Security in Mobile Wireless Sensor Networks – A Survey <s> C. Mobile Adversary <s> Establishing secure links between pairs of directly connected sensor nodes is an important primitive for building secure wireless sensor networks. This paper systematically identifies two important security requirements of pairwise key setup in wireless sensor networks, namely opaqueness and inoculation. Transitory master key schemes, such as the LEAP protocol, can satisfy both requirements if the master key has not been compromised. However, if the master key is compromised, every key in the network is exposed to an adversary. To prevent the master key from becoming a single point failure of the whole system, we propose a new opaque transitory master key (OTMK) scheme for pairwise key setup in sensor networks. In OTMK, even if the master key is compromised, an adversary can only exploit a small number of keys nearby the compromised node, while other keys in the network remain safe. To further investigate key establishment schemes, we experimented with a way to compromise a sensor node, and tested our key establishment time in a real sensor network environment. <s> BIB001 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Mobile Adversary <s> Unattended sensor networks operating in hostile environments might collect data that represents a high-value target for the adversary. The unattended sensor's inability to off-load - in real time - sensitive data to a safe external entity makes it easy for the adversary to mount a focused attack aimed at eliminating certain target data. In order to facilitate survival of this data, sensors can collectively attempt to confuse the adversary by changing its location and content, i.e., by periodically moving the data around the network and encrypting it. In this paper, we focus on data survival in unattended sensor networks faced with an adversary intent on surgically destroying data which it considers to be of high value. After motivating the problem and considering several attack flavors, we propose several simple techniques and provide their detailed evaluation. <s> BIB002 </s> Security in Mobile Wireless Sensor Networks – A Survey <s> C. Mobile Adversary <s> Some wireless sensor networks preclude the constant presence of a centralized data collection point, that is, a sink. In such a disconnected or unattended setting, nodes must accumulate sensed data until it can be off loaded to an itinerant sink. Furthermore, if the operating environment is hostile, there is a very real danger of node and data compromise. The unattended nature of the network makes it an attractive target for attacks that aim to learn, erase, or modify potentially valuable data collected and held by sensors. We argue that adversarial models and defense techniques in prior WSN literature about security are unsuitable for the unattended WSN setting. We define a new adversarial model by taking into account special features of the UWSN environment. We show that in the presence of a powerful mobile adversary, securing data stored on unattended sensors presents interesting challenges and opens an exciting new line of research. <s> BIB003
In MWSNs, sensors cannot transmit sensed data to a sink at will because the sink is not always present (i.e., a mobile sink periodically visits the static sensors to collect data; mobile sensors visit static sinks to offload data; or mobile sinks and mobile sensors meet and communicate uncertainly). The data accumulated in their memories thus become targets of various adversaries. The authors in BIB002 propose a mobile adversary model where a mobile adversary visits and travels around the network, trying to compromise a subset (up to a certain size) of sensors within the time interval while sinks are not present in the network. (We will hereafter refer to the mobile adversary as ADV.) The time an ADV compromises a set of sensors is much shorter than the time between two successive data collections of a sink. As a consequence, given enough compromise intervals, such an ADV can gradually subvert the entire network. The authors in BIB003 further extend and divide an ADV into three categories as follows: • Read-only ADV: ADV aims to learn as much sensed data as possible. Until now, it was not difficult to read data from the memories of commodity sensors BIB001 . Therefore, with no countermeasures, an ADV can compromise sensors and read the data accumulated in their memory directly. • Search-and-erase ADV: ADV tries to prevent certain target data from reaching the sink. For example, in a nuclear emission monitoring application, sink will raise the alarm if one of the sensing nodes reports a value above a pre-specified threshold. ADV thus aims to find that value and erase it before it ever reaches the sink. ADV might be undetected if the sink tolerates some missing measurements (due to occasional errors or malfunctions). • Search-and-replace ADV: If the sink has no tolerance for lost data, ADV changes its strategy from search-and-erase to search-and-replace, in the sense that ADV replaces the target data with a value within the threshold.