Protocols for Secure Communication in Wireless Sensor Networks

3.5. Approximating End-to-End Security 93
work. This measure is defined only if there is at least one live path in the network.
It is consistent with end-to-end security techniques: for these, it always
yields 1, independent of the number of compromised nodes in the network,
since every live path is also functional.
Byzantine Agreement
In many applications of distributed systems, at some point a consensus problem
has to be solved. For example, the hosts have to agree whether or not to
perform a specific action, such as committing a database transaction. In sensor
networks, nodes may have to agree on the value of aggregated sensor data before
reporting it. Or a distributed intrusion detection system is concerned with
the expulsion of a sensor node that is suspected to falsify sensor readings.
The problem of reaching consensus in the presence of malicious faults is
called the Byzantine agreement problem. It is well-known that solutions to this
problem exist only under specific conditions on the synchronization of hosts,
the characteristics of the communication network, and the authentication of
messages. We will not go into detailed descriptions of appropriate conditions.
We are interested in evaluating the ability of a network to reach consensus
when it is subject to an attack. This evaluation provides a metrics for the level
of security that is delivered by the network.
Our model is a synchronous system with point-to-point connections. In a
fully connected network, this would allow for Byzantine agreement in case
there are n > 3t nodes in the network. Since we are dealing with a sparsely
connected, multi-hop network, message authentication is used to simulate full
connectivity, i.e. provide resilient point-to-point connections. Digital signatures
would allow tolerating arbitrary values of t, but we disregard this possibility
here and concentrate on end-to-end security properties.
The synchrony assumption is a strong assumption to be made in a sensor
network. This assumption demands that messages are reliably transmitted between
nodes within a “round” of operation. This requires a reliable message
transport service that retransmits lost messages. Transmission failures have to
be detected. Such a service should be possible to implement in a sensor network,
though it may be unusable in practice.
Protocols for distributed consensus are very complex. In order to tolerate t
faulty nodes, they require at least t + 1 rounds of message exchanges between
all node pairs. It is clearly unacceptable in a large-scale sensor network to include
all nodes in such a protocol. Thus, we do not consider Byzantine agreement
among all nodes in a sensor network to be of practical value. However,