Rethinking security properties, threat models, and the design space in sensor networks: A case study in SCADA systems

Abstract

In recent years we have witnessed the emergence and establishment of research in sensor network security. The majority of the literature has focused on discovering numerous vulnerabilities and attacks against sensor networks, along with suggestions for corresponding countermeasures. However, there has been little guidance for understanding the holistic nature of sensor network security for practical deployments. In this paper, we discuss these concerns and propose a taxonomy composed of the security properties of the sensor network, the threat model, and the security design space. In particular, we try to understand the application-layer goals of a sensor network, and provide a guide to research challenges that need to be addressed in order to prioritize our defenses against threats to application-layer goals.

Introduction

A quick look at the research literature on sensor networks does not offer a hopeful view about their security. There appears to be innumerable threats to sensor networks, such as, replication (cloning) attack, Sybil attack, communication replay, wormhole attack, time synchronization attack, localization attack, routing attack, jamming, rushing of messages, aggregation attack, false sensor data injection, reputation attack, and many others.

Contributing to this grim outlook, sensor networks are generally presented as systems with very limited resources. Typical arguments include: (1) the hardware and energy constraints of sensor nodes severely limit their ability to implement traditional security solutions, (2) sensor nodes are left unattended and are therefore easily compromised, (3) there is no trusted infrastructure; therefore, distributed protocols must be resilient to Byzantine attackers, and (4) without an online trusted third party, it is difficult to bootstrap security associations.

As a result, if we implement a security countermeasure for each of the proposed attacks, the security overhead will overwhelm the (already scarce) available resources of the sensor network. In short, attempting to create a secure sensor network appears to be an impossible task.

This is not a problem unique to sensor networks, since obtaining perfect security is impossible. The problem, however, is that deployments of sensor networks have been used chiefly for either: (1) scientific purposes, where an adversary has little incentive to attack the sensors, or (2) military deployments, where very little public data is available: as a result, most of the academic research for the security of sensor networks has been done in abstract scenarios, where any assumption is valid; such as, the type of threats the sensor network is exposed, and the architecture and resource constraints of the sensor network.

However, recently sensor networks have found their way into real commercial applications. This offers us the opportunity to use concrete practical scenarios and avoid making assumptions about abstract deployments.

In this paper we begin to address these problems and we identify some key research challenges:

• Providing the background setting for the security of sensor networks in Supervisory Control and Data Acquisition (SCADA) systems. Identifying (1) the common architecture and resource constraints of the sensor networks, and (2) the incentives and methods an attacker can follow.

• Providing a holistic view of the security requirements and threat models of the sensor networks. We express our holistic view with two considerations: (1) we focus on high-level security goals (we argue that previous research has focused on low-level security goals), and (2) we introduce a class of physical attacks. (previous research has focused mostly on cyber-attacks).

• Providing a ranking of threats and security mechanisms. While our rankings may not be general enough, we believe our taxonomy is an important first step to better understand the threats against a sensor network and to understand our priorities for protecting them.

• Defining the high-level security goals of a sensor network. While terms like availability and integrity tend to be understood informally, we provide a new interpretation of these properties in sensor networks.

• Identifying different ways that sensor measurements are reported back to the base station: Event-based sensor measurements can compromise confidentiality of the network even when we use standard encryption algorithms.

The rest of the paper is organized as follows: In Section 2 we discuss the use of sensor networks in SCADA systems and emphasize the importance of securing sensor networks. Section 3 outlines the security properties of the sensor network as seen from the point of view of a network user. Our goal is to analyze global requirements, such as, confidentiality, availability, integrity, and privacy of the network, instead of focusing only on the requirements for secure middleware (e.g., secure routing) as previous research has done. Section 4 describes the threat model. The goal is to provide a general framework to analyze the threat models against the global security requirements by determining the conditions necessary for an attack to succeed and its estimated consequences. This framework gives us a way to identify and evaluate the things that can go wrong in the network. In Section 5 we study the security design space to identify best practices for the design and configuration of secure sensor network. Our aim is to help a system designer decide how to best defend the deployed sensor network. Finally, Section 7 concludes the paper and describes challenges and future work.