Protocols for Secure Communication in Wireless Sensor Networks

2.6. Simulation of Sensor Networks 39
class) host, which makes it easy to reconfigure the nodes and run a wide range
of tests in a completely automated manner with minimal effort.
An important component in a sensor network is the wireless communication
medium being used. The performance and energy demands of a protocol
directly depend on the characteristics of the medium and the communication
interface. It is therefore important to be able to test new protocol designs and
evaluate their costs before they are deployed on actual hardware platforms.
Consequently, there exist sophisticated models of this low level layer that include
characteristics such as radio propagation and interference. The goal is to
reflect the properties of the real communication medium as closely as possible.
For example, simulation environments like OMNeT++ [120], TOSSIM [115],
or ns2 [130] allow for the specification of a model of the wireless channel.
Some predefined specifications are already provided in most packages, which
can be further refined as required. However, all of these models provide only an
imperfect embodiment of reality, so in most works, the results obtained through
simulation are validated by tests on real hardware, usually on a smaller scale
than the simulation.
Node-level simulations encompassing the network stack are useful for evaluating
the performance and energy characteristics of an implementation. They
can also be helpful for testing whether potential security-relevant flaws exist
in an implementation. Standard security evaluation techniques like penetration
testing [7] and fuzzing [131] are usually applied to real-world implementations.
However, they can also be helpful in uncovering vulnerabilities in the design
of network protocols or system designs when they are applied to formal system
models [168] or during simulations. In these cases, it is important that
all relevant properties of all components of a network node are reflected in the
underlying abstract model.
Security evaluations in this fashion study the security properties of single
nodes. They assume an external attacker, i.e. some entity that is able to send
messages through the communication channel. In reality, this could be some
existing node that is compromised by the attacker, or some additional device
through which the attacker is able to simulate a legitimate party. Depending
on its actual manifestation, the attacker may have certain abilities that exceed
those of the legitimate participants, such as excessive computational or transmission
power. Usually, the attacker model proposed by Dolev and Yao [57] is
assumed. This model represents an external attacker that has full access to the
communication channel being used by legitimate participants. This means that
the attacker can read all exchanged messages and inject own messages, as well
as intercept messages and drop them. The attacker’s computational abilities are