Enhancing SourceLocation Privacy in Sensor Network Routing

1
Enhancing Source-Location Privacy in Sensor
Network Routing
2
Sensor networks

• Security threats
• concerns with data security
• necessity to protect content of the data packets
  transferred through the network
• privacy threats associated with sensing devices
• necessity to secure the transmission of the data,
  for ex. location of the sensor node providing
  particular information
• Presented work addresses this issue

3
Example pander-hunter game

• Sensors are monitoring the habitat of pandas
• once panda is observed - the information is
  reported to the base station
• hunter desires to capture panda
• Assumptions
• one panda, one hunter and one base station
• hunter is equipped with rich memory and power
  resources and is able to identify the immediate
  sender knowing signal strength and the angle of
  the arrived message

4
Privacy metrics

• the safety period
• number of messages initiated by the sensors
  monitoring the panda before the hunter finds the
  panda.
• the communication overhead
• the number of packets transferred for each
  delivered panda sensing result.

5
Considered routing protocols

• Baseline techniques
• flooding
• message is broadcasted to all neighbors
• single-path routing
• message is routed to one of the neighbors
• Approaches in between
• Improvements for these techniques
• each technique is associated with behavioral
  hunter model

6
Performance baseline routing protocols

• The safety period is the same as the length of
  the shortest routing path.

• Patient hunter model
• hunter waits at the base station for message
• moves to the immediate sender of that message
• repeats until reaches the source node

Probabilistic flooding
single-path routing and flood routing
7
Improvement routing with fake sources

• introduce new sources that inject fake messages
  into the network
• two challenges
• How to chose fake sources
• Rate of fake messaging
• We need a persistent fake source instead of a
  short lived one

8
Routing with fake sources

• Fake source
• source is h hops away, sends message to the sink
• sink sends a message into opposite direction
• once message reached node in h hops away from
  sink it becomes a fake source
• Rate of fake messaging
• Slow rate ?hunter finds the real source fast
• At the rate of the real messaging ? hunter
  struggles between fake and real source
• High rate ? hunter is kept at the fake source

real source
fake source
9
Performance routing with fake sources

• Fast speed of fake messaging provides good
  privacy!
• But it wont work for more sophisticated hunter

• Perceptive hunter model
• hunter is able to detect deception
• for ex. can keep the history of visited nodes

10
Improvement phantom routing

• Introduces two phases
• random walk
• message is routed in random fashion for h hops
• flooding/single-path routing
• after h hops message is routed using baseline
  technique

Random walk
Flooding
11
Phantom routing further improvement

• Pure random walk might not be efficient ?
  directed random walk
• a sector based directed random walk
• each node partitions neighbors into two sets S1,
  S2 (for ex. east/west)
• if message is sent to node in S1, then every node
  forwards it to the neighbors in set S1 only
• a hop-based directed random walk
• must know the hop count between sink and all
  nodes
• partition node into 2 sets with hop count lt
  mine and gt mine

12
Performance phantom routing

• Safety period for phantom single-source routing
  is higher than for phantom flooding

single-path routing

• Why
• probability in single-source routing that message
  will intersect hunters path is small
• in flooding this probability is still large

flooding
13
Performance phantom routing

• The communication overhead - number of
  transmissions per message increases for both
  techniques
• Flood the broadcast dominates the communication
  overhead
• Single path at most 2h transmissions are added
  (h is the random walk hops)

14
Performance phantom routing

• Caution hunter model
• hunter limits its listening time at node
• after timeout hunter returns to the previous node
• However does not provide more benefits
• hunter does not make much progress towards the
  real source
• Safety period is higher, while capture likelihood
  is lower

15
Privacy in mobile sensor network

• Mobility adds privacy
• Fast moving panda alone is sufficient to provide
  source privacy using single-source routing
• In phantom routing the privacy increases

16
Conclusion

• Majority of the research efforts are focused on
  data security
• There are some works on protecting privacy
  associated with network devices
• not appropriate for sensor networks
• This is one of the first efforts to address
  sensor location privacy in sensor network

17
(No Transcript)
18

• Phantom routing introduces randomness into the
  choice of paths b/w source and sink
• What can we do after a path is determined?
• Entrapping attackers with routing loops

19

• The approach from 10,000 feet
• Introduce routing loops on the path
• Attacker has to choose to trace the real path or
  the routing loop
• Multiple loops can be added
• Increase safety period

20
(No Transcript)
21
Detailed approach

• Loop generation
• After deployment, every sensor determines whether
  or not to generate a loop
• First random walk for h hops, then route it back
• All nodes in the loop knows the identities
• The same sensor can be in multiple loops

22

• Loop activation
• When a real sensing packet goes through a loop
  node, the loop is activated
• A fake message is sent along the loop
• The fake messages have the same frequency as the
  real data
• Probabilistic loop acitvation can be used

23

• Loop deactivation
• The loop will stop sending fake messages after
• A predetermined period of time

24

• Attackers response
• It cannot tell the difference b/w a real and a
  fake path
• It can detect a loop after going through it
• But the safety period already increased

25

• Safety period analysis
• A quick result
• For every loop, the attacker has 50 chance to
  choose it
• On average, the attacker will go though half of
  the loops on the path
• The increase in safety period determined by
• Average length of loops
• Average number of loops on the path

26

• Average length of loop can be predetermined
• If the loop length is l, the probability that a
  node is on a loop is 1-(1-p)l
• In this way, we can determine the expected
  increase in safety period
• Communication overhead

27
Simulation results
28
Conclusion

• The entrapment approach adds branches after a
  path is determined
• Can be combined with phantom routing
• Safety period will be increased