Protocols for Secure Communication in Wireless Sensor Networks

44 Chapter 2. Wireless Sensor Networks and Their Security
verification, and broadcast authentication, which are able to protect against
most attacks. Sinkhole and wormhole attacks are hard to defend against. A
sinkhole attracts messages and prevents them from reaching their target. A
wormhole is a shortcut through the network (an external low-latency link) that
can be used to mount sinkhole, selective forwarding, or eavesdropping attacks.
Data-centric routing protocols are vulnerable against these attacks since a path
is established between the source and the receiver of a message. By offering superior
routing properties (low latency, high energy resources), a node under the
adversary’s control can influence the establishment of these paths. Geographic
routing protocols are less vulnerable to these attacks. For example, a wormhole
could deliver a message to its intended target prematurely, which is hardly a
violation of security. Assuming that the target address is included in a message
and cannot be changed by the attacker, a node that receives that message
through a wormhole but is not located at the target address itself would simply
forward the message towards its actual target location. This changes the path
the message travels, which may or may not be a security violation depending
on the application context.
2.7.3 Access Control
Many sensor network applications deal with sensitive or commercially valuable
data; queries are disseminated through the network, triggering nodes to activate
their sensors and transmit data; actuators are triggered by control commands.
All these actions are significant with regards to the (commercial) operation of
the sensor network, and its interaction with its environment. Illegitimate use
may have harmful consequences. Therefore, access to a sensor network should
be restricted to authorized parties.
Access control plays an important role in ensuring the confidentiality and
integrity of sensor network data, as well as the safe operation of a sensor network.
Thus, an effective access control mechanism is required, preferably implemented
in a distributed manner in order to allow arbitrary entry points into
the network. This avoids the use of a centralized entitiy that acts as a single
entry point, thereby constituting a single point of failure, and a performance
bottleneck.
The access control mechanism should still be effective when the network is
being attacked and some nodes have been compromised. Such a robust framework
for access control in sensor networks is described in [17], where a certain
minimum number of nodes have to agree in order to authenticate a principal
requesting access. This avoids that a single, compromised node is able to grant