Thesis

1. INTRODUCTION
only data sent to the base station is the occurrence of the event. Thus the presence
of communication reveals the location of the event. In some situations, it must be
hidden from an attacker. Some approaches are described in the following:
Baseline and probabilistic flooding mechanisms: The basic idea of baseline
flooding is for each sensor to broadcast the data it receives from one neighbor
to all of its other neighbors. The premise of this approach is that all sensors
participate in the data transmission so that it is unlikely for an attacker to
track a path of transmission back to the data source [Kamat et al., 2005]. This
can be further optimized if not every node rebroadcasts the message, only a
probabilistic set of them.
Random walk mechanisms: According to [Kamat et al., 2005], a random
walk can be performed before the probabilistic flooding to further increase the
uncertainty of the attacker. To improve simple random walk, a two-way greedy
random walk(GROW) scheme was proposed in [Xi et al., 2006].
Dummy data mechanism: To further protect the location of the data source,
fake data packets can be introduced to perturb the traffic patterns observed by
the adversary. In particular, a simple scheme called Short-lived Fake Source
Routing was proposed in [Kamat et al., 2005] for each sensor to send out a fake
packet with a pre-determined probability.
Fake data sources mechanism: The basic idea of fake data source is to
choose one or more sensor node to simulate the behavior of a real data source
in order to confuse the adversaries [Mehta et al., 2007].
Location privacy of base station: In a WSN, a base station is not only in
charge of collecting and analyzing data, but also used as the gateway connecting the
WSN with outside wireless or wired network. Consequently, destroying or isolating
the base station may lead to the malfunction of the entire network. This can be
circumvented if the location of the base station is unknown to the adversary.
Defense against local adversaries: The location information or identifier
of the base station is sent in clear in many protocols. These information must be
hidden from an eavesdropper, which can be done by traditional cryptographic
techniques (encryption). Another problem can be if the attacker can follow
the way of packets from the source towards the base station. This can be
mitigated by changing data appearance by re-encryption [Deng et al., 2006a;
Dingledine et al., 2004], routing with multiple parents [Deng et al., 2005; Deng et
al., 2006a], routing with random walk [Jian et al., 2007], or decorrelating parentchild
relationship by randomly selecting sending time [Deng et al., 2006a].
Defense against global adversaries: The techniques discussed above are
inefficient against a global attacker. To fight against a global attacker the
traffic patterns of the whole network must be modified. This can be done by
hiding traffic pattern by controlling transmission rate [Deng et al., 2006a], or
by propagating dummy data [Deng et al., 2005; Deng et al., 2006a].
– Temporal privacy problem: When an adversary eavesdrops a message, it can
deduce the sending time of the message from the time it eavesdropped and the TTL
value. In some applications this information must be hidden. It can be done by randomly
delaying the messages by the relaying nodes [Kamat et al., 2007].
As it can be seen from the discussion above, a considerable amount of work has been done in the
field of privacy in wireless sensor networks. However, the particular problem of location privacy
of aggregator nodes received less attention. Therefore, in Chapter 4, I study this problem and
propose two anonym aggregator election protocols, which can hide the identity of the aggregator
nodes.
6