Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> One of the most notable challenges threatening the successful deployment of sensor systems is privacy. Although many privacy-related issues can be addressed by security mechanisms, one sensor network privacy issue that cannot be adequately addressed by network security is source-location privacy. Adversaries may use RF localization techniques to perform hop-by-hop traceback to the source sensor's location. This paper provides a formal model for the source-location privacy problem in sensor networks and examines the privacy characteristics of different sensor routing protocols. We examine two popular classes of routing protocols: the class of flooding protocols, and the class of routing protocols involving only a single path from the source to the sink. While investigating the privacy performance of routing protocols, we considered the tradeoffs between location-privacy and energy consumption. We found that most of the current protocols cannot provide efficient source-location privacy while maintaining desirable system performance. In order to provide efficient and private sensor communications, we devised new techniques to enhance source-location privacy that augment these routing protocols. One of our strategies, a technique we have called phantom routing, has proven flexible and capable of protecting the source's location, while not incurring a noticeable increase in energy overhead. Further, we examined the effect of source mobility on location privacy. We showed that, even with the natural privacy amplification resulting from source mobility, our phantom routing techniques yield improved source-location privacy relative to other routing methods <s> BIB001 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> Wireless sensor networks are often constructed as asymmetric networks comprised of a large number of small, resource-constrained sensor nodes and a small number of relatively powerful base stations. A base station is vulnerable as a central point of failure in such networks. Typical packet traffic in a sensor network reveals pronounced patterns that allow an adversary analyzing packet traffic to deduce the location of a base station, which can then be disabled or destroyed. This paper investigates multiple antitraffic analysis techniques aimed at disguising the location of a base station. First, a degree of randomness is introduced in the multi-hop path a packet takes from a sensor node to a base station. Second, random fake paths are introduced to confuse an adversary from tracking a packet as it moves towards a base station. Finally, multiple, random areas of high communication activity are created to deceive an adversary as to the true location of the base station. The paper evaluates these techniques analytically and via simulation using three evaluation criteria: total entropy of the network, total energy consumed, and the ability to guard against heuristic-based techniques to locate a base station. <s> BIB002 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> Typical packet traffic in a sensor network reveals pronounced patterns that allow an adversary analyzing packet traffic to deduce the location of a base station. Once discovered, the base station can be destroyed, rendering the entire sensor network inoperative, since a base station is a central point of data collection and hence failure. This paper investigates a suite of decorrelation countermeasures aimed at disguising the location of a base station against traffic analysis attacks. A set of basic countermeasures is described, including hop-by-hop reencryption of the packet to change its appearance, imposition of a uniform packet sending rate, and removal of correlation between a packet's receipt time and its forwarding time. More sophisticated countermeasures are described that introduce randomness into the path taken by a packet. Packets may also fork into multiple fake paths to further confuse an adversary. A technique is introduced to create multiple random areas of high communication activity called hot spots to deceive an adversary as to the true location of the base station. The effectiveness of these countermeasures against traffic analysis attacks is demonstrated analytically and via simulation using three evaluation criteria: total entropy of the network, total overhead/energy consumed, and the ability to frustrate heuristic-based search techniques to locate a base station. <s> BIB003 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> While many protocols for sensor network security provide confidentiality for the content of messages, contextual information usually remains exposed. Such information can be critical to the mission of the sensor network, such as the location of a target object in a monitoring application, and it is often important to protect this information as well as message content. There have been several recent studies on providing location privacy in sensor networks. However, these existing approaches assume a weak adversary model where the adversary sees only local network traffic. We first argue that a strong adversary model, the global eavesdropper, is often realistic in practice and can defeat existing techniques. We then formalize the location privacy issues under this strong adversary model and show how much communication overhead is needed for achieving a given level of privacy. We also propose two techniques that prevent the leakage of location information: periodic collection and source simulation. Periodic collection provides a high level of location privacy, while source simulation provides trade-offs between privacy, communication cost, and latency. Through analysis and simulation, we demonstrate that the proposed techniques are efficient and effective in protecting location information from the attacker. <s> BIB004 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> Due to the open nature of a sensor network, it is relatively easy for an adversary to eavesdrop and trace packet movement in the network in order to capture the receiver physically. After studying the adversary's behavior patterns, we present countermeasures to this problem. We propose a location-privacy routing protocol (LPR) that is easy to implement and provides path diversity. Combining with fake packet injection, LPR is able to minimize the traffic direction information that an adversary can retrieve from eavesdropping. By making the directions of both incoming and outgoing traffic at a sensor node uniformly distributed, the new defense system makes it very hard for an adversary to perform analysis on locally gathered information and infer the direction to which the receiver locates. We evaluate our defense system based on three criteria: delivery time, privacy protection strength, and energy cost. The simulation results show that LPR with fake packet injection is capable of providing strong protection for the receiver's location privacy. Under similar energy cost, the safe time of the receiver provided by LPR is much longer than other methods, including Phantom routing (Kamat et al., 2005) and DEFP (Deng et al., 2005). The performance of our system can be tuned through a couple of parameters that determine the tradeoff between energy cost and the strength of location-privacy protection. <s> BIB005 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> For sensor networks deployed to monitor and report real events, event source anonymity is an attractive and critical security property, which unfortunately is also very difficult and expensive to achieve. This is not only because adversaries may attack against sensor source privacy through traffic analysis, but also because sensor networks are very limited in resources. As such, a practical tradeoff between security and performance is desirable. In this paper, for the first time we propose the notion of statistically strong source anonymity, under a challenging attack model where a global attacker is able to monitor the traffic in the entire network. We propose a scheme called FitProbRate, which realizes statistically strong source anonymity for sensor networks. We also demonstrate the robustness of our scheme under various statistical tests that might be employed by the attacker to detect real events. Our analysis and simulation results show that our scheme, besides providing source anonymity, can significantly reduce real event reporting latency compared to two baseline schemes. <s> BIB006 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> F. Location Privacy <s> Sensors deployed to monitor the surrounding environment report such information as event type, location, and time when a real event of interest is detected. An adversary may identify the real event source through eavesdropping and traffic analysis. Previous work has studied the source location privacy problem under a local adversary model. In this work, we aim to provide a stronger notion: event source unobservability, which promises that a global adversary cannot know whether a real event has ever occurred even if he is capable of collecting and analyzing all the messages in the network at all the time. Clearly, event source unobservability is a desirable and critical security property for event monitoring applications, but unfortunately it is also very difficult and expensive to achieve for resource-constrained sensor network. Our main idea is to introduce carefully chosen dummy traffic to hide the real event sources in combination with mechanisms to drop dummy messages to prevent explosion of network traffic. To achieve the latter, we select some sensors as proxies that proactively filter dummy messages on their way to the base station. Since the problem of optimal proxy placement is NP-hard, we employ local search heuristics. We propose two schemes (i) Proxy-based Filtering Scheme (PFS) and (ii) Tree-based Filtering Scheme (TFS) to accurately locate proxies. Simulation results show that our schemes not only quickly find nearly optimal proxy placement, but also significantly reduce message overhead and improve message delivery ratio. A prototype of our scheme was implemented for TinyOS-based Mica2 motes. <s> BIB007
Since WSNs are usually deployed in unattended areas, location privacy is an important issue. Location privacy in MWSNs may be classified into two categories: location privacy of sensor nodes (e.g., data source) and location privacy of mobile sinks. For location privacy of a data source, consider, for example, "Panda Hunter Game", where a WSN consists of a large number of Panda-detecting-sensors deployed in a panda habitat BIB001 . If a sensor detects panda activity, it generates a message and sends this message towards the based station. Meanwhile, due to the open nature of WSNs, an armed panda hunter may listen in and trace location of the sensor that generates the message of panda location. Compared with location privacy of data source, location privacy of a mobile sink is more important. Imagine a MWSN deployed in unattended areas, such as a battlefield, where the mobile sink is carried by a soldier or a tank in order that they can access or retrieve sensed data to analyze activities of enemies or movement of troops. If the location of the mobile sink is exposed to the adversary, the soldier or tank will be in great danger. Moreover, since a mobile sink always holds authentication keys and pairwise keys of the network, the entire MWSN becomes useless if the mobile sink is destroyed or controlled by an adversary. In existing literature, there are several ways to trace the location of data source and mobile sink. Here, we present two main approaches. Since both data source and mobile sink need to receive messages, an adversary can trace the location of a data source or mobile sink by analyzing the traffic rate. This traffic-analysis attack is introduced and studied in BIB002 , based on the basic observation that near-sink nodes forward more packets than the sensors further away from the sink. By analyzing the packets sent at various locations in the network, an adversary is able to compute the traffic rates (intensities) at these locations, and then estimates the direction of the sink (the denser it is, the closer to the sink). Another type of attack is that an adversary can trace the location of data source or mobile sink by following the movement of packets. This packet-tracing attack is first addressed in BIB001 , where the sender's location privacy (instead of the receiver's) is considered. In this attack, by eavesdropping on the traffic, the adversary is able to perform a hop-by-hop trace toward the original data source. In the following paragraphs, we discuss four existing defense measures (flooding BIB001 , Random walk BIB001 , dummy injection BIB001 , BIB006 , BIB007 , and fake data source BIB004 ) against these two types of attacks. 1) Location Privacy of Data Source: Baseline and probabilistic flooding BIB001 . The basic idea of baseline flooding is that an intermediate node, once it receives a message, broadcasts the message to all its neighbors. As a consequence, all the sensors in the network participate in forwarding messages so that it is hard for an adversary to trace a transmission route back to the data source. In probabilistic flooding, each sensor forwards message it receives with a pre-specified probability, instead of all sensors participating in forwarding messages. Compared with baseline flooding, probabilistic flooding can save energy for the network. Random walk BIB001 . Random walk, as its name suggests, performs a few steps of random walk from data source to protect the original one. If an adversary follows the path of transmission back to the data source, it will only be able to figure out the terminal node of random walk. Dummy data injection. The basic idea of dummy data injection is to perturb traffic by sending fake packets. As a consequence, the traffic observed by adversary is added with "noise" so that it is not easy to quickly identify fake paths and eliminate them from consideration. In BIB001 , a simple scheme, called Short-lived Fake Source Routing, was proposed to protect location privacy. Take communication overhead and energy consumption into account. On the one hand, the scheme enables each sensor to send fake packets with a pre-determined probability. On the other hand, upon receiving a fake packet, a sensor just discards it to prevent from further sending it to others. Although the scheme can perturb the local traffic observed by adversary, it is ineffective when it meets a global adversary that can monitor transmission rate of each sensor node and thus identify the sensors that only sends out dummy packets BIB006 . To solve the problem, one scheme was proposed in BIB006 that injects dummy packets globally and keeps the transmission of real packets the same as dummy packets against global adversaries who may monitor and analyze the traffic over the whole network. The main idea of BIB006 is that sensors send out network-wide dummy packets with intervals following a special distribution, such as constant or probabilistic. Thanks to the fact that sending packets follow a predetermined distribution, the transmission delay of real packets can be reduced without allowing an adversary to identify the real traffic. However, this benefit is achieved at a cost of transmission power for sensors or in other words shorter network lifetime. Fake data source BIB004 . The basic idea of fake data source is to use it to confuse an adversary so that real data source can be protected. By specifying one or more sensors to impersonate the behaviors of real data sources (such as sending fake packets with the same interval or distribution), more data sources exist in the network. The more the fake data sources, the harder and slower the adversary can identify the real data source. However, the scheme may cause more energy consumption for the behavior impersonation. 2) Location Privacy of Mobile Sink: Besides protecting location privacy of data source, another important task is to protect location privacy of the mobile sink. To the best of our knowledge, there is so far no such literature addressing the topic of protecting location privacy of a mobile sink. However, in order to provide a clue and stimulate new research direction, we review the existing approaches aimed at protecting location privacy of a static sink or base station. The main challenges for protecting the location of a sink or base station can be divided into two types: First, a local adversary may be able to deduce the parent-child relationship according to the received and sent data at each sensor following a certain interval. By analyzing the traffic, the adversary is able to trace down to the sink along the data transmission route. Second, a global adversary is able to monitor all traffic transmitted in a whole WSN so that the global adversary is able to compute the transmission rate of each sensor node, and thus can identify the location of the sink. Location-Privacy Routing protocol (LPR): In BIB005 , the behavior of an adversary is defined, which trusts previous packet movement trend more than the current eavesdropping trend. To defend against such an attack pattern, the scheme enables sensors to select routing paths randomly based on a pre-defined probability. More specifically, the neighbors of each sensor are divided into two lists -closer list and farther list -based on the hop account from the base station. When a sensor forwards a packet, it selects the next hop from the farther list with probability P r, and from the closer list with probability 1 − P r . Consequently, various routing paths are produced, which in turn drastically reduce the probability of successful analysis by the adversary. In addition, the authors combine the routing protocol with fake packet injection to minimize the information that an adversary can deduce from the eavesdropped packets about the direction towards the sink. Controlling transmission rate: Since near-sink sensors need to both generate and forward traffic and thus cause a higher transmission rate (and thus cause a high transmission rate), the asymmetric traffic flow enables an global adversary to find the sink. To defend against the attack, ref. BIB003 has proposed a privacy-preserving technique to keep the same transmission rate among all sensors by controlling delay of real data.