## 4 Threat Model  
An underwater acoustic network is subjected to several threats and possible attacks [16]. An adversary equipped with an acoustic modem can eavesdrop on messages as well as modify and inject fake messages so endangering the confidentiality and integrity of application messages.  
In a surveillance system, integrity is as important as confidentiality. Actually, an adversary that is able to spoof a node and thus impersonate it can then inject fake messages. Fake messages may carry wrong measurements as well as wrong commands for mobile nodes. Wrong measurements may lead the surveillance system to return wrong results in terms of false positives/negatives. Wrong commands may cause the network to disrupt or even translate into a safety issue with possible damages to devices themselves.  
In order to protect integrity and confidentiality, we assume that underwater communications are enciphered. At the application level, every node \(u\) shares a secret symmetric _end-to-end_ key, \(e_{u}\) with the gateway GW for one-to-one communication. Node \(u\) uses the key \(e_{u}\) to encrypt unicast application message addressed to GW, and to decrypt unicast messages received from GW.  
In addition, in order to support one-to-many communication, the gateway GW and the mobile nodes are organized as a _group_ and, as such, they share a secret symmetric _group key_\(g\). Every group member uses \(g\) to encrypt/decrypt application messages before broadcasting/receiving them into/from the group.  
An adversary may also attack availability. Denial of Service (DoS) is a severe threat in an underwater acoustic network, even more severe than in traditional networks, due to the intrinsic limitations of the  
Figure 2: Implementation of the (**a**) one-to-one and (**b**) one-to-many communication paradigms.  
acoustic channel [21]. In the UAN project, we have contrasted DoS at multiple different layers. In this paper we mainly focus on DoS that may derive from attacks to network integrity [3]. We come back to this point later in Section 6 for more details. However, here, we would like to spend just a few intuitions about the countermeasures against DoS we have adopted at the application level. These countermeasures are complementary to those applied at the network layer. The cooperative algorithm that allows UAVs to maintain the largest sensing area is intrinsically reactive against DoS due to the _emergent behaviour_ approach on which it is based [22, 23]. In brief, whenever an adversary succeeds in disrupting communication among vehicles, the simple rules that drive vehicles motion make them move closer to the asset in order to ensure protection regardless what the other agents are doing. As a result, a DoS attack effectively degrades the performance of the cooperation, but it cannot prevent continuing the surveillance mission with a limited number of cooperating nodes, or even with all the nodes acting individually. A detailed description of the algorithm can be found in [20]. Furthermore, from a practical standpoint, if the DoS attack persists, an underwater node may take an extreme measure, namely surface and communicate with a land station using standard radio communication technologies. We have used this approach in a surveillance system but it can be generalized to other underwater application scenarios.