Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> Our motivation is the notion of ``timed-release crypto,'''' where the goal is to encrypt a message so that it can not be decrypted by anyone, not even the sender, until a pre-determined amount of time has passed. The goal is to ``send information into the future.'''' This problem was first discussed by Timothy May \cite{May93}. What are the applications of ``timed-release crypto''''? Here are a few possibilities (some due to May): A bidder in an auction wants to seal his bid so that it can only be opened after the bidding period is closed. A homeowner wants to give his mortgage holder a series of encrypted mortgage payments. These might be encrypted digital cash with different decryption dates, so that one payment becomes decryptable (and thus usable by the bank) at the beginning of each successive month. An individual wants to encrypt his diaries so that they are only decryptable after fifty years. A key-escrow scheme can be based on timed-release crypto, so that the government can get the message keys, but only after a fixed period (say one year). \ There are presumably many other applications. There are two natural approaches to implementing timed-release crypto: Use ``time-lock puzzles''''--computational problems that can not be solved without running a computer continuously for at least a certain amount of time. Use trusted agents who promise not to reveal certain information until a specified date. Using trusted agents has the obvious problem of ensuring that the agents are trustworthy; secret-sharing approaches can be used to alleviate this concern. Using time-lock puzzles has the problem that the CPU time required to solve a problem can depend on the amount and nature of the hardware used to solve the problem, as well as the parallelizability of the computational problem being solved. In this note we explore both approaches. (We note that Tim May has suggested an approach based on the use of trusted agents.) <s> BIB001 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> As sensor networks edge closer towards wide-spread deployment, security issues become a central concern. So far, much research has focused on making sensor networks feasible and useful, and has not concentrated on security. We present a suite of security building blocks optimized for resource-constrained environments and wireless communication. SPINS has two secure building blocks: SNEP and μTESLA SNEP provides the following important baseline security primitives: Data confidentiality, two-party data authentication, and data freshness. A particularly hard problem is to provide efficient broadcast authentication, which is an important mechanism for sensor networks. μTESLA is a new protocol which provides authenticated broadcast for severely resource-constrained environments. We implemented the above protocols, and show that they are practical even on minimal hardware: the performance of the protocol suite easily matches the data rate of our network. Additionally, we demonstrate that the suite can be used for building higher level protocols. <s> BIB002 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> In this paper, we describe LEAP (Localized Encryption and Authentication Protocol), a key management protocol for sensor networks that is designed to support in-network processing, while at the same time restricting the security impact of a node compromise to the immediate network neighborhood of the compromised node. The design of the protocol is motivated by the observation that different types of messages exchanged between sensor nodes have different security requirements, and that a single keying mechanism is not suitable for meeting these different security requirements. LEAP supports the establishment of four types of keys for each sensor node -- an individual key shared with the base station, a pairwise key shared with another sensor node, a cluster key shared with multiple neighboring nodes, and a group key that is shared by all the nodes in the network. The protocol used for establishing and updating these keys is communication- and energy-efficient, and minimizes the involvement of the base station. LEAP also includes an efficient protocol for inter-node traffic authentication based on the use of one-way key chains. A salient feature of the authentication protocol is that it supports source authentication without precluding in-network processing and passive participation. We analyze the performance and the security of our scheme under various attack models and show our schemes are very efficient in defending against many attacks. <s> BIB003 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> Broadcast authentication is a fundamental security service in distributed sensor networks. A scheme named $\mu$TESLA has been proposed for efficient broadcast authentication in such networks. However, $\mu$TESLA requires initial distribution of certain information based on unicast between the base station and each sensor node before the actual authentication of broadcast messages. Due to the limited bandwidth in wireless sensor networks, this initial unicast-based distribution severely limits the application of $\mu$TESLA in large sensor networks. This paper presents a novel technique to replace the unicast-based initialization with a broadcast-based one. As a result, $\mu$TESLA can be used in a sensor network with a large amount of sensors, as long as the message from the base station can reach these sensor nodes. This paper further explores several techniques that improve the performance, the robustness, as well as the security of the proposed method. The resulting protocol satisfies several nice properties, including low overhead, tolerance of message loss, scalability to large networks, and resistance to replay attacks as well as some known Denial of Service (DOS) attacks. <s> BIB004 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> Sensor networks are often deployed in unattended environments, thus leaving these networks vulnerable to false data injection attacks in which an adversary injects false data into the network with the goal of deceiving the base station or depleting the resources of the relaying nodes. Standard authentication mechanisms cannot prevent this attack if the adversary has compromised one or a small number of sensor nodes. In this paper, we present an interleaved hop-by-hop authentication scheme that guarantees that the base station will detect any injected false data packets when no more than a certain number t nodes are compromised. Further, our scheme provides an upper bound B for the number of hops that a false data packet could be forwarded before it is detected and dropped, given that there are up to t colluding compromised nodes. We show that in the worst case B is O(t/sup 2/). Through performance analysis, we show that our scheme is efficient with respect to the security it provides, and it also allows a tradeoff between security and performance. <s> BIB005 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> We introduce a short signature scheme based on the Computational Diffie–Hellman assumption on certain elliptic and hyperelliptic curves. For standard security parameters, the signature length is about half that of a DSA signature with a similar level of security. Our short signature scheme is designed for systems where signatures are typed in by a human or are sent over a low-bandwidth channel. We survey a number of properties of our signature scheme such as signature aggregation and batch verification. <s> BIB006 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> We describe LEAPp (Localized Encryption and Authentication Protocol), a key management protocol for sensor networks that is designed to support in-network processing, while at the same time restricting the security impact of a node compromise to the immediate network neighborhood of the compromised node. The design of the protocol is motivated by the observation that different types of messages exchanged between sensor nodes have different security requirements, and that a single keying mechanism is not suitable for meeting these different security requirements. LEAPp supports the establishment of four types of keys for each sensor node: an individual key shared with the base station, a pairwise key shared with another sensor node, a cluster key shared with multiple neighboring nodes, and a global key shared by all the nodes in the network. LEAPp also supports (weak) local source authentication without precluding in-network processing. Our performance analysis shows that LEAPp is very efficient in terms of computational, communication, and storage costs. We analyze the security of LEAPp under various attack models and show that LEAPp is very effective in defending against many sophisticated attacks, such as HELLO flood attacks, node cloning attacks, and wormhole attacks. A prototype implementation of LEAPp on a sensor network testbed is also described. <s> BIB007 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> We present the first aggregate signature, the first multisignature, and the first verifiably encrypted signature provably secure without random oracles. Our constructions derive from a novel application of a recent signature scheme due to Waters. Signatures in our aggregate signature scheme are sequentially constructed, but knowledge of the order in which messages were signed is not necessary for verification. The aggregate signatures obtained are shorter than Lysyanskaya et al. sequential aggregates and can be verified more efficiently than Boneh et al. aggregates. We also consider applications to secure routing and proxy signatures. <s> BIB008 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> Wireless sensors are employed in a wide range of applications. One common feature of many sensor settings is the need to communicate sensed data to some collection point or sink. This communication can be direct (to a mobile collector) or indirect-via other sensors towards a remote sink. In either case, a sensor might not be able to communicate to a sink at will. Instead it might collect data and wait (for a potentially long time) for a signal to upload accumulated data directly. In a hostile setting, a sensor may be compromised and its post-compromise data can be manipulated. One important issue is forward security - how to ensure that pre- compromise data cannot be manipulated? Since a typical sensor is limited in storage and communication facilities, another issue is how to minimize resource consumption by accumulated data. It turns out that current techniques are insufficient to address both challenges. To this end, we explore the notion of forward-secure sequential aggregate (FssAgg) authentication schemes. We consider FssAgg authentication schemes in the contexts of both conventional and public key cryptography and construct a FssAgg MAC scheme and a FssAgg signature scheme, each suitable under different assumptions. This work represents the initial investigation of forward-secure aggregation and, although the proposed schemes are not optimal, we believe it opens a new direction for follow-on research. <s> BIB009 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Authentication (Countermeasures against Search-andReplace ADV) <s> Unattended Wireless Sensor Networks (UWSNs) operating in hostile environments face great security and performance challenges due to the lack of continuous real-time communication between senders (sensors) and receivers (e.g., mobile data collectors, static sinks). The lack of real-time communication forces sensors to accumulate the sensed data possibly for long time periods, along with the corresponding signatures for authentication purposes. Moreover, non-real-time characteristic of UWSNs makes sensors vulnerable especially to active adversaries, which compromise sensors and extract all data stored in them. Hence, it is critical to have forward security property such that even if the adversary can compromise the current keying materials, she cannot modify or forge authenticated data generated before the node compromise. Forward secure and aggregate signatures are cryptographic primitives developed to address these issues. Unfortunately, existing forward secure and aggregate signature schemes either impose substantial computation and storage overhead, or do not allow public verifiability, thereby impractical for resource-constrained UWSNs. In order to address these problems, we propose a new class of signature schemes, which we refer to as Hash-Based Sequential Aggregate and Forward Secure Signature (HaSAFSS). Such a scheme allows a signer to sequentially generate a compact, fixed-size, and publicly verifiable signature at a nearly optimal computational cost. We propose two HaSAFSS schemes, Symmetric HaSAFSS (Sym-HaSAFSS) and Elliptic Curve Cryptography (ECC) based HaSAFSS (ECC-HaSAFSS). Both schemes integrate the efficiency of MAC-based aggregate signatures and the public verifiability of bilinear map based signatures by preserving forward security via Timed-Release Encryption (TRE). We demonstrate that our schemes are secure under appropriate computational assumptions. We also show that our schemes are significantly more efficient in terms of both computational and storage overheads than previous schemes, and therefore quite practical for even highly resource-constrained UWSN applications. <s> BIB010
In traditional WSNs, schemes BIB002 - BIB003 were proposed to provide data (sensor) authentication. However asymmetric cryptographic mechanisms are too costly for resource constrained sensor networks. To address this problem, the authors in BIB002 proposed the µTESLA protocol that introduces asymmetry through a delayed disclosure of symmetric keys and one-way function key chains, resulting in an efficient broadcast authentication scheme. In BIB004 authors improved the µTESLA key distribution efficiency by using predetermined and broadcast initial parameters of the µTESLA instead of unicast-based initial key chain distribution, thus the requirement of unicastbased initial communication between sensor nodes and base station to save communication overhead in largescale WSNs is removed. This is because if a node wants to broadcast information in the µTESLA, it must first firstly send the information to the base station, and then the base station broadcasts the information. This procedure causes in turn a great deal of communication overhead between base station and sensor nodes and is not suitable for local broadcast authentication. The authors in BIB003 , BIB007 have proposed an efficient protocol for providing local broadcast authentication based on the use of oneway key chains to solve the problems in the µTESLA. To prevent false data injection attacks in WSNs, the authors in BIB005 enable the base station to verify authenticity of a received report as long as the number of compromised nodes is fewer than a certain threshold value. However, the schemes mentioned above are not suitable for MWSNs since sink (or base station) is not always present in this case. Furthermore, due to the absence of real-time communication between sensors and sinks, sensors are forced to accumulate data along with their authentication information till the next visit of a mobile sink to offload the data. The authentication information per data is not a storage issue in traditional WSNs because sensors can send data alone with the authentication information to a base station either at will or at brief intervals, which would not cause much storage overhead, whereas in MWSNs, computing authentication tags per sensed unit of data may cause high storage overhead, and the cost increases along with the mobile sink visiting time interval. Moreover, in order to provide reasonable security requirements, a minimum number like 128 bits per MAC (or 320 bits per signature) is needed. Consequently, the size of the authentication tag may easily exceed the size of sensed data. Thus, how to solve the storage overhead of authentication accumulated tag is a challenging task in MWSNs. In addition, if a sensor is compromised, its secret key used for MACs or signatures is exposed as well. An ADV holding a secret key can easily produce falsely sensed data after the compromise, and also produce fraudulent data before the compromise, if the data has not been off-loaded to a sink. Therefore, another issue is how to provide forward secrecy. To reduce the storage overhead of authentication tags as well as provide data (or sensor) authentication and forward secrecy, the authors in BIB009 explore Forward secure sequential Aggregate (FssAgg) authentication schemes BIB006 - BIB008 to construct an FssAgg-MAC scheme and an FssAgg-signature scheme, which allows a signer to combine multiple authentication tags generated in different key/time periods into a single constant-size tag. Consequently, the storage overhead of accumulated authentication tags is reduced significantly. However, although computational efficiency is achieved through hash chains and symmetric key distribution, FssAgg-MAC still requires high storage overhead, and its signature cannot be publicly verified. To achieve computational efficiency, forward secrecy and public verifiability, the authors in BIB010 proposed a new class of digital signature schemes for MWSNs, which is called Hash-based Sequential Aggregate and Forward Secure Signatures (HaSAFSS) by introducing asymmetry between the senders (sensors) and receivers (mobile sinks) with the aid of Timed-Release Encryption (TRE) BIB001 . The property of TRE is to encrypt data that no party including the intended receivers (mobile sinks) can decrypt it until a predefined future time. Thus, even if the sender (sensor) is compromised, such property can still provide forward secrecy and aggregate signature in a publicly verifiable way. Based on the difference of keys (time trapdoor key, per-interval key and per-data item key) generation, HaSAFSS can be further classified into two schemes, a symmetric HaSAFSS scheme (Sym-HaSAFSS) and an Elliptic Curve Cryptography (ECC)-based HaSAFSS scheme. Sym-HaSAFSS and ECC-HaSAFSS are complementary to each other with respect to storage overhead of computing these keys. In Sym-HaSAFSS, each sender (sensor) initially stores R encrypted keys, which each receiver (mobile sink) stores only one key. In contrast, in ECC-HaSAFSS, each sender stores only one key and the sender can compute its own session keys after the deployment based on the fact that each receiver stores R public keys for each sender.