Adapted from the original presentation made by the authors Reputation-based Framework for High Integrity Sensor Networks

2 High Integrity Sensor Networks How can the end-user rely on the information provided to it by the sensor network?

3 Why does misbehavior takes place? Information returned may be distorted Malicious attacks: (External attacker, compromised nodes) Noise: unavoidable In sensing In communication Fault: Persistent, transient, intermittent malfunction

4 Collaborative and local data processing Collaborative and local data processing Sensing ???? Where does misbehavior takes place? Cryptography Key Establishment Cryptographic frameworks Secure routing …… Networking Is Network Security enough?

5 Decentralized decision making I detected a car at (x,y) I detected a car at (x,y) I detected a car at (x,y) Misbehavior while routing information It was a false alarm. No such car! I detected a car at (x,y) I detected a car at (x,y) Misbehavior even while generating information

6 Limitations of network security Distributed collaborative data processing –Network security -> Make sure that only authenticated nodes participate. –Network security cannot -> Verify if nodes function properly Distributed data gathering –Network security can -> message integrity, confidentiality, secure relaying. –Network security cannot -> data authentication. Compromise nodes have access to valid keys!

7 Reputation based framework for sensor networks (RFSN) How do nodes trust each other? How do nodes trust the information provided by other nodes? Embedded in every social network is a web of trust How does human societies evolve? –Principle of reciprocal altruism Be nice to others who are nice to you –When faced with uncertainties Trust them who have the reputation of being trustworthy Proposed solution: Form a similar community of trustworthy nodes in the network over time

8 Sensor network already follow a community model –Individual nodes do not have any utility –Collaborative information gathering, data processing and relaying. Missing element is trust…. –Nodes are dumb and they collaborate with every node. –Internal adversaries exploit this very fact! –Faulty sensors results in equally detrimental effects. RFSN incorporates intelligence into nodes –Exposes trust as an explicit metric! –Cooperate with ONLY those nodes that are trustworthy. Why this approach?

9 Node level skeleton structure of RFSN n Observe the action of other nodes – Watchdog mechanism n Develop a perception of other nodes over time – Reputation n Predict their future behavior – Trust n Cooperate/Non-cooperate with trustworthy nodes – Behavior n Share experiences to facilitate community growth – Second hand information Watchdog mechanism Reputation TrustBehavior Second hand information

10 Reputation representation Probabilistic formulation –Use beta distribution to represent reputation of a node. Reputation of node j from the perspective of node i Why beta distribution? –Simple to store: Just characterized by 2 parameters. –Intuitive: α and β represents magnitude of cooperation and non-cooperation. –Efficient: Easy reputation updates, integration, trust formulation. Maintain reputation for just neighboring nodes –Use locality – Provides scalability.

11 Reputation updates Problem formulation –Node i wants to update R ij = Beta(α j, β j ) based on r cooperative and s non- cooperative observations about j. Approach Solution –Beta distribution is conjugate prior of binomial distribution. –Model P(observations/belief) as Bin(r+s,r) New reputation, ?? Old reputation, Beta(α j, β j ) ????

12 Update algorithm Implications –Simple, efficient and strong foundation to statistic. Diversity – No restrictions on (r, s) –Not necessarily has to be integers Beta distribution still well defined. –Nodes can give higher rating to critical events. –Allow partial ratings.

13 Reputation integration Problem formulation –Node i receives reputation information about node j through node k. Represented by (α j k,β j k ). Different from updation step –Reputation of reporter node, k, should also reflect in final result Approach –Use belief theory

14 Trust Problem formulation –What is the expectation of its next action being cooperative? Approach –Want to estimate θ, future behavior of node j Prior knowledge – None - Uniform in (0,1). Observations – α j as cooperative, β j as non-cooperative - Binomial

15 Behavior How to classify nodes as good/bad? –Use a simple thresholding technique on trust What is B ij ? –An abstract quantity. –Node i further action will decide on this Don’t route packet through j. Don’t send sensor data to j. Choosing threshold –Flexible Allow for dynamic configurability by the user. –Diverse Can be application specific. Reflect the security needed by that application.

16 Conclusions Generalized –Can handle malicious as well as non-malicious misbehavior. –Can handle misbehavior in networking, sensing as well as data processing. Scalable –Maintain reputation only about neighboring nodes. Diverse –Security can be tuned to meet application demands –Events can be rated at completely arbitrary scales Reconfigurable –All our design choices are governed by this criteria. BUT LOTS OF WORK STILL NEEDS TO BE DONE….

17 Ongoing research work: Watchdog Mechanism Generalized watchdog mechanism is not feasible! –Modules developed will be context specific. Designing individual modules –Outlier detection schemes, Consensus based protocols, …. Key is the scale! –Relies on redundancy and consistency in a local neighborhood. Watchdog mechanism is the heart of RFSN

18 Watchdog Mechanism (Contd….) Limits to which a framework based on homogeneous resources can work –Find out these limits? Can introducing heterogeneous resources help? –For example a trusted sensor -> equivalent to an access point. Problem is much simpler for the non-malicious case -> faulty nodes and noise. –Malicious attacker can act completely arbitrarily! –Ongoing work: Fault tolerant temperature monitoring system using mica motes

19 Open problems Bootstrapping network. –How does trust gets established? Intelligent adversaries –Cooperate and non-cooperate periodically. Context aware reputation –Is node with a bad temperature sensor bad for routing? –Multilayered RFSN seems like a feasible solution.