Protocols for Secure Communication in Wireless Sensor Networks

66 Chapter 3. A Security Model for Wireless Sensor Networks
tured nodes, but also by the attacker’s ability to interfere with the operations of
uncompromised nodes. Such interference may comprise the manipulation of
sensor readings, which in most cases requires physical access to the nodes or
the ability to change their environment, which may involve the use of powerful
equipment. Usually it is easier to tamper with the operations of uncompromised
nodes from within the network. Since sensor nodes act as message forwarders
on behalf of other nodes, it is easy for them to drop messages or manipulate
their contents. Thus, the selection of compromised nodes will be important for
determining the strength of an attack as some nodes are more valuable to an
attacker than others.
The best known protection against attacks on communications are end-toend
security associations such as shared keys or those provided by a public
key infrastructure. However, such associations can be prohibitively costly in
wireless sensor networks. Therefore, we explore alternative approaches that
provide approximations to end-to-end security while still achieving an adequate
level of protection.
3.1 Attack Paths
Today’s research prototypes of sensor nodes employ virtually no protection
mechanisms at all. Re-programming is easily possible with little technical requirements
[15]. This is, of course, due to the early technical stage of development,
and the research focus on functional and operational aspects of sensor
networking. Also, the real-world deployment of sensor networks is in its infancy,
so the demand for secure sensor devices has not yet emerged. Should the
demand arise, it is probably possible to develop devices with a certain level of
hardware protection, profiting from experience in other areas. With appropriate
financial investment, it seems perfectly feasible to build sensor devices that
are physically isolated from their environment except for dedicated communication
interfaces. These interfaces remain to be secured through cryptographic
means and secure protocol engineering.
There are three levels on which vulnerabilities may exist despite of careful
design and engineering. The first is the physical level, i.e. vulnerabilities of the
hardware. These are hard to protect against, since sensor networks are often deployed
in open environments, and reliable physical protection is expensive. The
second level is comprised of the interfaces that are offered by a sensor node.
Some interfaces are indispensable, since communication with other nodes is required,
and connections to sensors have to exist. The third level is the software
running on sensor nodes. Secure software engineering is a quickly developing