1. Secure Localization: Location Verification and detection of Malicious nodes in WSN Advisor: Dr. Tricia Chigan Presenter: Solomon Ayalew 3/16/20121

2. Outline  Introduction and Background  Location discovery in wireless sensor networks  Localization systems  Detection of malicious nodes  Types of attacks on WSN’s  Cryptography in secure localization  Revocation of malicious nodes  Comparison of Secure Localization Algorithms 3/16/20122

3. Introduction & background (I)  Wireless Sensor Ntk’s  Low cost,  Low power,  mobility of nodes  dynamic topology,  withstand harsh environment  unattended operation,  ability to cope with node failure  Autonomous systems randomly deployed in remote hostile environments. 3/16/20123

4. Introduction & background (II)  Multi functional  Applications  battlefield surveillance  enemy tracking  Environmental  medical and industrial fields  Their location play’s a very important role in their application  localization systems are target of attack  Wrong location:- wrong military plan, wrong decision 3/16/20124

5. source of Pictures http://www.decentlab.com/index.php?id=2 http://www.indefia.com/products/hardware/wsn/ http://www.sics.se/~luca/profile.html http://www.decentlab.com/index.php?id=2 3/16/20125

6. 6

7. Cont…  Official terminologies  GPS is expensive. So new protocols come:  use special nodes called Beacon Nodes (landmarks, anchors, locators) o They Know their own location through GPS receivers or Manual configuration  Regular (unknown/free/dumb) nodes will learn from the beacons.  How????  Detecting beacon node:- node performing detection on received signal  Target node:- node being detected  Node ID: - Id used by a detecting beacon node to make a target beacon node believe that a non-beacon node wants to communicate. 3/16/20127

8. cont 3/16/20128 Deployment of sensor nodes. Ref [1]

9. Location discovery in WSN nodes.  Stage 1  Non beacon nodes receive radio signal called Beacon Signal/Beacon Packet form Beacon nodes.  Beacon Packet = f ( RSSI, ToA, TDoA, AoA, (x,y )) where  RSSI is Received Signal Strength Indicator.  ToA :- Time of Arrival.  TDoA Time Difference of Arrival. Location References  AoA:- Angle of Arrival  Stage 2  Based on different References', nodes determine their own location with minimum estimation error. But if some beacon nodes r malicious??? 3/16/20129

10. Localization systems 1.Distance/angle estimation:-  Estimate regarding distance &/or angle b/n 2 nodes.  Based on RSSI, ToA, or hop count analysis. This values are affected by Δ signal power or introduce noise obstacles or magnet to the sensor field. 2.Position computation:-  Compute the position of a node based on the received signal. Some techniques use trilateration, multilateration or triangulation. 3/16/201210

11. Cont… 3.Localization algorithms:-  Main component of the localization system  Distributed and multi-hop algorithms  Info manipulated; WSN nodes know their positions.  rref [6] Fig xx the division of localization systems in to 3 distinct components 3/16/201211

12. Detection of malicious nodes Example. [1] ref [1]  Detecting node N sends request message to the target node N A.  Target node reply a Beacon Packet (beacon signal) that includes its own location (x’, y’).  Then the detecting node will do calculations  Estimates the distance between them based on Beacon signal. 3/16/201212

13. Cont..  Calculate the distance between them from (x’,y’)& (x,y)  If | - measured distance| > maximum measurement error,  the node is Malicious  can’t be a node Malicious by satisfying the above condition ????....  Condition not satisfied mean this node is Malicious???  Consider an attacker reply a previously captured signal.  DRBTS [7] (distributed reputation based beacon trust system):- each beacon node monitors its neighborhood for suspicious beacon nodes.  Build a trustworthy table so that other nodes will chose highly trustworthy nodes. 3/16/201213

14. Types of Attack’s ref [8]  Distance fraud attack  Mafia fraud attack  Terrorist fraud attack  Wormhole attack  Sybil attack  Spoofing attack  Jamming  Overshadowing  Manipulation and Replay 3/16/201214

15. Attacks against Location discovery beacon node N B attacking node N A Malicious node N B (x,y) (x’, y’) (x, y) I am N B location I am N B & my location is (x, y) (x’, y’) N N a) Masquerade beacon b) compromised beacon node Beacon node N B I am N B my location attacking node N A (x, y) is (x, y) (x’,y’) Malicious/ attacking node is a node that have access to a compromised cryptographic keys. I am N B @ (x,y) N c) Replay attack ref [1] 3/16/201215

16. Cont… 3/16/201216 a) Sybil attack b) reply attack c) wormhole attack Ref [6]

17. Cont… a)Sybil attack:-  Malicious node appears in different poistions. b)Reply attacks:-  Store a received packet(from a beacon node) & respond it later.  Estimated distance & calculated distance are different. Cant be the some???? 3/16/201217

18. Cont… C ) Wormhole attack:-  Received signal by malicious node in 1 side of the ntk is sent and replicated by other side of the ntk.  Developed algorithms: Geographical Leashes, Directional antenna  works if two nodes are neighbors. Temporal Leashes  needs synchronization and large mem space to save auth. Keys.  Round trip time:- doesn’t need synchronization.  Assumption, all nodes are equipped with Wormhole detectors. RTT = [(R4-R1)-(R3-R2)] where t1: time to finish sending first byte of request t2: time to finish receiving first byte of request t3: time to finish sending first byte of reply t4: time to finish receiving first byte of reply 3/16/201218

19. Cryptography in secure localization  Cryptograph is against externally deployed hostile nodes.  But here we are talking about compromised nodes. Attackers have access to secret keys and passwords  So most secure localization algorithms use non-cryptographic security techniques.  Cryptography is 2 nd Line of defense. E.g HiRLoc, ROUPE, SeRLoc  Communication between beacon nodes &BS and some algorithms use cryptography.  E.g SPINe 3/16/201219

20. Revocation of Malicious Nodes A Beacon node will report its detection to the base station securely. ==>they use shared key. Alert [detecting node ID, target node ID]. Base station maintains alert counter & report counter.  Alert counter :- suspiciousness of this node.  Report counter:- # of alerts this node reported.  Why?? If malicious node repots against Benign B. nodes 3/16/201220

21. Comparison of different algorithms ref[6] 3/16/201221

22. Cont… 3/16/201222

23. Cont…  HiRloc/SeRloc  Rope  Liu et al  Based on Distance estimation  RTT (round trip time)  WRBTS  Keeps neighbor- reputation table  Trustworthiness by voting 3/16/201223

24. Cont…  HiRloc ( High resolution range independent localization )  Extended version of SerLoc ( secure range independent localization )  doesn’t perform range measurment  Sensors don’t interact to determine their location  Beacon nodes called locaters  Locators know their location and orientation (antenna)  Sensors determine their position Passively. 3/16/201224

25. Location determination  Each locator transmits 1.Locators coordinate 2.Angel of sector boundary 3.Locators communication range  Sensors don’t perform  Signal strength measurement  angle of arrival measurement or time of flight  HirLoc and SeRloc are range independent 3/16/201225

26. Cont… 3/16/201226

27. Cont…  Region of intersection (ROI)  Is the region formed by intersection of the locators signal  Location determination perfection  Varying the antenna orientation or rotation  Varying the communication range.  SeRloc do this by  Increasing the locator density  Narrower antenna sectors  hardware complexity, expensive  Weakness of HiRloc and SeRloc, assumption no Jamming 3/16/201227

28. ROPE  ROPE (RObust Position Estimation)  Resistant to jamming  Accept the existence of malicious nodes  Assuming Benign nodes outnumber malicious nodes  Statistical and outlier filtering techniques  Sensors request update of their position  Assumption:-  Sensors share a pair wise key.  DBIR (Distance Bounding Intersection Region) 3/16/201228

29. Cont… 3/16/201229

30. Location estimation in ROUPE 1.Sensor broadcasts it ID and nonce N s 2.Locator that is in range performs distance bounding  Sensor defines its LDB 3.If LDB>=3 perform Verifiable Multilateration (VM)  Computes it location  Notify this to locators  Terminate the algorithm 4.If locator didn’t receive notification==> sensor don’t know his position. Do more specific steps looks like the above.  Weakness of ROPE, needs at least 3 locators unlike 2 for HiRloc/SeRloc 3/16/201230

31. . ? 3/16/201231

32. References 1.D.Liu, P.Ning, and W.Du “”Detecting Malicious beacon Nodes fir Secure Location Discovery in Wireless Sensor Networks” 25 th ICDCS, 2005,pp.609-19. 2.L.lazos, R. Poovendran, and S.Capkun “Rope: Robust Position Estimation in Wireless sensor Networks” Proc IPSN, Apr. 2005 pp. 324-31 3.L.lazos, and R. Poovendran, “Hirloc: High-Resolution Robust Localization for Wireless Sensor Networks ” IEEE JSAC Vol. 24, Feb 2006, pp. 233-46 4.L.lazos, and R. Poovendran, “Serloc: Secure Range-independent Localization for Wireless Sensor Networks” IPSN, Apr. 2005, pp.324-31. 5.S.Capkun and J. Hubaux “Secure Positioning in Sensor Networks” … 6.A.Boukerche, H. Oleiveira, E. Nakamura and A. Loureio “Secure Localization Algorithms for Wireless Sensor Networks” … 7.Z. Li et al., “Robust Statistical Methods for Securing Wireless Localization in Sensor Networks” IPSN ’05, p. 12 8.W. Ammar, A. ELDawy, M. Youssef “ Sensor Localization in a Wireless Sensor Networks” June 2007 3/16/201232