Distributed Detection Of Node
Replication Attacks In Sensor
Networks
By Bryan Parno, Adrian Perrig and Virgil Gligor
Presenter: Kirtesh Patil
Acknowledgement: Slides on Paper originally provided by Bryan Parno, Adrian
Perrig and Virgil Gligor
Sensor Networks
• Wireless sensor networks contain thousands
of nodes
• Each node has limited processing, storage
capacity and power
• Low Cost
• Easy to deploy
– No Tamper proof
Replication Attack
• Capture one node
– pressure, voltage and temperature sensing not
built-in to detect intrusion
– Read memory
• Replicate nodes – same IDs
– Affects data aggregation protocols
– Replicated nodes can be used to kick legitimate
nodes out (node-revocation protocol)
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Outline
•
•
•
•
•
Introduction
Problem Statement and Previous Work
Solution
Evaluation
Discussion
Discussion
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Assumptions
• Adversary can’t deploy nodes with arbitrary ID
– paper assumes n/w implements required
safeguards
• Adversary has limited node capturing
capability
• Cloned node has at least one legitimate node
in neighborhood (Can be eliminated)
• All node know their geographical location and
node are primarily stationary
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Objectives
• Detect node replication with high probability
• Secure against adaptive adversary
– Unpredictable to adversary
– No central point of failure
• Minimize communication overhead
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Previous Approaches
• Centralized scheme
– Each node sends location to central base station
– Central base station examines list for conflicts
– Revocation: flood network with authenticated
revocation message
– Disadvantages:
• Vulnerable to single point failure
– Compromise base station
– Interfere with its communication
• Node surrounding base station – undue routing of traffic
• Revocation can be delayed
– Advantages: 100% detection
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Previous Approaches (Contd.)
• Local Detection Scheme
– Neighbor try to detect replicated nodes
– Fails to detect distributed node replicated in
disjoint neighborhood
Discussion
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Emergent Properties
• They are properties that only emerge through
collective action of multiple nodes
• Advantages:
– No Central Point of Failure
– Attractive approach to thwart unpredictable and
adaptive adversary
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Simple Approach
• Node-To-Network Broadcast
– Each node broadcast location information
– 100% detection
– Assumption: Broadcast reaches all nodes
• Attacker can easily jam or interfere with
communication
Discussion
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Simple Approach (Contd.)
• Deterministic Multicast
– Node sends location to neighbors
– Neighbors choose witness and forward location to
them
– Problem:
• Predictable – attacker can jam all messages to
witnesses
• Witnesses become target to subversion
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Approach Overview
STEP1: Announce location
– Sign and broadcast location to neighbors
STEP 2: Detect Replicas
– Use Emergent properties
– Ensure at least one witness receives two conflicting
locations
STEP 3: Revoke replicas
– Flood network with conflicting location claims (signed)
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Randomized Multicast Protocol
STEP 2
• Witness chosen randomly
• Each neighbor chooses n d witnesses
• So n neighbor send location to n witnesses
• By Birthday Paradox – if there are clones then
location conflict will occur.
w R
• Probability of detection PDetect  1  e n
2
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Line Selected Multicast
• Use routing topology of network to select
witnesses
• All the intermediate nodes between neighbor
and witness check for conflict
• Geometric probability says replicated nodes
will be detected
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Line Selected Multicast Detection
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Line Selected Multicast Detection
Y
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Line Selected Multicast Detection
Y
With five line segments per point : 95%
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Theoretical Communication Overhead
Detection Scheme
Centralized Detection
Randomized Multicast
Line Selected Multicast
Average
# of Messages / Nodes
O( n )
O( n )
O (n)
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Communication Overhead
Discussion
Introduction
Problem Statement
Solution 1
Solution 2
Topologies
Evaluation
Discussion
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Probability of Detection in Irregular
Topologies
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Timing Issue And Masked-Replication
• How often to perform detection
1. Every T unit of time – node forgets previous
claims
2. Time slots
•
•
Time slots based on ID
Witness remember claims during time slot
• Adversary captures neighbors
– Solution: pseudo-neighbors – neighbors ask for
location claim
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Discussion
Conclusion And Future Work
• Use of emergent properties to tackle node
replication
– High probability of detection
– Resilient to adaptive adversary
– Minimum communication overhead
• Scheme assumes captured nodes follow
protocol
– Implicit sampling to detect nodes that suppress or
drop messages
Introduction
Problem Statement
Solution 1
Solution 2
Evaluation
Comments and Questions?
Discussion