Protocols for Secure Communication in Wireless Sensor Networks

92 Chapter 3. A Security Model for Wireless Sensor Networks
this is the fraction of pairs of uncompromised nodes that can communicate securely.
From the adversary’s point of view, this means that the adversary is
able to manipulate a certain fraction of the messages that are sent throughout
the network.
Note the difference between link and path security. Link security prevents
a passive adversary from reading messages that are sent between two adjacent
nodes. In case of an active adversary that operates only at the link level, link
security prevents the adversary from manipulating messages. If the active adversary
is also able to compromise nodes, link security is not sufficient to keep
the adversary from eavesdropping or manipulation. In a multi-hop environment
and an adversary of the latter kind, link level security provides no protection
against this adversary. In this case, it is necessary to protect communication
paths instead of links only. A path provides a connection between two nodes
that are non-adjacent. All nodes on that path cooperate relaying messages.
There is a certain level of trust that must be put into them to provide the necessary
protection.
A live path is an end-to-end connection in which both endpoints are uncompromised.
This is independent of the fact whether these nodes can communicate
securely with each other or not. If they have a unique secret shared key,
secure communication is possible independent of the number of compromised
nodes that relay the messages. The shared key guarantees that intermediate
nodes cannot tamper with the message. If the nodes use disjoint multi-path
routing, a shared secret key is not necessary, but there is a limit on the number
of compromised paths that can be tolerated. Using a secret sharing scheme, t
out of n available paths may be compromised without affecting the traffic.
A functional path is a path that provides a secure connection between two
uncompromised endpoints. If end-to-end security means are available, such as
a shared key, any path that is alive is considered functional. Only its ability to
relay messages is required. Security is provided by the shared secret key. If no
end-to-end security means are available, the path itself is responsible for providing
security properties. For example, in a hop-to-hop authentication scheme
all nodes are trusted to relay a message untampered.
For defining a measure for the level of security, we consider the set of live
paths as the basic reference. This seems sensible as the integrity of a path is
irrelevant if one of the endpoints is compromised. Formally, we define as a
measure for the security of a sensor network the quotient
|{π ∈ Π : π is functional}|
(3.1)
|{π ∈ Π : π is alive}|
where Π is the set of all paths (i.e., pairwise multi-hop connections) in the net-