Fast Detection of Replica Node Attacks in Mobile Sensor Networks Using Sequential Analysis

Due to the unattended nature of wireless sensor networks, an adversary can capture and compromise sensor nodes, generate their replicas, and thus mount a variety of attacks with these replicas. Such attacks are dangerous because they allow the attacker to leverage the compromise of a few nodes to exert control over much of the network. Several replica node detection schemes have been proposed in the literature to defend against such attacks in static sensor networks. However, these schemes rely on fixed sensor locations and hence do not work in mobile sensor networks, where sensors are expected to move. In this work, we propose a fast and effective mobile replica node detection scheme using the Sequential Probability Ratio Test. To the best of our knowledge, this is the first work to tackle the problem of replica node attacks in mobile sensor networks. We show analytically and through simulation experiments that our scheme provides effective and robust replica detection capability with reasonable overheads. I. INTRODUCTION Advances in robotics have made it possible to develop a variety of new architectures for autonomous wireless networks of sensors. Mobile nodes, essentially small robots with sens- ing, wireless communications, and movement capabilities, are useful for tasks such as static sensor deployment, adaptive sampling, network repair, and event detection (4). These advanced sensor network architectures could be used for a variety of applications including intruder detection, border monitoring, and military patrols. In (potentially) hostile envi- ronments, the security of unattended mobile nodes is critical. The attacker may be able to capture and compromise mobile nodes, and then use them to inject fake data, disrupt network operations, and eavesdrop on network communications. In this scenario, a particularly dangerous attack is the replica node attack, in which the adversary takes the secret keying materials from a compromised node, generates a large number of attacker-controlled replicas that share the node's keying materials and ID, and then spreads these replicas throughout the network. With a single captured node, the adversary can create as many replica nodes as he has the hardware to generate. Note that replica nodes need not be identical robots; a group of static nodes can mimic the movement of a robot and other mobile nodes or even humans with handheld devices could be used. The only requirement is that they have the software and keying material to communicate in the network, all of which can be obtained from the captured node. The time and effort needed to inject these replica nodes into the network should be much less than the effort to capture and compromise the equivalent number of original nodes. The replica nodes are controlled by the adversary, but have keying materials that allow them to seem like authorized participants in the network. Protocols for secure sensor network commu- nication would allow replica nodes to create pairwise shared keys with other nodes and the base station, thereby enabling the nodes to encrypt, decrypt, and authenticate all of their communications as if they were the original captured node. The adversary can then leverage this insider position in many ways. For example, he can simply monitor a signifi- cant fraction of the network traffic that would pass through these nodes. Alternately, he could jam legitimate signals from benign nodes or inject falsified data to corrupt the sensors' monitoring operation. A more aggressive attacker could under- mine common network protocols, including cluster formation, localization, and data aggregation, thereby causing continual disruption to the network operations. Through these methods, an adversary with a large number of replica nodes can easily defeat the main mission of the deployed network. A straightforward solution to stop replica node attacks is to prevent the adversary from extracting secret key materials from mobile nodes by equipping them with tamper-resistant hardware. We might expect such measures to be implemented in mobile nodes with security-critical missions. However, although tamper-resistant hardware can make it significantly harder and more time-consuming to extract keying materials from captured nodes, it may still be possible to bypass tamper resistance for a small number of nodes given enough time and attacker's expertise. Since the adversary can generate many replicas from a single captured node, this means that replica attacks are even more dangerous relative to the attempt for compromising many nodes. We thus believe that it is very important to develop software-based countermeasures to defend mobile sensor networks against replica node attacks. Several software-based replica node detection schemes have been proposed for static sensor networks (3), (9), (12). The primary method used by these schemes is to have nodes report location claims that identify their positions and attempt to detect conflicting reports that signal one node in multiple locations. However, since this approach requires fixed node locations, it cannot be used when nodes are expected to move. Thus, our challenge is to design an effective, fast, and robust replica detection scheme specifically for mobile sensor