## 2 Related Work  
Many research works have dealt with the problem of security in wireless sensor networks. [PERSON] and [PERSON] [10; 11] proposed an architecture to stimulate a correct routing behavior. In their solution, nodes receive a per-hop payment in every packet they forward. Nodes store this payment information in an internal counter. As elements get benefits from routing, they understand cooperation as a benefit not only for the entire network, but also for individual nodes. This approach, however, maintains this cooperation information locally, only shared by nodes that interact directly. In our approach, on the contrary, reputation information is transmitted all over the network, so all nodes are warned about misbehaving nodes. [PERSON] _et al._[12] proposed mitigating routing misbehavior by detecting non-forwarding nodes and rating every path so those nodes are avoided when the routes are recalculated. The resulting behavior is that non-routing nodes are not included in routing paths (as they are not going to cooperate) but they still can ask others to forward their messages. According to [PERSON] [13], this scheme detects the misbehavior but it does not isolate it. In our system, bad-behaving or attacker nodes are isolated by rating their reputation as low. Many approaches to secure wireless sensor networks use encryption keys, or need user authentication and/or authorization. [PERSON] and [PERSON] [14] accept encryption keys from the first device that sends such a key. [PERSON], [PERSON] and [PERSON] [15] studied vulnerabilities of distance vector protocols and proposed countermeasures for these possible attacks. Their solution includes sequence numbers and digital signatures so senders can be identified and messages from attacking or misbehaving nodes are not routed. We opt for detecting bad behavior and dropping the reputation for these nodes. We assume misbehavior and attacks will happen and the system is responsible for isolating them. The CONFIDANT solution, proposed by [PERSON] and [PERSON] [16] is a good effort that solves most of the problems mentioned in this section. CONFIDANT is a protocol that sits over the chosen routing protocol and makes misbehavior less attractive for the nodes than proper routing: nodes watch their neighbors for bad behavior, take into account this behavior in a local reputation system and eventually inform their trusted neighbors on misbehaving nodes. Our approach is in some aspects similar to CONFIDANT. For example, it has a reputation system too, but it is not local, but global. Intuitively, a node \(i\) should give more weight to the direct observations made by it than the evidence obtained from other nodes. Furthermore, the evidence from different nodes should be weighted on the basis of their respective reputations. The beta reputation system [17] and recent implementations for Mica2 motes [18] base on these observations to provide resistance against bad-mouthing attacks. A different scheme is proposed in [19], based on the separation between action trust and recommendation trust. Either because they hold encryption keys or for other reasons, many approaches demand that the nodes be tamper-proof secure [20]. But this need is more difficult to fulfill with every passing day [21; 22; 23]). CONFIDANT's authors reason out that their protocol does not need tamper-proof hardware because other nodes' reputation tables are not alterable by the attack. As far as we know, it is not very clear how they maintain the local trusted nodes list or how trust information is updated. It could be difficult to detect a sybil attack [24; 25] or the impersonation of a trusted node by first reading the trusted node list from a tampered node. In an early design stage we decided not to depend on the hardware being tamper-proof. In fact, it is our assumption that it isn't _and_ that the communications between nodes with limited resources are not secure. Our approach compensates those drawbacks by taking advantage of redundancy, temporal and spatial.