Calculating trust in sensor networks

[PSW04]. A shared network-wide key would create a single point of failure, where a
compromised node may leak the key. Public-key cryptography (such as Diffie-Hellman
key establishment) can prove to be computationally beyond the capabilities of sensor
nodes. Other approaches, such as using the sink-node or a distributed pool of random
keys to authenticate other nodes, have been proposed but they still are vulnerable to one
or several captured nodes.
Another aspect to consider is the ease of access an attacker may have to a node. A sensor
network will most likely consist of many unattended nodes scattered across a large area
so gaining access to a node will most likely be easy. Because of financial considerations,
a node may not have a very tamper-proof exterior. Thus, one possible attack on a sensor
network is node capture, where an attacker can capture and reprogram a node [BBD06]. If
this attack goes unnoticed it may result in a node that behaves in an arbitrarily malicious
way.
If an attacker captures a node, he may extract code and keys from the node and use this
information to launch an attack from more powerful computers. An off-the-shelf laptop
will have hugely more powerful processors, more sensitive antennas and higher-powered
radio transmitters than any node. A laptop computer can more efficiently eavesdrop or
disrupt the sensor network. Several laptops may also be connected by a faster low-latency
network that allows an attacker to mount coordinated assaults from different parts of the
network.
There are several ways an attacker may take advantage of a node upon gaining physical
access [BBD06]. An attacker may change the sensing unit of a node and thus inject
erroneous data to the network. Some nodes are designed as modular units and changing
the sensing component could be as easy as unplugging the old one and replacing it with a
new one. This operation could only take a couple of seconds. If the sensing component is
soldered into the node it may be harder to change, but a skilled attacker could still do it
in a matter of minutes.
An attacker may also be interested in reading or writing the external memory of the node
if it is possible that sensitive information is stored in it. The simplest way to do this
14