1. KAIS T SIGF : A Family of Configurable, Secure Routing Protocols for WSNs Sep. 20, 2007 Presented by Kim, Chano Brian Blum, Tian He, Sang Son, Jack Stankovic Security of Ad Hoc and Sensor Networks ( SASN’06)

2. 2 / 19 SIGF : A Family of Configurable, Secure Routing Protocols for WSNs Contents Introduction IGF : Implicit Geographic Forwarding Assumptions and Attacks SIGF : Secure IGF Evaluation Conclusion

3. 3 / 19 Introduction Resource bound security solution Efficiency of individual security mechanism Efficiency of all security mechanisms installed together at a node Access control, routing, localization, time synchronization, Power management SIGF(Secure Implicit Geographic Forwarding ) B.blum at al, IGF : A state free robust communication protocol for wireless sensor networks. CS-2003-1, Univ. of Virginia, 2003 A family of configurable secure routing protocols Three protocols (SIGF-0, SIGF-1, SIGF-2) State ↑ & Security ↑ SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

4. 4 / 19 IGF(Implicit Geographic Forwarding) – 1/2 Quick overview of IGF Fig-1. Forwarding Area for Source SFig-2. IGF handshake timeline A R : Candidate nodes SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

5. 5 / 19 Keeps no routing state information Lazy binding → Fault tolerance, robust topology changes Eliminate maintenance overhead and routing latency Ten-fold increase in delivery ratio Reduce end to end delay and control overhead A point of view from security Confines the attacker’s impact to the neighborhood Prevents attackers that proof, alter, replace routing information Vulnerable in black-hole attack IGF(Implicit Geographic Forwarding) – 2/2 SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

6. 6 / 19 System assumption Insecure radio links Attacker’s possibilities Nodes know their own location Additionally know that of their neighbors (SIGF-1, SIGF-2) Pairwise-shared keys in the neighbors(SIGF-2 ) Routing attacks (applicable to IGF) Routing state corruption, Wormhole, Hello-flood => prevented Black hole attack, Selective forwarding attack, Sybil attack Denial of services : ORTS replay attack, CTS replay attack Assumptions and Attacks – 1/3 SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

7. Routing Attacks Assumptions and Attacks – 2/3 Fig-3. CTS Rushing Attack by AFig-4. Node A performs a Sybil attack SIGF : A Family of Configurable, Secure Routing Protocols for WSNs 7 / 19

8. 8 / 19 SIGF : Secure IGF Tradeoff between security and state maintenance Configurability can be adapted at runtime Higher cost must be borne even when no attacks are occurring Each protocol is a subset of the next SIGF-0 : no state at all SIGF-1 : locally generated state Limited information learned from interactions with neighbors SIGF-2 : Cryptographic guarantees in routing Use keys and sequence numbers shared among neighbors SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

9. 9 / 19 SIGF : Secure IGF-0 Lessen but not eliminate the chance of selecting an attackers Fig-3. SIFG-0 next hop selection for message from current node S to ultimate Destination D SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

10. 10 / 19 SIGF : Secure IGF-0 Configurable dimension Forward Area {60° sextant, closer, whole neighborhood} Collection Window {one responder, fixed multiple, dynamically lengthened} Forwarding Candidate Choice {first, by priority, random, multiple} Omit location { yes, no} Robust against a black-hole attack cased by CTS rushing attack SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

11. 11 / 19 SIGF : Secure IGF-1 Reduce the chance of selecting an attacker as the next-hop State T : Total # of messages sent to all neighbors) N sent = # of messages sent to N N forward = # of messages forwarded by neighbor N on this node’s behalf N location = Last claimed location of node N N delay = average delay between relaying a message to node N N success = N forward / N sent = forwarding success ratio (reliability) N fairness = (T- N sent ) / T = forwarding fairness ratio N consistency = A consistency score based on N’s claimed location N performance = (D – N delay ) / D SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

12. 12 / 19 SIGF : Secure IGF-1 Per Neighbor Reputation Value System Parameters for SIGF-1 SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

13. 13 / 19 SIGF : Secure IGF-2 Shared state secure IGF (for cryptographic operations) Message Authentication { all messages, only DATA, node) Message Sequence { yes, no) Payload Encryption { yes, no} Attacks resisted by IFG and SIGF protocols State & Cost ↑ Security ↑ SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

14. 14 / 19 Use GloMoSim Simulator Evaluation Table. Simulation parameterFig. Final node location (S,D, A1-4) SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

15. 15 / 19 Evalutation (2/2) Base System (No attacks) SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

16. 16 / 19 Evalutation (2/2) Black Hole Attack Selective Forwarding Attack (by A3) SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

17. 17 / 19 Evalutation (2/2) Sybil Attack (by A3) SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

18. 18 / 19 Conclusion SIGF (Secure Implicit Geographic Forwarding) Chooses the next hop dynamically and nondeterministically Increase robustness to node mobility and failure SIGF-0, SIGF-1, SIGF-2 Future studies Evaluate lower densities How failure-recovery mechanism impacts the performance of SIGF family SIGF : A Family of Configurable, Secure Routing Protocols for WSNs

19. 19 / 19 SIG – WORK (4) Thank you

20. EXTRA : Wormhole attack (1/4) Adapted from Chris Karlof and David Wagner's WSNPA slides Routing Tree

21. Wormhole attack (2/4) Routing Adapted from Chris Karlof and David Wagner's WSNPA slides

22. Wormhole Attack (3/4) Tunnel packets received in one place of the network and replay them in another place The attacker can have no key material. All it requires is two transceivers and one high quality out-of-band channel Adapted from Chris Karlof and David Wagner's WSNPA slides

23. Disrupted Routing (4/4) Adapted from Chris Karlof and David Wagner's WSNPA slides Most packets will be routed to the wormhole The wormhole can drop packets or more subtly, selectively forward packets to avoid detection Blackhole / Selective forwarding attack

24. Sybil attack & Rushing attack Sybil AttackRushing Attack