Protocols for Secure Communication in Wireless Sensor Networks

2.7. Security Requirements 45
access to an illegitimate user.
A simpler approach to access control would be the use of a globally shared
key for encrypting all traffic, which is regularly updated in order to provide
backward secrecy. Such an approach is described in [13]. It protects against
eavesdropping by outsiders, but would not help in case there is at least one
node being compromised by the adversary. The underlying adversary model
is fundamentally different from the one assumed in the previously described
framework, but it is much easier to implement. Of course, there is no universal
mechanism that can be applied efficiently in all cases. Eventually, the application
scenario determines the appropriate mechanisms required for providing
access control.
2.7.4 Data Aggregation
One of the main tasks of sensor networks is data aggregation, i.e. the combination
of data gathered by various sensors into a single value that is meaningful
within the application context and represents the monitored state as accurately
as possible. This process must not only be robust against random errors, which
are likely to occur, but also against malicious nodes reporting intentionally falsified
sensor data.
Generally, it is not feasible to detect whether a sensor reports the data it has
obtained from its sensors correctly, as this would require a second sensor node
that performs the same sensor readings. Due to the high redundancy in a sensor
network, it would seem likely that in most cases, there would be sufficiently
many nodes close to any other node. However, there are two reasons that argue
against such a solution. The first ist cost. Keeping all nodes actively monitoring
their environment all the time depletes the energy sources of all these nodes. It
would be more desirable to exploit the redundancy for extending the lifetime of
the network, replacing depleted nodes with others that have saved their energy.
The second reason is that the adversary who has managed to compromise one
node is likely to be able to compromise, or at least disable, the nearby nodes
as well. These would then rather support the falsified readings of the first node
than dispute them.
If some correlation can be assumed between the sensor readings of nodes
within a certain area that goes beyond the immediate reach of the adversary,
nodes may still monitor each other’s readings and report gross aberrations. If
a node constantly reports data that is inconsistent with its neighbours’ readings,
it might be expelled from the network. However, such a mechanism must
be careful not to miss important events whose patterns may be misjudged as