Security PDF

University of Nebraska - Lincoln
DigitalCommons@University of Nebraska - Lincoln

CSE Journal Articles Computer Science and Engineering, Department of
2006
A Survey of Security Issues In Wireless Sensor

Networks
Yong Wang
University of Nebraska-Lincoln
Garhan Attebury
University of Nebraska-Lincoln, [email protected]
Byrav Ramamurthy
University of Nebraska-Lincoln, [email protected]
Follow this and additional works at: http://digitalcommons.unl.edu/csearticles

Part of the Computer Sciences Commons
Wang, Yong; Attebury, Garhan; and Ramamurthy, Byrav, "A Survey of Security Issues In Wireless Sensor Networks" (2006). CSE
Journal Articles. 84.
http://digitalcommons.unl.edu/csearticles/84
This Article is brought to you for free and open access by the Computer Science and Engineering, Department of at DigitalCommons@University of
Nebraska - Lincoln. It has been accepted for inclusion in CSE Journal Articles by an authorized administrator of DigitalCommons@University of
Nebraska - Lincoln.
2ND QUARTER 2006, VOLUME 8, NO. 2
www.comsoc.org/pubs/surveys
A SURVEY OF SECURITY ISSUES IN

WIRELESS SENSOR NETWORKS
YONG WANG, GARHAN ATTEBURY, AND BYRAV RAMAMURTHY
UNIVERSITY OF NEBRASKA-LINCOLN
ABSTRACT
Wireless Sensor Networks (WSNs) are used in many applications in mil-
itary, ecological, and health-related areas. These applications often include
the monitoring of sensitive information such as enemy movement on the
battlefield or the location of personnel in a building. Security is therefore
important in WSNs. However, WSNs suffer from many constraints, includ-
ing low computation capability, small memory, limited energy resources,
susceptibility to physical capture, and the use of insecure wireless communi-
cation channels. These constraints make security in WSNs a challenge. In
this article we present a survey of security issues in WSNs. First we outline
the constraints, security requirements, and attacks with their corresponding
countermeasures in WSNs. We then present a holistic view of security
issues. These issues are classified into five categories: cryptography, key
management, secure routing, secure data aggregation, and intrusion detec-
tion. Along the way we highlight the advantages and disadvantages of vari-
ous WSN security protocols and further compare and evaluate these
protocols based on each of these five categories. We also point out the
open research issues in each subarea and conclude with possible future
research directions on security in WSNs.
A dvances in wireless communication and electronics

have enabled the development of low-cost, low-
power, multifunctional sensor nodes. These tiny sen-
sor nodes, consisting of sensing, data processing, and
communication components, make it possible to deploy Wire-
between sensor networks and ad hoc networks are [4]:
• The number of sensor nodes in a sensor network can be
several orders of magnitude higher than the nodes in an
ad hoc network.
• Sensor nodes are densely deployed.
less Sensor Networks (WSNs), which represent a significant • Sensor nodes are prone to failures due to harsh environ-
improvement over traditional wired sensor networks. WSNs ments and energy constraints.
can greatly simplify system design and operation, as the envi- • The topology of a sensor network changes very frequently
ronment being monitored does not require the communica- due to failures or mobility.
tion or energy infrastructure associated with wired networks • Sensor nodes are limited in computation, memory, and
[1]. power resources.
WSNs are expected to be solutions to many applications, • Sensor nodes may not have global identification.
such as detecting and tracking the passage of troops and tanks These differences greatly affect how secure data-transfer
on a battlefield, monitoring environmental pollutants, measur- schemes are implemented in WSNs. For example, the use of
ing traffic flows on roads, and tracking the location of person- radio transmission, along with the constraints of small size,
nel in a building. Many sensor networks have mission-critical low cost, and limited energy, make WSNs more susceptible to
tasks and thus require that security be considered [2, 3]. denial-of-service attacks [5]. Advanced anti-jamming tech-
Improper use of information or using forged information may niques such as frequency-hopping spread spectrum and physi-
cause unwanted information leakage and provide inaccurate cal tamper-proofing of nodes are generally impossible in a
results. sensor network due to the requirements of greater design
While some aspects of WSNs are similar to traditional complexity and higher energy consumption [5]. Furthermore,
wireless ad hoc networks, important distinctions exist which the limited energy and processing power of nodes makes the
greatly affect how security is achieved. The differences use of public key cryptography nearly impossible. While the
2 1553-877X IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

results from recent studies show that public key Internet BS
cryptography might be feasible in sensor net-
works [6, 7], it remains for the most part infeasi-
ble in WSNs. Instead, most security schemes
make use of symmetric key cryptography. One
thing required in either case is the use of keys for Sensor node
User
secure communication. Managing key distribution
is not unique to WSNs, but again constraints such
as small memory capacity make centralized key- Position finding system Mobilizer
ing techniques impossible. Straight pairwise key
sharing between every two nodes in a network Transmission
does not scale to large networks with tens of Sensing unit Processing unit unit
thousands of nodes, as the storage requirements Processor
Sensor ADC Transceiver
are too high. A security scheme in WSNs must Storage
provide efficient key distribution while maintain-
ing the ability for communication between all rel-
evant nodes. Power
In addition to key distribution, secure routing Power unit generator
protocols must be considered. These protocols
are concerned with how a node sends messages
to other nodes or a base station. A key challenge n Figure 1. The components of a sensor node (Source: [4]).
is that of authenticated broadcast. Existing
authenticated broadcast methods often rely on
public key cryptography and include high computational over- BACKGROUND
head making them infeasible in WSNs. Secure routing proto-
cols proposed for use in WSNs, such as SPINS [8], must COMMUNICATION ARCHITECTURE
consider these factors. Additionally, the constraint on energy
in WSNs leads to the desire for data aggregation. This aggre- A WSN is usually composed of hundreds or thousands of
gation of sensor data needs to be secure in order to ensure sensor nodes. These sensor nodes are often densely deployed
information integrity and confidentiality [9, 10]. While this is in a sensor field and have the capability to collect data and
achievable through cryptography, an aggregation scheme must route data back to a base station (BS). A sensor consists of
take into account the constraints in WSNs and the unique four basic parts: a sensing unit, a processing unit, a transceiver
characteristics of the cryptography and routing schemes. It is unit, and a power unit [4]. It may also have additional applica-
also desirable for secure data aggregation protocols to be flex- tion-dependent components such as a location finding system,
ible, allowing lower levels of security for less important data, power generator, and mobilizer (Fig. 1). Sensing units are
thus saving energy, and allowing higher levels of security for usually composed of two subunits: sensors and analog-to-digi-
more sensitive data, thus consuming more energy. tal converters (ADCs). The ADCs convert the analog signals
As with any network, awareness of compromised nodes produced by the sensors to digital signals based on the
and attacks is desirable. Many security schemes provide assur- observed phenomenon. The processing unit, which is generally
ance that data remain intact and communication unaffected as associated with a small storage unit, manages the procedures
long as fewer than t nodes are compromised [11]. The ability that make the sensor node collaborate with the other nodes.
of a node or base station to detect when other nodes are com- A transceiver unit connects the node to the network. One of
promised enables them to take action, either ignoring the the most important units is the power unit. A power unit may
compromised data or reconfiguring the network to eliminate be finite (e.g., a single battery) or may be supported by power
the threat. scavenging devices (e.g., solar cells). Most of the sensor net-
The remainder of this article discusses the above areas in work routing techniques and sensing tasks require knowledge
more detail and considers how they are all required to form a of location, which is provided by a location finding system.
complete WSN security scheme. A few existing surveys on Finally, a mobilizer may sometimes be needed to move the
security issues in ad hoc networks can be found in [12–14]; sensor node, depending on the application.
however, only small sections of these surveys focus on WSNs. The protocol stack used in sensor nodes contains physical,
A recent survey article on security issues in mobile ad hoc data link, network, transport, and application layers defined as
networks also included an overview of security issues in WSNs follows [4]:
[15]. However, the article did not discuss cryptography and • Physical layer: responsible for frequency selection, carrier
intrusion detection issues. Further, it included only a small frequency generation, signal deflection, modulation, and
portion of the available literature on security in WSNs. data encryption
The rest of this article is organized as follows. Background • Data link layer: responsible for the multiplexing of data
information on WSNs is presented, followed by a discussion streams, data frame detection, medium access, and error
of attacks in the different network layers of sensor networks. control; as well as ensuring reliable point-to-point and
Then we focus on the selection of cryptography in WSNs, key point-to-multipoint connections
management, secure routing schemes, secure data aggrega- • Network layer: responsible for specifying the assignment
tion, and intrusion detection systems. We discuss future of addresses and how packets are forwarded
research directions on security in WSNs and then conclude • Transport layer: responsible for specifying how the reli-
the article. able transport of packets will take place
• Application layer: responsible for specifying how the data
are requested and provided for both individual sensor
nodes and interactions with the end user
IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 3

Berkeley mote [16]
EYES [17] Medusa MK-2 [18] Imote[19]
WeC rene2 rene2 dot mica
Month/Year 09/99 10/00 06/01 08/01 02/02 03/02 09/02 01/03
CPU AT90LS8535 ATmega163 ATmega1031 MSP 430F149 40MHz ARM THUMB ARM core 12MHz
Prog. memory 8KB 16KB 128KB 60KB 1MB 512KB
RAM 0.5KB 1KB 4KB 2KB 136KB 64KB
Radio RFM TR1000 916MHz RFM TR1001 868.35MHz RFM TR1000 916MHz BT 2.4 GHz
Rate 10 kb/s 10/40 kb/s 115 kb/s 115 kb/s 100kb/s
1 Later versions are an ATmega128 running in 103 mode.
n Table 1. Variety of real-life sensor nodes.

CONSTRAINTS IN WSNS SECURITY REQUIREMENTS
Individual sensor nodes in a WSN are inherently resource The goal of security services in WSNs is to protect the infor-
constrained. They have limited processing capability, storage mation and resources from attacks and misbehavior. The
capacity, and communication bandwidth. Each of these limita- security requirements in WSNs include:
tions is due in part to the two greatest constraints — limited • Availability, which ensures that the desired network ser-
energy and physical size. Table 1 shows several currently avail- vices are available even in the presence of denial-of-ser-
able sensor node platforms. The design of security services in vice attacks
WSNs must consider the hardware constraints of the sensor • Authorization, which ensures that only authorized sensors
nodes: can be involved in providing information to network ser-
• Energy: energy consumption in sensor nodes can be cate- vices
gorized into three parts: • Authentication, which ensures that the communication
–Energy for the sensor transducer from one node to another node is genuine, that is, a
–Energy for communication among sensor nodes malicious node cannot masquerade as a trusted network
–Energy for microprocessor computation node
The study in [20, 21] found that each bit transmitted in • Confidentiality, which ensures that a given message can-
WSNs consumes about as much power as executing 800–1000 not be understood by anyone other than the desired
instructions. Thus, communication is more costly than compu- recipients
tation in WSNs. Any message expansion caused by security • Integrity, which ensures that a message sent from one
mechanisms comes at a significant cost. Further, higher secu- node to another is not modified by malicious intermedi-
rity levels in WSNs usually correspond to more energy con- ate nodes
sumption for cryptographic functions. Thus, WSNs can be • Nonrepudiation, which denotes that a node cannot deny
divided into different security levels, depending on energy cost sending a message it has previously sent
[22, 23]. • Freshness, which implies that the data is recent and
• Computation: the embedded processors in sensor nodes ensures that no adversary can replay old messages
are generally not as powerful as those in nodes of a Moreover, as new sensors are deployed and old sensors
wired or ad hoc network. As such, complex cryptographic fail, we suggest that forward and backward secrecy should also
algorithms cannot be used in WSNs. be considered:
• Memory: memory in a sensor node usually includes flash • Forward secrecy: a sensor should not be able to read any
memory and RAM. Flash memory is used for storing future messages after it leaves the network.
downloaded application code and RAM is used for stor- • Backward secrecy: a joining sensor should not be able to
ing application programs, sensor data, and intermediate read any previously transmitted message.
computations. There is usually not enough space to run The security services in WSNs are usually centered around
complicated algorithms after loading OS and application cryptography. However, due to the constraints in WSNs, many
code. In the SmartDust project, for example, TinyOS already existing secure algorithms are not practical for use.
consumes about 3500 bytes of instruction memory, leav- We discuss this problem in the section “Cryptography in
ing only 4500 bytes for security and applications [20, 21]. WSNs” below.
This makes it impractical to use the majority of current
security algorithms [8]. With an Intel Mote, the situation THREAT MODEL
is slightly improved, but still far from meeting the
requirements of many algorithms. In WSNs, it is usually assumed that an attacker may know the
• Transmission range: the communication range of sensor security mechanisms that are deployed in a sensor network;
nodes is limited both technically and by the need to con- they may be able to compromise a node or even physically
serve energy. The actual range achieved from a given capture a node. Due to the high cost of deploying tamper-
transmission signal strength is dependent on various resistant sensor nodes, most WSN nodes are viewed as non-
environmental factors such as weather and terrain. tamper-resistant. Further, once a node is compromised, the
attacker is capable of stealing the key materials contained
within that node.
4 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

Base stations in WSNs are usually regarded as trustworthy. promises a sensor node and injects a false data value
Most research studies focus on secure routing between sen- through that sensor node.
sors and the base station. Deng et al. considered strategies In these attacks, keeping the sensor network available for
against threats which can lead to the failure of the base sta- its intended use is essential. DoS attacks against WSNs may
tion [24]. permit real-world damage to the health and safety of people
Attacks in sensor networks can be classified into the fol- [5]. In this section, we focus only on DoS attacks and their
lowing categories: countermeasures in sensor networks. We discuss attacks on
• Outsider versus insider attacks: outside attacks are secrecy and authentication in the section “Secure Routing
defined as attacks from nodes which do not belong to a Protocols,” and discuss stealthy attacks and countermeasures
WSN; insider attacks occur when legitimate nodes of a in the section “Intrusion Detection” below.
WSN behave in unintended or unauthorized ways. The DoS attack usually refers to an adversary’s attempt to
• Passive versus active attacks: passive attacks include disrupt, subvert, or destroy a network. However, a DoS attack
eavesdropping on or monitoring packets exchanged with- can be any event that diminishes or eliminates a network’s
in a WSN; active attacks involve some modifications of capacity to perform its expected function [5]. Sensor networks
the data steam or the creation of a false stream. are usually divided into layers, and this layered architecture
• Mote-class versus laptop-class attacks: in mote-class makes WSNs vulnerable to DoS attacks, as DoS attacks may
attacks, an adversary attacks a WSN by using a few occur in any layer of a sensor network.
nodes with similar capabilities to the network nodes; in Previous discussions on DoS attacks in WSNs can be found
laptop-class attacks, an adversary can use more powerful in [3, 5, 26, 27]. The remainder of this section summarizes the
devices (e.g., a laptop) to attack a WSN. These devices possible DoS attacks and countermeasures in each layer of a
have greater transmission range, processing power, and sensor network.
energy reserves than the network nodes.
PHYSICAL LAYER
EVALUATION
The physical layer is responsible for frequency selection, carri-
We suggest using the following metrics to evaluate whether er frequency generation, signal detection, modulation, and
a security scheme is appropriate in WSNs. data encryption [4]. As with any radio-based medium, there
• Security: a security scheme has to meet the requirements exists the possibility of jamming in WSNs. In addition, nodes
discussed above. in WSNs may be deployed in hostile or insecure environments
• Resiliency: in case a few nodes are compromised, a secu- where an attacker has easy physical access. These two vulnera-
rity scheme should still protect against the attacks. bilities are explored in this subsection.
• Energy efficiency: a security scheme must be energy effi-
cient so as to maximize node and network lifetime. Jamming — Jamming is a type of attack which interferes with
• Flexibility: key management needs to be flexible so as to the radio frequencies that a network’s nodes are using [3, 5].
allow for different network deployment methods, such as A jamming source may either be powerful enough to disrupt
random node scattering and predetermined node place- the entire network or less powerful and only able to disrupt a
ment. smaller portion of the network. Even with lesser-powered
• Scalability: a security scheme should be able to scale jamming sources, such as a small compromised subset of the
without compromising the security requirements. network’s sensor nodes, an adversary has the potential to dis-
• Fault-tolerance: a security scheme should continue to rupt the entire network provided the jamming sources are
provide security services in the presence of faults such as randomly distributed in the network.
failed nodes. Typical defenses against jamming involve variations of
• Self-healing: sensors may fail or run out of energy. The spread-spectrum communication such as frequency hopping
remaining sensors may need to be reorganized to main- and code spreading [5]. Frequency-hopping spread spectrum
tain a set level of security. (FHSS) is a method of transmitting signals by rapidly switch-
• Assurance: assurance is the ability to disseminate differ- ing a carrier among many frequency channels using a pseudo
ent information at different levels to end-users [25]. A random sequence known to both transmitter and receiver.
security scheme should offer choices with regard to Without being able to follow the frequency selection sequence,
desired reliability, latency, and so on. an attacker is unable to jam the frequency being used at a
given moment in time. However, as the range of possible fre-
quencies is limited, an attacker may instead jam a wide sec-
ATTACKS IN SENSOR NETWORKS tion of the frequency band.
Code spreading is another technique used to defend
WSNs are vulnerable to various types of attacks. According to against jamming attacks and is common in mobile networks.
the security requirements in WSNs, these attacks can be cate- However, this technique requires greater design complexity
gorized as [3]: and energy, thus restricting its use in WSNs. In general, to
• Attacks on secrecy and authentication: standard crypto- maintain low cost and low power requirements, sensor devices
graphic techniques can protect the secrecy and authentic- are limited to single-frequency use and are therefore highly
ity of communication channels from outsider attacks susceptible to jamming attacks.
such as eavesdropping, packet replay attacks, and modifi-
cation or spoofing of packets. Tampering — Another physical layer attack is tampering [5].
• Attacks on network availability: attacks on availability are Given physical access to a node, an attacker can extract sensi-
often referred to as denial-of-service (DoS) attacks. DoS tive information such as cryptographic keys or other data on
attacks may target any layer of a sensor network. the node. The node may also be altered or replaced to create
• Stealthy attacks against service integrity: in a stealthy a compromised node which the attacker controls. One defense
attack, the goal of the attacker is to make the network to this attack involves tamper-proofing the node’s physical
accept a false data value. For example, an attacker com- package [5]. However, it is usually assumed that the sensor

nodes are not tamper-proofed in WSNs due to the additional • Power efficiency is an important consideration.
cost. This indicates that a security scheme must consider the • Sensor networks are mostly data-centric.
situation in which sensor nodes are compromised. • An ideal sensor network has attribute-based addressing
and location awareness.
LINK LAYER The attacks in the network and the routing layer include
the following.
The data link layer is responsible for the multiplexing of data
streams, data frame detection, medium access, and error con- Spoofed, Altered, or Replayed Routing Information —
trol [4]. It ensures reliable point-to-point and point-to-multi- The most direct attack against a routing protocol in any net-
point connections in a communication network. Attacks at the work is to target the routing information itself while it is being
link layer include purposely introduced collisions, resource exchanged between nodes. An attacker may spoof, alter, or
exhaustion, and unfairness. This subsection looks at each of replay routing information in order to disrupt traffic in the
these three link-layer attack categories [5]. network [26]. These disruptions include the creation of rout-
ing loops, attracting or repelling network traffic from select
Collisions — A collision occurs when two nodes attempt to nodes, extending and shortening source routes, generating
transmit on the same frequency simultaneously [5]. When fake error messages, partitioning the network, and increasing
packets collide, a change will likely occur in the data portion, end-to-end latency.
causing a checksum mismatch at the receiving end. The pack- A countermeasure against spoofing and alteration is to
et will then be discarded as invalid. An adversary may strategi- append a message authentication code (MAC) after the mes-
cally cause collisions in specific packets such as ACK control sage. By adding a MAC to the message, the receivers can veri-
messages. A possible result of such collisions is the costly fy whether the messages have been spoofed or altered. To
exponential back-off in certain media access control (MAC) defend against replayed information, counters or timestamps
protocols. can be included in the messages [8].
A typical defense against collisions is the use of error-cor-
recting codes [5]. Most codes work best with low levels of col- Selective Forwarding — A significant assumption made in
lisions, such as those caused by environmental or probabilistic multihop networks is that all nodes in the network will accu-
errors. However, these codes also add additional processing rately forward received messages. An attacker may create
and communication overhead. It is reasonable to assume that malicious nodes which selectively forward only certain mes-
an attacker will always be able to corrupt more than what can sages and simply drop others [26]. A specific form of this
be corrected. While it is possible to detect these malicious col- attack is the black hole attack in which a node drops all mes-
lisions, no complete defenses against them are known at this sages it receives. One defense against selective forwarding
time. attacks is using multiple paths to send data [26]. A second
defense is to detect the malicious node or assume it has failed
Exhaustion — Repeated collisions can also be used by an and seek an alternative route.
attacker to cause resource exhaustion [5]. For example, a
naive link-layer implementation may continuously attempt to Sinkhole — In a sinkhole attack, an attacker makes a com-
retransmit the corrupted packets. Unless these hopeless promised node look more attractive to surrounding nodes by
retransmissions are discovered or prevented, the energy forging routing information [5, 26]. The end result is that sur-
reserves of the transmitting node and those surrounding it will rounding nodes will choose the compromised node as the next
be quickly depleted. node to route their data through. This type of attack makes
A possible solution is to apply rate limits to the MAC selective forwarding very simple, as all traffic from a large
admission control such that the network can ignore excessive area in the network will flow through the adversary’s node.
requests, thus preventing the energy drain caused by repeated
transmissions [5]. A second technique is to use time-division Sybil — The Sybil attack is a case where one node presents
multiplexing where each node is allotted a time slot in which more than one identity to the network [3, 26, 27]. Protocols
it can transmit [5]. This eliminates the need of arbitration for and algorithms which are easily affected include fault-tolerant
each frame and can solve the indefinite postponement prob- schemes, distributed storage, and network-topology mainte-
lem in a back-off algorithm. However, it is still susceptible to nance. For example, a distributed storage scheme may rely on
collisions. there being three replicas of the same data to achieve a given
level of redundancy. If a compromised node pretends to be
Unfairness — Unfairness can be considered a weak form of two of the three nodes, the algorithms used may conclude that
a DoS attack [5]. An attacker may cause unfairness in a net- redundancy has been achieved while in reality it has not.
work by intermittently using the above link-layer attacks.
Instead of preventing access to a service outright, an attacker Wormholes — A wormhole is a low-latency link between two
can degrade it in order to gain an advantage such as causing portions of the network over which an attacker replays net-
other nodes in a real-time MAC protocol to miss their trans- work messages [26]. This link may be established either by a
mission deadline. The use of small frames lessens the effect of single node forwarding messages between two adjacent but
such attacks by reducing the amount of time an attacker can otherwise non-neighboring nodes or by a pair of nodes in dif-
capture the communication channel. However, this technique ferent parts of the network communicating with each other.
often reduces efficiency and is susceptible to further unfair- The latter case is closely related to the sinkhole attack, as an
ness, for example, when an attacker is trying to retransmit attacking node near the base station can provide a one-hop
quickly instead of randomly delaying. link to that base station via the other attacking node in a dis-
tant part of the network. Hu et al. presented a novel and gen-
NETWORK AND ROUTING LAYER eral mechanism called packet leashes for detecting and
defending against wormhole attacks [28]. Two types of leashes
The network and routing layer of sensor networks is usual- were introduced: geographic leashes and temporal leashes.
ly designed according to the following principles [4]: The proposed mechanisms can also be used in WSNs.

Network Attacks Defense
Spread-spectrum, priority messages, lower duty cycle, region

Jamming
Physical mapping, mode change
Tampering
Tamper-proofing, hiding
Collision Error-correcting code

Link Exhaustion Rate limitation
Unfairness Small frames
Spoofed, altered or replayed routing information Egress filtering, authentication, monitoring

Selective forwarding Redundancy, probing
Sinkhole Authentication, monitoring, redundancy
Network and Sybil Authentication, probing
routing Wormholes Authentication, packet leashes by using geographic and
temporal information
Hello flood attacks Authentication, verify the bidirectional link
Acknowledgment spoofing Authentication
Flooding Client puzzles

Transport
Desynchronization Authentication
n Table 2. Sensor network layers and denial-of-service defenses. that host to request
the retransmission of
missed frames. If timed correctly, an attacker may degrade or
Hello Flood Attacks — Many protocols which use HELLO even prevent the ability of the end hosts to successfully
packets make the naive assumption that receiving such a exchange data, thus causing them to instead waste energy by
packet means the sender is within radio range and is therefore attempting to recover from errors which never really existed.
a neighbor. An attacker may use a high-powered transmitter A possible solution to this type of attack is to require
to trick a large area of nodes into believing they are neighbors authentication of all packets communicated between hosts [5].
of that transmitting node [26]. If the attacker falsely broad- Provided that the authentication method is itself secure, an
casts a superior route to the base station, all of these nodes attacker will be unable to send the spoofed messages to the
will attempt transmission to the attacking node, despite many end hosts.
being out of radio range in reality. Table 2 shows the possible DoS attacks and countermea-
sures in WSNs.
Acknowledgment Spoofing — Routing algorithms used in In the following sections we discuss cryptography, key man-
sensor networks sometimes require Acknowledgments to be agement protocols, secure routing protocols, secure data
used. An attacking node can spoof the Acknowledgments of aggregation, and intrusion detection for WSNs. For the
overheard packets destined for neighboring nodes in order to remainder of this article, we use the following notation:
provide false information to those neighboring nodes [26]. An • A, B are principals such as communicating nodes.
example of such false information is claiming that a node is • IDA denotes the sensor identifier of node A.
alive when in fact it is dead. • N A is a nonce generated by A (a nonce is an unpre-
dictable bit string, usually used to achieve freshness).
TRANSPORT LAYER • K AB denotes the secret pairwise key shared between A
and B.
The transport layer is responsible for managing end-to-end • MK is the encryption of message M with key K
connections [4]. Two possible attacks in this layer, flooding • MAC(K,M) denotes the computation of the message
and desynchronization, are discussed in this subsection. authentication code of message M with key K
• A → B denotes A unicasts a message to B
Flooding — Whenever a protocol is required to maintain • A → * denotes A broadcasts a message to its neighbors
state at either end of a connection it becomes vulnerable to
memory exhaustion through flooding [5]. An attacker may
repeatedly make new connection requests until the resources CRYPTOGRAPHY IN WSNS
required by each connection are exhausted or reach a maxi-
mum limit. In either case, further legitimate requests will be Selecting the most appropriate cryptographic method is vital
ignored. One proposed solution to this problem is to require in WSNs because all security services are ensured by cryptog-
that each connecting client demonstrate its commitment to raphy. Cryptographic methods used in WSNs should meet the
the connection by solving a puzzle [5]. The idea is that a con- constraints of sensor nodes and be evaluated by code size,
necting client will not needlessly waste its resources creating data size, processing time, and power consumption. In this
unnecessary connections. Given that an attacker does not like- section, we focus on the selection of cryptography in WSNs.
ly have infinite resources, it will be impossible for him/her to Public key cryptography, discussed first, is followed by sym-
create new connections fast enough to cause resource starva- metric key cryptography.
tion on the serving node. While these puzzles do include pro-
cessing overhead, this technique is more desirable than PUBLIC KEY CRYPTOGRAPHY IN WSNS
excessive communication.
Many researchers believe that the code size, data size, pro-
Desynchronization — Desynchronization refers to the dis- cessing time, and power consumption make it undesirable for
ruption of an existing connection [5]. An attacker may, for public key algorithm techniques, such as the Diffie–Hellman
example, repeatedly spoof messages to an end host, causing key agreement protocol [29] or RSA signatures [30], to be

Operation
Algorithm
time (s)
multiplication. However, ECC point multiplication outper-
ECC secp160r1 0.81s forms RSA private key operation by an order of magnitude.
The RSA private key operation, which is too slow, limits its
ECC secp224r1 2.19s use in a sensor node. ECC has no such issues since both the
public key operation and private key operation use the same
RSA-1024 public-key e = 216 + 1 0.43s point multiplication operations.
Wander et al. investigated the energy cost of authentication
RSA-1024 private key w. CRT1 10.99 and key exchange based on RSA and ECC cryptography on
an Atmel ATmega128 processor [7]. The result is shown in
Table 4. The ECC-based signature is generated and verified
RSA-2048 public-key e = 216 + 1 1.94s
using the Elliptic Curve Digital Signature Algorithm (ECDSA)
[41]. The key exchange protocol is a simplified version of the
RSA-2048 private-key w. CRT1 83.26 SSL handshake, which involves two parties: a client initiating
the communication and a server responding to the initiation
1 Chinese Remainder Theory [42]. The WSN is assumed to be administered by a central
point with each sensor having a certificate signed by the cen-
n Table 3. Public key cryptography: average ECC tral point’s private key using a RSA or ECC signature. In the
and RSA execution times (Source: [6]). handshake process, the two parties verify each other’s certifi-
cate and negotiate the session key to be used in the communi-
cation. As Table 4 shows, in comparison with RSA
employed in WSNs. cryptography at the same security level, ECDSA signatures
Public key algorithms such as RSA are computationally are significantly cheaper than RSA signatures and ECDSA
intensive and usually execute thousands or even millions of verifications are within reasonable range of RSA verifications.
multiplication instructions to perform a single security opera- Further, the ECC-based key exchange protocol outperforms
tion. Further, a microprocessor’s public key algorithm effi- the RSA-based key exchange protocol at the server side, and
ciency is primarily determined by the number of clock cycles there is almost no difference in the energy cost for these two
required to perform a multiply instruction [31]. Brown et al. key exchange protocols at the client side. In addition, the rela-
found that public key algorithms such as RSA usually require tive performance advantage of ECC over RSA increases as
on the order of tens of seconds and up to minutes to perform the key size increases in terms of the execution time and ener-
encryption and decryption operations in constrained wireless gy cost. Tables 3 and 4 indicate that ECC is more appropriate
devices which exposes a vulnerability to DoS attacks [32]. On than RSA for use in sensor networks.
the other hand, Carman et al. found that it usually takes a The implementation of RSA and ECC cryptography on
microprocessor thousands of nano-joules to do a simple multi- Mica2 motes further proved that a public key based protocol
ply function with a 128 bit result [31]. In contrast, symmetric is viable for WSNs. Two modules, TinyPK [43], based on
key cryptography algorithms and hash functions consume RSA, and TinyECC [44], based on ECC, have been designed
much less computational energy than public key algorithms. and implemented on Mica2 motes using the TinyOS develop-
For example, the encryption of a 1024-bit block consumes ment environment. Similar work was also conducted by Malan
approximately 42 mJ on the MC68328 DragonBall processor et al. on ECC cryptography using a Mica2 mote [45]. In their
using RSA, while the estimated energy consumption for a 128 work, ECC was used to distribute a single symmetric key for
bit AES block is a much lower at 0.104 mJ [31]. the link-layer encryption provided by the TinySec module
Recent studies have shown that it is feasible to apply pub- [46].
lic key cryptography to sensor networks by using the right While public key cryptography may be possible in sensor
selection of algorithms and associated parameters, optimiza- nodes, the public key operations are still expensive. The
tion, and low-power techniques [6, 7, 33]. The investigated assumptions in [33, 45] may not be satisfied in some applica-
public key algorithms include Rabin’s Scheme [34], NtruEn- tions. For example, the work in [33, 45] concentrated on the
crypt [35], RSA [30], and Elliptic Curve Cryptography (ECC) public key operations only, assuming the private key opera-
[36, 37]. Most studies in literature focus on RSA and ECC tions will be performed by a base station or a third party. By
algorithms. The attraction of ECC is that it appears to offer selecting appropriate parameters, for example, using the small
equal security for a far smaller key size, thereby reducing pro- integer e = 216 + 1 as the public key, the public key operation
cessing and communication overhead. For example, RSA with time can be extremely fast while the private key operation
1024 bit keys (RSA-1024) provides a currently time does not change. The limitation of private key operation
accepted level of security for many applications
and is equivalent in strength to ECC with 160 bit
Algorithm Signature Key Exchange
keys (ECC-160) [38]. To protect data beyond the
year 2010, RSA Security recommends RSA-2048
as the new minimum key size which is equivalent Sign Verify Client Server
to ECC with 224 bit keys (ECC-224) [39]. Table
3 summarizes the execution time of ECC and RSA-1024 304 11.9 15.4 304
RSA implementations on an Atmel ATmega128
processor (used by Mica2 mote) [6]. The execu- ECDSA-160 22.82 45.09 22.3 22.3
tion time is measured on average for a point mul-
tiplication in ECC and a modular exponential RSA-2048 2302.7 53.7 57.2 2302.7
operation in RSA. ECC secp160r1 and secp224r1
are two standardized elliptic curves defined in ECDSA-224 61.54 121.98 60.4 60.4
[40]. As shown in Table 3, by using the small
integer e = 216 + 1 as the public key, RSA public
key operation is slightly faster than ECC point
nTable 4. Public key cryptography: average energy costs of digital signature and
key exchange computations [mJ]. (Source: [7]).

Algorithm Operation time (ms)
Skipjack (C) [47] 0.38ms The performance of symmetric key cryptography is mainly
decided by the following factors:
RC5 (C, assembly) [48] 0.26ms • Embedded data bus width: many encryption algorithms
n Table 5. Symmetric key cryptography: average

prefer 32 bit word arithmetic, but most embedded pro-
cessors usually use 8 or 16 bit wide data bus.
RC5 and skipjack execution times (Source: • Instruction set: the Instruction Set Architecture (ISA)
[46]). has specific effects on certain algorithms. For example,
most embedded processors do not support the variable-
bit rotation instruction like ROL (rotate bits left) of the
Intel architecture, which greatly improves the perfor-
Algorithm Energy
mance of RC5.
Due to the constraints in sensor nodes, symmetric key
SHA-1 (C) [49] 5.9 mJ/byte cryptography is preferred in a WSN.
AES-128 Enc/Dec (assembly) OPEN RESEARCH ISSUES
1.62/2.49 mJ/byte
[50]
n Table 6. Symmetric key cryptography: average Selecting the appropriate cryptography method for sensor
nodes is fundamental to providing security services in WSNs.
energy numbers for AES and SHA-1. (Source: However, the decision depends on the computation and com-
[7]). munication capability of the sensor nodes. Open research
issues range from cryptography algorithms to hardware design
as described below:
occurring only at a base station makes many security services • Recent studies on public key cryptography have demon-
using public key algorithms not available under these schemes. strated that public key operations may be practical in
Such services include peer-to-peer authentication and secure sensor networks. However, private key operations are
data aggregation. still too expensive in terms of computation and energy
In contrast, Tables 5 and 6 show the execution time and cost to accomplish in a sensor node. The application of
energy cost of two symmetric cryptography protocols on an private key operations to sensor nodes needs to be stud-
Atmel ATmega128 processor. In Table 5, the execution time ied further.
was measured on a 64 bit block using a 80 bit key. From the • Symmetric key cryptography is superior to public key
table we can see that symmetric key cryptography is faster and cryptography in terms of speed and low energy cost.
consumes less energy as compared to public key cryptography. However, the key distribution schemes based on symmet-
In the next section we focus on symmetric key cryptography. ric key cryptography are not perfect. Efficient and flexi-
ble key distribution schemes need to be designed.
SYMMETRIC KEY CRYPTOGRAPHY IN WSNS • It is also likely that more powerful motes will need to be
designed in order to support the increasing requirements
The constraints on computation and power consumption in for computation and communication in sensor nodes.
sensor nodes limit the application of public key cryptography
in WSNs. Thus, most research studies focus on symmetric key
cryptography in sensor networks. KEY MANAGEMENT PROTOCOLS
Five popular encryption schemes, RC4 [51], RC5 [48],
IDEA [51], SHA-1 [49], and MD5 [51, 52], were evaluated on Key management is a core mechanism to ensure the security
six different microprocessors ranging in word size from 8 bit of network services and applications in WSNs. The goal of key
(Atmel AVR) to 16 bit (Mitsubishi M16C) to 32 bit widths management is to establish required keys between sensor
(StrongARM, XScale) in [53]. The execution time and code nodes which must exchange data. Further, a key management
memory size were measured for each algorithm and platform. scheme should also support node addition and revocation
The experiments indicated uniform cryptographic cost for while working in undefined deployment environments. Due to
each encryption class and each architecture class. The impact the constraints on sensor nodes, key management schemes in
of caches was negligible while Instruction Set Architecture WSNs have many differences with the schemes in ad hoc net-
(ISA) support was limited to specific effects on certain algo- works.
rithms. Moreover, hashing algorithms (MD5 and SHA-11) As shown above, public key cryptography suffers from limi-
incurred almost an order of a magnitude higher overhead tations in WSNs. Thus, most proposed key management
than encryption algorithms (RC4, RC5, and IDEA). schemes are based on symmetric key cryptography. Further, a
In [54], Law et al. evaluated two symmetric key algorithms: straight pairwise private key sharing scheme between every
RC5 and TEA [55]. They further evaluated six block ciphers, pair of nodes is also impractical in WSNs. A pairwise private
including RC5 and RC6 [56], Rijndael [50], MISTY1 [57], key sharing scheme requires predistribution and storage of n –
KASUMI [58], and Camellia [59] on IAR Systems’ 1 keys in each node, where n is the number of nodes in a sen-
MSP430F149 in [60]. The benchmark parameters were code, sor network. Due to the large amount of memory required,
data memory, and CPU cycles. The evaluation results showed pairwise schemes are not viable when the network size is
that Rijndael is suitable for high-security and energy-efficiency large. Moreover, most key pairs would be unusable since
requirements while MISTY1 is suitable for good storage and direct communication is possible only among neighboring
energy efficiency. The evaluation results in [60] disagreed with nodes. This scheme is also not flexible for node addition and
the work in [8] in which RC5 was selected as the revocation. In this section, we discuss key management proto-
encryption/decryption scheme, and with the work in [22] in cols in WSNs. Another investigation of key management
which RC6 was selected. The work in [60] provides a good mechanisms for WSNs can be found in [61].
resource for deciding which symmetric algorithm should be Figure 2 shows a taxonomy of key management protocols
adopted in sensor networks. in WSNs. According to the network structure, the protocols

Key management protocols in WSNs
KEY MANAGEMENT PROTOCOLS BASED ON THE
PROBABILITY OF KEY SHARING
In the remainder of this section, we present the
Network structure Probability of key sharing
key management protocols based on the proba-
bility of key sharing between a pair of sensor
nodes. We first discuss deterministic approaches
Centralized Distributed Probabilistic Deterministic
and then discuss probabilistic approaches.
key scheme key scheme key scheme key scheme
Deterministic Approaches — Zhu et al. have
proposed a key management protocol, Localized
Encryption and Authentication Protocol
LKHW [62] LEAP [63], BROSK [64] Random key schemes LKHW [62], (LEAP), for sensor networks in [63]. LEAP sup-
CDTKeying [65], [67, 68, 69, 70, 71, 72, LEAP [63],
73, 74] BROSK [64], ports the establishment of four types of keys for
IOS/DMBS [66],
random key schemes [67 CDTKeying [65], each sensor node:
68, 69, 70, 71, 72, 73, 74] IOS/DMBS [66]
• An individual key shared with the base
station (predistributed)
• A group key that is shared by all the
n Figure 2. Key management protocols in WSNs: a taxonomy. nodes in the network (predistributed)
• Pairwise keys shared with immediate
neighboring nodes
can be divided into centralized key schemes and distributed • A cluster key shared with multiple neighboring nodes
key schemes. According to the probability of key sharing The pairwise keys shared with immediate neighboring
between a pair of sensor nodes, the protocols can be divided nodes are used to protect peer-to-peer communication while
into probabilistic key schemes and deterministic key schemes. the cluster key is used for local broadcast. The pairwise keys
In this section, we present a detailed overview of the main key can be set up as follows: in the key predistribution stage, each
management protocols in WSNs. We start with key manage- sensor node is loaded with an initial key KI and each node A
ment protocols based on network structure. generates a master key KA = fKI (A), where f is a pseudoran-
dom function. Then, in the neighbor discovery stage, A broad-
NETWORK STRUCTURE BASED casts a HELLO message and expects an Acknowledgment
KEY MANAGEMENT PROTOCOLS from neighboring nodes, e.g., node B:
The underlying network structure plays a significant role in A → *: A

the operation of key management protocols. According to the B → A: B, MAC(KB, A|B)
structure, the protocols can be divided into two categories:
centralized key schemes and distributed key schemes. Node A computes its pairwise key with B, KAB = fKB(A). Node
B knows A, K B and can also compute K AB in the same way.
Centralized Key Management Schemes — In a centralized Then, KAB serves as their pairwise key.
key scheme, there is only one entity, often called a key distri- Cluster key establishment follows the pairwise key estab-
bution center (KDC), that controls the generation, regenera- lishment phase. Suppose node A wants to establish a cluster
tion, and distribution of keys. The only proposed centralized key with all its immediate neighbors B1, B2, …, Bm. Node A
key management scheme for WSNs in the current literature is first generates a random key KcA, then encrypts this key with
the LKHW scheme, which is based on the Logical Key Hier- the pairwise key shared with each neighbor, and finally trans-
archy (LKH) [62]. In this scheme, the base station is treated mits the encrypted key to each neighbor Bi where 1 ≤ m:
as a KDC and all keys are logically distributed in a tree root-
ed at the base station. A → Bi: (KcA)KABi
The central controller does not have to rely on any auxil-
iary entity to perform access control and key distribution. LEAP uses unicast for key exchange. Notice that most of
However, with only one managing entity, the central server is the proposed security protocols were based on point-to-point
a single point of failure. The entire network and its security handshaking procedures to negotiate session keys. Lai et al.
will be affected if there is a problem with the controller. Dur- have proposed a BROadcast Session Key (BROSK) negotia-
ing the time when the controller is not working, the network tion protocol [64]. BROSK assumes a master key is shared by
becomes vulnerable as keys are not generated, regenerated, all nodes in the network. To establish a session key K with its
and distributed. Furthermore, the network may become too neighbors, such as node B, a sensor node A broadcasts a key
large to be managed by a single entity, thus affecting scalabili- negotiation message:
ty.
A → *: IDA|NA,MAC(K, IDA|NA)
Distributed Key Management Schemes — In the distribut- B → * : IDB|NB,MAC(K, IDB|NB)
ed key management approaches, different controllers are used
to manage key generation, regeneration, and distribution, thus A and B will receive the broadcast message. They can verify
minimizing the risk of failure and allowing for better scalabili- the message using the master key K and both A and B can cal-
ty. In this approach, more entities are allowed to fail before culate the shared session key:
the whole network is affected.
Most proposed key management schemes are distributed KAB = MAC(K,NA|NB)
schemes. These schemes also fall into deterministic and prob-
abilistic categories, which are discussed in detail in the follow- BROSK therefore establishes pairwise session keys between
ing subsection. every two neighboring nodes. It is both scalable and energy
efficient.

Camtepe and Yener have proposed a deterministic key dis- to successfully attack any link. Because k << P, it only affects
tribution schemes for WSNs using Combinatorial Design The- a small number of sensor nodes.
ory [65]. The combinatorial design theory based pairwise key Inspired by the work in [68], which we call the basic ran-
predistribution (CDTKeying) scheme is based on block design dom key scheme in the following section, additional random
techniques in combinatorial design theory. It employs sym- key predistribution schemes have been proposed in [69–74].
metric and generalized quadrangle design techniques. The In the basic random key scheme, any two neighboring
scheme uses a finite projective plane of order n (for prime nodes need to find a single common key from their key rings
power n) to generate a symmetric design with parameters n2 in order to establish a secure link in the key setup phase.
+ n + 1, n + 1, 1. The design supports n 2 + n + 1 nodes, However, Chan et al. observed that increasing the amount of
and uses a key-pool of size n2 + n + 1. It generates n2 + n + key overlap in the key ring can increase the resilience of the
1 key chains of size n + 1 where every pair of key chains has network against node capture [69]. Thus, they proposed a q-
exactly one key in common, and every key appears in exactly n composite keying scheme, in which it is required that at least
+ 1 key chains. After the deployment, every pair of nodes q common keys be shared in the key setup phase in order to
finds exactly one common key. Thus, the probability of key build a secure link between any two neighboring nodes. Fur-
sharing among a pair of sensor nodes is 1. The disadvantage ther, a key update phase was introduced to enhance the basic
of this solution is that the parameter n has to be a prime random key scheme. Suppose A has a secure link to B after
power, thus indicating that not all network sizes can be sup- the key setup phase and the secure key k is from the key pool
ported for a fixed key-chain size. P. Because k may be residing in the key-ring memory of some
Lee and Stinson have proposed two combinatorial design other nodes in the network, the security of the link between A
theory based deterministic schemes: the ID-based one-way and B is jeopardized if any of those nodes are captured. Thus,
function scheme (IOS) and the deterministic multiple space it is better to update the communication key between A and B
Blom’s scheme (DMBS) [66]. They further discussed the use instead of using a key in the key pool. To address this prob-
of combinatorial set systems in the design of deterministic key lem, they presented a multipath key reinforcement for the key
predistribution schemes for WSNs in [67]. update. Assume there are j disjoint paths between A and B. A
generates j random values v1, v2, …, vj and then routes each
Probabilistic Approaches — Most proposed key manage- random value along a different path to B. When B has
ment schemes in WSNs are probabilistic and distributed received all j keys, the new link key can be computed by both
schemes. A and B as follows:
Eschenauer and Gligor introduced a key predistribution
scheme for sensor networks which relies on probabilistic key k′ = k ⊕ v1 ⊕ v2 ⊕ … ⊕ vj
sharing among the nodes of a random graph in [68]. This
scheme consists of three phases: key predistribution, shared- The adversary has to eavesdrop on all j paths if he/she
key discovery, and path key establishment. In the key predis- wants to reconstruct the communication key. This security
tribution phase, each sensor is equipped with a key ring held enhancement comes at the cost of more communication over-
in the memory. The key ring consists of k keys which are ran- head needed to find multiple disjoint paths. Further, Chan et
domly drawn from a large pool of P keys. The association al. also developed a random-pairwise keys scheme for node-
information of the key identifiers in the key ring and sensor to-node authentication.
identifier is also stored at the base station. Further, the Blundo et al. presented a polynomial-based key predistri-
authors assumed that each sensor shares a pairwise key with bution protocol for group key predistribution [75] which can
the base station. In the shared key discovery phase, each sen- also be adapted to sensor networks. The key setup server ran-
sor discovers its neighbors within the wireless communication domly generates a bivariate t-degree polynomial f(x, y) =
range with which it shares keys. Two methods to accomplish Σit,j=0 aijxiyj over a finite field Fq where q is a prime number
this are suggested in [68]. The simplest method is for each that is large enough to accommodate a cryptographic key such
node to broadcast a list of identifiers of the keys in their key that it has the property of f(x, y) = f(y, x). For each sensor i,
ring in plain text, thus allowing neighboring nodes to check the setup server computes a polynomial share of f(x, y), that
whether they share a key. However, an adversary may observe is, f(i, y). For any two sensor nodes i and j, node i can com-
the key-sharing patterns among sensors in this way. The sec- pute the common key f(i, j) by evaluating f(i, y) at point j, and
ond method uses the challenge–response technique to hide node j can compute the same key f(j, i) = f(i, j) by evaluating
key-sharing patterns among nodes from an adversary. For f(j, y) at point i. In this approach, each sensor node i needs to
every Ki on a key ring, each node could broadcast a list α, EKi store a t-degree polynomial f(i, x), which occupies (t + 1) log
(α), i = 1, …, k where α is a challenge. The decryption of q storage space. This scheme is unconditionally secure and t-
E Ki (α) with the proper key by a recipient would reveal the collusion resistant. However, the storage cost for a polynomial
challenge and establish a shared key with the broadcasting share is exponential in terms of the group size, making it pro-
node. This method requires that the challenge α be well hibitive in sensor networks.
known in the sensor network, thus allowing the recipient with Inspired by the work of [68, 69, 75], Liu and Ning pro-
the proper key to discover the challenge. posed a polynomial pool-based key predistribution scheme in
Finally, in the path-key establishment phase, a path-key is [70], which also includes three phases: setup, direct key estab-
assigned for those sensor nodes within wireless communica- lishment, and path key establishment. In the setup phase, the
tion range and not sharing a key, but connected by two or setup server randomly generates a set F of bivariate t-degree
more links at the end of the second phase. If a node is com- polynomials over the finite field Fq. For each sensor node, the
promised, the base station can send a message to all other setup server picks a subset of polynomials Fi ⊆ F and assigns
sensors to revoke the compromised node’s key ring. Rekeying the polynomial shares of these polynomials to node i. In the
follows the same procedure as revocation. The messages from direct key establishment stage, the sensor nodes find a shared
the base station are signed by the pairwise key shared by the polynomial with other sensor nodes and then establish a pair-
base station and sensor nodes, and thus it is ensured that no wise key using the polynomial-based key predistribution
adversary can forge a base station. If a node is compromised, scheme discussed in [75]. The path key establishment phase is
the attacker has a probability of approximately k/P to be able similar to that in the basic random key scheme. Further, the

Master Pairwise Path Cluster Scala- Resili Process. Comm. Storage
Protocol Ref. Theory
key key key key bility ency load load load
All pairwise — n/a n/a Yes No No Low Low Low Low High
LEAP [63] n/a Yes Yes Yes Yes Good Low Low Low Low
BROSK [64] n/a Yes Yes No No Good Low Low Low Low
I
LKHW [62] LKH Yes Yes No Yes Limited Low Low Low Low
CDTKeying [65] Combinatorial n/a Yes No No Good Good Medium Medium High
IOS & DMBS [66] Combinatorial n/a Yes No No Good Good Medium Medium High
Basic random key [68] Random graph n/a Yes Yes No Good Good Medium Medium High
q-composite [69] Random graph n/a Yes Yes No Good Good Medium Medium High
t-degree
Polynomial based [70] polynomial & n/a Yes Yes No Good Good Medium Medium High
random graph
Blom's method
II Blom based [72] & random n/a Yes Yes No Good Good Medium Medium High
graph
Deployment
[73] Random graph n/a Yes Yes No Good Good Medium Medium Medium
knowledge based
Cluster key
[74] Random graph n/a Yes Yes No Good Good Medium Medium High
grouping
Location based [77] Random graph n/a Yes Yes No Good Good Medium Medium Medium
Note: Category I denotes deterministic approaches and category II denotes probabilistic approaches. Master key is the key shared by all the
nodes in the network. Pairwise key is the key shared between two neighboring nodes. Path key denotes the key shared between any two
nodes which need exchange data but does not share a pairwise key. Cluster key denotes the common key shared by all cluster members.
n Table 7. Classification and comparison of key management protocols in WSNs.

proposed framework allows for the study of multiple instantia-
tions of possible pairwise key establishment schemes. Two of • Store the kth row of matrix A at node k
the possible instantiations, the key predistribution scheme • Store the kth column of matrix G at node k
based on random subset assignment and the grid-based key Therefore, when nodes i and j need to find the pairwise key
predistribution scheme, are also presented and analyzed in the between them, they first exchange their columns of G, and
article. then respectively compute Kij and Kji using their private rows
Similar to [70], Du et al. presented another pairwise key of A.
predistribution scheme in [72] which uses Blom’s method [76]. In the proposed scheme in [72], each sensor node is loaded
The key difference between [70] and [72] is that the scheme in with G and τ distinct D matrices drawn from a large pool of ω
[70] is based on a set of bivariate t-degree polynomials while symmetric matrices D1, …, Dω of size (λ + 1) × (λ + 1). For
Du’s scheme is based on Blom’s method. The proposed each Di, calculate the matrix Ai = (Di ⋅ G)T and store the jth
scheme allows any pair of nodes in a network to be able to row of Ai at this node. After deployment, each node needs to
find a pairwise secret key. As long as no more than λ nodes discover whether it shares any space with neighbors. If they
are compromised, the network is perfectly secure (which is find out that they have a common space, the nodes can follow
called the λ-secure property). To use Blom’s method, during Blom’s method to build a pairwise key. The scheme in [72] is
the predeployment phase, the base station first constructs a (λ scalable and flexible. Moreover, it is substantially more
+ 1) × N matrix G over a finite field GF(q) where N is the resilient against node capture as compared to [70].
size of the network and G is considered to be public informa- Hwang et al. extended the basic random key scheme and
tion. Then the base station creates a random (λ + 1) × (λ + proposed a cluster key grouping scheme [74]. They further
1) symmetric matrix D over GF(q), and computes a N × (λ + analyzed the tradeoffs involved between energy, memory, and
1) matrix A = (D ⋅ G)T where (D ⋅ G)T is the transpose of D ⋅ security robustness.
G. Matrix D needs to be kept secret, and should not be dis- Notice that location information helps to avoid unneces-
closed to adversaries. It is easy to verify that A ⋅ G is a sym- sary key assignments and thus improve the performance of
metric matrix. sensor networks, for example, connectivity, memory usage,
and network resilience against node capture. Taking this into
A ⋅ G = (D ⋅ G)T ⋅ G = GT ⋅ DT ⋅ G = GT ⋅ D ⋅ G = (A ⋅ G)T account, two random key predistribution schemes were pro-
posed in [73, 77]. Although the presented schemes show
Thus, we know that Kij = Kji. The idea is to use Kij (or Kji) as improved performance, the deployment information (e.g.,
the pairwise key between nodes i and j. To carry out the location) is required when sensors are deployed.
above computation, in the predistribution phase, for any sen- The abovementioned schemes are classified and compared
sor k = 1, …, N: in Table 7.

OPEN RESEARCH ISSUES nerable to many kinds of attacks if authentication is not
Although some key management protocols have been pro- included in the protocol [26]. For example, it is easy for an
posed for sensor networks, the design of key management adversary to add himself/herself onto the path taken by a flow
protocols is still largely open to research. Open research of events as described in the following:
issues include the following: • The adversary can influence the path by spoofing positive
• The proposed key management protocols discussed in reinforcements. After receiving and rebroadcasting an
this section employ different strategies on the trade-off interest, an adversary could strongly reinforce the nodes
between memory, processing and communication over- to which the interest was sent while spoofing high-rate,
head. These protocols could be improved and new key low-latency events to the nodes from which the interest
management protocols need to be designed. was received.
• All key management protocols discussed in literature so • The adversary can replay the interests intercepted from a
far are based on symmetric key cryptography. Recent legitimate base station and list himself/herself as a base
progress in public key cryptography has shown that pub- station. All events satisfying the interest will then be sent
lic key cryptography may be suitable for sensor networks. to both the adversary and the legitimate base station.
Key management schemes based on public key cryptog- By using the attacks above, the adversary can add himself/
raphy need to be designed. herself onto the path and thus gain full control of the flow.
• Current proposed key management schemes assume that The adversary can eavesdrop, modify, and selectively forward
the base station is trustworthy. However, there may be packets of his/her choosing. He/she can drop all forwarded
situations (e.g., in the battlefield) where the security of a packets and act as a sinkhole. Further, a laptop-class adver-
base station needs to be considered. New schemes need sary can exert great influence on the topology by using a
to be designed considering the security of base stations. wormhole attack. The adversary creates a tunnel between a
node located near a base station and a node located close to
where events are likely to be generated. By spoofing positive
SECURE ROUTING PROTOCOLS or negative reinforcements, the adversary can push data flows
away from the base station and towards the nodes selected by
Many routing protocols have been specifically designed for the adversary.
WSNs. These routing protocols can be divided into three cate- Hierarchical and location based routing protocols not
gories according to the network structure: flat-based routing, incorporating security services are also vulnerable to many
hierarchical-based routing, and location-based routing [78]. In attacks [26]. For example, location-based routing protocols
flat-based routing, all nodes are typically assigned equal roles such as Geographic and Energy Aware Routing (GEAR) [80]
or functionality. In hierarchical-based routing, nodes play dif- require location information to be exchanged between neigh-
ferent roles in the network. In location-based routing, sensor bors. However, location information can be misrepresented.
node positions are used to route data in the network. Regardless of the adversary’s actual location, he/she may
Although many sensor network routing protocols have been advertise false position data to place himself/herself on the
proposed in literature, few of them have been designed with path of a known flow. Once on that path, the adversary can
security as a goal. Lacking security services in the routing pro- mount selective forwarding and Sybil attacks in the data flows.
tocols, WSNs are vulnerable to many kinds of attacks. Simulations in [81] found that such attacks have great influ-
Most network layer attacks against sensor networks fall ence on the overall ratio of successfully delivered messages in
into one of the categories described above, namely: the network.
• Spoofed, altered, or replayed routing information Secure routing in ad hoc networks is similar to that in sen-
• Selective forwarding sor networks and has been well studied in the literature [14].
• Sinkhole However, the defense mechanisms developed for ad hoc net-
• Sybil works cannot be directly applied to sensor networks because
• Wormholes of the differences between sensor and ad hoc networks dis-
• Hello flood attacks cussed earlier.
• Acknowledgment spoofing Ideally, a secure routing protocol should guarantee the
These attacks may be applied to compromise the routing integrity, authentication, and availability of messages in the
protocols in a sensor network. For example, directed diffusion presence of adversaries of arbitrary power. In the presence of
is a flat-based routing algorithm for drawing information from only outsider adversaries, it is conceivable to achieve these
a sensor network [79]. In directed diffusion, sensors measure idealized goals. However, in the presence of compromised
events and create gradients of information in their respective nodes or insider adversaries, especially those with laptop class
neighboring nodes. The base station requests data by broad- capabilities, it is most likely that some if not all of these goals
casting interest which describes a task to be conducted by the are not fully attainable. In this situation, the best we can hope
network. The interest is diffused through the network hop by for is graceful degradation instead of a complete compromise
hop, and broadcasted by each node to its neighbors. As the of the network. To achieve the above goal requires that a
interest is propagated throughout the network, gradients are routing protocol degrades no faster than a rate approximately
setup to draw data satisfying the query towards the requesting proportional to the ratio of compromised nodes to total nodes
node. Each sensor that receives the interest sets up a gradient in the network [26].
toward the sensor nodes from which it received the interest. A secure routing protocol depends on an appropriate key
This process continues until gradients are setup from the management scheme in a WSN, which has been discussed ear-
sources back to the base station. Interests initially specify a lier. Before a routing protocol starts, sensor nodes should
low rate of data flow, but once a base station starts receiving have been loaded with proper keys (e.g., the key for confiden-
events it will reinforce one or more neighboring nodes in tiality, authentication, etc.). One of the fundamental security
order to request higher data rate events. This process pro- services in sensor networks is broadcast authentication, which
ceeds recursively until it reaches the nodes generating events, enables the base station to broadcast authenticated data to
causing them to generate events at a higher data rate. Paths the entire sensor network. In this section, we first discuss the
may also be negatively reinforced. Directed diffusion is vul- broadcast authentication problem and then review several

F F F F
K0 K1 K2 K3 K4 Time ters. Notice that µTESLA requires that the base station uni-
cast initial parameters to individual sensor nodes, thus incur-
ring a long delay to boot up a large-scale sensor network. Liu
and Ning proposed a multilevel key chain scheme for broad-
P1 P2 P3 P4 P5 P6 P7 cast authentication to overcome this deficiency in [82, 83].
The basic idea in [82, 83] is to predetermine and broadcast
n Figure 3. Using a time-released key chain for source authenti- the initial parameters required by µTESLA instead of using
cation (Source: [8]). unicast-based message transmission. The simplest way is to
predistribute the µTESLA parameters with a master key dur-
ing the initialization of the sensor nodes. As a result, all sen-
secure routing schemes. sor nodes have the key chain commitments and other
necessary parameters once they are initialized, and are ready
BROADCAST AUTHENTICATION to use µTESLA as long as the starting time has passed. Fur-
thermore, Liu and Ning introduced a multilevel key chain
Previous proposals for authenticated broadcast are impractical scheme, in which the higher-level key chains are used to
in WSNs for the following reasons: authenticate the commitments of lower-level ones. However,
• Most proposals rely on public key cryptography for the the multilevel key chain scheme suffers from possible DoS
authentication. However, public key cryptography is attacks during the commitment distribution stage. Further,
impractical for WSNs; none of the µTESLA or multilevel key chain schemes is scal-
• Even one-time signature schemes that are based on sym- able in terms of the number of senders. In [84], a practical
metric key cryptography have too much overhead. broadcast authentication protocol was proposed to support a
µTESLA [10] and its extensions [82, 83] have been pro- potentially large number of broadcast senders using µTESLA
posed to provide broadcast authentication for sensor net- as a building block.
works. µTESLA provides broadcast authentication for base sta-
µTESLA is an authenticated broadcast protocol which was tions but is not suitable for local broadcast authentication.
proposed by Perrig et al. for the SPINS protocol [8]. µTESLA This is because µTESLA does not provide immediate authen-
introduces asymmetry through a delayed disclosure of sym- tication. For every received packet, a node has to wait for one
metric keys resulting in an efficient broadcast authentication µTESLA interval to receive the MAC key used in computing
scheme. µTESLA requires that the base station and nodes be the MAC for the packet. As a result, if µTESLA is used for
loosely time synchronized, and that each node knows an local broadcast authentication, a message traversing l hops
upper bound on the maximum synchronization error. will take at least l µTESLA intervals to arrive at the destina-
To send an authenticated packet, the base station simply tion. In addition, a sensor node has to buffer all the unverified
computes a MAC on the packet with a key that is secret at packets. Both the latency and the storage requirements limit
that point in time. When a node gets a packet, it can verify the scheme for authenticating infrequent messages broadcast
that the corresponding MAC key was not yet disclosed by the by the base station. Zhu et al. proposed a one-way key chain
base station. Since a receiving node is assured that the MAC scheme for one-hop broadcast authentication in LEAP [63].
key is known only by the base station, the receiving node is In this scheme, every node generates a one-way key chain of
assured that no adversary could have altered the packet in certain length and then transmits the commitment (i.e., the
transit. The node stores the packet in a buffer. At the time of first key) of the key chain to each neighbor, encrypted with
key disclosure, the base station broadcasts the verification key their pairwise shared key. Whenever a node has a message to
to all receivers. When a node receives the disclosed key, it can send, it attaches to the message the next authenticated key in
easily verify the correctness of the key. If the key is correct, the key chain. The authenticated keys are disclosed in an
the node can now use it to authenticate the packet stored in order that is reverse to their generation. A receiving neighbor
its buffer. can verify the message based on the commitment or an
Each MAC key is a key from the key chain, generated by a authenticated key it received from the sending node more
public one-way function F. To generate the one-way key recently.
chain, the sender chooses the last key Kn from the chain, and
repeatedly applies F to compute all other keys: Ki = F(Ki+1). SECURE ROUTING
Figure 3 shows an example of µTESLA. The receiver node
is loosely time-synchronized and knows K0 in an authenticated The goal of a secure routing protocol is to ensure the integri-
way. Packets P1 and P2 sent in interval 1 contain a MAC with ty, authentication, and availability of messages. The proposed
key K1. Packet P3 has a MAC using key K2. If P4, P5, and P6 secure routing protocols for WSNs in the literature are based
are all lost, as well as the packet that disclosed key K 1, the on symmetric key cryptography, except the work in [85], which
receiver cannot authenticate P1, P2, and P3. In interval 4 the is based on public key cryptography.
base station broadcasts key K2, which the nodes authenticate SPINS is a suite of security protocols optimized for sensor
by verifying K0 = F(F(K2)), and hence also know K1 = F(K2), networks [8]. SPINS includes two building blocks: SNEP and
so that they can authenticate packets P1, P2 with K1, and P3 µTESLA. SNEP provides data confidentiality, two-party data
with K2. authentication, and data freshness for peer-to-peer communi-
SPINS limits the broadcasting capability to only the base cation (node to base station). µTESLA provides authenticated
station. If a node wants to broadcast authenticated data, the broadcast as discussed before. We discuss SNEP in this sub-
node has to broadcast the data through the base station. The section.
data is first sent to the base station in an authenticated way. It SPINS assumes that each node is predistributed with a
is then broadcasted by the base station. master key K which is shared with the base station at creation
To bootstrap a new receiver, µTESLA depends on a point- time. All other keys, including a key K encr for encryption, a
to-point authentication mechanism in which a receiver sends a key K mac for MAC generation, and a key K rand for random
request message to the base station and the base station number generation, are derived from the master key using a
replies with a message containing all the necessary parame- strong one-way function. SPINS uses RC5 for confidentiality.

P2P Broadcast
Reference Routing Confidentiality Integrity Scalability
Authentication authentication
SNEP [8] Flat Yes Yes No Yes Good
LKHW [62] Flat Yes No No No Limited
µTESLA [8] Flat/Hierarchy No No Yes Yes Medium
Multi level key chains [82] Flat/Hierarchy No No Yes Yes Good
LEAP [63] Hierarchy Yes Yes Yes Yes Medium
n Table 8. Comparison of secure routing protocols.
If A wants to send a message to base station B, the complete (CA) [86]. However, the signature verification operations are
message that A sends to B is still too expensive for sensor nodes, as depicted in Table 3
and 4. Du et al. proposed an efficient alternative that uses
A → B : D〈Kencr,C〉,MAC(Kmac,C|D)〈Kencr,C〉 only a one-way hash function for the public key authentica-
tion. The proposed scheme can be divided into two stages. In
while D is the transmitted data and C is a shared counter the predistribution stage, a Merkle tree R is constructed with
between the sender and the receiver for the block cipher in each leaf Li corresponding to a sensor node (more informa-
counter mode. The counter C is incremented after each mes- tion on Merkle trees is given below). Let pki represent node
sage is sent and received in both the sender and receiver i’s public key, V be an internal tree node, and Vleft and Vright
sides. SNEP also provides a counter exchange protocol to syn- be V’s two children. The value of an internal tree node is
chronize the counter value in both sides. denoted by φ. The Merkle tree can then be constructed as fol-
SNEP offers the following properties: semantic security, lows:
data authentication, replay protection, weak freshness, and
low communication overhead. SPINS identifies two types of φ(Li) = h(idi, pki), for i = 1, …, N
freshness: weak freshness and strong freshness. Weak fresh-
ness provides partial message ordering and carries no delay φ(V) = h(φ(Vleft) || φ(Vright))
information while strong freshness provides a total order on a
request–response pair and allows for delay estimation. where “||” represents the concatenation of two strings and h
• Semantic security: The counter value is incremented after is a one-way hash function such as MD5 or SHA-1. Let R be
each message and thus the same message is encrypted the root of the tree. Each sensor node v needs to store the
differently each time. root value φ(R) and the sibling node values λ1, …, λH along
• Data authentication: A receiver can be assured that the the path from v to R. If node A wants to authenticate B’s pub-
message originated from the claimed sender if the MAC lic key, B sends its public key pk, along with the value of λ1,
verifies correctly. …, λ H to node A. Then, A can use the same procedure to
• Replay protection: The counter value in the MAC pre- reconstruct the Merkle tree R′ and calculate the root value
vents replaying old message. φ(R′). A will trust B to be authentic if φ(R′) = φ(R). A sensor
• Weak freshness: The counter also maintains a message node only needs H + 1 storage units for the extra hash values.
ordering in the receiver side and yields weak freshness. Based on this scheme, Du et al. further extended the idea to
SNEP provides weak data freshness only because there is reduce the height of the Merkle tree in order to improve the
no absolute assurance to node A that a message was cre- communication overhead of the scheme. The proposed
ated by node B in response to an event in node A. scheme is more efficient than signature verification on certifi-
• Low communication overhead: The counter state is kept cates. However, the scheme requires that some hash values be
at each end point and does not need to be sent in each distributed in a predistribution stage. This results in some
message. scalability issues when new sensors are added to an existing
The directed diffusion routing protocol was proposed by WSN.
Intanagonwiwat et al. without considering security issues [79]. The above discussion is summarized in Table 8.
Pietro et al. proposed an extension of the directed diffusion
protocol which provides secure multicasting in [62]. The OPEN RESEARCH ISSUES
extended scheme, Logical Key Hierarchy for WSNs (LKHW),
provides robustness in routing and security and supports both The development of secure routing protocols is challenging
backward and forward secrecy for sensor join and leave oper- because sensor nodes are prone to failures and the topology
ations. However, it does not provide data authentication. of a sensor network changes frequently due to node failures
Inspired by the work on public key cryptography [6, 7, 33, and possible mobility. Key open research issues include the
43], Du et al. investigated the public key authentication prob- following:
lem [85]. The use of public key cryptography eases many • The proposed secure routing protocols for WSNs focus
problems in secure routing, for example, authentication and on static sensor networks only, ignoring mobility. Secure
integrity. However, before a node A uses the public key from routing protocols for mobile sensor networks need to be
another node B, A must verify that the public key is actually investigated.
B’s (i.e., A must authenticate B’s public key); otherwise, man- • Current broadcast authentication schemes such as µTES-
in-the-middle attacks are possible. In general networks, public LA and its extensions require the sensor network to be
key authentication involves a signature verification on a cer- loosely time-synchronized. This requirement is often
tificate signed by a trusted third party Certificate Authority hard to meet and new techniques that do not require

Protocol operations
tive way is to provide data aggregation on concealed data,
which requires a particular class of encryption transformation.
However, this method usually lowers the security level.
Figure 4 shows a taxonomy of secure data aggregation pro-
tocols in WSNs. According to the protocol operation, secure
Plaintext-based Cipher-based data aggregation can be classified into two categories: plain-
aggregation aggregation text based and cipher based. This section reviews the tech-
niques for secure data aggregation.
PLAIN-TEXT BASED SECURE DATA AGGREGATION
Hu and Evans proposed a secure aggregation (SA) protocol

SA [9], SIA [10], SINP [88], for WSNs that is resilient to both intruder devices and single
ESPDA [89, 90] CDA [93], HSC [94] device key compromises [9]. However, the protocol may be
SDDA [91], WDA [92] vulnerable if a parent and a child node in the hierarchy are
compromised.
n Figure 4. Secure data aggregation in WSNs: a taxonomy. Przydatek et al. proposed a secure information aggregation
(SIA) framework for sensor networks [10]. The framework
consists of three node categories: a home server, base sta-
tion(s), and sensor nodes. A base station is a resources-
time synchronization are desirable. enhanced node which is used as intermediary between the
• New schemes with higher scalability and efficiency need home server and the sensor nodes, and is also the candidate
to be developed for the authenticated broadcast proto- to perform the aggregation task. SIA assumes that each sen-
cols. The recent progress on public key cryptography may sor has a unique identifier and shares a separate secret cryp-
facilitate the design of authenticated broadcast protocols. tographic key with both the home server and the aggregator.
• Quality of Service (QoS) in WSNs needs to be evaluated The keys enable message authentication and encryption if
with the addition of secure routing services. data confidentiality is required. Moreover, it further assumes
that the home server and base station can use a mechanism,
such as µTESLA, to broadcast authentic messages. The pro-
SECURE DATA AGGREGATION posed solution consists of three parts: computation of the
result, committing to the collected data, and reporting the
Data communication constitutes an important share of the aggregation result while proving the correctness of the result.
total energy consumption of the sensor network. The simula- In the first part, the aggregator collects the data from sen-
tion in [8] shows that data transmission accounts for 71 per- sors and locally computes the aggregation result. The aggrega-
cent of the energy cost of computation and communication tor can verify the authenticity of each sensor reading.
for the SNEP protocol. Thus, data aggregation can greatly In the second part, the aggregator commits to the collected
help conserve the scarce energy resources by eliminating data. The commitment to the input data ensures that the
redundant data. aggregator uses the data provided by the sensors, and that the
Data aggregation (fusion) protocols aim at eliminating statement to be verified by the home server about the correct-
redundant data transmitted across the network and are essen- ness of computed results is meaningful. One efficient way of
tial for energy-constrained WSNs. Traditional data aggrega- committing to the data is a Merkle hash-tree construction. In
tion techniques include simple types of queries such as SUM, this construction, all the data collected from the sensors is
COUNT, AVERAGE, and MIN/MAX. Some researchers also placed at the leaves of the tree. The aggregator then com-
extend data aggregation to median, the most frequent (con- putes a binary hash tree starting from the leaf nodes. Each
sensus) data values, a histogram of the data distribution, and internal node in the hash tree is computed as the hash value
range queries [87]. Data aggregation can be divided into two of the concatenation of its two child nodes. The root of the
stages: detection and data fusion. tree is called the commitment of the collected data. As the
In a WSN, there are usually certain nodes, called aggrega- hash function in use is collision resistant, once the aggregator
tors, helping to aggregate information requested by queries. commits to the collected values it cannot change any of them.
When an aggregator node is compromised, it is easy for the Figure 5 shows an example of a Merkle hash tree.
adversary to inject false data into sensor networks. Thus, the In the third part, the aggregator and the home server
aggregators are vulnerable to attack. Another possible attack engage in a protocol in which the aggregator communicates
is to compromise a sensor node and inject forged data through the aggregation result and the commitment to the server while
a sensor node. Without authentication, the attackers can fool proving to the server that the reported results are correct
the aggregators into reporting false data to the base station. using interactive proof protocols. Moreover, the authors also
Secure data aggregation requires authentication, confidentiali- presented efficient protocols for secure computation of the
ty, and integrity. Moreover, secure data aggregation also median and average of the measurements, for the estimation
requires the cooperation of sensor nodes to identify the com- of the network size, and for finding the minimum and maxi-
promised sensors. mum sensor reading.
However, requirements for confidentiality and data aggre- Deng et al. proposed a collection of mechanisms for secur-
gation are at odds with each other. Confidentiality requires ing in-network processing (SINP) for WSNs [88]. Security
the data to be transmitted in encrypted text while data aggre- mechanisms were proposed to address the downstream
gation is usually based on plain text. A straightforward requirement that sensor nodes authenticate commands dis-
method is to invoke end-to-end encryption and decryption seminated from parent aggregators and the upstream require-
before evoking data aggregation. However, the tradeoff is that ment that aggregators authenticate data produced by sensors
the end-to-end encryption and decryption operations consume before aggregating that data. In the downstream stage, two
more energy, which is of great concern in WSNs. An alterna- techniques are involved: one-way functions and µTESLA. The

v0,0=H(v1,0//v1,1)
to prove the validity of the fusion result, the

fusion node has to provide proofs from several
witnesses. A witness is one who also conducts
v1,0 v1,1 data fusion like a data fusion node, but does not
forward its result to the base station. Instead,
each witness computes the message authentica-
tion code (MAC) of the result and then provides
it to the data fusion node who must forward the
v2,0 v2,1 v2,2 v2,3 proofs to the base station.
Wagner studied secure data aggregation in
sensor networks and proposed a mathematical
framework for formally evaluating their security
[93]. In [11, 94], the authors proposed two data
fusion schemes for the filtering of injected false
v3,0 v3,1 v3,2 v3,3 v3,4 v3,5 v3,6 v3,7
data in sensor networks, which will be intro-
duced below.
H
CIPHER-BASED SECURE DATA AGGREGATION
Two cipher-based secure data aggregation

m0 m1 m2 m3 m4 m5 m6 m7 schemes were proposed in [95, 96], works which
are based on a particular encryption transforma-
n Figure 5. Merkle hash tree used to commit to a set of values. The aggregator tion called a privacy homomorphism (PH). This
is an encryption transformation that allows
constructs the Merkle hash tree over the sensor measurement m0, …, m7. To
direct computation on encrypted data. Let Q
construct the Merkle hash tree, the aggregator first hashes the measurements
and R denote two rings, and let + denote addi-
with a cryptographic hash function, e.g., v3,0 = H(m0), assuming that the size
tion and × denote multiplication on both. Let K
of the hash is smaller than the size of the data. Then, each internal value of the
be the key space. We denote an encryption trans-
Merkle hash tree is derived from its two child nodes: vi,j = H(vi+1,2j || vi+1,
formation E: K × Q → R and the corresponding
2j+1). The Merkle hash tree is a commitment to all the leaf nodes. Once the
decryption transformation D : K × R → Q. Given
aggregator commits to the collected values, it cannot change any of the collect-
a, b ∈ Q, and k ∈ K, we term
ed data. A verifier can authenticate any value by verifying that the leaf value is
used to derive the root node given the authentic root node v0,0. For example, to
a + b = Dk(Ek(a) + Ek(b))
authenticate the measurement m5, the aggregator sends m5 along with v3, 4,
v2,3, v1,0, and m5 is authentic if the following equality holds: v0,0 = H(v1,0 ||
additively homomorphic and
H(H(v3,4 || H(m5)) || v2,3)). (Source:[10]).
a × b = Dk(Ek(a) × Ek(b))
upstream stage requires that a pairwise key be shared between multiplicative homomorphic [12].
an aggregator and its sensor nodes. The proposed scheme in [95], Concealed Data Aggregation
Çam et al. proposed an energy-efficient secure pattern- (CDA), is based on the PH proposed in [97], although the
based data aggregation (ESPDA) protocol for wireless sensor study in [98] has shown that the proposed PH in [97] is unse-
networks in [89, 90]. ESPDA is applicable for hierarchy-based cure against chosen plain text attacks for some parameter set-
sensor networks. In ESPDA, a cluster head first requests sen- tings. In [95] the authors claimed that, for the WSN data
sor nodes to send the corresponding pattern code for the aggregation scenario, the security level is still adequate and
sensed data. If multiple sensor nodes send the same pattern the proposed PH method in [97] can be employed for encryp-
code to the cluster head, only one of them is permitted to tion. CDA can be used to calculate SUM and AVERAGE in
send the data to the cluster head. ESPDA is secure because it a hierarchical WSN. To calculate AVERAGE, an aggregator
does not require encrypted data to be decrypted by cluster- needs to know the number of sensor nodes n.
heads in order to perform data aggregation. Castelluccia et al. proposed a simple and provable secure
Further, the authors introduced a secure differential data additively homomorphic stream cipher (HSC) that allows for
aggregation (SDDA) scheme based on pattern codes [91]. the efficient aggregation of encrypted data [96]. The new
SDDA prevents redundant data transmission from sensor cipher uses modular addition and is therefore very well suited
nodes by implementing the following schemes: SDDA trans- for CPU-constrained devices such as those in WSNs. The
mits differential data rather than raw data, SDDA performs aggregation based on this cipher can be used to efficiently
data aggregation on pattern codes representing the main char- compute statistical values such as the mean, variance, and
acteristics of sensed data, and SDDA employs a sleep proto- standard deviation of sensed data while achieving significant
col to coordinate the activation of sensing units in such a way bandwidth gain.
that only one of the sensor nodes capable of sensing the data
is activated at a given time. In the SDDA data transmission OPEN RESEARCH ISSUES
scheme, the raw data from sensor nodes is compared to refer-
ence data with the difference data being transmitted. The ref- Data aggregation is essential for WSNs and security is abso-
erence data is obtained by taking the average of previously lutely necessary to defend against compromised sensor nodes.
transmitted data. Open research issues include the following:
Du et al. proposed a witness-based data aggregation • Several secure data aggregation protocols have been pro-
(WDA) scheme for WSNs to assure the validation of the data posed; however, no comparisons have been conducted on
sent from data fusion nodes to the base station [92]. In order these protocols. Further evaluation and comparison are

desirable to learn the performance of these protocols. lished a pairwise key with each of them.
The performance matrices might include security, pro- • A node can establish a pairwise key with another node
cessing overhead, communication overhead, energy con- that is multiple hops away if needed.
sumption, and data compression rate. Further, IHOP also assumes that the base station has a
• New data aggregation protocols need to be developed to mechanism to authenticate broadcast messages (e.g., µTES-
address higher scalability and higher reliability against LA).
aggregator and sensor node cheating. A cluster head collects information from its members and
sends a report to the base station only when at least t + 1 sen-
sors observe the same result. Meanwhile, a cluster head also
INTRUSION DETECTION collects the message authentication codes (MACs) from
detecting nodes. Each detecting node sends two MACs to the
The security mechanisms implemented in secure routing pro- cluster head: a MAC using the key shared with the base sta-
tocols and secure data aggregation protocols are configured tion, referred to as the individual MAC, and a MAC using the
ahead of time in order to inhibit an attacker from breaking key shared with its upper associate nodes, referred to as the
the security of the network. These security mechanisms alone pairwise MAC. The cluster head then compresses the t + 1
cannot ensure perfect security of a WSN. Since sensor nodes individual MACs by XORing them to reduces the size of a
can be compromised, it is easy for an adversary to inject false report. However, the pairwise MACs are not compressed for
data into a WSN through the compromised nodes. Authenti- transmission. If they were, a node relaying the message would
cation and data encryption are not enough for ensuring data not be able to extract the pairwise MACs of interest to it.
security. Another approach to protect WSNs involves mecha- Thus, a legitimate report includes t + 1 pairwise MACs and a
nisms for detecting and reacting to intrusions. compressed MAC for the base station. When an intermediate
An Intrusion Detection System (IDS) monitors a host or node receives a report, it verifies the MAC of its lower associ-
network for suspicious activity patterns outside normal and ate node. If it fails, the report is eliminated. Otherwise, it
expected behavior [5]. It is based on the assumption that there removes the MAC, generates a new MAC using its upper
exists a noticeable difference in the behaviors of an intruder associate node pairwise key, and appends it to the report.
and a legitimate user in the network such that an IDS can IHOP ensures that the base station can detect false data
match those preprogrammed or possibly learned rules. Based packets when no more than t nodes are compromised. Howev-
on the analysis model used for analyzing the audit data to er, the article does not show how to select the parameter t for
detect intrusions, IDSs in ad hoc networks are classified into a sensor network.
rule-based and anomaly-based systems. The rule-based intru- Ye et al. proposed a statistical en-route filtering (SEF)
sion detection systems are used to detect known patterns of mechanism that can detect and drop false data [94]. SEF uses
intrusions (e.g., [99] and [100]) while anomaly-based systems a similar key assignment scheme as the basic random key
are used to detect new or unknown intrusions (e.g., [101] and scheme presented in [68]. There is a global key pool and each
[102]). A rule-based IDS has a low false-alarm rate when sensor is pre-installed with a partition selected from the pool.
compared to an anomaly-based system, and an anomaly-based When a stimulus occurs in the fields, the sensors detecting
IDS has a high intrusion-detection rate in comparison to a this event elect one of the nodes as the center of stimulus
rule-based system. (CoS), a node which collects and summarizes the detection
However, WSNs are generally application-specific and lack results from all detecting nodes and produces a synthesized
basic information on topology, normal usage, expected com- report on behalf of the group. The CoS generates the report
munication patterns, and so forth. It is impractical to prein- and broadcasts the report to all detecting nodes. If a detecting
stall some fixed patterns in sensors before they are deployed. node agrees with the report, it generates a MAC using a key
Moreover, due to constraints in sensors, to learn and detect in its partition and sends the MAC to the CoS. The CoS
these parameters after deployment is both time and energy reports the stimulus to the base station only if it receives ade-
consuming. Thus, existing IDSs in ad hoc networks may not quate MACs. A legitimate report carries multiple MACs and
be adapted to WSNs. The research on intrusion detection in a single compromised node cannot fake all MACs. When an
WSNs is still preliminary. Current research focuses on how to en-route node receives the report, it verifies the correctness of
detect and eliminate injected false information. Note that the MACs probabilistically and drops those with invalid
compromised nodes can always inject false information into a MACs immediately. Finally, if a report reaches the base sta-
sensor network. Thus, cooperation among sensors, especially tion, the base station checks all the MACs and filters out any
neighboring nodes, is necessary to decide the validity of a remaining false reports that escaped the en-route filtering.
report. In this section, we discuss the intrusion detection tech- When a stimulus appears, multiple nodes that detect it collab-
niques in WSNs. orate to process the signal and elect the CoS based on the
sensing signal strength. The node with the strongest signal
INTRUSION DETECTION IN WSNS stands out as the CoS. To reduce the communication over-
head, SEF further uses a Bloom filter [103] to reduce MAC
Zhu et al. proposed an interleaved hop-by-hop authentication sizes. SEF is designed to protect against injected false infor-
(IHOP) scheme in [11]. IHOP guarantees that the base sta- mation and cannot defend against selective forwarding
tion will detect any injected false data packets when no more attacks.
than a certain number t of nodes are compromised. The sen- Deng et al. proposed an intrusion-tolerant routing in wire-
sor network is organized in a cluster-based hierarchy. Each less sensor networks (INSENS) in [104] and they further eval-
cluster head builds a route to the base station and each inter- uated its performance in [105]. INSENS is a proactive routing
mediate node has an upper associate node and a lower associ- protocol. The sensors collect local topology information and
ate node that is t + 1 hops away. IHOP depends on the use of send this information back to the base station. The base sta-
some sharing keys: tion generates a forwarding table based on the collected infor-
• Every node shares a master secret key with the base sta- mation and sends the routing table to the corresponding
tion. sensors. The base station is the central control point for calcu-
• Each node knows its one-hop neighbors and has estab- lating the routing table, which relieves the computation load

of individual sensors. Protecting against intrusions focuses on fy some of the future directions in the study of security issues
three attacks: DoS-type attacks, routing attacks, and select in WSNs as follows.
forwarding attacks. To protect against DoStype attacks, only • Exploit the availability of private key operations on sen-
the base station is allowed to broadcast to the entire network sor nodes: Recent studies on public key cryptography
and individual sensors can only send unicast messages. show that public key operations may be practical in sen-
INSENS requires some broadcast authentication scheme such sor nodes. However, private key operations are still too
as µTESLA. Although a compromised node may still alter a expensive to accomplish in a sensor node. As public key
valid message and broadcast that message to its neighbors, the cryptography can greatly ease the design of security in
damage is restricted to only nearby nodes and the down- WSNs, improving the efficiency of private key operations
stream nodes. To protect against routing attacks which propa- on sensor nodes is highly desirable.
gate erroneous control packets, a symmetric key is chosen for • Secure routing protocols for mobile sensor networks: The
confidentiality and authentication. Further, to protect against mobility of sensor nodes has a great influence on sensor
select forwarding attacks, data are sent to base stations along network topology and thus on the routing protocols.
two separate paths which are calculated by the base stations in Mobility can be at the base station, sensor nodes, or
the route discovery step. However, INSENS is built on a table both. Current protocols assume the sensor network is
based routing protocol, and as such depends on the base sta- stationary. New secure routing protocols for mobile sen-
tions to collect all needed topology information to calculate sor networks need to be developed.
the forwarding table for each individual sensor. Thus, INSENS • Continuous stream security in WSNs: Current work on
is not scalable in large sensor networks. security in sensor networks focuses on discrete events
Wang et al. proposed a scheme to detect whether a node is such as temperature and humidity. Continuous stream
faulty or malicious with the collaboration of neighbor nodes events such as video and images are not discussed. Video
[106]. In the proposed scheme, when a node suspects that one and image sensors for WSNs might not be widely avail-
of its neighbors is faulty, it sends out messages to request able now, but will likely be in the future. Substantial dif-
opinions on the behavior of this suspected node from other ferences in authentication and encryption exist between
neighbors of the suspect. After collecting the results, the node discrete events and continuous events, indicating that
analyzes the results to diagnose whether the suspect has a there will be distinctions between continuous stream
fault. The authors formalized the problem as how to construct security and the current protocols in WSNs.
a dominating tree to cover all the neighbors of the suspect • QoS and security: Performance is generally degraded
and further proposed two tree-based propagation collection with the addition of security services in WSNs. Current
protocols to construct a dominating tree and collect informa- studies on security in WSNs focus on individual topics
tion via the tree structure. such as key management, secure routing, secure data
aggregation, and intrusion detection. QoS and security
OPEN RESEARCH ISSUES services need to be evaluated together in WSNs.
Intrusion detection in WSNs is still largely open to research.

Key research issues include the following: SUMMARY
• Due to the constraints in WSNs, intrusion detection has
many aspects that are not of concern in other network As WSNs grow in capability and are used more frequently,
types. The problem of intrusion detection needs to be the need for security in them becomes more apparent. How-
well defined in WSNs. ever, the nature of nodes in WSNs gives rise to constraints
• The proposed IDS protocols in literature focus on filter- such as limited energy, processing capability, and storage
ing injected false information only [11, 94, 104]. These capacity. These constraints make WSNs very different from
protocols need to be improved so as to address scalability traditional ad hoc wireless networks. As such, special proto-
issues. cols and techniques have been developed for use in WSNs.
While existing surveys [12–15] discuss security in wireless
networks, none focus specifically on security in WSNs and the
SECURITY IN WSNS: FUTURE DIRECTIONS constraints unique to them. In this article, we have surveyed
the security issues in WSNs starting with the attacks and
WSNs are promising solutions for many applications and countermeasures in each network layer followed by the issues
security is often a key concern. Although research efforts have and solutions in cryptography, key management, secure rout-
been made with regard to cryptography, key management, ing, secure data aggregation, and, finally, intrusion detection.
secure routing, secure data aggregation, and intrusion detec- While the discussed security services certainly add more com-
tion in WSNs, there are still some challenges to be addressed. putation, communication, and storage overhead in WSNs, and
First, the selection of the appropriate cryptographic methods thus consume more energy, they are highly desirable and
depends on the processing capability of sensor nodes, indicat- often required in real-world applications.
ing that there is no unified solution for all sensor networks.
Instead, the security mechanisms are highly application-specif- ACKNOWLEDGMENTS
ic. Second, sensors are characterized by the constraints on
energy, computation capability, memory, and communication This work is partially supported by NSF Grant no. CCR-
bandwidth. The design of security services in WSNs must sat- 0311577. The authors thank the anonymous reviewers for
isfy these constraints. Third, most of the current protocols their valuable comments on this manuscript.
REFERENCES
assume that the sensor nodes and the base station are station-
ary. However, there may be situations, such as battlefield
environments, where the base station and possibly the sensors
[1] D. Estrin et al., “Instrumenting the World with Wireless Sensor
need to be mobile. The mobility of sensor nodes has a great Networks,” Proc. Int’l. Conf. Acoustics, Speech and Signal Pro-
influence on sensor network topology and thus raises many cessing, Salt Lake City, UT, May 2001.
issues about secure routing protocols. In particular, we identi- [2] H. Chan and A. Perrig, “Security and Privacy in Sensor Net-

works,” IEEE Comp. Mag., Oct. 2003, pp. 103–05. Wksp. Sensor Network Protocols and Applications, May 2003,
[3] E. Shi and A. Perrig, “Designing Secure Sensor Networks,” pp. 113–27.
Wireless Commun. Mag., vol. 11, no. 6, Dec. 2004 pp. 38–43. [27] J. Newsome et al., “The Sybil Attack in Sensor Networks:
[4] I. F. Akyildiz et al., “A Survey on Sensor Setworks,” IEEE Com- Analysis and Defenses,” IPSN '04: Proc. IEEE Int'l. Conf. Info.
mun. Mag., vol. 40, no. 8, Aug. 2002, pp. 102–114. Processing in Sensor Networks, Apr. 2004.
[6] N. Gura et al., “Comparing Elliptic Curve Cryptography and [28] Y.-C. Hu, A. Perrig, and D. B. Johnson, “Packet Leashes: A
RSA on 8-bit CPUs,” CHES '04: Proc. Wksp. Cryptographic Defense Against Wormhole Attacks in Wireless Networks,”
Hardware and Embedded Systems, Aug. 2004. Proc. IEEE INFOCOM 2003, Apr. 2003.
[7] A. S. Wander et al., “Energy Analysis of Public-Key Cryptogra- [29] W. Diffie and M. E. Hellman, “New Directions in Cryptogra-
phy for Wireless Sensor Networks,” PerCom ’05: Proc. 3rd IEEE phy,” IEEE Trans. Info. Theory, vol. 22, no. 6, Nov. 1976, pp.
Int'l. Conf. Pervasive Computing and Commun., Mar. 2005. 644–54.
[8] A. Perrig et al., “SPINS: Security Protocols for Sensor Net- [30] R. L. Rivest, A. Shamir, and L. Adleman, “A Method for
works,” Wireless Networks, vol. 8, no. 5, Sept. 2002, pp. Obtaining Digital Signatures and Public-Key Cryptosystems,”
521–34. Commun. ACM, vol. 26, no. 1, 1983, pp. 96–99.
[9] L. Hu and D. Evans, “Secure Aggregation for Wireless Net- [31] D. W. Carman, P. S. Kruus, and B. J. Matt, “Constraints and
works,” Wksp. Security and Assurance in Ad Hoc Networks, Approaches for Distributed Sensor Network Security,” NAI
2003. Labs, Tech. Report 00-010, 2000.
[10] B. Przydatek, D. Song, and A. Perrig, “SIA: Secure Informa- [32] M. Brown et al., “PGP in Constrained Wireless Devices,” Proc.
tion Aggregation in Sensor Networks,” SenSys '03: Proc. 1st 9th USENIX Security Symp., Aug. 2000.
Int'l. Conf. Embedded Networked Sensor Systems, New York: [33] G. Gaubatz, J.-P. Kaps, and B. Sunar, “Public Key Cryptogra-
ACM Press, 2003, pp. 255–65. phy in Sensor Networks-Revisited,” ESAS ’04: 1st European
[11] S. Zhu et al., “An Interleaved Hop-by-Hop Authentication Wksp. Security in Ad-Hoc and Sensor Networks, 2004.
Scheme for Filtering of Injected False Data in Sensor Net- [34] M. O. Rabin, “Digitalized Signatures and Public-Key Functions
works,” Proc. IEEE Symp. Security and Privacy, Oakland, CA, as Intractable as Factorization,” Tech. Rep., Cambridge, MA,
May 2004, pp. 259–71. 1979.
[12] R. L. Rivest, L. Adleman, and M. L. Dertouzos, “On Data [35] J. Hoffstein, J. Pipher, and J. H. Silverman, “Ntru: A Ring-
Banks and Privacy Homomorphisms,” in Foundations of Secure Based Public Key Cryptosystem,” ANTS-III: Proc. 3rd Int'l.
Computation, New York: Academic, 1978, pp. 169–79. Symp. Algorithmic Number Theory, London: Springer-Verlag,
[13] F. Stajano and R. J. Anderson, “The Resurrecting Duckling: 1998, pp. 267–88.
Security Issues for Ad-hoc Wireless Networks,” Proc. 7th Int'l. [36] V. S. Miller, “Use of Elliptic Curves in Cryptography,” Lecture
Wksp. Security Protocols, London: Springer-Verlag, 2000, pp. notes in computer sciences; 218 on Advances in Cryptology-
172–94. CRYPTO 85, New York: Springer-Verlag, 1986, pp. 417–26.
[14] Y.-C. Hu and A. Perrig, “A Survey of Secure Wireless Ad Hoc [37] N. Koblitz, “Elliptic Curve Cryptosystems,” Mathematics of
Routing,” IEEE Security & Privacy Special Issue: Making Wire- Computation, vol. 48, 1987, pp. 203–09.
less Work, vol. 2, no. 3, May/June 2004, pp. 28–39. [38] Elliptic Curve Cryptography, SECG Std. SEC1, 2000, available
[15] D. Djenouri, L. Khelladi, and N. Badache, “A Survey on Securi- at www.secg.org/collateral/sec1.pdf
ty Issues in Mobile Ad Hoc and Sensor Networks,” IEEE Com- [39] B. Kaliski, “TWIRL and RSA Key Size,” RSA Laboratories,”
mun. Surveys and Tutorials, vol. 7, no. 4, 2005. Tech. Note, May 2003.
[16] P. Levis and D. Culler, “Mate: A Tiny Virtual Machine for Sen- [40] Recommended Elliptic Curve Domain Parameters, SECG Std.
sor Networks,” ASPLOS-X: Proc. 10th Int'l. Conf. Architectural SEC2, 2000, available at www.secg.org/collateral/sec2.pdf
Support for Programming Languages and Operating Systems, [41] D. Hankerson, A. Menezes, and S. Vanstone, Guide to Elliptic
New York: ACM Press, 2002, pp. 85–95. Curve Cryptography, New York: Springer-Verlag, 2004.
[17] EYES project, Mar. 2002–Feb. 2005, http://www.eyes.eu.org [42] A. Freier, P. Karlton, and P. Kocher, “The SSL Protocol, Ver-
[18] A. Savvides and M. B. Srivastava, “A Distributed Computation sion 3.0.” http://home.netscape.com/eng/ssl3/
Platform for Wireless Embedded Sensing,” ICCD '02: Proc. [43] R. Watro et al., “TinyPK: Securing Sensor Networks with Pub-
2002 IEEE Int'l. Conf. Computer Design: VLSI in Computers lic Key Technology,” SASN '04: Proc. 2nd ACM Wksp. Security
and Processors, Washington, DC: IEEE Computer Society, 2002, of Ad Hoc and Sensor Networks, New York: ACM Press, 2004,
p. 220. pp. 59–64.
[19] R. Kling, “Intel Research Mote,” in Network Embedded Sys- [44] A. Liu and P. Ning, “TinyECC: Elliptic Curve Cryptography for
tems Technology, Winter 2003 Retreat, Jan. 15–17. 2003. sensor networks (version 0.1),” Sept. 2005, available at
[20] J. Hill et al., “System Architecture Directions for Networked http://discovery.csc.ncsu.edu/software/TinyECC/
Sensors,” ASPLOSIX: Proc. 9th Int'l. Conf. Architectural Support [45] D. J. Malan, M. Welsh, and M. D. Smith, “A Public-Key Infra-
for Programming Languages and Operating Systems, New structure for Key Distribution in TinyOS based on Elliptic Curve
York: ACM Press, 2000, pp. 93–104. Cryptography,” Proc. 1st IEEE Int'l. Conf. Sensor and Ad Hoc
[21] J. Hill et al., “System Architecture Directions for Networked Communications and Networks, Santa Clara, CA, Oct. 2004.
Sensors,” SIGOPS Oper. Syst. Rev., vol. 34, no. 5, 2000, pp. [46] C. Karlof, N. Sastry, and D. Wagner, “Tinysec: A Link-Layer
93–104. Security Architecture for Wireless Sensor Networks,” SenSys
[22] S. Slijepcevic et al., “On Communication Security in Wireless '04: Proc. 2nd Int'l. Conf. Embedded Networked Sensor Sys-
Ad-Hoc Sensor Networks,” Proc. 11th IEEE Int'l. Wksp. Enabling tems, New York: ACM Press, 2004, pp. 162–75.
Technologies: Infrastructure for Collaborative Enterprises [47] U.S. National Institute of Standards and Technology (NIST),
(WETICE’02), 2002, pp. 139–44. “SKIPJACK and KEA Algorithm Specifications,” Federal Informa-
[23] L. Yuan and G. Qu, “Design Space Exploration for Energy- tion Processing Standards Publication 185 (FIPS PUB 185), June
Efficient Secure Sensor Network,” IEEE Int'l. Conf. Application- 1998.
Specific Systems, Architectures, and Processors (ASAP '02), July [48] R. L. Rivest, “The RC5 Encryption Algorithm,” Fast Software
2002, pp. 88–100. Encryption, B. Preneel (Ed.), Springer, 1995, pp. 86–96.
[24] J. Deng, R. Han, and S. Mishra, “Enhancing Base Station [49] D. Eastlake III and P. Jones, “US Secure Hash Algorithm 1
Security in Wireless Sensor Networks,” Department of Comput- (SHA1),” RFC 3174 (Informational), Sept. 2001.
er Science, University of Colorado, Tech. Report CU-CS-951-03, [50] J. Daemen and V. Rijmen, “AES Proposal: Rijndael,” Proc. 1st
2003. AES Conf., Aug. 1998.
[25] B. Deb, S. Bhatnagar, and B. Nath, “Information Assurance in [51] A. J. Menezes, S. A. Vanstone, and P. C. V. Oorschot, Hand-
Sensor Networks,” Proc. 2nd ACM Int'l. Conf. Wireless Sensor book of Applied Cryptography, Boca Raton, FL: CRC Press,
Networks and Applications (WSNA '03), New York: ACM Press, 1996.
2003, pp. 160–68. [52] R. L. Rivest, “The MD5 Message-Digest Algorithm,” RFC 1321,
[26] C. Karlof and D. Wagner, “Secure Routing in Wireless Sensor Apr. 1992.
Networks: Attacks and Countermeasures,” Proc. First IEEE Int'l. [53] P. Ganesan et al., “Analyzing and Modeling Encryption Over-

head for Sensor Network Nodes,” WSNA '03: Proc. 2nd ACM Dynamic Conferences,” CRYPTO ’92: Proc. 12th Annual Int’l.
Int'l. Conf. Wireless Sensor Networks and Applications, New Cryptology Conf. Advances in Cryptology, London: Springer-
York: ACM Press, 2003, pp. 151–59. Verlag, 1993, pp. 471–86.
[54] Y. W. Law et al., “Assessing Security- Critical Energy-Efficient [76] R. Blom, “An Optimal Class of Symmetric Key Generation Sys-
Sensor Networks,” Proc. 18th IFIP TC11 Int'l. Conf. Info. Securi- tems,” Proc. EUROCRYPT ‘84 Wksp., Advances in Cryptology,
ty, Security, and Privacy in the Age of Uncertainty (SEC), New York: Springer-Verlag, 1985, pp. 335–38.
Athens, Greece, May 2003, pp. 459–63. [77] D. Liu and P. Ning, “Location-Based Pairwise Key Establish-
[55] D. J. Wheeler and R. M. Needham, “TEA, A Tiny Encryption ments for Static Sensor Networks,” Proc. ACM Wksp. Security
Algorithm,” Proc. Fast Software Encryption: 2nd Int'l. Wksp., Ad Hoc and Sensor Networks, Oct. 2003.
in Lecture Notes in Computer Science (series), B. Preneel (Ed.), [78] J. N. Al-Karaki and A. E. Kamal, “Routing Techniques in Wire-
vol. 1008, 1994. less Sensor Networks: A Survey,” IEEE Wireless Commun., vol.
[56] R. L. Rivest et al., “The RC6 Block Cipher,” submitted to NIST 11, no. 6, Dec. 2004, pp. 6–28.
as a candidate for the AES. [79] C. Intanagonwiwat, R. Govindan, and D. Estrin, “Directed Dif-
[57] M. Matsui, “New Block Encryption Algorithm Misty,” Proc. fusion: A Scalable and Robust Communication Paradigm for
4th Int'l. Wksp. Fast Software Encryption, in LNCS, E. Biham Sensor Networks,” MobiCom ’00: Proc. 6th Annual Int’l. Conf.
(Ed.), vol. 1267, London: Springer-Verlag, 1997, pp. 54–68. Mobile Computing and Networking, New York: ACM Press,
[58] ETSI/SAGE, “Specification of the 3GPP Confidentiality and 2000, pp. 56–67.
Integrity Algorithms Document 2: KASUMI Specification,” Dec. [80] Y. Yu, R. Govindan, and D. Estrin, “Geographical and Energy
1999. Aware Routing: A Recursive Data Dissemination Protocol for
[59] K. Aoki et al., “Specification of Camellia: A 128-Bit Block Wireless Sensor Networks,” UCLA Computer Science Depart-
Cipher, specification version 2.0,” Nippon Telegraph and Tele- ment, Tech. Rep. UCLA/CSD-TR-01-0023, May 2001.
phone Corporation and Mitsubishi Electric Corporation, 2001. [81] T. Leinmüller et al., “Influence of Falsified Position Data on
[60] Y. W. Law, J. M. Doumen, and P. H. Hartel, “Benchmarking Geographic Ad-Hoc Routing,” 2nd European Wksp. Security
Block Ciphers for Wireless Sensor Networks (Extended and Privacy Ad Hoc and Sensor Networks (ESAS 2005), LNCS,
Abstract),” 1st IEEE Int'l. Conf. Mobile Ad-hoc and Sensor Sys- July 2005.
tems, IEEE Computer Society Press, Oct. 2004. [82] D. Liu and P. Ning, “Efficient Distribution of Key Chain Com-
[61] S. A. Camtepe and B. Yener, “Key Distribution Mechanisms mitments for Broadcast AuthenticationDistributed Sensor Net-
for Wireless Sensor Networks: A Survey,” Computer Science works,” Proc. 10th Annual Network and Distributed System
Department at RPI, Tech. Rep. TR-05-07, 2005. Security Symp., San Diego, CA, Feb. 2003, pp. 263–76.
[62] R. D. Pietro et al., “LKHW: A Directed Diffusion-Based Secure [83] D. Liu and P. Ning, “Multilevel mTESLA: Broadcast Authenti-
Multicast Scheme for Wireless Sensor Networks,” ICPPW ’03: cation for Distributed Sensor Networks,” Trans. Embedded
Proc. 32nd Int’l. Conf. Parallel Processing Wksps., IEEE Com- Computing Sys., vol. 3, no. 4, 2004, pp. 800–36.
puter Society Press, 2003, pp. 397–406. [84] D. Liu et al., “Practical Broadcast AuthenticationSensor net-
[63] S. Zhu, S. Setia, and S. Jajodia, “LEAP: Efficient Security works,” MobiQuitous ’05: Proc. 2nd Annual Int’l. Conf. Mobile
Mechanisms for Large-Scale Distributed Sensor Networks,” CCS and Ubiquitous Systems: Networking and Services, July 2005,
’03: Proc. 10th ACM Conf. Comp. and Commun. Security, New pp. 118–29.
York: ACM Press, 2003, pp. 62–72. [85] W. Du, R. Wang, and P. Ning, “An Efficient Scheme for
[64] B. Lai, S. Kim, and I. Verbauwhede, “Scalable Session Key Authenticating Public KeysSensor Networks,” MobiHoc ’05:
Construction Protocols for Wireless Sensor Networks,” IEEE Proc. 6th ACM Int’l. Symp. Mobile Ad Hoc Net. and Comp.,
Wksp. Large Scale Real Time and Embedded Systems, 2002. New York: ACM Press, 2005, pp. 58–67.
[65] S. A. Cametepe and B. Yener, “Combinatorial Design of Key [86] Public-Key Infrastructure (X.509) (pkix), available:
Distribution Mechanisms for Wireless Sensor Networks,” Proc. http://www.ietf.org/html.charters/pkix-charter.html
9th European Symp. Research Computer Security, 2004. [87] N. Shrivastava et al., “Medians and Beyond: New Aggrega-
[66] J. Lee and D. R. Stinson, “Deterministic Key Predistribution tion Techniques For Sensor Networks,” SenSys ’04: Proc. 2nd
Schemes for Distributed Sensor Networks,” Proc. Selected Int’l. Conf. Embedded Networked Sensor Systems, New York:
Areas Cryptography, 2004, pp. 294–307. ACM Press, 2004, pp. 239–49.
[67] J. Lee and D. R. Stinson, “A Combinatorial Approach to Key [88] J. Deng, R. Han, and S. Mishra, “Security Support for in-Net-
Predistribution for Distributed Sensor Networks,” Proc. IEEE work Processing Wireless Sensor Networks,” SASN ’03: Proc.
Wireless Commun. and Net. Conf., 2005. 1st ACM Wksp. Security of ad Hoc and Sensor Networks, New
[68] L. Eschenauer and V. D. Gligor, “A Key-Management Scheme York: ACM Press, 2003, pp. 83–93.
for Distributed Sensor Networks,” CCS ’02: Proc. 9th ACM [89] H. Çam, D. Muthuavinashiappan, and P. Nair, “ESPDA: Energy
Conf. Comp. and Commun. Security, New York: ACM Press, Efficient and Secure Pattern-Based Data Aggregation for Wire-
2002, pp. 41–47. less Sensor Networks,” Proc. IEEE Sensors, Toronto, Canada,
[69] H. Chan, A. Perrig, and D. Song, “Random Key Predistribution Oct. 2003, pp. 732–36.
Schemes for Sensor Networks,” Proc. IEEE Symp. Security and [90] H. Çam, D. Muthuavinashiappan, and P. Nair, “Energy-Effi-
Privacy, May 2003. cient Security Protocol for Wireless Sensor Networks,” Proc.
[70] D. Liu and P. Ning, “Establishing Pairwise KeysDistributed IEEE VTC Conf., Orlando, FL, Oct. 2003, pp. 2981–84.
Sensor Networks,” CCS ’03: Proc. 10th ACM Conf. Comp. and [91] H. Çam et al., Sensor Network Operations, Wiley, 2004, ch.
Commun. Security, New York: ACM Press, 2003, pp. 52–61. “Secure Differential Data Aggregation for Wireless Sensor Net-
[71] R. D. Pietro, L. V. Mancini, and A. Mei, “Random Key-Assign- works”.
ment for Secure Wireless Sensor Networks,” SASN ’03: Proc. [92] W. Du et al., “A Witness-Based Approach for Data Fusion
1st ACM Wksp. Security of Ad Hoc and Sensor Networks, New Assurance wireless Sensor Networks,” GLOBECOM ’03: Proc.
York: ACM Press, 2003, pp. 62–71. IEEE Global Telecommun. Conf., San Francisco, CA, Dec. 2003,
[72] W. Du et al., “A Pairwise Key Predistribution Scheme for pp. 1435–39.
Wireless Sensor Networks,” CCS ’03: Proc. 10th ACM Conf. [93] D. Wagner, “Resilient Aggregation Sensor Networks,” SASN
Comp. and Communications Security, New York: ACM Press, ’04: Proc. 2nd ACM Wksp. Security of Ad Hoc and Sensor Net-
2003, pp. 42–51. works, New York: ACM Press, 2004, pp. 78–87.
[73] W. Du et al., “A Key Management Scheme for Wireless Sen- [94] F. Ye et al., “Statistical En-Route Filtering of Injected False
sor Networks using Deployment Knowledge,” Proc. IEEE INFO- Datasensor Networks,” Proc. IEEE INFOCOM, Hong Kong,
COM, Hong Kong, 2004, pp. 586–97. 2004.
[74] D. D. Hwang, B. Lai, and I. Verbauwhede, “Energy-Memory- [95] J. Girao, D. Westhoff, and M. Schneider, “CDA: Concealed
Security Trade-OffsDistributed Sensor Networks,” Proc. 3rd Data Aggregation for Reverse Multicast Traffic wireless Sensor
Int’l. Conf. Ad-Hoc Networks and Wireless, July 2004, pp. Networks,” ICC ’05: Proc. IEEE Int’l. Conf. Commun., Seoul,
70–81. Korea, May 2005.
[75] C. Blundo et al., “Perfectly-Secure Key Distribution for [96] C. Castelluccia, E. Mykletun, and G. Tsudik, “Efficient Aggre-

gation of Encrypted Data Wireless Sensor Network,” Proc. security for wireless ad hoc and sensor networks.
ACM/IEEE Mobiquitous, San Diego, CA, July 2005.
[97] J. Domingo-Ferrer, “A Provably Secure Additive and Multi- GARHAN ATTEBURY ([email protected]) is an M.S. degree candi-
plicative Privacy Homomorphism,” Lecture Notes Comp. Sci., date in the Department of Computer Science and Engineering at
vol. 2433, 2002, pp. 471–83. the University of Nebraska-Lincoln. He received his B.S. degree
[98] D. Wagner, “Cryptanalysis of an Algebraic Privacy Homomor- from Eastern Oregon University in 2004. His research efforts are
phism,” ISC ’03: Proc. 6th Info. Security Conf., Bristol, U.K., in the areas of computer network security and computational
Oct. 2003. chemistry.
[99] S. Marti et al., “Mitigating Routing Misbehavior Mobile Ad
Hoc Networks,” MobiCom ’00: Proc. 6th Annual Int’l. Conf. B YRAV R AMAMURTHY ([email protected]) received his B.Tech.
Mobile Comp. and Net., New York: ACM Press, 2000, pp. degree in computer science and engineering from the Indian Insti-
255–65. tute of Technology, Madras, India in 1993. He received M.S. and
[100] Y. Zhang, W. Lee, and Y. Huang, “Intrusion Detection Tech- Ph.D. degrees in computer science from University of California
niques for Mobile Wireless Networks,” Wireless Networks, vol. (UC), Davis in 1995 and 1998, respectively. Since August 1998 he
9, no. 5, 2003, pp. 545–56. has been a faculty member in the Department of Computer Sci-
[101] Y. Huang et al., “Cross-Feature Analysis For detecting Ad- ence and Engineering at the University of Nebraska-Lincoln (UNL),
Hoc Routing Anomalies,” ICDCS ’03: Proc. 23rd Int’l. Conf. where he is currently an associate professor. He is the co-director
Distributed Computing Systems, Providence, RI, May 2003. of the UNL Academic Program Priority Initiative in the areas of
[102] Y. Huang and W. Lee, “Attack Analysis and Detection for Ad Simulation & Computing Engineering (SCE) and Information Tech-
Hoc Routing Protocols,” RAIS ’04: Proc. 7th Int’l. Symp. Recent nology & Telecommunications (ITT). He is the founding co-director
Advances Intrusion Detection, Sophia Antipolis, France, Sept. of the Advanced Networking and Distributed Experimental Sys-
2004. tems (ANDES) Laboratory at UNL. He served as Feature Editor on
[103] B. H. Bloom, “Space/Time Trade-Offshash Coding with Theses for Optical Network Magazine. He served as a guest co-
Allowable Errors,” Commun. ACM, vol. 13, no. 7, 1970, pp. editor for a special issue of IEEE Network on Optical Communica-
422–26. tion Networks. He served as a member of the technical program
[104] J. Deng, R. Han, and S. Mishra, “INSENS: Intrusion-Tolerant committees for the IEEE INFOCOM, IEEE GLOBECOM,
Routing Wireless Sensor Networks,” Department of Computer Opticomm/Broadnets, ICC, and ICCCN conferences. He is author of
Science, University of Colorado, Tech. Report CU CS-939-02, the book Design of Optical WDM Networks — LAN, MAN and
Nov. 2002. WAN Architectures and a co-author of Secure Group Communica-
[105] J. Deng, R. Han, and S. Mishra, “A Performance Evaluation tions over Data Networks, published by Kluwer Academic Publish-
of Intrusion-Tolerant Routing Wireless Sensor Networks,” IPSN ers/Springer in 2000 and 2004, respectively. From 2001–2003, he
’03: Proc. IEEE 2nd Int’l. Wksp. Information Processing Sensor served as the founding secretary of the IEEE ComSoc Optical Net-
Networks, Palo Alto, CA, 2003, pp. 349–64. working Technical Committee (ONTC), for which he currently
[106] G. Wang et al., “On supporting Distributed Collaboration serves as the Secretary and Online Content Chair. He serves as the
Sensor Networks,” Proc. MILCOM, 2003. TPC Co-Chair for the IEEE ICC 2006 Optical Systems and Networks
Symposium and the Broadnets 2006 Optical Symposium. He was
BIOGRAPHIES
a recipient of the Indian National Talent Search scholarship and
was a fellow of the Professors for the Future program at UC
Davis. He is a recipient of the UNL Research Council Grant-in-Aid
Y ONG W ANG ([email protected]) is a Ph.D. candidate in the award (1999), the College of Engineering and Technology Faculty
Department of Computer Science and Engineering (CSE) at the Research Award (2000), and the UNL CSE Dept. Students Choice
University of Nebraska-Lincoln. He received B.S. and M.S.E Award for the Best Graduate Professor (2002–2003). His research
degrees from Wuhan University, China in 1995 and 1998, respec- areas include optical networks, wireless/sensor networks, network
tively. Before joining the CSE department, he has worked as a security, distributed computing, and telecommunications. His
senior telecom engineer at ZTE Corp. and UTStarcom Inc., in research is supported by the U.S. National Science Foundation,
China. His research focuses on secure group communication and Agilent Tech., and OPNET Inc.


Security PDF

Uploaded by

Copyright:

Available Formats

Security PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security PDF

Uploaded by

Copyright:

Available Formats

University of Nebraska - Lincoln

DigitalCommons@University of Nebraska - Lincoln

A Survey of Security Issues In Wireless Sensor

Follow this and additional works at: http://digitalcommons.unl.edu/csearticles

A SURVEY OF SECURITY ISSUES IN

A dvances in wireless communication and electronics

2 1553-877X IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 3

Month/Year 09/99 10/00 06/01 08/01 02/02 03/02 09/02 01/03

Prog. memory 8KB 16KB 128KB 60KB 1MB 512KB

RAM 0.5KB 1KB 4KB 2KB 136KB 64KB

Rate 10 kb/s 10/40 kb/s 115 kb/s 115 kb/s 100kb/s

1 Later versions are an ATmega128 running in 103 mode.

n Table 1. Variety of real-life sensor nodes.

4 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 5

6 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

Spread-spectrum, priority messages, lower duty cycle, region

Collision Error-correcting code

Spoofed, altered or replayed routing information Egress filtering, authentication, monitoring

Flooding Client puzzles

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 7

8 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

n Table 5. Symmetric key cryptography: average

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 9

The underlying network structure plays a significant role in A → *: A

10 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 11

n Table 7. Classification and comparison of key management protocols in WSNs.

12 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 13

14 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

SNEP [8] Flat Yes Yes No Yes Good

LKHW [62] Flat Yes No No No Limited

µTESLA [8] Flat/Hierarchy No No Yes Yes Medium

Multi level key chains [82] Flat/Hierarchy No No Yes Yes Good

LEAP [63] Hierarchy Yes Yes Yes Yes Medium

n Table 8. Comparison of secure routing protocols.

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 15

PLAIN-TEXT BASED SECURE DATA AGGREGATION

Hu and Evans proposed a secure aggregation (SA) protocol

16 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

to prove the validity of the fusion result, the

Two cipher-based secure data aggregation

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 17

18 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

Intrusion detection in WSNs is still largely open to research.

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 19

20 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

IEEE Communications Surveys & Tutorials • 2nd Quarter 2006 21

22 IEEE Communications Surveys & Tutorials • 2nd Quarter 2006

You might also like