A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> Advances in processor, memory and radio technology will enable small and cheap nodes capable of sensing, communication and computation. Networks of such nodes can coordinate to perform distributed sensing of environmental phenomena. In this paper, we explore the directed diffusion paradigm for such coordination. Directed diffusion is datacentric in that all communication is for named data. All nodes in a directed diffusion-based network are application-aware. This enables diffusion to achieve energy savings by selecting empirically good paths and by caching and processing data in-network. We explore and evaluate the use of directed diffusion for a simple remote-surveillance sensor network. <s> BIB001 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> As sensor networks edge closer towards wide-spread deployment, security issues become a central concern. So far, much research has focused on making sensor networks feasible and useful, and has not concentrated on security. We present a suite of security building blocks optimized for resource-constrained environments and wireless communication. SPINS has two secure building blocks: SNEP and μTESLA SNEP provides the following important baseline security primitives: Data confidentiality, two-party data authentication, and data freshness. A particularly hard problem is to provide efficient broadcast authentication, which is an important mechanism for sensor networks. μTESLA is a new protocol which provides authenticated broadcast for severely resource-constrained environments. We implemented the above protocols, and show that they are practical even on minimal hardware: the performance of the protocol suite easily matches the data rate of our network. Additionally, we demonstrate that the suite can be used for building higher level protocols. <s> BIB002 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> In this paper, we present a mechanism for securing group communications in Wireless Sensor Networks (WSN). First, we derive an extension of logical key hierarchy (LKH). Then we merge the extension with directed diffusion. The resulting protocol, LKHW, combines the advantages of both LKH and directed diffusion: robustness in routing, and security from the tried and tested concepts of secure multicast. In particular, LKHW enforces both backward and forward secrecy, while incurring an energy cost that scales roughly logarithmically with the group size. This is the first security protocol that leverages directed diffusion, and we show how directed diffusion can be extended to incorporate security in an efficient manner. <s> BIB003 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> Strong public-key cryptography is often considered to be too computationally expensive for small devices if not accelerated by cryptographic hardware. We revisited this statement and implemented elliptic curve point multiplication for 160-bit, 192-bit, and 224-bit NIST/SECG curves over GF(p) and RSA-1024 and RSA-2048 on two 8-bit microcontrollers. To accelerate multiple-precision multiplication, we propose a new algorithm to reduce the number of memory accesses. <s> BIB004 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> The common perception of public key cryptography is that it is complex, slow and power hungry, and as such not at all suitable for use in ultra-low power environments like wireless sensor networks. It is therefore common practice to emulate the asymmetry of traditional public key based cryptographic services through a set of protocols [1] using symmetric key based message authentication codes (MACs). Although the low computational complexity of MACs is advantageous, the protocol layer requires time synchronization between devices on the network and a significant amount of overhead for communication and temporary storage. The requirement for a general purpose CPU to implement these protocols as well as their complexity makes them prone to vulnerabilities and practically eliminates all the advantages of using symmetric key techniques in the first place. In this paper we challenge the basic assumptions about public key cryptography in sensor networks which are based on a traditional software based approach. We propose a custom hardware assisted approach for which we claim that it makes public key cryptography feasible in such environments, provided we use the right selection of algorithms and associated parameters, careful optimization, and low-power design techniques. In order to validate our claim we present proof of concept implementations of two different algorithms—Rabin’s Scheme and NtruEncrypt—and analyze their architecture and performance according to various established metrics like power consumption, area, delay, throughput, level of security and energy per bit. Our implementation of NtruEncrypt in ASIC standard cell logic uses no more than 3,000 gates with an average power consumption of less than 20 μW. We envision that our public key core would be embedded into a light-weight sensor node architecture. <s> BIB005 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> Wireless networks of miniaturized, low-power sensor/actuator devices are poised to become widely used in commercial and military environments. The communication security problems for these networks are exacerbated by the limited power and energy of the sensor devices. In this paper, we describe the design and implementation of public-key-(PK)-based protocols that allow authentication and key agreement between a sensor network and a third party as well as between two sensor networks. Our work is novel in that PK technology was commonly believed to be too inefficient for use on low-power devices. As part of our solution, we exploit the efficiency of public operations in the RSA cryptosystem and design protocols that place the computationally expensive operations on the parties external to the sensor network, when possible. Our protocols have been implemented on UC Berkeley MICA2 motes using the TinyOS development environment. <s> BIB006 </s> A survey of security issues in wireless sensor networks <s> SECURE ROUTING <s> In this paper, we quantify the energy cost of authentication and key exchange based on public-key cryptography on an 8-bit microcontroller platform. We present a comparison of two public-key algorithms, RSA and elliptic curve cryptography (ECC), and consider mutual authentication and key exchange between two untrusted parties such as two nodes in a wireless sensor network. Our measurements on an Atmel ATmega128L low-power microcontroller indicate that public-key cryptography is very viable on 8-bit energy-constrained platforms even if implemented in software. We found ECC to have a significant advantage over RSA as it reduces computation time and also the amount of data transmitted and stored. <s> BIB007
The goal of a secure routing protocol is to ensure the integrity, authentication, and availability of messages. The proposed secure routing protocols for WSNs in the literature are based on symmetric key cryptography, except the work in  , which is based on public key cryptography. SPINS is a suite of security protocols optimized for sensor networks BIB002 . SPINS includes two building blocks: SNEP and µTESLA. SNEP provides data confidentiality, two-party data authentication, and data freshness for peer-to-peer communication (node to base station). µTESLA provides authenticated broadcast as discussed before. We discuss SNEP in this subsection. SPINS assumes that each node is predistributed with a master key K which is shared with the base station at creation time. All other keys, including a key K encr for encryption, a key K mac for MAC generation, and a key K rand for random number generation, are derived from the master key using a strong one-way function. SPINS uses RC5 for confidentiality. BIB002 ). If A wants to send a message to base station B, the complete message that A sends to B is while D is the transmitted data and C is a shared counter between the sender and the receiver for the block cipher in counter mode. The counter C is incremented after each message is sent and received in both the sender and receiver sides. SNEP also provides a counter exchange protocol to synchronize the counter value in both sides. SNEP offers the following properties: semantic security, data authentication, replay protection, weak freshness, and low communication overhead. SPINS identifies two types of freshness: weak freshness and strong freshness. Weak freshness provides partial message ordering and carries no delay information while strong freshness provides a total order on a request-response pair and allows for delay estimation. • Semantic security: The counter value is incremented after each message and thus the same message is encrypted differently each time. • Data authentication: A receiver can be assured that the message originated from the claimed sender if the MAC verifies correctly. • Replay protection: The counter value in the MAC prevents replaying old message. • Weak freshness: The counter also maintains a message ordering in the receiver side and yields weak freshness. SNEP provides weak data freshness only because there is no absolute assurance to node A that a message was created by node B in response to an event in node A. • Low communication overhead: The counter state is kept at each end point and does not need to be sent in each message. The directed diffusion routing protocol was proposed by Intanagonwiwat et al. without considering security issues BIB001 . Pietro et al. proposed an extension of the directed diffusion protocol which provides secure multicasting in BIB003 . The extended scheme, Logical Key Hierarchy for WSNs (LKHW), provides robustness in routing and security and supports both backward and forward secrecy for sensor join and leave operations. However, it does not provide data authentication. Inspired by the work on public key cryptography BIB004 BIB007 BIB005 BIB006 , Du et al. investigated the public key authentication problem  . The use of public key cryptography eases many problems in secure routing, for example, authentication and integrity. However, before a node A uses the public key from another node B, A must verify that the public key is actually B's (i.e., A must authenticate B's public key); otherwise, manin-the-middle attacks are possible. In general networks, public key authentication involves a signature verification on a certificate signed by a trusted third party Certificate Authority (CA) [86] . However, the signature verification operations are still too expensive for sensor nodes, as depicted in Table 3 and 4. Du et al. proposed an efficient alternative that uses only a one-way hash function for the public key authentication. The proposed scheme can be divided into two stages. In the predistribution stage, a Merkle tree R is constructed with each leaf L i corresponding to a sensor node (more information on Merkle trees is given below). Let pk i represent node i's public key, V be an internal tree node, and V left and V right be V's two children. The value of an internal tree node is denoted by φ. The Merkle tree can then be constructed as follows: where "||" represents the concatenation of two strings and h is a one-way hash function such as MD5 or SHA-1. Let R be the root of the tree. Each sensor node v needs to store the root value φ(R) and the sibling node values λ 1 , …, λ H along the path from v to R. If node A wants to authenticate B's public key, B sends its public key pk, along with the value of λ 1 , …, λ H to node A. Then, A can use the same procedure to reconstruct the Merkle tree R′ and calculate the root value φ(R′). A will trust B to be authentic if φ(R′) = φ(R). A sensor node only needs H + 1 storage units for the extra hash values. Based on this scheme, Du et al. further extended the idea to reduce the height of the Merkle tree in order to improve the communication overhead of the scheme. The proposed scheme is more efficient than signature verification on certificates. However, the scheme requires that some hash values be distributed in a predistribution stage. This results in some scalability issues when new sensors are added to an existing WSN. The above discussion is summarized in Table 8 .