1. Chris Karlof and David Wagner
Secure Routing in Wireless Sensor Networks: Attacks and Countermeasures
Chris Karlof and David Wagner

2. Key Contributions Secure routing issues in WSNs
Show how they are different from ad hoc networks
Introduce two new classes of attacks
Sinkhole attack
Hello flood attack
Analyze security aspects of major routing protocols
Discuss countermeasures & design considerations for secure routing in WSNs

3. WSNs vs. Ad Hoc Networks Multi-hop wireless communications
Ad hoc nets: communication between two arbitrary nodes
WSNs
Specialized communication patterns
Many-to-one
One-to-many
Local communication
More resource constrained
More trust needed for in-network processing, aggregation, duplicate elimination

4. Assumptions Insecure radio links
Malicious nodes can collude to attack the WSN
Sensor are not tamper-resistant
Adversary can access all key material, data & code
Base station is trustworthy
Aggregation points may not be trustworthy

5. Threat Models Device capability Attacker type Mote class attacker
Laptop class attacker: more energy, more powerful CPU, sensitive antenna, more radio power
Attacker type
Outside attacker: External to the network
Inside attacker: Authorized node in the WSN is compromised or malicious

6. Security Goals Secure routing
Support integrity, authenticity, availability of messages in presence of attack
Data confidentiality

7. Potential Attacks Attacks on general WSN routing
Attacks on specific WSN protocols

8. Attacks on General WSN Routing Protocols
Spoof, alter, or replay routing info.
Create loops, attack or repel network traffic, partition the network, attract or repel network traffic, etc.
Selective forwarding
Malicious node selectively drops incoming packets

9. Sinkhole attacks Specific to WSNs
All packets are directed to base station
A malicious node advertises a high quality link to the base station to attract a lot of packets
Enable other attacks, e.g., selective forwarding or wormhole attack

10. Sybil attack Wormholes
A single node presents multiple ID’s to other nodes
Affect geographic routing, distributed storage, multi-path routing, topology maintenance
Wormholes
Two colluding nodes
A node at one end of the wormhole advertises high quality link to the base station
Another node at the other end receives the attracted packets

11. Hello flood attack Acknowledge spoofing Specific to WSNs
In some protocols, nodes have to periodically broadcast “hello” to advertise themselves
Not authenticated!
Laptop-class attacker can convince it’s a neighbor of distant nodes by sending high power hello messages
Acknowledge spoofing
Adversary spoofs ACKs to convince the sender a weak/dead link support good link quality

12. Attacks on Specific Routing Protocols
TinyOS beaconing
Construct a BFS rooted at the base station
Beacons are not authenticated!
Adversary can take over the whole WSN by broadcasting beacons

13. Directed diffusion Geographic routing Replay interest
Selective forwarding & data tampering
Geographic routing
Adversary false, possibly multiple, location info.
Create routing loop
GEAR considers energy in addition to location
Laptop-class attacker can exploit it

14. Countermeasures Shared key & link layer encryption
Prevent outsider attacks, e.g., Sybil attacks, selective forwarding, ACK spoofing
Cannot handle insider attacks
Wormhole, Hello flood, TinyOS beaconing
Sybil attack
Every node shares a unique secret key with the base station
Create pairwise shared key for msg authentication
Limit the number of neighbors for a node
Hello flood attack
Verify link bidirectionality
Doesn’t work if adversary has very sensitive radio

15. Wormhole, sinkhole attack
Cryptography may not help directly
Good routing protocol design
Geographic routing
Location verification
Use fixed topology, e.g., grid structure
Selective forwarding
Multi-path routing
Route messages over disjoint or Braided paths
Dynamically pick next hop from a set of candidates
Measure the trustworthiness of neighbors

16. Authenticated broadcast Base station floods blacklist
uTESLA
Base station floods blacklist
Should be authenticated
Adversaries must not be able to spoof

17. Conclusions WSN security is challenging, new area of research
This paper covers security issues at network layer