## 5 Common Criteria IT Security Development Process--Intelligent Sensor Specific Issues
### Defining Common Criteria related security design patterns--general rules
#### 5.2.3 Threats related to the intelligent sensor with respect to the full life cycle
The barrier of the node resources (discussed further) can be encountered by applying advanced cryptography. TDA.NodeCompromise. Attacker [Sparam] can: eavesdrop the traffic, inject packets or replay older messages, because wireless communication generally is not secure. After the node compromising, all information it holds [Dparam] is known to the attacker and/or node operation or communication is broken [Dparam]. OACC.Access. The sensor must control access of connected entities. OIDA.Authentication. The sensor must authenticate connected entities. OADT.Audit. The sensor must audit attempts to undermine its security and should trace them to the associated entities. OINT.Processing The sensor must ensure that the processing of input to derive output data [Dparam \(<=\) DTO.SensorData] is accurate. OAVB.DataFreshness. Ensure that the message received [Dparam] is the message sent by the authorized source [Sparam] but not a replayed message sent by the intruder [Sparam]. TDA.Access. Users or intruders [Sparam \(<=\) SAU.IntellSensorUser, SNA.HighPotIntrud] could try to access functions or data [Dparam] they are not allowed to. OACC.Access. The sensor must control access of connected entities. TDA.SensorDataEavesdrop. Intruder [Sparam \(<=\) SNA.HighPotIntruder] eavesdrops sensor data [Dparam \(<=\) DTO.SensorData]. OCON.DataEncrypt. Encrypt the data [Dparam \(<=\) DTO.SensorData]. TDA.SensDataMdfy. Intruder [Sparam \(<=\) SNA.HighPotIntruder] modifies sensor data (falsifies them) [Dparam \(<=\) DTO.SensorData]. OIDA.Authentication. The sensor must authenticate connected entities. The sampled and partially processed data are sent to other nodes, data base servers or to any control/monitoring equipment. The next group of threats represents attacks aimed at sensor networks and the sensor node transmission ability, constituting the TOE IT environment (TIT). TIT.CommInterfer. Intruder [Sparam \(<=\) SNA.HighPotIntruder] interferes network communication by sending messages through different protocol layers (e.g., jamming, collisions, flooding), causing that the data [Dparam \(<=\) DTO.SensorData] are lost (usually inconspicuously for their owner or destination) or the node disappears (-has been stolen\"). ODEX.CommQuality. Avoidance of interference, blocked communication spaces, using specialized measures against jamming, collision and flooding. OINT.DataVerification. Verify that the data [Dparam] are valid. OINT.MajorityVoting. Apply the majority voting scheme to determine the validity of an alarm raised by neighbouring nodes based on their own measurement. TIT.RoutingMisuse. Intruder [Sparam \(<=\) SNA.HighPotIntruder] interferes routing by ignoring all or some messages or network communication. ODEX.MultipleCommPaths. Use redundant communication paths, specialized countermeasures (e.g., against blackholes, misdirection, wormholes), and controlling of the routing information. TIT.Malware. Malicious software designed to infiltrate or damage a sensor node or sensor network. TIT.BackdoorOpen. Using the wireless access point an intruder [Sparam \(<\) SNA.HighPotIntruder] creates a backdoor for the network of an organization (corporation) from the sensor node side. TIT.AttackPropagation. The possibility of attack propagation from a node to other nodes, gateways and external servers. OACC.Access. The sensor must control access of connected entities. OIDA.Authentication. The sensor must authenticate connected entities. OINT.AntiMalware. Specialized anti-malware software. TIT.UncontrolledArea. Due to uncontrolled pervasiveness of a wireless sensors network, the node works in an uncontrolled network area accessible to potential intruders [Sparam \(<=\) SNA.HighPotIntruder]. OEIT.SecPerimVsTrRangeCtrl. The physically controlled security perimeter, where nodes are placed, should be defined with respect to the range of wireless transmission. For some safety-critical applications a special class of threats should be considered, which express scenarios how IT security problems may cause safety problems.