Protocols for Secure Communication in Wireless Sensor Networks

2.7. Security Requirements 43
network is not under attack. Thus, there exists a short time window during
which key material can be exchanged as plaintext. This essentially replaces
authentication by a (temporarily) secure environment.
Link-level security is, however, only effective against outsider attacks. A
message that is transmitted over multiple hops is easily compromised if its path
includes a malicious node. Therefore, a mechanism to set up end-to-end secure
connections is desirable. However, this requires a means to establish a shared
key between the endpoints of a connection, which turns out to be challenging
in sensor networks. This problem is further discussed in section 3.4.
Sometimes, messages need to be delivered network-wide, for example code
or configuration updates. Such messages originate preferably at a base station
that is trusted by all nodes, and must be authenticated. The µTESLA protocol
[142] has been designed for authenticated broadcast and is suitable for this
use case.
2.7.2 Routing
Multi-hop routing is a fundamental service in large-scale sensor networks. There
are protocols that are specifically designed to address the needs of sensor network
applications. Usually, they do not rely on up-to-date routing tables, which
would be too complex to maintain. Rather, they forward a message based on
features of the message itself, or they set up paths on demand.
One important class of such protocols provide data-centric routing. They
are either demand-driven, where a node that is interested in a certain type of
events announces its interest and thereby pulls messages towards itself [86], or
event-driven, where a message source announces the availability of messages
of a certain type [31]. A path is then established between source and receiver.
Another important class are geometric routing protocols [91, 100, 149, 201].
They rely on nodes knowing their and their neighbours’ position in a real-world
or virtual coordinate space. Messages are routed according to a target location
without the need of setting up a path.
A routing protocol ensures that messages reach their target. Attacks on the
network layer, where routing functionality is located, aim at diverting or suppressing
messages. This can lead to unauthorized data disclosure, missing critical
events, energy exhaustion, or event triggering at undesired locations. A
secure routing protocol must be resilient against such attacks.
Karlof and Wagner [90] have identified a number of ways to attack routing
protocols designed for sensor networks, and propose countermeasures. These
include link-layer encryption and authentication, multipath routing, identity