Sensor Network Security - Networked Embedded Systems - page 213

TABLE . DoS-Threats in Wireless Sensor Networks [WS]

Network Layer Attacks Countermeasures

Physical Tampering Tamper-proofing, hiding

Jamming Spread-spectrum, priority messages, lower duty cycle,

region mapping, mode change

Link Collision Error-correcting code

Exhaustion Rate limitation

Unfairness Small frames

Network Neglect and greed Redundancy, Probing

Homing Encryption (only partial protection)

Misdirection Egress filtering, authorization, monitoring

Black holes Authorization, monitoring, redundancy

Transport Flooding Client puzzles

Desynchronization Data origin authentication

sensor nodes, so that any opportunity for an attacker to cause a sensor node to wake up and perform
some processing functions is a potential DoS vulnerability.
In , Wood and Stankovic published an article on DoS threats in sensor networks [WS] in
which they mainly concentrate on protocol functions of the first four open systems interconnection
(OSI) layers. Table . gives an overview of their findings and potential countermeasures proposed.
On the physical layer, “jamming” of the wireless communication channel represents the princi-
pal attacking technique. Spread-spectrum techniques are by nature more resistant against this kind
of attack, but can nevertheless not guarantee availability of physical layer services. In case that the
bandwidth available in an area is reduced by a DoS attack, giving priority to more important messages
could help maintain at least basic operations of a sensor network. While jamming mainly disturbs the
availability of sensor nodes to communicate, it has second DoS relevant side effect. As a consequence
of worse channel conditions, sensor nodes need more energy to exchange messages. Depending on
protocol implementation, this could even lead to energy exhaustion of some nodes, if they tirelessly
try to send their messages instead of waiting for better channel conditions. Therefore, from a DoS
avoidance point of view, lower duty cycles could be a beneficial protocol reaction to bad channel
conditions. Furthermore, the routing protocol (see also below) should avoid to direct messages into
jammed areas, and ideally, cooperating sensor nodes located at the edge of a jammed area could
collaborate to map jamming reports and reroute traffic around this area. If sensor nodes posses of
multiple modes of communication (e.g., wireless and infrared communications), changing the mode
is also a potential countermeasure. Finally, even if not directly related to communications, capturing
and “tampering” of sensor nodes can also be classified as a physical layer threat. Tamper-proofing
of nodes is one obvious measure to avoid further damage resulting from misuse of captured sen-
sor nodes. A traditional preventive measure to at least render capturing of nodes more difficult is to
hide them.
On the link layer, Wood and Stankovic identify (malicious) “collisions” and “unfairness” as poten-
tial threats and propose as classical measures the use of error-correcting codes and small frames.
Whileonecouldarguethatboththreats(andrespectivecountermeasures)arenotactuallysecurity-
specific but also known as conventional problems (and strategies for overcoming them), their
deliberate exposure for DoS attacks could nevertheless lead to temporal unavailability of commu-
nication services, and ultimately to “exhaustion” of sensor nodes. For the latter threat, the authors
propose rate limitation as a potential countermeasure (basically the same idea as lower duty cycle
mentioned in the physical layer discussion).
Considering the network layer, threats can be further subdivided into forwarding- and routing-
related threats. Regarding forwarding, the main threats are “neglect and greed”, that is, sensor nodes
that might only be interested in getting their own packets transferred in the network without correctly
participating in the forwarding of other node's packets. Such behavior could potentially be detected
by the use of probing packets and circumvented by using redundant communication paths. How-
ever, both measures increase the network overhead and thus do not come for free. If packets contain