Subject: [Roll] Trust Management & draft-tsao-roll-security-framework-00

From: "Theodore Zahariadis" <[email-masked]>
Date: Thu, 23 Apr 2009 21:38:25 +0300

Dear all,

Thank you for allowing me any my team in the ROLL email list and sharing our thoughts with you.

First of all let me introduce myself. My name is Theodore Zahariadis and I am the Technical Manager of the project AWISSENET. 

AWISSENET started on 1/1/2008 and is partially funded by EC under FP7. It includes key industrial partners e.g. Hellenic Aerospace Industry, Alcatel-Lucent and Thales Communications. Among its main objectives is to design, simulate and implement a secure routing scheme for Wireless Sensor Networks. So far, we have designed a trust management scheme, which includes both direct and indirect trust, weighting factors' values, which are auto-adjusted according to the attacks, and node's energy information. Then, we modified the GPSR protocol in order to include both trust and energy-efficient metrics and simulated the result in J-Sim. The simulations show that the scheme can provide energy-aware routing paths that bypass malicious nodes of many kinds. From our experience, up to now, sensor nodes resources are adequate for implementing at least some of the trust metrics; thus currently, we are implementing the scheme in TinyOS v2.1 on IRIS and MicaZ motes. More info may be found at www.awissenet.eu.

In this context, we think that trust for LLN could be in conformance with the application-specific documents in ROLL. In more details:

Trust models for sensor networks [1-3] allow for detecting a list of attacks including black-hole, selective forwarding, integrity/modification attacks. The nodes may also exchange opinions as regards the trustworthiness of their neighbors [4-5]. Trust & reputation information can be accelerated for new-comers, i.e. is useful in case of mobile nodes and/or newly initiated nodes.

The draft-tsao-roll-security-framework-00 provides an excellent description of a security framework for sensor networks. In section 5.3.3, the selective forwarding attack is described and two countermeasures are sought. We believe, that a third way to defend against this attack may be to realize a trust model i.e. in case messages are not encrypted (and this may be the case in the majority of sensor networks), each node monitors/overhears the behavior of its neighbors in order to check whether they sincerely execute the routing protocol and behave as expected. If for example, node A selects node B for forwarding packet P1, after transmitting the packet, node A overhears the wireless medium in order to check whether node B actually forwarded the packet P1 correctly. The end result is that each node calculates the trustworthiness of its neighbors and then takes into account this information to avoid choosing malicious nodes during routing decisions, either for key distribution [1], for data aggregation or for cluster head election. 

Also, in the definition of selective forwarding, the case where a malicious node behaves differently towards different neighbors could also be covered.  i.e. maybe by replacing the sentence "An insider malicious node basically blends neatly in with the network but then may decide to forward and/or manipulate certain packets." with "An insider malicious node basically blends neatly in with the network, but then may decide to forward and/or manipulate certain packets from all or part of its neighbors." This behavior is called conflicting behavior in [6].

[1]    Nathan Lewis, Noria Foukia, "Using Trust for Key Distribution and Route Selection in Wireless Sensor Networks" IEEE Globecom 2007, 26-30 Nov. 2007 

[2]    A.A. Pirzada and C. McDonald, "Trust Establishment In Pure Ad-hoc Networks", Wireless Personal Communications Vol. 37, 2006, pp: 139-163

[3]    Sapon Tanachaiwiwat, Pinalkumar Dave, Rohan Bhindwale, Ahmed Helmy "Location-centric Isolation of Misbehavior and Trust Routing in Energy-constrained Sensor Networks" IEEE International Conference on Performance, Computing, and Communications, 2004

[4]    G. Theodorakopoulos and J. S. Baras, "On Trust Models and Trust Evaluation Metrics for Ad-Hoc Networks," IEEE Journal on Selected Areas in Communications (JSAC), Feb. 2006.

[5]    S. Ganeriwal and M. B. Srivastava. Reputation-Based Framework for High Integrity Sensor Networks. In 2nd ACM Workshop on Security of Ad Hoc and Sensor Networks., pages 66-77, Washington, DC, USA, 2004

[6] Yan (Lindsay) Sun, Zhu Han, K. J. Ray Liu, "Defense of Trust Management Vulnerabilities in Distributed Networks", IEEE Communications Magazine, Vol. 25, No.2, February 2008, pp. 112-119.

Looking forward to hearing from you,

Theodore

------------------------------------------------------

Dr. Theodore Zahariadis

Ass. Professor, TEI of Chalkida

Email: [email-masked]

---

From: JP Vasseur <[email-masked]>
Date: Fri, 24 Apr 2009 06:59:30 +0200

Thanks for the pointers. I am sure that the authors will come back to  
you with comments.

Thanks.

JP.

On Apr 23, 2009, at 8:38 PM, Theodore Zahariadis wrote:

> First of all let me introduce myself. My name is Theodore Zahariadis  
> and I am the Technical Manager of the project AWISSENET.
> AWISSENET started on 1/1/2008 and is partially funded by EC under  
> FP7. It includes key industrial partners e.g. Hellenic Aerospace  
> Industry, Alcatel-Lucent and Thales Communications. Among its main  
> objectives is to design, simulate and implement a secure routing  
> scheme for Wireless Sensor Networks. So far, we have designed a  
> trust management scheme, which includes both direct and indirect  
> trust, weighting factors’ values, which are auto-adjusted according  
> to the attacks, and node’s energy information. Then, we modified the  
> GPSR protocol in order to include both trust and energy-efficient  
> metrics and simulated the result in J-Sim. The simulations show that  
> the scheme can provide energy-aware routing paths that bypass  
> malicious nodes of many kinds. From our experience, up to now,  
> sensor nodes resources are adequate for implementing at least some  
> of the trust metrics; thus currently, we are implementing the scheme  
> in TinyOS v2.1 on IRIS and MicaZ motes. More info may be found at www.awissenet.eu 
> .
>
> In this context, we think that trust for LLN could be in conformance  
> with the application-specific documents in ROLL. In more details:
>
> Trust models for sensor networks [1-3] allow for detecting a list of  
> attacks including black-hole, selective forwarding, integrity/ 
> modification attacks. The nodes may also exchange opinions as  
> regards the trustworthiness of their neighbors [4-5]. Trust &  
> reputation information can be accelerated for new-comers, i.e. is  
> useful in case of mobile nodes and/or newly initiated nodes.
>
> The draft-tsao-roll-security-framework-00 provides an excellent  
> description of a security framework for sensor networks. In section  
> 5.3.3, the selective forwarding attack is described and two  
> countermeasures are sought. We believe, that a third way to defend  
> against this attack may be to realize a trust model i.e. in case  
> messages are not encrypted (and this may be the case in the majority  
> of sensor networks), each node monitors/overhears the behavior of  
> its neighbors in order to check whether they sincerely execute the  
> routing protocol and behave as expected. If for example, node A  
> selects node B for forwarding packet P1, after transmitting the  
> packet, node A overhears the wireless medium in order to check  
> whether node B actually forwarded the packet P1 correctly. The end  
> result is that each node calculates the trustworthiness of its  
> neighbors and then takes into account this information to avoid  
> choosing malicious nodes during routing decisions, either for key  
> distribution [1], for data aggregation or for cluster head election.
>
> Also, in the definition of selective forwarding, the case where a  
> malicious node behaves differently towards different neighbors could  
> also be covered.  i.e. maybe by replacing the sentence “An insider  
> malicious node basically blends neatly in with the network but then  
> may decide to forward and/or manipulate certain packets.” with “An  
> insider malicious node basically blends neatly in with the network,  
> but then may decide to forward and/or manipulate certain packets  
> from all or part of its neighbors.” This behavior is called  
> conflicting behavior in [6].
>
> [1]    Nathan Lewis, Noria Foukia, “Using Trust for Key Distribution  
> and Route Selection in Wireless Sensor Networks” IEEE Globecom 2007,  
> 26-30 Nov. 2007
> [2]    A.A. Pirzada and C. McDonald, “Trust Establishment In Pure Ad- 
> hoc Networks”, Wireless Personal Communications Vol. 37, 2006, pp:  
> 139–163
> [3]    Sapon Tanachaiwiwat, Pinalkumar Dave, Rohan Bhindwale, Ahmed  
> Helmy “Location-centric Isolation of Misbehavior and Trust Routing  
> in Energy-constrained Sensor Networks” IEEE International Conference  
> on Performance, Computing, and Communications, 2004
> [4]    G. Theodorakopoulos and J. S. Baras, "On Trust Models and  
> Trust Evaluation Metrics for Ad-Hoc Networks," IEEE Journal on  
> Selected Areas in Communications (JSAC), Feb. 2006.
> [5]    S. Ganeriwal and M. B. Srivastava. Reputation-Based Framework  
> for High Integrity Sensor Networks. In 2nd ACM Workshop on Security  
> of Ad Hoc and Sensor Networks., pages 66–77, Washington, DC, USA, 2004
> [6] Yan (Lindsay) Sun, Zhu Han, K. J. Ray Liu, “Defense of Trust  
> Management Vulnerabilities in Distributed Networks”, IEEE  
> Communications Magazine, Vol. 25, No.2, February 2008, pp. 112-119.
>
> _______________________________________________
> Roll mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/roll

---

From: Mischa Dohler <[email-masked]>
Date: Fri, 24 Apr 2009 09:08:00 +0200

Thanks, Theodore, for your comments. To facilitate a practical way 
forward, I propose the following:

1) You and your team propose additions/deletions/amendments directly in 
draft-tsao-roll-security-framework-00 to speed up publication of -01.

2) You and your team propose some viable trust management scheme (and 
ideally a complete security suite) which is implementable into a ROLL 
protocol, i.e. for the time being HYDRO. You may need to synchronize 
with the design team and any other partners working on security for ROLL.

Thanks and kind regards,
Mischa.

Theodore Zahariadis wrote:
> First of all let me introduce myself. My name is Theodore Zahariadis and 
> I am the Technical Manager of the project AWISSENET.
> 
> AWISSENET started on 1/1/2008 and is partially funded by EC under FP7. 
> It includes key industrial partners e.g. Hellenic Aerospace Industry, 
> Alcatel-Lucent and Thales Communications. Among its main objectives is 
> to design, simulate and implement a secure routing scheme for Wireless 
> Sensor Networks. So far, we have designed a trust management scheme, 
> which includes both direct and indirect trust, weighting factors’ 
> values, which are auto-adjusted according to the attacks, and node’s 
> energy information. Then, we modified the GPSR protocol in order to 
> include both trust and energy-efficient metrics and simulated the result 
> in J-Sim. The simulations show that the scheme can provide energy-aware 
> routing paths that bypass malicious nodes of many kinds. From our 
> experience, up to now, sensor nodes resources are adequate for 
> implementing at least some of the trust metrics; thus currently, we are 
> implementing the scheme in TinyOS v2.1 on IRIS and MicaZ motes. More 
> info may be found at www.awissenet.eu <http://www.awissenet.eu>.
> 
>  
> 
> attacks including black-hole, selective forwarding, 
> integrity/modification attacks. The nodes may also exchange opinions as 
> regards the trustworthiness of their neighbors [4-5]. Trust & reputation 
> information can be accelerated for new-comers, i.e. is useful in case of 
> mobile nodes and/or newly initiated nodes.
> 
>  
> 
> messages are not encrypted (and this may be the case in the majority of 
> sensor networks), each node monitors/overhears the behavior of its 
> neighbors in order to check whether they sincerely execute the routing 
> protocol and behave as expected. If for example, node A selects node B 
> for forwarding packet P1, after transmitting the packet, node A 
> overhears the wireless medium in order to check whether node B actually 
> forwarded the packet P1 correctly. The end result is that each node 
> calculates the trustworthiness of its neighbors and then takes into 
> account this information to avoid choosing malicious nodes during 
> routing decisions, either for key distribution [1], for data aggregation 
> or for cluster head election.
> 
>   
> 
> malicious node basically blends neatly in with the network but then may 
> decide to forward and/or manipulate certain packets.” with “An insider 
> malicious node basically blends neatly in with the network, but then may 
> decide to forward and/or manipulate certain packets from all or part of 
> its neighbors.” This behavior is called conflicting behavior in [6].
> 
>  
> 
> [1]    Nathan Lewis, Noria Foukia, “Using Trust for Key Distribution and 
> Route Selection in Wireless Sensor Networks” IEEE Globecom 2007, 26-30 
> Nov. 2007
> 
> [2]    A.A. Pirzada and C. McDonald, “Trust Establishment In Pure Ad-hoc 
> Networks”, Wireless Personal Communications Vol. 37, 2006, pp: 139–163
> 
> Helmy “Location-centric Isolation of Misbehavior and Trust Routing in 
> Energy-constrained Sensor Networks” IEEE International Conference on 
> Performance, Computing, and Communications, 2004
> 
> [4]    G. Theodorakopoulos and J. S. Baras, "On Trust Models and Trust 
> Evaluation Metrics for Ad-Hoc Networks," IEEE Journal on Selected Areas 
> in Communications (JSAC), Feb. 2006.
> 
> [5]    S. Ganeriwal and M. B. Srivastava. Reputation-Based Framework for 
> High Integrity Sensor Networks. In 2nd ACM Workshop on Security of Ad 
> Hoc and Sensor Networks., pages 66–77, Washington, DC, USA, 2004
> 
> Management Vulnerabilities in Distributed Networks”, IEEE Communications 
> Magazine, Vol. 25, No.2, February 2008, pp. 112-119.
> 
>  
> 
> Email: [email-masked] <mailto:[email-masked]>
>

---

From: JP Vasseur <[email-masked]>
Date: Tue, 28 Apr 2009 09:08:34 +0200

Hi Mischa,

On Apr 24, 2009, at 9:08 AM, Mischa Dohler wrote:

> 1) You and your team propose additions/deletions/amendments directly  
> in draft-tsao-roll-security-framework-00 to speed up publication of  
> -01.
>

Theodore: your call to send your comments directly to the authors in  
whichever form you prefer (this is an individual submission at this  
time), or to the list (in text form please) if it relates to a WG  
document.

> 2) You and your team propose some viable trust management scheme  
> (and ideally a complete security suite) which is implementable into  
> a ROLL protocol, i.e. for the time being HYDRO. You may need to  
> synchronize with the design team and any other partners working on  
> security for ROLL.
>

Please send your comments to the DT. I would suggest you to wait a few  
more weeks, once there will be a first draft out.

Thanks.

JP.

>> First of all let me introduce myself. My name is Theodore  
>> Zahariadis and I am the Technical Manager of the project AWISSENET.
>> to the attacks, and node’s energy information. Then, we modified  
>> the GPSR protocol in order to include both trust and energy- 
>> efficient metrics and simulated the result in J-Sim. The  
>> simulations show that the scheme can provide energy-aware routing  
>> paths that bypass malicious nodes of many kinds. From our  
>> implementing at least some of the trust metrics; thus currently, we  
>> are implementing the scheme in TinyOS v2.1 on IRIS and MicaZ motes.  
>> More info may be found at www.awissenet.eu <http://www.awissenet.eu>.
>> In this context, we think that trust for LLN could be in  
>> conformance with the application-specific documents in ROLL. In  
>> more details:
>> Trust models for sensor networks [1-3] allow for detecting a list  
>> of attacks including black-hole, selective forwarding, integrity/ 
>> messages are not encrypted (and this may be the case in the  
>> majority of sensor networks), each node monitors/overhears the  
>> behavior of its neighbors in order to check whether they sincerely  
>> execute the routing protocol and behave as expected. If for  
>> example, node A selects node B for forwarding packet P1, after  
>> transmitting the packet, node A overhears the wireless medium in  
>> order to check whether node B actually forwarded the packet P1  
>> correctly. The end result is that each node calculates the  
>> trustworthiness of its neighbors and then takes into account this  
>> information to avoid choosing malicious nodes during routing  
>> decisions, either for key distribution [1], for data aggregation or  
>> for cluster head election.
>> malicious node behaves differently towards different neighbors  
>> could also be covered.  i.e. maybe by replacing the sentence “An  
>> insider malicious node basically blends neatly in with the network  
>> but then may decide to forward and/or manipulate certain packets.”  
>> with “An insider malicious node basically blends neatly in with the  
>> network, but then may decide to forward and/or manipulate certain  
>> packets from all or part of its neighbors.” This behavior is called  
>> [1]    Nathan Lewis, Noria Foukia, “Using Trust for Key  
>> Distribution and Route Selection in Wireless Sensor Networks” IEEE  
>> Globecom 2007, 26-30 Nov. 2007
>> [2]    A.A. Pirzada and C. McDonald, “Trust Establishment In Pure  
>> Ad-hoc Networks”, Wireless Personal Communications Vol. 37, 2006,  
>> pp: 139–163
>> in Energy-constrained Sensor Networks” IEEE International  
>> Conference on Performance, Computing, and Communications, 2004
>> [5]    S. Ganeriwal and M. B. Srivastava. Reputation-Based  
>> Framework for High Integrity Sensor Networks. In 2nd ACM Workshop  
>> on Security of Ad Hoc and Sensor Networks., pages 66–77,  
>> Washington, DC, USA, 2004

---

From: "Theodore Zahariadis" <[email-masked]>
Date: Fri, 24 Apr 2009 20:19:52 +0300

Dear Mischa, all,

Attached please find some comments/revisions on the 
draft-tsao-roll-security-framework-00 in word format.

Best Regards,
Theodore