Towards Techniques of Detecting Node Replication Attack in Static Wireless Sensor Networks
Towards Techniques of Detecting Node Replication Attack in Static Wireless Sensor Networks
Abstract
The paper reports the techniques to detect node replication also called
clone node attacks in the Static Wireless Sensor Networks (sWSN) and
critically reviews them. The focus of the paper is to highlight and
discuss various techniques to deal with node replication attack in static
WSNs.
1. Introduction
Wireless Sensor Networks (WSNs) are specialized network of large number of sensor
equipped nodes which are spatially deployed over the region of interest where the
nodes may be stationary or mobile in nature. Wireless sensor networks are a group of
small untethered sensor devices which are densely populated in a specific target area,
where they collaborate in an ad-hoc manner to sense phenomena and report sensed
data for various uses [8]. Sensor nodes are vulnerable to a number of attacks and hence
its security can be compromised by an attacker. The node replication attack or the
clone node attack is a security threat where an attacker creates its sensor nodes and
joins the network as if they are the legitimate nodes of the network. For this attack to
happen, the attacker will physically capture one node from the network and extract all
the secret information of the node such as node ID, Keys etc.Using the extracted
information, the attacker creates many replicas/clones of the compromised node. These
clones are then deployed into the WSN at suitable positions and start to attack the
whole network internally [1] which will hamper the network. The nodes are stationary
or fixed for the static WSNs and hence the node’s location/position does not change
154 Moirangthem Marjit Singh et al
after deployment. This is in contrast to the mobile WSNs where the nodes are mobile
in nature and hence the position of the node changes. The node operates while
controlling their own movement [1]. As a result, the techniques to detect node
replication attack are different for static and mobile WSNs. A number of protocols for
detecting node replication attack in static WSNs can be found in the literature. Some of
which are discussed in this paper. Section 2 of the paper deals with the detection
techniques and conclusions are drawn in section 3.
claims passes should also store the claims [2] and while forwarding some other claim
if it encounters a conflict a revocation process can be initiated.
second step. Bloom filter construction and verification are done in the third step by
each cluster head and other cluster heads respectively [7].
Scheme I: The basic scheme, assumes that sensor nodes are deployed group by
group, and that each group is expected to be deployed towards a
deployment point that can be pre-determined [8]. Prior to deployment,
the network operator loads the pre-determined deployment coordinates
of every group onto every sensor node. It is noted that the sensor nodes
in the same group are very likely to be close to each other after
deployment. The sensor nodes in the network are divided into groups,
and each group has a unique group ID. The ID of every sensor node has
two parts: the group ID and a unique ID within the group [8]. Keying
materials are also pre-loaded to each sensor node for pair-wise key
establishment, any key pre-distribution technique can be used for sensor
networks [8]. When a sensor node receives a request from its neighbor
node to forward a message after deployment it checks whether or not the
distance between the deployment points of groups to which the two
nodes belong is smaller than a pre-defined system wide threshold [8]. If
the condition is fulfilled, the neighbor node is believed to be a trusted
node and it’s message is forwarded. Otherwise, every message from that
neighbor node is ignored.
Scheme II: In Location claim approach, in addition to the keying materials for pair-
wise key establishment, every sensor node also gets the keying materials
for generating digital signatures [8]. The deployment zone of a group is
defined as a circle centered at the group’s deployment point with a
certain radius [8]. After deployment, every node discovers its real
location and produces a location claim. In neighbor discovery phase
every sensor node discovers a set of neighbor nodes. If a neighbor node
claims a location such that the distance between the location of the node
and it’s neighbor is larger than the assumed signal range then that
neighbor will be removed from the neighbor list and the node then
158 Moirangthem Marjit Singh et al
checks for every neighbor node whether or not it is deployed in the right
place [8]. If the check fails for a certain neighbor node it will be marked
un-trusted[8]. A sensor node always forwards message received from its
neighbors whether trusted or un-trusted. However in case of un-trusted
neighbor its location claim is sent to its home zone[8] for replica
detection. The location claim after reaching the home zone is flooded
throughout the home zone and any node receiving a conflicting claim
can conclude that the node has been replicated.
Scheme III: This is a tree based scheme where every sensor node forwards every
location claim to a number of groups instead of a single group [8]. The
proposed approach in the following is similar to Scheme II. The only
difference is in the way the group is selected to which the location
claims are sent. For a certain group say ‘x’, the protocol organizes the set
of groups into a complete virtual binary tree[8] with the group ‘x’ as its
root and the position of other groups in the tree is determined in a
pseudo-random way based on a seed[8]. In case a node encounters an
un-trusted neighbor, its location claim is sent upwards the tree to all the
groups till it reaches the root.
2.11. Yingpei Zeng et al have proposed two non deterministic fully distributed
and random walk based approaches in[9].
The protocols/ approaches as described in [9] are RAWL (RAndom WaLk) and
TRAWL (Table-assisted Random WaLk). The protocols assume the nodes to be
uniformly distributed in the deployment field and that each node knows their own
locations.
RAWL:Each node a broadcasts a signed location claim to its neighbors. When
hearing the claim, each neighbor verifies the signature and checks the plausibility of
the location claim. Then with probability p, each neighbor randomly selects g nodes
(or g locations) and uses geographic routing to forward the claim to the g nodes [9].
Each chosen node that receives the claim of a, first verifies the signature. Then it stores
the claim and becomes a witness node of a. The neighbor will also become a witness
node of a. It adds counter by one and continues to forward the message to a random
neighbor, unless counter reaches t [9]. When a node finds a collision (two different
location claims with a same node ID), the node will broadcast the two conflicting
claims as evidence to revoke the replicas. Each node receiving the two claims
independently verifies the signatures. If the two signatures are valid, it terminates the
links with replicas [9].
TRAWL: This protocol is modified from RAWL [9]. When a randomly chosen
node performs a random walk, all the nodes that are passed through will become
witness nodes. However, they will store the location claim independently with certain
probability [9]. Also, each witness node creates a new entry in its table so as to record
the pass of a location claim. Every entry of the table maintained by each node
corresponds to the pass of a random walk (with a location claim). The table has the two
Towards Techniques of Detecting Node Replication Attack in Static Wireless 159
appear in any other area. The RBDM is a range-based distributed detection method. In
this paper, they used RSSI (received signal strength indicator) to estimate the distance
between nodes. Each node estimates the distances between it and its neighbors by
RSSI and executes a test for categorizing the neighbors as follows [11]: assuming two
nodes a and b and the detection range R. These nodes are categorized as close
neighbors if distance between nodes |xa –xb |<R as mentioned in [11]. RSSI is used as a
distance estimator for Range-based detection. If the distance between the nodes |xa –xb
|<R/2 then they are categorized as far neighbors[11]. Each node records all
identifications of its neighbors and set a flag signify their categorization. All of this
information is stored in the neighbor-information table. Nodes in the network
periodically broadcast own neighbor information table. By comparing node’s
neighbor-information table, the replication attacks can be detected. Three criterion are
suggested in the proposed protocol namely Local Unique ID Criterion [11], which is
used to detect clone node in the neighborhood of the compromised node itself.
Neighbor Unique ID Criterion [11], which is used if the clone node and the
compromised node are in the neighborhood of another node. Global Unique ID
Criterion [11], which is used when the clone node and the compromised nodes are
placed sparsely.
2.14. Ho, Jun-Won have proposed a sequential hypothesis in [12] for detection of
replica cluster
Replica cluster is a special case of replication where multiple replicas with the same
identity and secret keying materials are placed in the same small regions forming a
cluster [12]. In the proposed work each node performs the SPRT (Sequential
Probability Ratio Test) on its neighbor node. This is done using the null hypothesis that
a replica cluster of the neighbor node does not exist. The alternate hypothesis is that a
replica cluster of the neighbor node exists [12]. In SPRT, if the number of
communication peers of a neighbor node is less or exceeds a pre-configured threshold
value, it will lead to the acceptance of the null or alternate hypotheses respectively. As
soon as the alternate hypothesis is accepted, the node will stop communicating the
neighbor node [12].
some common features in WSNs such as sensor reading, receive power, send rate,
receive rate [13].
The comparison of various techniques for the detection of node replication attack
that are reviewed in the paper is given in table 1 and the notations used are described in
table 2.
Table 2: Notations.
3. Conclusion
The paper has presented a brief review on various node replication attack detection
techniques/protocols for static WSNs. The techniques reviewed in the paper fall in two
categories namely location aware and location independent protocol. Location aware
protocols require the nodes to know their geographic location for which the nodes
should either have GPS or must rely on the base station to compute their location
coordinates. The location independent protocol does not require the knowledge of the
nodes’ location to detect node replication. The performance of these
protocols/techniques depends on the density of the networks as reported in the
literature. Hence research in this area is required to address this issue.
References
[1] WZ Khan, Mohammed Y. Aalsalem, Mohammed Naufal Bin Mohammed
Saad, and Yang Xiang, ”Detection and Mitigation of Node Replication
Attacks in Wireless Sensor Networks: A Survey”, International Journal of
Distributed Sensor Networks ,Volume 2013, Article ID 149023, 22
pages,2013
[2] B. Parno, A. Perrig, and V. Gligor, “Distributed detection of node replication
attacks in sensor networks,” in Proceedings of the IEEE Symposiumon
Security and Privacy (IEEE S and P ’05), pp. 49–63, May 2005.
[3] Tassos Dimitriou, Ioannis Krontiris and Fotios Nikakis, "Fast and scalable key
establishment in sensor networks." Shashi Phoha, Thomas F. La Porta, and
Christopher Griffin, editors, Sensor Network Operations: Wiley-IEEE press,
pp 557-570, 2006
[4] Sencun Zhu, Sanjeev Setia, Sushil Jajodia. LEAP: Efficient Security
Mechanisms for Large-Scale Distributed Sensor Networks. In The
Proceedings of the 10th ACM conference on Computer and communications
security 2003.
[5] C. Bekara and M. Laurent-Maknavicius, “A new protocol for securing
wireless sensor networks against nodes replication attacks,” in Proceedings of
the 3rd IEEE International Conference on Wireless and Mobile Computing,
Networking and Communications (WiMob ’07),White Plains, NY, USA,
October 2007
Towards Techniques of Detecting Node Replication Attack in Static Wireless 163