHING. In this strategy, sensors do nothing about their sensed data. That is sensors just simply leave the data to reside in the sensor that collected it and wait for the sink. In this case, the Search-andErase ADV can find the target sensor quickly and erase the target data. • MOVE-ONCE. In this strategy, sensors move their data once and only once right after their data collection. The data will stay in their new home until the next sink visits. • KEEP-MOVING. Sensors move data continuously, i.e., at each round, each sensor re-allocates the data to another randomly selected sensor. To analyze data survival probability, the authors have further proposed three attack strategies of the Search-andErase ADV as follows: • LAZY. The ADV is LAZY in the sense that the ADV satisfies with its current compromised k sensors, and does not want to further compromise other k sensors. • FRANTIC. It is only in extreme cases that ADV compromises k randomly selected sensors at each round. • SMART. ADV first selects two sets of sensors, each of size k, and then simply alternates control between these two sets at each round. At the first glance, we may have the impression that DO-NOTHING is the worst choice listed above, and KEEP-MOVING is the best one to keep target data survival since it is more difficult for ADV to catch the target data if it is moving continuously. However, this supposition is not true. After completing a detailed analysis comparing the survival strategies of target data and attack strategies of ADV, the authors have produced the analysis results (as shown in Table II ). It is surprising that DO-NOTHING is the best choice if ADV's attack strategy is LAZY and SMART. For the ADV, a "NO" label in a table cell implies that the corresponding combination of data survival and attack strategies is not sensible, whereas a "YES" label means that the corresponding combination is viable. Although sensors may play a hide-and-seek game by moving all data around the network BIB001 , BIB002 , BIB003 , this is ultimately a losing game, unless cryptography is used BIB003 . The authors in BIB003 apply cryptography in the context of data survival in unattended WSNs. By comparing with symmetric encryption and public key encryption, the result shows that simple cryptographic schemes coupled with data mobility strategies can be of great help in providing data survival, and demonstrates that there is no security advantage in using public key (over symmetric) cryptography.