SIA: Secure Information Aggregation in Sensor Networks

1 SIA:SecureInformationAggregationinSensor Networks BartoszPrzydatekCarnegieMellonUniversity Pittsburgh,PA many , thepracticaldeploymentofsensornetworksfa cesmany , inmany applicationssensorsarede-ployedinopenenv ironments,andhencearevulnerabletophysica lattacks,potentiallycompromisingthesenso r s , weproposea novel frameworkforsecureinforma-tionaggregatio nin ,calledaggregators,helpaggregatinginform ationrequestedbya query, proofs,weenabletheusertoverifythattheans wergivenbytheaggregatoris a goodapproxi-mationofthetruevalueevenwhen theaggregatoranda , wepresentefficientprotocolsforsecurecomp utationofthemedianandtheaverageofthemeas urements,fortheestimationofthenetworksiz e, To thebestofourknowledge,thispaperisthefirs tonsecureinformationaggregationinsensorn etworksthatcanhandlea maliciousaggregatorandsensornodes.

2 ThisresearchwassupportedinpartbytheCente rforComputerandCommunicationsSecurityatC arnegieMellonundergrantDAAD19-02-1-0389f romtheArmyResearchOffice,byNSFAl-addinCe ntergrantsCCR-0122581andCCR-0058982, ,eitherexpressorimplied,ofNSF, ARO,Bosch,CarnegieMellonUniversity, digitalorhardcopiesofallorpartofthiswork forpersonalorclassroomuseis copy otherwise,torepublish,topostonserversort oredistributetolists,requirespriorspecif icpermissionand/ora 03,November5 7,2003,LosAngeles,California, $ [Computer CommunicationNetworks]: DistributedSys-tems; [AnalysisofAlgorithmsandProblemComplexit y]:MiscellaneousGeneralTermsalgorithms,r eliability, securityKeywordssensornetworks,informati onaggregation,security, approximateinteractive challengingproblemssuchasreal-timetraffi cmonitoring,wildfiretracking,wildlifemon itoring, , substantialamountofdata,yetthesensornode softenhave limitedresources,suchascomputationpower, memory, stor-age,communication,andmostimportantl y, batteryenergy.

3 Thelargescaleofsensornetworksandtheresou rceconstraintsmake itanimportantchallengetodesignanddevelop efficientinformationprocessingandaggrega tiontechniquestomake effective query, it maybeunnecessaryandinefficienttore-turna llraw datacollectedfromeachsensor instead,informationshouldbeprocessedanda ggregatedwithinthenetworkandonlyprocesse dandaggregatedinformationis returned[13,16].Insucha setting,certainnodesinthesensornetwork,c alledaggregators,collecttheraw informationfromthesensors,processit locally, andreplytotheaggregatequeriesofa remoteuser. However, informa-tionaggregationinsensornetworksi s ,theprocessingandaggregationmechanismsne edtoberesilientagainstattackswheretheagg regatoranda [21,10,13,16],withtheexceptionof[15]( ).

4 Inthispaper, weaddresstheproblemofhowtoenablesecurein for-mationaggregation,suchthattheuseracc eptsthedatawithhighprobabilityif theaggregatedresultis withina desiredbound,butthattheuserdetectscheati ngwithhighprobabilityandrejectstheresult if it is ,oncetheattackercompromisedthebasestatio northeaggregators,theattackercouldperfor ma denial-of-serviceattackandstopre-spondin gtoany compromisednodeisunderthefullcontrolofth eattacker, , inthispaperwefocusonanothertypeofattackt hatwecallstealthyattack. Ina stealthyattack,theattacker s goalistomake theuseracceptfalseaggregationresults,whi charesignifi-cantlydifferentfromthetruer esultsdeterminedbythemeasuredvalues,whil enotbeingdetectedbytheuser.

5 Inparticular, wewanttoguaranteethatif theuseracceptsa reportedaggregationresultfromtheaggregat ors,thenthereportedresultis close tothetrueaggregationvaluewithhighprobabi lity;otherwise,if thereportedvalueis significantlydifferentfromthetruevaluedu etothemisbe-haviorofthecompromisedaggreg atorsand/orthesensors,theuserwilldetectt hecorruptionandrejectthereportedaggregat ionresultwithhighprobability. We stressthatintheconsideredmodelthecorrupt edsensorsandaggregatorsmaydeviatefromthe protocolinanarbitrarilymaliciousway, andourgoalis , weproposetheapproachofaggregate-commit-p rove: inoursetting,theaggregatorsnotonlyperfor mtheaggre-gationtasks,butalsoprovethatth ey , to preventtheaggregatorsfromcheating,weusec ryp-tographictechniquesofcommitments, andconstructefficientran-domsamplingmech anismsandinteractive proofs,whichenabletheuserto verifythattheanswergivenbytheaggregators is a goodapproximationofthetruevalueevenwhent heaggregatorsand/ora.

6 We introducetheproblemofsecureinformationag gregationinsensornetworks,analyzetheatta ckmodelandsecurityrequirements. We proposetheaggregate-commit-proveframewor kforde-signingsecureinformationaggregati onprotocols(Section3). We putforwardconcreteprotocolsforsecurelyco mputingthemedian(Section4),securelyfindi ngtheminimumandmaximumvalues(Section5),s ecurelyestimating(counting)thenumberofdi stinctelements(andthenetworksize)(Sec-ti on6),andsecurelycomputingtheaverageofmea surements(Section7).Ourprotocolsrequireo nlysublinearcommuni-cationoverheadbetwee ntheaggregatorandtheuser. We proposetheapproachofforward Secure authenticationtoensurethatevenif anattackercorruptsa sensornodeata pointintime,it willnotbeabletochangeany previousreadingsthesensorhasrecordedloca lly(Section8).

7 [21,10,13,16].HuandEvanshave studiedtheproblemofinformationaggregatio nif onenodeis compromised[15],buttheirprotocolmaybevul nerableif a parentanda unet al.[12]studiedtheproblemofapproximateint eractiveproofs,wherea prover(theaggregator)provestoa verifier(thehomeserver)thattheinputdatah assomeproperty. However, intheirmodelboththeproverandtheverifierc anaccesstheinputdata,andthetaskoftheprov eris toassisttheverifier, sothattheverifierdoesn t have s accesstotheinput:wheneververifiershouldr eada partoftheinput, ,inmany casesthelocationsofthedesiredpartsshould behiddenfromtheprover, hencea moreexpensive simulationis needed, ,usinga privateinformationretrieval protocol[7,18].

8 : considerthesettingwherea largenumberofsensorsarede-ployedinsomear eadistantfromahomeserver. Sensorsperformmeasurementsandthehomeserv erwouldlike , sensorsareusuallysimple,low-powereddevic eswhichcancommunicateonlywithinsmallrang eoftheirlocation,andsothey cannotreportthemeasurementsdi-rectlytoth edistanthomeserver[17].Thus,a , werefertothenodethatperformstheaggregati ontasktheaggregator. Thebasestationisa naturalcandidatetoperformtheaggregationt ask,duetoitsen-hancedcomputationandcommu nicationpower. However, theissueofdecidingwhichnodesaretheaggreg atorsis outofthescopeofthispaperandwesimplyassum ethatthereexistsomeaggregatorsinthenetwo rkata , somesensornetworksmayhave multipleaggregators(Forexample,inTAG[21] ,eachnon-leafnodeis anaggregator).

9 Forsimplicity, inmostofthispa-per, weonlyconsiderthecaseofa singleaggregator. Nevertheless,ourtechniquescanbeextendedt omultipleaggregators, assumethateachsensorhasa uniqueidentifierandsharesa separatesecretcryptographickey withthehomeserverandwiththeaggregator[25 ].Thekeysenablemessageauthentication,and encryptionif andtheaggregatordonotneedto storeO(n)keys[25] in-steadeachofthemstoressimplya masterkeyKBandKA(forthehomeserver andtheaggregator, respectively),andeachsensornodestoresthe sharedkeysMACKB(nodeID)andMACKA(nodeID), whereMACis a securemessageauthenticationcodethatis usedhereasa [5].Thus,givena nodeID,thehomeserver(ortheaggregator)can computeitssharedkey withthesensornodebyusingitsmasterkey andhenceauthenticatethesensornode s ( ),thenet-workmaybecomepartitionedbytheco rruptedsensors, ,thecorruptedsensorscouldalwaysplaya denial-of-serviceattackandcutoff thecommunicationbe-tweentwo caseanaggregatormayat ,forsimplicity, weassumethattheuncorruptedsensorsforma connectedcomponentcontainingtheaggregato r, furthermoreassumethatthehomeserverandbas estationhave a mechanismtobroadcastauthenticmessages( )

10 Intothenetwork,suchthateachsensornodecan verifytheauthen-ticityofthemessage,forex ampleusingtheTESLA broadcastau-thenticationprotocol[24,25]. considera settingwitha polynomiallyboundedattacker, corrupteddevicearetotallydeterminedbythe adver-sary. Inparticular, theadversarycanarbitrarilychangethemea-s uredvaluesreportedbya corruptedsensor. However, weassumethattheadversarycancorruptatmost a (small) ,a corruptedaggregatorcouldreportsomesignif icantlybiasedorfictive values(possiblytotallyindependentoftheme asuredval-ues),insteadoftherealaggregate s, applicationstheinformationreceivedbytheh omeserverprovidesa basisforcriticaldecisions,falseinformati oncouldhave ,wedonotwanttolimitourselvestojusta ,weassumethattheadversarycanmisbehave inanyarbitraryway, andtheonlylimitationsweputontheadversary areitscomputationalresources(polynomiali nthesecurityparameter)