A secure alternate path routing in sensor networks

Abstract

This paper presents a secure alternate path routing in sensor networks. Our alternate path scheme makes the routing protocol resilient in the presence of malicious nodes that launch selective forwarding attacks. SeRINS (a Secure alternate path Routing IN Sensor networks) detects and isolates the compromised nodes, which try to inject inconsistent routing information, from the network by neighbor report system. In neighbor report system, a node’s route advertisement is verified by its surrounding neighbor nodes so that the suspect node is reported to the base station and is excluded from the network. Simulation experiments show that SeRINS is resilient in the presence of several compromised nodes which launch selective forwarding attacks, and robust by excluding the compromised nodes which inject inconsistent routing information from the network.

Introduction

Sensor networks are drawing much attention in the research community and will play an essential role in a wide variety of areas ranging from critical military applications to monitoring of building security in the near future. To deploy sensor networks in real situation, security is an important aspect in sensor networks and should be provided against various attacks such as node capture, physical tempering, denial of service, etc. [14], [26], [31].

Researchers in sensor networks have actively investigated security problems and proposed security mechanisms that protect against malicious attackers eavesdropping, injecting malicious packets, replaying old messages, etc. While key-management schemes for establishing pairwise keys among neighboring nodes [2], [6], [17], [27], [33] and security mechanisms for node-to-node secure communication [15], [27] such as link layer encryption and authentication mechanisms in sensor networks are well defined, many other security issues need further investigation. Karlof and Wagner [14] have revealed that especially current routing protocols are insecure and are highly vulnerable to node capture attacks. Their analysis shows that attacks launched from insiders (the adversaries compromise the legitimate nodes and make them affect the routing topology adversely) are most dangerous, and they leave it as an open problem to design secure routing protocols.

Security mechanisms in sensor networks should deal with compromised nodes, detecting any compromised node and then revoking its cryptographic keys network-wide. Most key-management schemes in sensor networks have the ability to exclude compromised nodes from the entire network by the revocation of the entire key rings of the compromised nodes. Those schemes provide how to revoke the key rings of the compromised nodes (e.g., base station involved revocation [6] or localized voting system [2]). They, however, do not address the problem, of deciding which nodes have been compromised.

To design secure routing protocols in the presence of several compromised nodes that drop all relaying packets, launch selective forwarding attacks [14], or inject inconsistent routing information, secure routing protocols must be robust and resilient by detecting and isolating them from legitimate nodes. In reality, detecting all of the compromised nodes in the network is not always possible, so we should pursue graceful degradation, with a small number of compromised nodes [29].

Staddon et al. [30] have proposed an efficient algorithm to trace failed nodes in sensor networks. Although the algorithm efficiently puts intensive computation load for tracing failed nodes to the base station, it assumes that the nodes are sufficiently tamper-resistant to prevent an adversary from re-programming a legitimate node, which is a strong assumption in that an inexpensive sensor node cannot afford tamper-resistant packaging. (It turns out to be relatively easy to compromise a legitimate node [9], which is to extract cryptographic keys from a captured node and to make malicious code run for the attacker’s purpose.) Deng et al. [4] have designed an intrusion-tolerant routing protocol for sensor networks called INSENS. INSENS sends every packet along multiple and independent paths for resiliency, but it requires that every node send a feedback message to the base station during route discovery.

Hu et al. [10] have proposed SEAD, a secure ad hoc network routing protocol based on the design of the DSDV [23]. SEAD uses efficient one-way hash functions to prevent any active attackers or compromised nodes from injecting inconsistent route updates. They [11] have also improved SEAD to make up for the weak points such as same-distance fraud, the vulnerability of denial of service attacks, etc. However, SEAD does not directly fit the properties of sensor networks, since it is designed for ad hoc networks where the number of nodes in the network is much smaller than that of sensor networks and the node’s capacity is usually greater than that of sensor networks. Moreover, SEAD does not mention how to sever the compromised nodes from the network.

Secure routing protocols should be resilient in the presence of several compromised nodes that launch selective forwarding attacks (malicious nodes arbitrarily drop the relaying packets instead of forwarding them). Also, to protect the network from the malicious nodes that inject forged routing information with an intention of routing inconsistencies, secure routing protocols should have a mechanism that detects and isolates these compromised nodes with a light-weighted security mechanism in consideration of the limited capacity of sensor nodes.

In addition, secure routing protocols must guarantee that routing advertisement messages are really sent from the claimed node, otherwise it would be extremely hard or impossible to exactly point out the compromised node [16].

In this paper, we present SeRINS, a Secure alternate path Routing IN Sensor networks. Our alternate path scheme makes the routing protocol resilient in the presence of malicious nodes that launch selective forwarding attacks. SeRINS detects and isolates the compromised nodes, which try to inject inconsistent routing information, from the network by neighbor report system.

In the following section, we introduce our network threat model and goal. In Section 3, our protocol SeRINS is presented and described in detail. An evaluation of the protocol is given and discussed in Section 4. We draw conclusions in Section 5.