Protocols for Secure Communication in Wireless Sensor Networks

5.2. Routing on Spanning Trees 133
R1
B
R2
Figure 5.1: Spanning tree multiple path routing
structures. Each spanning tree determines a path between any two nodes, and
multiple such paths are used for message exchange. We show that, similar
to Canvas, this scheme provides an adequate level of integrity protection for
wireless sensor networks.
The fundamental idea of this approach is to set up multiple spanning trees
and use them to create paths between pairs of nodes, which are node-disjoint to
a certain extent. An example is shown in Figure 5.1. Three spanning trees with
roots at R1,R2,R3 determine three paths between A and B.
Obviously, pairs of paths are not necessarily node-disjoint. In the example,
only pairs AR1B,AR2B and AR1B,AR3,B are node-disjoint, while AR2B,AR3B
overlap. Despite the overlap, path AR3B does not degrade the security of the
set-up but adds to it. The overlap occurs close to B, so the principle of locality
applies: In order to exploit the overlap, the attacker must be active in the vicinity
of B. If the attacker is only active further away from B, three locations have
to be attacked in order to compromise a message exchange. This significantly
increases the burden on the attacker.
Setting up a spanning tree is a costly procedure, as all nodes are involved.
A
R3