A survey of security issues in wireless sensor networks <s> BROADCAST AUTHENTICATION <s> As sensor networks edge closer towards wide-spread deployment, security issues become a central concern. So far, much research has focused on making sensor networks feasible and useful, and has not concentrated on security. We present a suite of security building blocks optimized for resource-constrained environments and wireless communication. SPINS has two secure building blocks: SNEP and μTESLA SNEP provides the following important baseline security primitives: Data confidentiality, two-party data authentication, and data freshness. A particularly hard problem is to provide efficient broadcast authentication, which is an important mechanism for sensor networks. μTESLA is a new protocol which provides authenticated broadcast for severely resource-constrained environments. We implemented the above protocols, and show that they are practical even on minimal hardware: the performance of the protocol suite easily matches the data rate of our network. Additionally, we demonstrate that the suite can be used for building higher level protocols. <s> BIB001 </s> A survey of security issues in wireless sensor networks <s> BROADCAST AUTHENTICATION <s> Broadcast authentication is a fundamental security service in distributed sensor networks. A scheme named $\mu$TESLA has been proposed for efficient broadcast authentication in such networks. However, $\mu$TESLA requires initial distribution of certain information based on unicast between the base station and each sensor node before the actual authentication of broadcast messages. Due to the limited bandwidth in wireless sensor networks, this initial unicast-based distribution severely limits the application of $\mu$TESLA in large sensor networks. This paper presents a novel technique to replace the unicast-based initialization with a broadcast-based one. As a result, $\mu$TESLA can be used in a sensor network with a large amount of sensors, as long as the message from the base station can reach these sensor nodes. This paper further explores several techniques that improve the performance, the robustness, as well as the security of the proposed method. The resulting protocol satisfies several nice properties, including low overhead, tolerance of message loss, scalability to large networks, and resistance to replay attacks as well as some known Denial of Service (DOS) attacks. <s> BIB002 </s> A survey of security issues in wireless sensor networks <s> BROADCAST AUTHENTICATION <s> Broadcast authentication is a fundamental security service in distributed sensor networks. This paper presents the development of a scalable broadcast authentication scheme named multilevel μTESLA based on μTESLA, a broadcast authentication protocol whose scalability is limited by its unicast-based initial parameter distribution. Multilevel μTESLA satisfies several nice properties, including low overhead, tolerance of message loss, scalability to large networks, and resistance to replay attacks as well as denial-of-service attacks. This paper also presents the experimental results obtained through simulation, which demonstrate the performance of the proposed scheme under severe denial-of-service attacks and poor channel quality. <s> BIB003 </s> A survey of security issues in wireless sensor networks <s> BROADCAST AUTHENTICATION <s> We describe LEAPp (Localized Encryption and Authentication Protocol), a key management protocol for sensor networks that is designed to support in-network processing, while at the same time restricting the security impact of a node compromise to the immediate network neighborhood of the compromised node. The design of the protocol is motivated by the observation that different types of messages exchanged between sensor nodes have different security requirements, and that a single keying mechanism is not suitable for meeting these different security requirements. LEAPp supports the establishment of four types of keys for each sensor node: an individual key shared with the base station, a pairwise key shared with another sensor node, a cluster key shared with multiple neighboring nodes, and a global key shared by all the nodes in the network. LEAPp also supports (weak) local source authentication without precluding in-network processing. Our performance analysis shows that LEAPp is very efficient in terms of computational, communication, and storage costs. We analyze the security of LEAPp under various attack models and show that LEAPp is very effective in defending against many sophisticated attacks, such as HELLO flood attacks, node cloning attacks, and wormhole attacks. A prototype implementation of LEAPp on a sensor network testbed is also described. <s> BIB004 </s> A survey of security issues in wireless sensor networks <s> BROADCAST AUTHENTICATION <s> In sensor networks, data aggregation is a vital primitive enabling efficient data queries. An on-site aggregator device collects data from sensor nodes and produces a condensed summary which is forwarded to the off-site querier, thus reducing the communication cost of the query. Since the aggregator is on-site, it is vulnerable to physical compromise attacks. A compromised aggregator may report false aggregation results. Hence, it is essential that techniques are available to allow the querier to verify the integrity of the result returned by the aggregator node. ::: ::: We propose a novel framework for secure information aggregation in sensor networks. By constructing efficient random sampling mechanisms and interactive proofs, we enable the querier to verify that the answer given by the aggregator is a good approximation of the true value, even when the aggregator and a fraction of the sensor nodes are corrupted. In particular, we present efficient protocols for secure computation of the median and average of the measurements, for the estimation of the network size, for finding the minimum and maximum sensor reading, and for random sampling and leader election. Our protocols require only sublinear communication between the aggregator and the user. <s> BIB005
Previous proposals for authenticated broadcast are impractical in WSNs for the following reasons: • Most proposals rely on public key cryptography for the authentication. However, public key cryptography is impractical for WSNs; • Even one-time signature schemes that are based on symmetric key cryptography have too much overhead. µTESLA BIB005 and its extensions BIB002 BIB003 have been proposed to provide broadcast authentication for sensor networks. µTESLA is an authenticated broadcast protocol which was proposed by Perrig et al. for the SPINS protocol BIB001 . µTESLA introduces asymmetry through a delayed disclosure of symmetric keys resulting in an efficient broadcast authentication scheme. µTESLA requires that the base station and nodes be loosely time synchronized, and that each node knows an upper bound on the maximum synchronization error. To send an authenticated packet, the base station simply computes a MAC on the packet with a key that is secret at that point in time. When a node gets a packet, it can verify that the corresponding MAC key was not yet disclosed by the base station. Since a receiving node is assured that the MAC key is known only by the base station, the receiving node is assured that no adversary could have altered the packet in transit. The node stores the packet in a buffer. At the time of key disclosure, the base station broadcasts the verification key to all receivers. When a node receives the disclosed key, it can easily verify the correctness of the key. If the key is correct, the node can now use it to authenticate the packet stored in its buffer. Each MAC key is a key from the key chain, generated by a public one-way function F. To generate the one-way key chain, the sender chooses the last key K n from the chain, and repeatedly applies F to compute all other keys: Figure 3 shows an example of µTESLA. The receiver node is loosely time-synchronized and knows K 0 in an authenticated way. Packets P 1 and P 2 sent in interval 1 contain a MAC with key K 1 . Packet P 3 has a MAC using key K 2 . If P 4 , P 5 , and P 6 are all lost, as well as the packet that disclosed key K 1 , the receiver cannot authenticate P 1 , P 2 , and P 3 . In interval 4 the base station broadcasts key K 2 , which the nodes authenticate by verifying K 0 = F(F(K 2 )), and hence also know K 1 = F(K 2 ), so that they can authenticate packets P 1 , P 2 with K 1 , and P 3 with K 2 . SPINS limits the broadcasting capability to only the base station. If a node wants to broadcast authenticated data, the node has to broadcast the data through the base station. The data is first sent to the base station in an authenticated way. It is then broadcasted by the base station. To bootstrap a new receiver, µTESLA depends on a pointto-point authentication mechanism in which a receiver sends a request message to the base station and the base station replies with a message containing all the necessary parameters. Notice that µTESLA requires that the base station unicast initial parameters to individual sensor nodes, thus incurring a long delay to boot up a large-scale sensor network. Liu and Ning proposed a multilevel key chain scheme for broadcast authentication to overcome this deficiency in BIB002 BIB003 . The basic idea in BIB002 BIB003 is to predetermine and broadcast the initial parameters required by µTESLA instead of using unicast-based message transmission. The simplest way is to predistribute the µTESLA parameters with a master key during the initialization of the sensor nodes. As a result, all sensor nodes have the key chain commitments and other necessary parameters once they are initialized, and are ready to use µTESLA as long as the starting time has passed. Furthermore, Liu and Ning introduced a multilevel key chain scheme, in which the higher-level key chains are used to authenticate the commitments of lower-level ones. However, the multilevel key chain scheme suffers from possible DoS attacks during the commitment distribution stage. Further, none of the µTESLA or multilevel key chain schemes is scalable in terms of the number of senders. In  , a practical broadcast authentication protocol was proposed to support a potentially large number of broadcast senders using µTESLA as a building block. µTESLA provides broadcast authentication for base stations but is not suitable for local broadcast authentication. This is because µTESLA does not provide immediate authentication. For every received packet, a node has to wait for one µTESLA interval to receive the MAC key used in computing the MAC for the packet. As a result, if µTESLA is used for local broadcast authentication, a message traversing l hops will take at least l µTESLA intervals to arrive at the destination. In addition, a sensor node has to buffer all the unverified packets. Both the latency and the storage requirements limit the scheme for authenticating infrequent messages broadcast by the base station. Zhu et al. proposed a one-way key chain scheme for one-hop broadcast authentication in LEAP BIB004 . In this scheme, every node generates a one-way key chain of certain length and then transmits the commitment (i.e., the first key) of the key chain to each neighbor, encrypted with their pairwise shared key. Whenever a node has a message to send, it attaches to the message the next authenticated key in the key chain. The authenticated keys are disclosed in an order that is reverse to their generation. A receiving neighbor can verify the message based on the commitment or an authenticated key it received from the sending node more recently.