Secure Routing in Sensor NetworksMohammad Nikjoo S.

Department of Electrical andComputer Engineering

University of Western OntarioOntario, Canada

Email: mnikjoos@uwo.ca

Arash Saber TehraniDepartment of Electrical and

Information TechnologyMunich University of Technology

Bavaria, GermanyEmail: a.saber@mytum.de

Priyantha KumarawaduDepartment of Electrical and

Computer EngineeringUniversity of Western Ontario

Ontario, CanadaEmail: skumaraw@uwo.ca

Abstract— In this paper, we present the secure routing insensor networks. Routing protocols in wireless sensor networks(WSNs) are susceptible to a number of attacks depending onthe nature of the protocol, its application, and the environmentin which the protocol is intended to be used. Routing protocolsthat do not take the malicious attacks into account can notbe easily tamper proofed. These protocols should be designedsecurely so that they are capable of asserting countermeasureswhenever they need to. In this paper we evaluate the mostimportant security attributes in wireless sensor networks. Then,based on these attributes and the application type of the routingprotocols, we compare the vulnerability of different groups ofprotocols.

Keywords— Wireless sensor networks, routing protocols, se-curity attributes, attacks, countermeasures.

I. INTRODUCTION

In multi-hop wireless systems, such as ad-hoc and sensornetworks, the need for cooperation among nodes to relay eachother’s packets exposes them to a wide range of securityattacks. Furthermore, routing is a fundamental functionality inwireless sensor networks, thus hostile interventions aiming todisrupt and degrade the routing service have a serious impacton the overall operation of the entire network. In this paperwe are going to go over the security attributes in wirelesssensor networks. Attacks that commonly affect the sensornetwork routings can be classified and countered if one closelyconsiders the attributes that are important in secure routings.In this paper, first we explain the goals of attackers whichattack the wireless sensor networks and Then, some importantattributes of security mechanism will be shown. Finally wecompare the protocols based on the main security attributesand application type. The organization of this report is asfollows: In Section 2, the main characteristics of the routingprotocols in wireless sensor networks are discussed. Securitygoals are explained in Sections 3. Possible goals of attackerson attacking to routing protocols are discussed in Section 4.Security attributes and their effects on routing protocols areexplained in Sections 5 and 6. Finally, conclusions are madein Section 7.

II. MAIN OBJECTIVES OF ROUTING PROTOCOLS

Wireless sensor networks have many restrictions. Limitedenergy supply, limited bandwidth of transceivers and comput-ing power of nodes are some of these restrictions. In designing

a WSN, carrying out data communication is a main goalwhile making efforts to prolong the lifetime of the network.In designing the routing protocols for WSN, the followingkey factors to be considered. These factors must be overcomebefore efficient communication can be accomplished [1],[3].• Node Deployment: Depending on application, deploy-

ment of nodes are deterministic or randomized. In determin-istic deployments the data is routed through predeterminedpaths whereas in randomized deployment is needed clusteringto have connectivity and energy efficient operation.• Energy Consumption: Each node in WSN has a limited

power supply, which is used both for computation, sendingand routing the data. So malfunctioning of a sensor node dueto lack of power can cause significant changes in topology ofWSN and rerouting and reorganizing may be required.• Data Reporting Model: Data reporting in WSN can be

categorized into time-driven, event-driven, query-driven andhybrid. Depending on the application, one of these modelswould be suitable. For instance in applications that data ismonitored periodically, time-driven data reporting is a goodcandidate.• Fault Tolerance: In WSNs some nodes might fail or not

have enough power to send or route their data. These faultsshould not affect the overall task of the network and WSNshould be able to reorganize itself and use other routes toovercome these failures. So fault tolerant WSNs have to havesome levels of redundancy.• Scalability: In a WSN, over hundreds or thousands nodes

may be deployed. Any routing protocol must be able to workwith this number of nodes. It should be scalable to respond toevents in the environment.• Data Aggregation: In a WSN, nodes may produce similar

data packets. These data can be aggregated to reduce numberof transmissions. Some functions like min, max, average, andsuppression can be used to aggregate data. This techniquehelps to energy efficiency and diminishing number of trans-missions.• Quality of Service: Data in some WSNs should be

transferred to a destination within a limited time otherwisethey would be useless. In these applications, a bounded latencytime is a condition to specify validity of data. In many otherapplications conserving energy has more priority than qualityof data sent, so the routing protocol should consider the energy

0840-7789/07/$25.00 ©2007 IEEE 978

consumption and reduce the quality of service to prolong thelifetime.• Security: Security is very important for many applications

and even critical for some applications like military andhomeland security [4]. A routing protocol should be resistiveto several attacks. An attacker can easily inject some datato the network and operate like several nodes and route thedata selectively. A routing protocol should consider securityand guarantee the integrity, authenticity, and availability ofmessages in the presence of adversaries.

III. IMPORTANCE OF SECURITY

In the previous section we explained some important char-acteristics in sensor networks routing. In this section we aregoing to highlight one of the attributes, Security. Most ofprevious works on sensor network routing protocols assume asafe and secure environment where all sensor nodes cooperatewith no attacker present. But we know that in real environmentthere are many attacks that can affect the performance ofsensor networks routing. attackers use different kinds of at-tacks to damage the sensor networks or listening and capturingimportant data. In the ideal world the security goal can beobtained when every node receives all messages intended for itand be able to verify the integrity of every message[3]. In thispaper we will first explain the goals of attackers and then willinvestigate some main factors in security of routing protocolsbased on this important goal. Finally we will compare thevarious kinds of routing protocols based on these attributes.

IV. POSSIBLE GOALS OF ATTACKERS

In this section we explain the possible objectives of attack-ers. Almost all the attackers have one of these major objectivesfrom their attacks. Attackers usually use different methodsto damage the networks. They use different kinds of attacksfor their malicious goals and damage the whole or parts ofnetworks using these attacks.• Eliminating important data and flow suppression: One

of the possible methods for damaging networks is to penetratein to the network as a node and then deleting or refusing toforward the information which is coming to this maliciousnode. With this method the other nodes in the network cannot obtain this specific information which is eliminated withmalicious node. Also attackers can suppress flow using thestructure of routing or using different kinds of attacks. Forexample in directed diffusion an adversary can suppress theflow using negative reinforcements.• Changing routing traffics: Sometimes attackers put a

compromised node which is especially attractive to surround-ing nodes with respect to the routing algorithm in the network,and by using this attractive node try to lure all the trafficfrom a particular area through this compromised node. Withthis method the routing traffics of network change and it candamage the network.• Listening to the transmission data and capturing

important data: In some application of sensor networks likemilitary application, protecting data from enemies are very

important. In these situations, enemies and attackers try toeavesdrop important data. They usually put some maliciousnodes in the network and then by advertising some alluringroutes try to capture important data. In this method theyconvince the other nodes to send their information to thesemalicious nodes.• Reducing the performance of the network : Sometimes

attackers use different kinds of attacks to reduce the perfor-mance of the network. They usually use these techniques infront of fault-tolerant schemes to reduce their effectiveness.• Cloning flow: Attackers usually clone a flow for eaves-

dropping. They use some malicious nodes in the network.Then these nodes reply to the interests with themselves listedas the base stations. All events satisfying the interest will nowbe sent to the attackers.

V. ATTRIBUTES AND MAIN FACTORS OF SECURITY

MECHANISM

In this section we will define the security attributes of rout-ing protocols in wireless sensor networks which with them theattackers can not achieve their goals. Security attributes are themechanisms that allow the routing protocols to defend againstthe possible threats in the whole network. These attributesconsist of identity verification, bi- directionality confirmation,topology structure restriction, base station decentralization andbraided and multi-path transmission and are presented asfollows:

1. Identity Verification: The identity of nodes, i.e., thecharacteristics of each and every node in wireless sensornetworks should be checked from time to time by base stationsor the gateways in each cluster.

2. Bi-directionality Conformation: Nodes in the networksshould be checked for being bidirectional. This is becauseof the fact that nodes receiving a message from a neighborshould know that if the sender is a trusted sender or not, i.e.,they should check whether the sender is in the range of theirtransmission in other words whether it can receive their limitedrange transmissions.

3. Topology Structure Restriction: The structure of thetopology in wireless sensor networks should not be able toexpand randomly. This is done using strict rules initiated fromthe base station.

4. Base Station Decentralization: The base station in thewireless sensor networks should not be the sink to every singlemessage. This is mainly because of the fact that fake basestations created by the adversary can direct all the sources tothemselves.

5. Braided and Multi-Path Transmission: Multi-path andbraided-path transmissions are needed especially when theprobability of being compromised by the adversaries is highin sensor networks. This attribute calls for sending k messagesinstead of one, so that the attackers are defeated in selectivelyforwarding the messages.

979

VI. COMPARISON OF ROUTING PROTOCOLS BASED ON

SECURITY ATTRIBUTES AND APPLICATION TYPE

In this section we are going to evaluate the attributes ofthe security schemes. We take a close look at the charac-teristics of the attributes discussed in the previous sectionand evaluate their effects on routing protocols family. In thissection we will compare the groups of routing protocols basedon their vulnerability to possible attacks according to theseattributes. Finally, the routing protocols according to securityattributes and possible attacks are tabulated. Some ad-hocnetworks utilize public key cryptography for encryption ordigital signature. This can not be the case for our evaluation.This is because of the fact that public key cryptography isvery expensive in terms of computation complexity and thusit is not preferred for resource constrained sensor networks.In our evaluation and comparison we focus on symmetrickey cryptography as well as the attributes of secure routingprotocols as follows:

1. Identity Verification: In the mobile sensor networks,each and every node has a single specific identity which isused for determining its characteristics such as its positionor resource constraints. The identity of nodes has to beverified by the base stations in order to have a secure routingprotocol. This is because of the fact that an attacker can easilycompromise single or multiple nodes when strict identityverification is not applied. Previously, the identity verificationwas possible if one used public key cryptography for digitalsignature. This is possible for networks that are not energyconstrained. In this technique, a shared key and a secret keyare used for identity verification. In sensor networks, however,we can not use this type of verification. Our evaluations showthat an attacker should only be able to take advantage of theidentities that are already established, i.e., she can not createnew identities. Furthermore, the base station should limitthe nodes surrounding each node for local communication.This restriction is essential, i.e., the nodes should not useany node except their previously verified neighbors. Basedon this attribute, we have had a comprehensive evaluationof different families of protocols. Our study shows that twogroups of protocols have the attribute of identity verification.Cluster based protocols and minimum cost forwarding familyhave the characteristic of verifying the identity of nodes.Not only it does prevent the outsider to attack the network,but taking care of this attribute can have an efficient effecton removing the Sybil attacks. Let us have a closer lookat the application types of protocols that are using identityverification in their structure. In terms of the application type,the algorithms that are based on efficiently forwarding packetsfrom the source to sink using identifiers have the attributeof identity verification. These can be the protocols in whichthe nodes maintain the minimum cost required to reach thebase station. Also, in those protocols that use cluster heads forefficiently disseminating queries such as low-energy adaptiveclustering hierarchy, identity verification is used to preventpossible attacks.

2. Bi-directionality Confirmation: In a network consistingof several nodes, messages are sent and received by thousandsof links over the network. Our evaluations show that there is astrict need for confirming the property of being bidirectionalfor each and every link in the network. It is interesting thatchecking the bi-directionality of the links before performingthe tasks wanted is equivalent to identity verification discussedin the previous attribute. This attribute is a sub-set of identityverification in the sense that when an identity in a networkis verified, the attribute of being bidirectional is checked aswell. Checking the links in the network for being bidirectionalis done in the applications that are using geographic andenergy aware or greedy perimeter stateless routings. Theseapplications consist of protocols in which identifying the nodesposition is the main concern. Furthermore, when there is aneed for matching the queries with data events with minimumcost using agents that are sent through the network, thisattribute is considered because these agents have to be checkedfor having this specific attribute.

3. Topology Structure Restriction: The structure ofthe topology in the sensor network should be restricted interms of expansion or modification. Not only it is importantbecause of the self organizing nature of the network but it alsoposes an important security attribute called topology structurerestriction. If the topology is well structured, information suchas the location of the nodes and the neighbors are easy tocontrol by the base station. This also reduces the need foradvertisement of IDs or time stamps by nodes because theexact topology is previously well known.

4. Base Station Decentralization: In any kind of sensornetwork, there is a base station which is the sink of allmessages obtained through the network. We have taken aclose look at this, and define an attribute called base stationdecentralizing. This attribute calls for a structure that is notinitiated at base station. Instead, if localized interactions areused and network does its duty without initiation from thebase station, this security attribute is taken into account. Ifa protocol pays attention to this attribute, private and out ofbound channels are detected because the sink of the messagesare not solely base stations. Moreover, in protocols that ad-vertised information is not used to construct the topology thisattribute is considered. Wormholes and sinkholes are easilyprotected using this attribute. For clarification, we have evalu-ated geographic protocols in which the topology is constructedon demand using localized interactions. The nodes, here noticethese attacks because the distance between two nodes can notbe fake. The topologies that are based on energy conservingand those which are cluster based consider this attribute. Thisattribute is well utilized when sensor networks have to bedeployed in hard to reach and unattended areas. Because ofthe power constrained nature of these networks, nodes haveto be in several levels according to the power they consume.This important nature calls for localized algorithms in whichthe base station is not the initial starting source. Geographicalrouting protocols, directed diffusion multi path, energy con-serving and cluster based protocols are built considering this

980

TABLE I

COMPARISON OF ROUTING PROTOCOLS BASED ON THE MAIN SECURITY ATTRIBUTES.

Protocols Main AttributesIdentity Bidirectionality Topology Base Station Multi-path

Verification Confirmation Restriction Decentralization TransmissionDirected Diffusion — —

√— —

Single PathDirected Diffusion —

√ √ √ √Multi Path

Geographic routing —√ √ √

—TinyOS Beaconing — —

√— —

Minimum Cost√

—√

— —Forwarding

Rumor routing —√ √

— —Energy conserving — —

√ √ √Topology Maintenance

Clustering Based√

—√ √

—Protocols

attribute.5. Braided and Multi-path Transmission: The last at-

tribute that we are going to focus on is the multi-pathtransmission attribute. In networks that a number of pathsare used for message routing, this attribute is taken intoaccount. Considering this attribute, the attacks that are basedon selective forwarding are ineffective. Braided paths in whichthe number of joint nodes is not zero but paths do notshare a link are built according to this security attribute. Inapplications that energy conservation topologies are used, thetransmission can be based on multi path routing. These appli-cations can use this security attribute to affect the attacks thatcompromise the nodes to selectively forward the information.In applications that this attribute is not taken into account,either because of the resource constraints or because of theusage of a protocol that is not based on multi-path routing,participating nodes may be compromised and can not betrusted in forwarding received information. Considering theabove mentioned attributes Table 1 compares and evaluatesthe security mechanism. As you can see in this table, some ofrouting protocols such as single path directed diffusion havelow security and are open to attacks but some of them likemulti path directed diffusion are more sucre and are mostlypreserving against adversary attacks, but we can see that noneof these protocols have all the security attributes and all ofthem are susceptible at least against one attack.

VII. CONCLUSION

Today, sensor network is one of the most important kindsof networks with many applications in the real life. Securerouting is vital to be accepted and used in sensor networks formany applications. Most of the previous works on sensor net-work routing protocols assume a safe and secure environmentwhere all sensor nodes cooperate with no attacker present.However, in this paper we have found that currently proposedrouting protocols for these networks do not provide necessarysecurity and are mostly open to adversary attacks. We haveinvestigated some main factors to secure routing protocols insensor networks and compared the different kinds of protocolsby using these factors. Based on our paper, we found out that

there is no sensor network routing protocol that satisfies ourproposed security goals completely and all kinds of protocolshave some negative points based on which an adversary canattack them.

REFERENCES

[1] Jamal N. Al-Karaki, and Ahmed E. Kamal ”Routing Techniques inWireless Sensor Net- works: A Survey,”.

[2] Gergely Acs, Levente Buttyan and Istvan Vajda, “Modelling adversariesand security objectives for routing protocols in wireless sensor networks,”Proceedings of the fourth ACM workshop on Security of ad hoc andsensor networks, pp. 49-58, 2006.

[3] Chris Karlof, David Wagner, “Secure routing in wireless sensor networks:attacks and countermeasures,” Proceedings of the IEEE InternationalWorkshop on Sensor Network Protocols andApplications, pp. 113-127,May 2003.

[4] Du, X., and Lin, F. ”Secure cell relay routing pro- tocol for sensornetworks,” Performance, Com- puting, and Communications Conference,2005. IPCCC 2005, pp. 477-482, April 2005.

[5] Hamid, A., Mamun-Or-Rashid, Choong Seon Hong, “Defense againstlap-top class attacker in wireless sensor network,” The 8th InternationalConference on Advanced Communication Technology, vol.1, Feb. 2006.

[6] J. R. Douceur, “The Sybil Attack,” In 1st International Workshop onPeer-to-Peer Systems (IPTPS 02), March 2002.

[7] B. Chen, K. Jamieson, H. Balakrishnan, and R. Morris, “Span: Anenergy-efficient coordination algorithm for topology maintenance in adhoc wireless networks,” ACM Wireless Networks Journal, vol. 8, no. 5,September 2002.

[8] algorithm for mobile wireless networks,” In IEEE INFOCOM ’97, pp1405-1413, 1997

[9] C. Intanagonwiwat, R. Govindan and D. Estrin, “Directed diffusion: Ascalable and robust communication paradigm for sensor networks,” InProceedings of the Sixth Annual International Conference on MobileComputing and Networks (MobiCOM ’00), August 2000.

[10] Wendi Rabiner Heinzelman, Anantha Chandrakasan, and Hari Balakrish-nan “Energy-efficient communication protocol for wireless microsensornetworks,” Proceedings of the 33rd Annual Hawaii International Confer-ence on System Sciences, Jan. 2000.

[11] Y. X. et al., Adaptive energy-conserving rout- ing for multihop ad hocnetworks,” USC/ISI, Re- search Report TR-2000-527, October 2000.

[12] Intrusion Detection for Routing Attacks in Sen- sor Networks ChongEik Loo1 Mun Yong Ng1 Christopher Leckie2 Marimuthu Palaniswami

981