A security policy language for wireless sensor networks

Abstract

Authenticated computer system users are only authorized to access certain data within the system. In the future, wireless sensor networks (WSNs) will need to restrict access to data as well. To date, WSN security has largely been based on encryption and authentication schemes. The WSN Authorization Specification Language (WASL) is a mechanism-independent composable WSN policy language that can specify arbitrary and composable security policies that are able to span and integrate multiple WSN policies. Using WASL, a multi-level security policy for a 1000 node network requires only 60 bytes of memory per node.

Introduction

Because of advancements in micro-electro-mechanical systems, wireless sensor network (WSN) nodes can now be made smaller than their power sources. Improvements in computing and wireless networking technologies will provide access to the sensors’ data at a level heretofore unattainable. We envision a future with WSNs composed of nano-sensors embedded within, say, building materials to provide data on the condition of the material or environment around it. While it is not the case with WSNs currently, we maintain that data within a WSN should have (and indeed will soon be required to have) the same level of data protection as that found in modern computer operating systems. Furthermore, it can reasonably be expected that WSNs with distinct security policies will eventually be required to interact with each other while maintaining their respective security policies. Therefore, policy composition must be supported by WSN security policies too.

Some research and development has focused on restricting WSN resources to authorized users via authentication protocols (Perrig et al., 2001, Di Pietro et al., 2003, Benenson et al., 2005). Particular access control schemes have also been proposed including (Donggang, 2007, Wang and Li, 2006, Zhou et al., 2007). Encryption has been used to enforce confidentiality and to restrict computing resources to authorized entities (Oliveira et al., 2007, Karlof et al., 2004, Gaubatz et al., 2005). Encryption and authentication are well-established techniques that address particular aspects of security; they are essential but incomplete elements of security in a WSN. Encryption will indeed protect the confidentiality of WSN data during transmission while authentication will prevent unauthorized users from accessing a WSN. Even so, we rightly expect that even authorized users of computer systems will not have access to all the data on the system. That is, we expect our files and data to remain confidential even from other authorized users of the system. As WSNs become more commonplace, the same will be expected of them.

WSN nodes, however, have severe limits on processing power, memory, wireless communication capabilities, and energy stores (Zhao and Guibas, 2004). The MICA2 Mote (Crossbow, 2007), for example, weighs 18 g and operates on two “AA” batteries. It hosts the TinyOS operating system on an ATmega128L 8 bit processor running at 8 MHz with 4 kB RAM and 128 kB flash RAM for code. Therefore, any practical security scheme will have to take this into account. We see this severely resource-constrained environment as a persistent characteristic of current WSN nodes as well as the micro- or nano-scale nodes of the future.

Security policies are generally represented by sets of rules. Given a request for some action, a servicing agent evaluates these rules according to the current status of the system and relevant information about the query. The information required by the agent to make a decision can be quite large—all the user identifications and groupings, object identities and groupings, associations of users and objects with security levels, mandatory authorizations and discretionary rules and explicit authorizations, and information about the history of actions performed in the system. Significant processing power and memory may be required to evaluate a number of rules against all the variables. Alternatively, memory could be saved by requiring that relevant associations (e.g., user groupings) be sent with a query, adding to the data required during query transmission.

With these considerations in mind, we propose a mechanism-independent composable WSN policy language called the WSN Authorization Specification Language (WASL). The resulting system distributes only system authorizations to nodes, reducing both the memory and computational requirements at the nodes. WASL is based on the Authorization Specification Language (ASL) (Jajodia et al., 1997) that provides a formal basis for specifying security policies, capturing policy authorizations, and describing the environments in which the policies function. WSN-specific modifications to ASL adapts it to a wireless environment. WASL, in conjunction with existing encryption and authentication mechanisms, constitute a robust system that will prevent, per the specified policy, unauthorized access to WSN resources. Although security policies, not mechanisms, are the focus of this research, we also present a simple implementation scheme to demonstrate that our system can be reasonably implemented within the constraints of a WSN node.

The remainder of this paper is organized as follows: Section 2 introduces the notion of security used in this work. The key contribution is the language WASL, as presented in Section 3 followed by implementation considerations made Section 4. Section 5 presents results of composition and compilation of WASL-encoded policies.