Location-based Access Control. Outline. Why do we need location in WSN? SeRLoc: Secure Range-Independent Localization for Wireless Sensor Networks

Transcription

1 SeRLoc: Secure Range-Independent Localization for Wirele Senor Network Louka Lazo Advior: Radha Poovendran Network Security Lab Univerity of Wahington Outline Motivation Secure Localization Problem SeRLoc Threat and defene Performance Evaluation Concluion 2 Why do we need location in WSN? Network function Location-dependent ervice Acce Control Location-baed Acce Control Microphone uername Databae query Monitoring App 3 Acce i decided baed on the location of the uer. Different privilege for variou area 4 1

2 Geographical Routing Report Monitoring Information Accelerometer 3 8 A B A want to end a meage to B Each node forward the meage to the neighbor cloet to the detination. Monitor the tructural health of the bridge Senor aociate their location with the reporting data 5 6 Localization Problem Localization: Senor Location Etimation How do enor become aware of their poition when they are randomly deployed or mobile? Algorithm Deign conideration What type of localization i required? Coare or Fine Grain? Where i the WSN deployed? Indoor or Outdoor What are the capabilitie of the enor? Hardware and Power Contraint Claification of Loc. Scheme Indoor v. Outdoor: GPS, VOR, Centroid (outdoor), RADAR, Active Bat, AhLo, (indoor). Infratructurele (I-L) v. Infratructure baed (I-B): AhLo, Amorphou, DV-Hop (I-L), RADAR, Active Bat, AVL (I-B). Range-baed (R-B) v. Range-Independent (R-I): Radar, Ahlo, GPS, Active Bat, VOR (R-B), APIT, DV-Hop, Amorphou, Centroid (R-I)

3 Localization in un-truted environment Previou cheme aumed truted node and no external attack, but WSN may be deployed in hotile environment Several threat in WSN localization: Replay attack, Node Imperonation attack, Compromie of network entitie. Secure Localization Problem Secure Localization: Enure robut location etimation even in the preence of adverarie. Related work: An Aymmetric Security Mechanim for navigation ignal [Kuhn 2004]. Secure Poitioning of Wirele Device with Application to Senor Network (SPINE) [Capkun et al, Infocom 2004] Outline Motivation Problem Decription SeRLoc Threat and defene Performance Concluion Our Approach: SeRLoc SeRLoc: SEcure Range-independent LOCalization SeRLoc feature Paive Localization, Robut againt ource of error, Decentralized Implementation, Scalable. Robut againt attack - Lightweight ecurity

4 Network Model Aumption (1) Two-tier network architecture Locator: Known Directional Location, Randomly deployed Orientation Antenna Senor range r r (X 2, Y 2 ) Senor: Omnidirectional Randomly deployed, Antenna unknown location (X 4, Y 4 ) Network Model Aumption (2) Locator deployment: Homogeneou Poion point proce of rate ρ L Random patial ditribution. Beamwidth θ (X 1, Y 1 ) θ R (X 3, Y 3 ) (X 5, Y 5 ) Senor deployment: Poion point proce of rate ρ independent of locator deployment Or can be een a Random ampling with rate ρ. Locator Senor Locator range R W N S E P ρ πr k! 2 k ( ) ( ) 2 L ρlπr LH = k = e LH : Locator heard at a enor The Idea of SeRLoc L 2 Locator Senor ROI ROI = Each locator L i tranmit information that define the ector S i, covered by each tranmiion. Senor define the region of interection (ROI), from all locator it hear. LH I S i i=1 SeRLoc Step 1: Beacon reception (0, 0) Locator Senor θ 2,2 L 2: (X 2, Y 2 ) θ 2,1 Locator : L 2 : : : The enor collect information from all the locator that it can hear. Coordinate (X 1, Y 1 ) (X 2, Y 2 ) (X 3, Y 3 ) (X 4, Y 4 ) Slope [θ 1,1, θ 1,2 ] [θ 2,1, θ 2,2 ] [θ 3,1, θ 3,2 ] [θ 4,1, θ 4,2 ]

5 SeRLoc Step 2: Search area Locator (X (X max -R, Y min +R) 1, Y 1 ) L 2 R R (X max -R, Y max -R) (X 2, Y 2 ) 2R+X min -X max Senor Search Area (X (X min +R, Y min +R) 4, Y 4 ) X min = min { X i i LH } (X R 3, Y 3 ) Y min = min { Y i i LH } Define: X max = max { Y i i LH } Locator heard by the enor Y max = max { Y i i LH } (X min +R, Y max -R) Senor place a grid of equally paced point into the earch area SeRLoc Step 3: Grid-ector tet Locator Senor R: Locator Range Senor hold a Grid Score Table (GST) initialized at zero. θ 1,2 θ For every point in the grid θ 1,1 R g: (xg,y g ) and every ector heard, perform Grid ector tet: C1 : g Li R, C 2 : θ1,1 θ θ1,2 If tet poitive increae core value by one SeRLoc Step 4: ROI computation Senor ROI Search Area GRID Score Table (GST) Outline Motivation Problem SeRLoc Threat and defene Performance High reolution localization: HiRLoc Concluion Majority vote: Point with highet core define the ROI. Error introduction due to dicrete computation. Accuracy v. Complexity tradeoff

6 Attacker Model Attacker aim at diplacing the enor. Attacker mut remain undetected. No DoS attack. SeRLoc - Security mechanim Meage Encryption: Meage encrypted with a ymmetric key K 0. ID authentication Beacon Format: L i : { (X i, Y i ) (θ i,1, θ i,2 ) (H n-j (PW i )), j } K0 No jamming of the communication medium. Locator coordinate Slope of the ector Shared ymmetric key H PW i H 0 (Pw i ) H H 1 (Pw i ) H H H n (Pw i ) Jamming f Hah chain one-way Every hah enor function tore the value H n (PW i ) for all the locator. A enor can authenticate all locator that are within it range (one-hop authentication) SeRLoc Wormhole Attack L 2 enor Locator Attacker THREAT MODEL The attacker record beacon information at region A, Region B tunnel it via the wormhole link at region B, and replay the beacon Senor i miled to believe it hear the et of locator LH : { -L 8 }. Wormhole link L L 7 Region A No compromie of integrity, L 5 8 authenticity of the communication or crypto protocol. Record beacon Direct link allow replay of the beacon in a timely fahion. L 6 23 Wormhole attack detection (1) P Accept only ingle meage per locator enor obtacle Locator A c Wormhole link ρ L Ac ( SG) = P( LH A 1) = 1 e c Attacker Multiple meage from the ame locator are heard due to: Multi-path effect Imperfect ectorization Replay attack 24 6

7 Wormhole attack detection (2) Communication range contraint property. enor Locator Attacker A i P L i 2R Wormhole link A j ρl A ρl A i j ( CR) ( 1 e )( 1 e ) L j Locator heard by a enor cannot be more than 2R apart. Li L j 2R R: locator-to-enor communication range. Wormhole attack detection (3) Probability of wormhole detection enor A i Wormhole link Pdet = U 2R A c Locator A j Attacker P( SG CR) = P( SG) + P( CR) ρ ( 1 ) ( 1 ) 2 L Ac ρl Ac ρl Ai e + e e The event of a locator being within any region A i, A j, A c are independent (Region do not overlap). P( SG) P( CR) Wormhole attack detection (4) Probability of wormhole detection 99.48% Reolution of location ambiguity A enor need to ditinguih the valid et of locator from the replayed one. Attach to Cloet Locator Algorithm (ACLA) Region B L 2 Cloet Locator 1. Senor : Broadcat a nonce η. 2. Locator L i : Reply with a beacon + the nonce η, encrypted with the pairwie key K,Li. 3. Senor : Identify the locator L c with the firt authentic reply. 4. Senor : A locator L i belong to the valid et, only if it overlap with the ector defined by the beacon of L c. L 5 L 8 L Wormhole link Region A L 6 L

8 SeRLoc Sybil Attack THREAT MODEL The attacker imperonate multiple locator (compromie of the globally hared key K 0 ). L L 2 3 Collect hah value Imperonator Attacker can fabricate arbitrary beacon. Hence, compromie the majority-baed cheme, if more than LH locator imperonated. 29 Sybil Attack detection(1) In a Sybil attack, the enor hear at leat twice the number of locator. Define a threhold L max a the maximum allowable number of locator heard, uch that: Lmax P( LH > Lmax ) = ε, P( LH > ) = 1 δ 2 Probability of fale alarm Probability of Sybil attack detection Deign goal: Given ecurity requirement δ, minimize fale alarm probability ε. 30 Sybil Attack detection - Defene Random locator deployment we can derive the L max value: 99% Detection probability 26 locator 5% Fale alarm P k 2 i ( ) ( ρlπr ) LH > k = 1 i= 1 i! e 2 ρ LπR Once the Sybil Attack i detected: Execute ACLA 52 locator 31 SeRLoc Compromied entitie THREAT MODEL Compromied network entitie: Attacker gain: 1. Knowledge of all cryptographic quantitie 2. Full control over the behavior of the entity. Compromie of a enor reveal the globally hared key K 0. Compromie of a locator reveal K 0, mater key K Li, and the hah chain of the locator. Imperonate the Cloet Locator Compromie the ACLA algorithm Diplace any enor 32 8

9 Enhanced location determination algorithm 1. The enor tranmit a nonce with hi ID 2. Locator within r from and et LH the enor relay the nonce. L7 3. Locator within R reply with a beacon + the nonce. L 2. Senor accept 9 L firt L max replie. 6 Outline Motivation Secure Localization Problem SeRLoc Threat and defene Performance Evaluation Concluion L 5 L 8 Attacker ha to compromie more than L max /2 locator, AND Replay before authentic replie arrive at Performance Evaluation Simulation etup: Random locator ditribution with denity ρ L. Random enor ditribution with denity 0.5. Performance evaluation metric: Localization Error v. LH Each locator i equivalent to M reference point, LE = 1 S S i= 1 et i r i M number of antenna ector et i : Senor location etimation. i : Senor actual location. r : Senor-to-enor communication range. S : Number of enor. SeRLoc outperform current cheme for any LH value

10 Localization error v. antenna ector Localization error v. ector error Higher number of directional antenna (narrower ector) reduce LH. Sector error: Fraction of ector falely etimated at each enor. More expenive hardware at each locator. SeRLoc i reilient againt ector error due to the majority vote cheme. Even when 50% of the ector are falely etimated, LE < r for LH Localization error v. GPS error Communication Cot GPS Error (GPSE): Error in the locator coordinate. For GPSE = 1.8r and LH = 3, LE = 1.1r. DV-hop/Amorphou: LE = 1.1r require LH = 5 with no GPSE. APIT: LE = 1.1r require LH = 12 with no GPSE. Communication cot i independent of the number of enor Communication cot increae with the locator denity, or number of directional antenna at each locator

11 Performance Summary Increaing number of ector Reduction in error and power needed but increaed complexity Senitivity to GPSE error GPSE=1.8r; Avg. LE=1.1r; require SeRLoc need LH=3; Dv-Hop need LH=5, no GPSE; APIT need LH=12, no GPSE; Communication cot; APIT require S + L SeRLoc require L *M S: Set of enor, L: Set of locator, M: # of antenna 41 Concluion We need to ecure location etimation to claim ecure location-dependent function/app. SeRLoc: SEcure Range-independent LOCalization Robutly compute the location even in the preence of attack Better performance than up-to-date range independent localization cheme Decentralized implementation, reilient to ource of error Current development Reitance to jamming attack Analytical evaluation of error bound 42 Thank you for your time! Any Quetion 43 11