Protocols for Secure Communication in Wireless Sensor Networks

60 Chapter 2. Wireless Sensor Networks and Their Security
to authenticate messages from the base station, but it remains unknown to the
receiving nodes. This means that nodes must buffer these messages first. Only
after a certain delay after the end of its validity period, it is disclosed by openly
broadcasting it. At that moment, nodes can (1) verify the authenticity of the
key (by computing the according step in the hash chain) and (2) authenticate
the messages that have been sent by the base station.
The deferred disclosure is necessary in order to avoid abuse of the key by
malicious nodes or an external attacker. If the key would be disclosed before
the validity period ends, it could be used by an attacker to inject authenticated
messages.
The key is disclosed only after the end of its validity period, plus the disclosure
delay. This is required in order to compensate for slight misalignments in
the nodes’ clocks. Thus, tight time synchronization between all nodes and the
base station is not required.
µTESLA is extremely efficient to implement, as it requires each node to
store only two keys, and the only cryptographic operation is the computation
of hash functions (message authentication is based on the same hash function).
The overhead per message is caused by the message authentication code, which
is 8 byte using RC5 as the hash function, which was used in [142]. The key
disclosure messages incur little overhead since they can be piggy-backed on
other messages from the base station. Only if no other traffic is generated,
extra messages for key disclosure have to be sent.
The reverse communication pattern to broadcast is aggregation. Here, data
collected by sensor nodes is transmitted towards the base station (or another
data sink). The individual data packets are not simply concatenated and passed
on by intermediary nodes, but rather the data is combined and compacted. This
minimizes the size of transmitted data but preserves its usefulness for the application.
For example, the average, minimum, and maximum temperature in a
room could be determined in this way without having to preserve every single
data item.
The threat to data aggregation is that malicious nodes could falsify the aggregation
result by either injecting false sensor data of their own, or by passing
on falsified aggregation information. This cannot be completely prevented, as
false sensor data may be indistinguishable to a faulty sensor. Also, as sensor
data from different sources is integrated, authentication information of individual
data packets is lost.
The work described in [146] and [186] approaches this problem from a statistical
perspective. The objective is to reduce the possible error introduced by
malicious nodes below a certain threshold. Data aggregation is also discussed