Protocols for Secure Communication in Wireless Sensor Networks

2.4. Related Device Types 27
in conjunction with a reader device, which often also provides a user interface
(keypad). The most important feature of smartcards is their tamper-resilience.
This allows to store secret information, such as a cryptographic key, within the
smartcard’s memory with a minimal risk of disclosure even if an adversary obtains
the smartcard. A smartcard has a well-defined interface through which
its functionality, and therefore the stored secret, is accessible. This interface
requires proper authorization by the user, such as entering the correct password
(PIN).
Tamper resistance against all classes of attackers is impossible to achieve. If
one is willing to invest enough resources, extracting the secret from a smartcard
is possible as has been shown through successful attacks [6]. The goal therefore
is risk minimization when deploying smartcards. For current applications,
the risks seem acceptable, as the widespread use of smartcards shows. Other
applications, however, seem to be hampered by security issues. The problem
here is not the smartcard itself but its connection to a backend system, which
boils down to the question, how can the user be sure to be connected to the right
system, and who else has access to this connection? This problem is usually
addressed by trying to establish a trusted path between the user and the backend
system. This is a hard problem as was recently shown practically by exploiting
the fact that smartcards often accept the PIN only in cleartext, which makes it
possible to intercept the PIN through a specially crafted smartcard reader [4].
This violates the trusted path between the user and the smartcard.
Sensor nodes are hard to protect against tampering, due to their deployment
in openly accessible locations and tight cost constraints. Thus, the security
of a sensor network should not depend on the integrity of single nodes. Even
if a network is under (not too heavy) attack, the risk of using it should be
acceptable. Of course, if too many nodes are compromised and the attacker
gains control over large parts of the network, relying on the results delivered by
the network would become dangerous.
In contrast to sensor nodes, smartcards are dedicated devices with specialized
functionality. Their programmability is limited. A smartcard “application”
is usually defined by a set of files accessible from an application running
on a host to which the smartcard reader is connected to. The SIM Application
Toolkit is an exception in that it also allows the execution of code on the
smartcard itself [1].
It is obvious that the usage patterns of sensor nodes and smartcards are fundamentally
different. While a smartcard is associated with a single user, performing
security-relevant actions on behalf of this user, sensor nodes operate
autonomously in large clusters, obtaining sensoric input from their environ-