## 4 Security Threats
### Negotiation
#### 4.2.9 Identity Theft and the Use of Multiple Identities  
During the negotiation phase, each participant must carry a unique, \"permanent\" identity [51]. This should unambiguously identify not only the nodes, but also the mechanisms assigned with the task of sharing the available spectrum in a DSA network. These identities should under no circumstances be modified. If the latter requirement is not satisfied, an attacking node can realize attacks such as identity theft or using multiple identities against either its legitimate competitors, or the sharing mechanism itself, posing a significant threat to the underlying network [29, 52].  
Identity theft is one of the most dangerous attacks. The main reason is that spoofing the identity of an unsuspecting victim could result in numerous unpredictable consequences. To begin with, an adversarial node may realize such an attack to successfully hide its non-conformant behavior. In this capacity, it can not only avoid being caught or punished because of acting in a non-conformant way, but also to accuse someone else for its own improper actions. Obviously, accusing innocent nodes for rule infringements they have never undertaken will cause strong user dissatisfaction, as well as high instability in the underlying DSA network. Additionally, an adversary having successfully spoofed the identity of another node could send spectrum requests to the sharing mechanism on behalf of its unaware victim. Such an attack could leave the respective spectrum portions unused, or oblige a victim node to pay the price for resources it never requested and, thus, never used. Unsurprisingly, such victim nodes could quickly stop trusting not only this DSA network, but also the CR paradigm as a whole.  
Moreover, identity theft may enable an attacker to successfully mislead a spectrum sharing mechanism by simply sending fake feedback. The reader should recall that special reports carrying operational details or information regarding the environment each node operates in are required by some allocation mechanisms proposed in the literature. A misbehaving node could thus start such an attack to manipulate the view a sharing mechanism maintains of the managed network, either for gaining personal profits (selfish behavior) or for affecting the optimality or the resource allocation results (potentially malicious behavior).  
An equally important threat can arise if an adversary is able to spoof more than one identity simultaneously. Such an action can enable him to achieve most of the malicious goals described above in a more efficient manner. In other words, an attacking node using multiple identities can provide more credible reports to the sharing mechanisms and, consequently, manipulate more successfully the view of the managing network of the latter. Also, he can better hide his actions and/or accuse innocent parties of them.  
In a worst case scenario, a malicious node can even continuously change the identities it spoofs. In such a way, it can equally divide its maliciousness to all its competitors, causing the least possible disturbance to each one of them and, as a consequence, avoid triggering any punishment mechanism. Even in the case a victim node is suspected of being non-conformant and punishment measures are enforced against it, the real attacker can easily avoid being punished by simply changing again its identity. Any active monitoring and/or punishment mechanism would then fail to effectively counter such an attack, posing a significant threat to both the stability as well as the efficiency of the operation of the underlying network.