Protocols for Secure Communication in Wireless Sensor Networks

3.2. Attack Objectives 75
Critical decisions are often based on aggregated data, it is therefore essential
that the data is “correct” in the sense that even if some input on which the
aggregation is based is corrupt, the deviation from the “true” result (the result
that is obtained when no maliciously or otherwise induced errors are involved)
is minimal. A viable attack goal is therefore the manipulation of data such
that a false report is being accepted by the issuer of a query. Without any
precautions, even an attacker restricted to manipulating very few input values
could significantly influence the outcome of an aggregation. Consequently,
techniques for detecting or at least mitigating the effects of faulty input are
required.
Perfect resilience against manipulated input data is impossible to achieve
if the manipulated parts cannot be identified (which is usually the case). The
secure aggregations schemes by Wagner [186] and Przydatek et al. [146] therefore
aim at approximate integrity, where the result y ∗ of an aggregation with
partially corrupt input deviates from the result y that would have been obtained
in absence of an attacker only by a small value ε, i.e. |y ∗ − y| < ε. We note that
some slight deviation from the “true” value must be dealt with even when no
attacker is active, since sensor data is inherently subject to noise.
Since some cost is involved in aggregation, aggregated data should be considered
more valuable than raw sensor data. Therefore, it is often appropriate
to restrict read access to it and allow only authorized parties to obtain such data
even if access to raw sensor data is unrestricted.
The availability of aggregated data is endangered when the aggregating node
is compromised by the attacker. This would allow the attacker to delay or suppress
a report, at least temporarily. As “aggregator” is likely to be implemented
as a role in a sensor network, there is nothing to prevent another node from assuming
this role. If the answer to a query is not delivered in time, a role switch
could be triggered, the new aggregating node would repeat the aggregation process
and finally deliver the report. The suppression of data has the disadvantage
that other nodes can detect the malfunctioning, which could be used by an intrusion
detection system to mark the respective node as being “suspect” and
eventually isolate them.
The “origin” of aggregated, higher-level data is determined by the origin of
the raw data that serves as input to the aggregation process. Thus, the contextual
information that is attributed to the raw data, such as location and time, may
be maintained in the aggregated data. However, the origin of aggregated (i.e.,
processed) data becomes blurry and often such information will be discarded
for efficiency reasons.