Constrained Function-Based Message Authentication for Sensor Networks

Abstract

Abstract-Sensor networks are vulnerable to false data injection attack and path-based denial of service (PDoS) attack. While conventional authentication schemes are insufficient for solving these security conflicts, an en-route filtering scheme, enabling each forwarding node to check the authenticity of the received message, acts as a defense against these two attacks. To construct an efficient en-route filtering scheme, this paper first presents a Constrained Function-based message Authentication (CFA) scheme, which can be thought of as a hash function directly supporting the en-route filtering functionality. Obviously, the crux of the scheme lies on the design of guaranteeing each sensor to have en-route filtering capability. Together with the redundancy property of sensor networks, which means that an event can be simultaneously observed by multiple sensor nodes, the devised CFA scheme is used to construct a CFA-based en-route filtering (CFAEF) scheme. In addition to the resilience against false data injection and PDoS attacks, CFAEF is inherently resilient against false endorsement-based DoS attack. In contrast to most of the existing methods, which rely on complicated security associations among sensor nodes, our design, which directly exploits an en-route filtering hash function, appears to be novel. We examine the CFA and CFAEF schemes from both the theoretical and numerical aspects to demonstrate their efficiency and effectiveness. Moreover, prototype implementation on TelosB mote demonstrates the practicality of our proposed method.

Secure System Practices and Data Access Management in Wireless Sensor Network

“…There have been many authentication schemes proposed for wireless sensor networks [1]. But Constrained Function based Authentication (CFA) [13] is only scheme of authentication which is supporting en-route filtering with only single packet overhead.…”

MoteSec-Aware: A Practical Secure Mechanism for Wireless Sensor Networks

“…We present a Virtual Counter Manager (VCM) with synchronized incremental counters and explore the KeyLock Matching (KLM) method [14] to, respectively, resist the replay/jamming attacks and achieve memory data access control. On the other hand, since sensors in the network, particularly those with limited resources, may suffer from DoS attacks, our previous work, called Constrained Functionbased Authentication (CFA) [28], is employed with proper modification to resist DoS attacks. We denote the process of executing CFA in the AES with Offset Codebook Mode (OCB) mode as AES-OCFA.…”

“…More specifically, included in AES-OCFA are two procedures for mitigating DoS and detecting replay/jamming attacks. Basically, in order to tackle DoS, our previously proposed method Constrained Function-based Authentication (CFA) scheme [28] has been properly modified and incorporated with the AES in OCB mode. Note that AES in OCB mode generates a ciphertext that simultaneously provides data secrecy and authenticity.…”

Fuzzy-Based Adaptive Countering Method against False Endorsement Insertion Attacks in Wireless Sensor Networks

“…However, relatively less research [6,[12][13][14][15] has focused on investigations of countermeasures to combat the latter type of security attack, which is called a false endorsement insertion attack (FEIA). Note that the detection of FEIAs might be much more important than that of FDIAs because of the important role of WSNs in reporting critical events.…”

“…Note that the detection of FEIAs might be much more important than that of FDIAs because of the important role of WSNs in reporting critical events. FEIA countermeasures can be classified into two types: distributed [6,[12][13][14] and centralized [15]. The centralized solution proposed by Lee and Cho [15], which is called the adaptive countering scheme (ACS), is more energy-efficient during "peacetime" (i.e., when an FEIA does not occur) because it does not involve en-route verification processes for reports.…”