Volume 8, Number 2, July 2005
Secure Data Delivery In Unattended Ground Sensor Networks
- 1 Department of Electrical and Computer Engineering, National Technical University of Athens, 9 Iroon Polytechniou St, Zografou, Athens, 15773, Greece.
Abstract
Security is of fundamental importance for a variety of applications where wireless sensor networks are deployed, especially in military operations, where strategic decisions are based on data gathered and processed by them. In this paper we introduce a protocol based on symmetric key encryption and strong tamper protection for secure data delivery in a network of wirelessly connected sensors.
Introduction
During the last few years, the rapid development in the sector of microelectronics technology has allowed for the development of low cost and low-consumption, multifunctional sensor nodes which can communicate wirelessly over small and medium distances. These networked devices can potentially be deployed in vast numbers even in the most adverse environments, ranging from deep space exploration to the bottom of the ocean; to the interior of the combustion chamber of an engine; to inside the human body. They can sense a variety of phenomena in a wide range of applications [1], bringing closer to reality the concept of ubiquitous, pervasive computing [2,3].
In the early days of unattended ground sensor (UGSN) and wireless sensor networks (WSN), research was focused on developing power-aware, energy-efficient nodes, algorithms and protocols. Today, there are still research efforts on the optimization of UGSN in the energy domain but there is another emerging research realm, that of security of wireless sensors networks.
Although computer and network security is a firmly established research field with protocols and standards widely adopted, the adaptation of the abovementioned standards and protocols to wireless sensor networks is generally not feasible due to the specific characteristics of the UGSNs—that is limited processing and memory capabilities, restricted power resources, small size and low cost. Additional factors are the unique operational demands of the UGSNs, the operation in harsh noisy environments, the lack of prior knowledge of the network topology, the self-organization and self-healing capabilities of the network, and the unattended operation often behind enemy lines.
In the present work our effort is focused on developing a protocol based on symmetric keying for secure data delivery of information gathered by the nodes of a UGSN. This includes the development of a tamper-resistant node and the implementation of secure protocol for all communication between the nodes and the base station.
System architecture and methodology
Security requirements of UGSN
It is crucial for network operation to have a very low possibility of interception. The main threats against the network security are eavesdropping, message injection, message replay, message modification, impersonation, denial of service, malicious code implantation, and the analysis of traffic and side-channels. To address these threats the security in such a system should incorporate authentication, integrity, confidentiality, non-repudiation, anti-playback resilience against traffic analysis and physical security. In [4–6] the authors include a thorough analysis of the aforementioned security primitives. In general, to satisfy the abovementioned security requirements the system must use secure protocols, implement encryption algorithms, use frequency-hopping techniques for data transmission, and have nodes resilient against tamper attacks.
Systems architecture
We assume a battlefield surveillance network [7] with three areas of interest, with a number of nodes deployed in each area (Figure 1). Each node of the network can communicate with any other neighboring node in its effective transmission range r, and with the base station in three different ways: direct, multihop, and clustering.
The radio model that we are using is based on [8,9]. Due to the broadcast nature of the wireless channel many nodes in the vicinity of a sender node may overhear its packet transmissions even if they are not the intended recipients of these transmissions.
Reception of these transmissions can result in unnecessary expenditure of battery energy of the recipients, therefore in order to perform communication tasks we assume a collision-free access channel scheme where every node can listen-overhear transmissions in each effective radius r, but retransmission of the listened data is allowed by the communication protocol only to intended recipients.
This protocol is tailored to the specific detection requirements of the security application in which that the network is going to be deployed. These detection requirements are high temporal and spatial correlation of the events, continuous operation of the network, low false-alarm rate, best coverage of the surveillance area. Under certain conditions these can be satisfied by all the abovementioned ways of communication (direct, multihop, or clustering) but the usage of the clustering method with overhearing, without relays and with every node communicating directly with its cluster head has been implemented, due to its greater capability in processing and fusing the data sensed by the nodes.
In that this case the energy needed to transmit a K-bit packet from node A to cluster head B separated by a distance d equals:
where Etransmit is the energy expenditure in the node transmitter electronics, N is the number of the nodes that overhear the transmission, Ereceive is the energy cost at the overhearing nodes to receive the K-bit packet, EreceiveClusterHead is the energy expenditure in the cluster transmitter electronics needed to receive K bits of data and α is the path-loss exponent which is between two and five and expresses the RF propagation path loss suffered over the wireless channel for a distance d.
The architecture of each sensor node is shown in Figure 2. Every node has a unique MAC-like identity, known to the base station, and is equipped with one seismic sensor. Seismic sensors based on piezoelectric accelerometers are suitable for human detection because of their unique characteristics [10], that is, a high signal-to-noise ratio (SNR) which means high sensitivity and low noise so that very small accelerations can be detected. Furthermore, their operation is not affected by changes in the weather conditions although their effective range is heavily dependent on the ground topology.
A key feature of the node is its tamper protection. This consists of both active and passive components to protect the node and especially the storage facility where the pre-deployed keys will be stored, denying any attempt to analyze node operation, or to alter the node behavior or to exploit crucial cryptographic data if a node is captured.
Passive components include tamper-resistant surface enclosures (such as hardened steel enclosures) and one-way security screws to offer additional tamper resistance. Active components include a low power tamper-response mechanism which will physically destroy the device using a small explosive charge in case of an adversary bypass of the hardened steal enclosure. The total physical destruction of the node with explosives is suitable for protecting nodes deployed in military operations. For commercial applications, other solutions (such as: high voltage, chemical solvents, or high current) can be adopted that will totally destroy the storage area of the node, without the use of explosives.
To minimize energy consumption, the node can operate in different levels of sleep-states, dependent on the operational needs defined prior to deployment, on the operational planning and security goals of the system, and on the activity on the area under surveillance [7].
The cluster head high-level architecture is similar to the nodes although cluster head nodes and base station have no limitation in processing power or energy, and additionally they are capable of storing and processing tables with the unique identities and secret keys of any node in the cluster network.
Introducing a protocol for secure data delivery in UGSN
Protocol overview
The proposed protocol is consists of three phases where certain actions must take place. These phases are prior to deployment, during the “initialization” phase [11] and while in regular operation.
During the phase prior to deployment a “book” of random keys is generated by the base station. This “book” is stored in the tamper-resistant storage area and is the same for each of the network nodes. This “book” will act as the key repository from where the nodes and the cluster-heads will randomly choose their encryption keys during the operational life of the network. Additionally, the base station generates a network-level key used by the nodes during the initialization phase of network operation. During this phase the network backbone is constructed (base station to cluster heads, cluster head to cluster nodes) and a new network-level key, for the communication between the base station and the cluster heads will be selected. After the completion of the aforementioned tasks and the establishment of secure communications between the base station and the cluster heads a cluster level key is selected by each cluster head to be used for intra-cluster communications. The utilization of a different cluster-level encryption key for each cluster allows the rest of the network to continue operating securely in the case of one cluster being compromised by an adversary.
Detailed protocol description
Before continuing with the protocol the basic notation is presented in Table 1.
Pre-deployment phase
During the phase prior to deployment a “book” of random keys is generated by the base station. This “book” is stored in the tamper resistant storage area and is the same for each of the network nodes and acts as a key repository. Keys can be produced for any of the popular symmetric encryption and hashing function schemes, such us RC4, RC5, IDEA, MD5, Blowfish, and SHA1. The aforementioned algorithms offer a variety of different operational modes and encompass different mathematical and data manipulation operations such as the Exclusive-OR operation, modulo addition and multiplication, and the use of various word, block and key sizes. The selection of the encryption algorithm is related to the architecture of the Microcontroller Unit (MCU) of the node since that the amount of energy consumed by a security algorithm is determined by the processor power consumption on active state, on MCU frequency, and on the number of clock cycles needed by the processor to compute the security function.
The generation of the keys prior to deployment allows for significant gains in the energy consumed by the nodes, since to compute a strong cryptographic key, a number of complex mathematical operations and a sequence of iterations are required, which are energy consuming and computationally demanding operations.
Initialization phase
After the deployment of the network the following actions take place:
(1) Every Ch and Sn initializes, performs a self check, and by using GPS determines its exact geolocation.
(2) The BS by employing a random address generator function generates the new KNL. This function does not generate the key itself but a physical address pinpointing the storage location of the keys. Then, starting from this address and for a given length decided by the BS operator, the new KNL is selected. This key is valid until the operator or the system automatically decides to use a new encryption key.
(3) The BS sends a message to Ch requesting it to transmit the identities and the positions of the Sn that form their cluster and at the same time it announces the new KNL(n). The general function that describes this action is as follows:
The header of the message encapsulates the information of Table 2. As can be seen, in the header resides all the needed information to compute the encryption and the decryption key of any component of the network. Instead of transmitting the key itself only the needed information to compute the key is transmitted. This approach offers the following advantages:
- Resilience to eavesdropping; even if an adversary manages to get the senders KNL(μ) or KCL(μ) he will not be able to decrypt the data unless he also has an valid key pool. It is assumed that this is not possible due to anti-tamper resilience of the network components.
- Energy efficiency. As can seen from Equation (1) energy needed to transmit a bit is proportional to the number of
- bits sent, thus the less data transmitted the longer the lifecycle of the nodes (Figure 3); and
- Authentication and resilience to impersonation; the SensorID parameter in the Header Field is unique for each node and every message to be processed by the Ch must originate from a Sn that appears in the Ch nodes registry. (It was added during the initialization phase or later with an operation that it is discussed later).
| Table 1. Terminology and Description. | ||
|---|---|---|
| Notation | Description | |
| BS | Base Station | |
| Ch | Cluster Head | |
| Sn | Sensor node | |
| KNL(μ) | Network Level Key [ μ = {(n)ew, (o)ld} ] | |
| KCL(μ) | Cluster Level Key [ μ = {(n)ew, (o)ld} ] | |
| KSn(μ) | Sensor Node’s Key, where μ = {(n)ew, (o)ld} | |
| [Head] | Message Header | |
| [Data] | Message Data | |
| E | Encryption Function | |
| MSGi | Message i, where i= {BS, Ch , Sn} | |
| id | Unique identity of a node or a Cluster Head |
| Table 2. Header Fields and Description. | |||
|---|---|---|---|
| Name | Meaning | Length in [char] | Type |
| Start of Heading (SOH) | Fix value (internal use) | 1 | hex |
| Message type | Whether is a Initialization or a sequential or a revocation message | 1 | char |
| Separator | 1 | char | |
| Generation time | Time of telegram generation | 6 | time |
| Sensor Id | Unique Sensor Id | 17 | char |
| Sensor position x value | Sensor site position x value (east/west) | 12 | num |
| Sensor position y value | Sensor site position y value (north/south) | 12 | num |
| Sensor position z value | Sensor site position z value (height) in [metres] | 8 | num |
| Key Starting Address | Hex Address to start reading from in order to compute the encryption key | 8 | hex |
| Key Length | The length of the key in order to compute the key’s ending address | 4 | Char |
| Separator | 1 | Char | |
| Header length | 71 |
(4) Each Ch that receives the message from the BS decrypts it with the KNL(o), compute the new KNL(n) and stores it. Similarly to the BS, it elects its new KCL(n) and send a message announcing to every node that is potentially deployed to his effective transmission range the selection of the new KCL(n) and requesting by each node to report its identity, position, and KSn. The format of the message is:
This key (KCL(n)) will be used for the encryption of all message headers between the Ch and any Sn deployed in his area.
(5) Each Sn that receives the message sent from the Ch decrypts it with the KCL(o) and then computes the new KCL(n) and stores it. Similarly to the Ch it elects its new KSn(n) and sends a message to Ch with all the information requested. The format of the message is as follows:
(6) When the Ch receives all the messages from the Sn participating in its cluster it:
(a) Stores the identities, node positions (x,y,z) and each node KSn(n) in a cluster node registry.
(b) It creates a message informing the BS with all the requested information. The format of the message is as follows:
(c) It shifts from initializing phase to regular operation.
(7) When the BS receives all the messages from the Ch it performs the following tasks:
(a) Stores the identities, Sn and Ch positions (x,y,z) and each Ch KCL(n) in a network cluster and nodes registry.
(b) It transits from initializing phase to regular operation.
Regular operation
During networks regular operation, the following can happen:
(1) Assignment of a new node to a cluster: When Ch receives a request from Sn to join its cluster, for the request to be accepted, the following two conditions have to be satisfied a) the message header must be encrypted with the current, valid KNL(n) and b) the unique node id must exist in the network nodes registry. If both conditions are satisfied, the request will be accepted, the new node will be added to the cluster nodes registry, and a message with the valid KCL(n) will be provided to it by Ch.
(2) Collection and transmission of data from a node to a cluster head: The format of the message that a Sn sends to Ch in order to send collected data is similar to the one of Equation (5), but instead of using KNL(n) to encrypt the header it uses KCL(n) and instead of using KCL(n) for the data it uses KSn(n).
(3) Change of encryption keys: Change of the KNl,, KCL, and individual nodes keys can be invoked either by the operator of the BS or they can follow a time schedule established prior to deployment. In extreme cases where security is the major concern, individual keys can change after every other message, although this affects the life span of the network and the frequency of changing encryption keys is highly correlated with the size of the storage that the nodes are equipped with.
(4) Revocation of a “suspicious” node: Due to the tamper protection of the nodes, the possibility of a node being compromised by an adversary is considered unlikely but, if there are suspicions that a node or a cluster is compromised, then the BS can delete it from the network registry and inform the Ch of the suspicious node. The Ch then generate a new KCL(n) and consequently sends a special type of message to all nodes with the exception of the suspicious node, called “revocation message”. The main difference between this type of message and the message of Equation (3) is that for the encryption of the header the Ch will use not the KCL(n) but the KCh of each node. This means that the cluster head will send N messages where N is the number of the nodes minus one that form the cluster.
Security and performance analysis
Security analysis
The proposed protocol satisfies the security primitives and tasks described earlier. The strength of the protocol against cryptanalysis relies on the encryption algorithm used, which will be selected from well-known encryption standards. Furthermore, the node tamper protection assures physical security particularly of the cryptographic material. Finally, the use of a network level registry, in which the exact geographical location of every network component is stored, assures the authenticity of the nodes due to the fact that no message will be processed by the cluster head unless the sender node is registered.
Performance analysis
To evaluate the performance of the proposed protocol in the energy domain, AVAKIS [13], a tool for calculating energy consumption in WSN was used. The encryption algorithm used was RC5 [14], a fast symmetric block cipher which has been suggested as a good algorithm for sensor networks [6, 15].
The amount of energy consumed by a security algorithm is determined by the characteristics of the encryption algorithm and by the power characteristics of the microcontroller unit of the node. Encryption algorithm characteristics include the key size (such as 64, 128 or 1024 bit), block or word size (such as 8, 16, or 32 byte), and required mathematical functions (such as modulo multiplications or additions). Power and processing characteristics of the microcontroller unit, which are processor power consumption on active state and the MCU frequency, are affecting the required encryption time that means the required number of clock cycles needed by the processor to compute the security function and thus the selection of an encryption algorithm must be decided in close relation with the capabilities of the MCU.
The evaluation of symmetric algorithms and hash functions has been chosen due to their energy efficiency especially when compared with the energy required to implement a public key security mechanism [18]. Figure 4 shows the number of instructions and the power consumption in relative power units required to encrypt a 512-kbyte file, using various symmetric encryption algorithms.
As described earlier for the network to become fully connected a number of messages, must be sent between the base station, cluster heads and nodes. In Figures 5, and 6, the required number of messages in relation to the number of network nodes and clusters is displayed. As can be seen, the number of messages increases linearly with the number of nodes or clusters added to the network.
The overall power required to transmit one initialization message is 0.47408 W, which can be further analysed to energy consumed at the RF component (0.4644 W) and at the MCU (0.00968W). Additionally the energy required to encrypt one bit using RC5 is calculated to be 0.09875 μJ/bit. In general the energy cost per message is:
(7)
Where CEncrypt_Head is the energy required to encrypt the head of the message, CEncrypt_Data is the energy required to encrypt the data of the message, CTransmit_bit is the energy required to transmit from a point A to B as shown in Equation (1).
Similar work
This section considers some similar work, and discusses some contributions which address the problem of security in WSN in a broader manner. Karlof et al [16] analysed routing layer attacks on a number of routing protocols and proposed countermeasures to enhance sensor network routing. Wood and Stankovic [17] provided a survey of a variety of DoS attacks in sensor networks and discussed possible defence technologies and countermeasures. Carman et al [18] analysed the existing key-management technologies in sensor networks, based on the computational resources and overhead needed for performing security operations on a variety of hardware platforms. Potlapally et al [19] present a comprehensive analysis of the energy requirements of a wide range of cryptographic algorithms used as building blocks in security protocols.
Perrig et al developed the security architecture SPINS, a symmetric-key-based protocol suite for providing security and authenticated broadcast. This is based on two building blocks, SNEP, a protocol for data confidentiality, two-party data authentication and data freshness, and on μTESLA, a broadcast authentication protocol [6]. Their architecture relies on the concept that every node shares a secret key with a trusted base station, which is at all times able to communicate with every node in the network. When two ordinary nodes need to communicate securely with one another the BS acts as a key-distribution centre.
In Pebblenet Basagni et al [20] proposed that the network is protected by a single network-wide group key, which is updated periodically. At each key update, the node with the most energy is chosen to generate the new key, and an efficient algorithm disseminates it among all nodes in the network. Their solution is based on the assumption, similar to our approach, that all nodes are tamper-proof. Zhu et al. proposed the Localized Encryption and Authentication Protocol (LEAP) [21] which utilizes four types of keys for each node for different purposes. These range from the individual key that is shared with the base station, to a group key that is shared with all nodes in the network. Eschenauer and Gligor first presented a pool-based random key pre-distribution system for secure network operation [22]. Their proposed system assures distribution, update and revocation of keys without substantial computation and communication requirements. Authors in [23, 24, 25] proposed a pair-wise distribution key scheme where the main feature is the assignment of a unique key to each pair of nodes.
Conclusion
In this work we have identified the main threats against an UGSN and highlighted the required countermeasures against them. Furthermore an energy efficient protocol for secure data delivery in UGSNs has been presented.
Our future work will be focused on:
- evaluating the results of the security and performance analysis using different cryptographic algorithms,
- evaluation of other symmetric cryptographic methods along with testing the protocol resilience to cryptanalysis, and
- the design and evaluation of effective and energy efficient anti tamper mechanisms.
References
[1] I. Akyildiz, W. Su, Y. Sankarasubramaniam, E. Cayirci, “Wireless Sensor Networks: A Survey”, Computer Networks, Vol. 38, pp. 393–422, 2002.
[2] M. Weiser, “Some Computer Science Issues in Ubiquitous Computing”, Communications of the ACM , Vol. 56, No. 7, July 1993.
[3] M. Satyanarayanan, “Pervasive Computing: Vision and Challenges”, IEEE Personal Communications, Vol. 8, No. 4, August 2001.
[4] S. Avancha, J. Undercoffer, A. Joshi, and J. Pinkston, “Secure Sensor Networks for Perimeter Protection”, Computer Networks, Vol. 43, pp. 421–435, 2003.
[5] K. Jones and M. Eltoweissy, “Towards a New Paradigm for Securing Wireless Sensor Networks”, ACM New Security Paradigms Workshop, Ascona Switzerland, 2003.
[6] A. Perrig, R. Szewczyck, V. Wen, D. Culler and J. Tygar, “SPINS: Security Protocols for Sensor Networks”, Proceedings MOBICOM’2001, Rome, Italy, August 2001.
[7] P. Kikiras, J. Avaritsiotis, “Unattended Ground Sensor Network for Force Protection,” Journal of Battlefield Technology, Vol. 7, No. 3, November 2004.
[8] P. Basu and J. Redi, “Effect of Overhearing Transmissions on Energy Efficiency in Dense Sensor Networks”, IPSN’04, Berkeley, California, USA, April 26–27, 2004.
[9] W. Heinzelman, A.a Chandrakasan, and H. Balakrishnan, “Energy-Efficient Communication Protocol forWireless Microsensor Networks”, Proceedings of the 33rd Hawaii International Conference on System Sciences, 2000.
[10] A. Kollias Application of Piezoelectric Films for the Design of Sensors and Microsystems, Phd Thesis, National Technical University of Athens, July 2004.
[11] H. Chan, A. Perrig, and D. Song, “Key Distribution Techniques for Sensor Networks”, Wireless Sensor Networks, Kluwer Academic Publishers, 2004.
[12] G. Jolly, M. Kuscu, P. Kokate, and M. Younis, “A Low-Energy Key Management Protocol for Wireless Sensor Networks”, Proceedings of the 8th IEEE (ISCC’03), 2003.
[13] P. Kikiras, G. Stamoulis, and J. Avaritsiotis, “AVAKIS: A Tool for Calculating Energy Consumption in Wireless Sensor Networks”, submitted to Ad Hoc Networks.
[14] R. Rivest, “The RC5 encryption algorithm”, Proceedings of the 1994 Leuven Workshop on Fast Software Encryption, pp. 86–96, Springer-Verlag, 1995
[15] G. Prasanth, R. Venugopalan, P. Peddabachagari, A. Dean, F. Mueller, and M. Sichitiu, “Analyzing and Modeling Encryption Overhead for Sensor Network Nodes”, Proceedings of theWSNA’03, 2003.
C. Karlof and D. Wagner, “Secure Routing In Wireless Sensor Networks: Attacks And Countermeasures” AdHoc Networks Journal, Special Issue on Sensor Network Applications and Protocols, Vol. 1, pp. 293–315, December 2003.
A. Wood, and J. Stankovic, “Denial of Service in Sensor Networks”, IEEE Computer, Vol. 35, No. 10, pp. 54–62, October 2002,
D. Carman, P. Kruss, and B. Matt, Constraints and Approaches for Distributed Sensor Network Security, NAI Labs Technical Report 00-010, September 2000.
N. Potlapally, S. Ravi, A. Raghunathan, and N. Jha, “Analyzing The Energy Consumption Of Security Protocols”, Proceedings ISPLED ’03, Seoul, Korea, August 2003.
S. Basagni, C. Herrin, D. Bruschi, and E. Rosti, “Secure Pebblenets”, Proceedings of the 2nd International Symposium on Mobile Ad Hoc Networking & Computing, ACM Press, Washington DC, pp. 156–163, 2001.
S. Zhu, S. Setia, and S. Jajodia, “LEAP: Efficient Security Mechanisms for Large-Scale Distributed Sensor Networks”, Proceedings of the Conference on Computer and Communications Security ’03, Washington DC. pp. 62–72, 2003.
L. Eschenauer, and V. Gligor, “A Key-management Scheme for Distributed Sensor Networks”, Proceedings of the Conference on Computer and Communications Security ’02, Washington DC, pp. 41–47, 2002.
Chan, H., Perrig, A., and Song, D.: Predistribution Schemes for Sensor Networks. In: Proceedings of the IEEE Security and Privacy Symposium. IEEE Computer Society Press, Los Alamos 2003. pp. 197–213
D. Liu, and P. Ning, “Establishing Pairwise Keys in Distributed Sensor Networks”, Proceedings of the Conference on Computer and Communications Security ’03, Washington DC, pp. 52–61, 2003.
S. Schmidt et al, “Security Architecture for Mobile Wireless Sensor Networks”, ESAS 2004, C. Castelluccia et al. (eds.), LNCS 3313, pp. 166–177, 2005.