Protocols for Secure Communication in Wireless Sensor Networks

3.3. Adversary Characteristics 81
concentrated in a certain area, he fully controls all reports from that area, but
he has no influence on the reports from other areas.
In general, the effectiveness of an attack highly varies with the geographical
distribution of the compromised nodes. We describe this in the following
through the principle of locality. We then go on discussing the effects of several
distributions of compromised nodes.
Principle of Locality
The influence on reports, which a compromised node can exercise, highly depends
on the location of the node. The most powerful position is at the source
of the report. If the compromised node itself creates a report, or a significant
part of it, it can make up the report with arbitrarily generated data. The power
of other nodes to verify such a report are limited and depend on application
semantics (e.g., to check the plausibility of reported data) and sensor range.
Similarly, if the receiver of a report is compromised, it may deliver arbitrary
data to the querying entity.
The second most powerful location where a node can exercise influence on
reports is either close to the receiver or close to the sender of a report. Here,
the probability that messages travel through a compromised node is high and
thus the node might have the opportunity to change the contents of a report by
manipulating these messages.
The threat of compromised nodes being located close to the receiver or being
the receiver itself can be overcome by obtaining a report in a redundant
manner, thus multiple receivers are established, which makes manipulations
more difficult. In most cases, redundancy cannot be applied to the source of a
report as easily.
Locations that are far away from either the sender or the receiver have a
much lower probability of influencing a report through message manipulation
as the likeliness that messages travel through specific nodes is low in densely
populated networks. Only if few alternate routes exist, nodes become bottlenecks
and draw traffic to them. This may be exploited by an attacker through
simulating congestion in certain areas, which may trigger the rerouting of messages.
The use of multiple paths that are spatially separated (discussed later in
Chapter 5) is a possible means to mitigate such threats.
It can be expected that the distribution of compromised nodes determines
how an attacker can influence the operations of a wireless sensor network. In
the following, we discuss some fundamental distribution patterns.