Calculating trust in sensor networks

A malicious node may refuse to forward all or some packets that it receives. This is known
as a blackhole or a greyhole-attack. These attacks work if the attacker is able to inject
itself into a route.
A sinkhole is a node that tries to lure all possible routes to itself by advertising itself as a
very high-quality candidate to other nodes. A laptop that disguises itself as a node may
use a high-powered radio to advertise itself to the whole network. As most communications
from the network are towards the sink-node, a sinkhole can effectively take over the network
by advertising itself as the best candidate for routing packets to the sink. A malicious
node may also launch a sybil-attack, in which it disguises itself as several nodes.
An attacker may also launch a wormhole-attack on the network. A wormhole occurs when
the traffic of one part of the network is relayed by a low-latency link to another part of
the network. This can effectively create a sinkhole since the attacker is able to create a
shorter connection to the sink from a distant part of the network.
An attacker can also spoof link layer acknowledgements for overheard packets. This can
be used to advertise a weak link as a strong link, or a dead node as a live node.
A method of combating some of these attacks is using link-layer encryption. This effectively
eliminates all but the wormhole-attack [KW03]. Wormholes may be detected by some
methods, for instance geographic routing protocols can notice if a route advertised through
a wormhole is well above their normal transmission ranges.
Eventually, if a node is compromised and the attacker gets around any possible encryption
or authentication mechanisms, there exists no possible way to counter any of the attacks
described above. The following chapter will give one possible solution to the problem of
compromised nodes, distributed trust management.
2.5 Summary
Sensor networks are ad hoc wireless networks formed by very small autonomous sensing
devices. These sensors typically contain a radio, a CPU, a small amount of memory and
run some sort of an embedded operating system complete with their on network stacks.
16