## 1 Introduction  
In essence, an intelligent environment is a distributed system that collects data from a wireless sensor network, processes this data, and enriches the environment with new meaning. These semantic enhancements can be used by other applications running on top of our system to make decisions. Security concerns are key issues in ambient intelligence (AmI) since its earliest inception [1]. Many researchers clearly recognize the inherent challenge that an invisible, intuitive and pervasive system of networked computers holds for current social norms and values concerning privacy and surveillance. In fact, the increasing attack rate has become the bottleneck of adopting next-generation services and applications. A study from the Computer Security Institute reveals that a random sample of 223 organizations had lost hundreds of millions of dollars in 2002 due to security attacks [2]. For example, [PERSON] and [PERSON] [3] developed a timing attack for the OpenSSL implementation of RSA in a real TCP/IP network. This low-cost attack exploits some asymmetries introduced by two optimizations used in the OpenSSL implementation. Even in OpenSSL, that is considered to be quite reliable and secure, and it is used in many servers around the world, it is possible to find asymmetries that reveal some data of the cryptographic keys. And these asymmetries can be used to implement a real attack. Using OpenSSL or something equivalent for sensor communications would be impractical in most cases, and therefore the security threats become much worse as many more attack opportunities arise. Three factors contribute to make security in wireless sensor networks a very difficult problem: 1) many nodes in the network have very limited resources; 2) pervasiveness implies that some nodes will be in non-controlled areas and are accessible to potential intruders; 3) all these computers are globally interconnected, allowing attacks to be propagated step by step from the more resource-constrained devices to the more secure servers with lots of private data. Usually, security issues are addressed, in a similar way to services in a network of general-purpose computers, by adding an authentication system and encrypted communications. First, the resource limitations make the embedded computers especially vulnerable to common attacks. In previous work [4], we demonstrated that current ciphers and countermeasures often imply a need for more resources (more computation requirements, more power consumption, specific integrated circuits with careful physical design, etc. ), but usually this is not affordable for this kind of applications. But even if we impose strong requirements for any individual node to be connected to our network, it is virtually impossible to update hardware and software whenever a security flaw is found. The need to consider security as a new dimension during the whole design process of embedded systems has already been stressed [5; 6], and there have been some initial efforts towards design methodologies to support security [7; 8; 9], but to the best of our knowledge no attempt has been made to exploit the special characteristics of wireless sensor networks. Applications built on wireless sensor networks have to live with the fact that privacy and integrity cannot be preserved in every node of the network. This poses restrictions on the information a single node can manage, and also in the way the applications are designed and distributed in the network. Of course, the inherent insecurity of embedded systems should not lead us to not try hard to avoid compromises. We should guarantee that a massive attack can not be fast enough to avoid the detection and recovery measures to be effective. Therefore we should design the nodes as secure as the available resources allow. In spite of the disadvantages of wireless sensor networks from the security point of view, they provide two advantages for fighting against attacks:* Redundancy.