Privacy in Sensor Nets

Transcription

1 Privacy in Sensor Nets Wade Trappe Yanyong Zhang Rutgers, The State University of New Jersey 1

2 Talk Overview Brief Update on the Security Group and then PARIS Motivation Set the Stage Privacy, Pandas, and Paris Project Framework: Who? When? What? How? Team Approach: Theory and Systems Testbed Validation: ORBIT and Pandas-in-PARIS 2

3 WINLAB s Security and Computing Initiatives WINLAB has a growing initiative in wireless network security and mobile/pervasive computing Currently the Security Group consists of 3 Faculty Members: Wade Trappe (University of Maryland): Wireless Security, Multimedia Security, Physical/MAC Layer Security, Multicast, Coding and Cryptography Yanyong Zhang (Penn. State University): Distributed Computing, Sensor Networking, Pervasive Computing, Fault Tolerant Computing Architectures, Wireless Security Marco Gruteser (University of Colorado): Ubiquitous Computing, Secure Software Engineering, Privacy in Location Services 14 Students (W. Xu, Q. Li, P. Kamat, Z. Li, Y. Zhang, T. Wood, S. Chao, A. Chincholi, B. Xue, S. Raj, K. Ma, S. Swami, B. Hoh, K. Ramchandran) Collaboration: Princeton (H. Kobayashi), Columbia (H. Schulzrinne), Bell Labs (S. Paul), IBM Watson, UMD (KJR Liu, M. Wu), Rutgers CS (B. Nath), UColorado (Grunwald), URI (Y. Sun), UBC (Z. Wang), U. Texas (IAT) Funding: NSF: ORBIT (joint with Princeton, Columbia, Bell Labs, IBM, Thomson), PARIS Air Force: Multimedia Fingerprinting (joint with UMD) (complete) NICT Japan: Secure Future Wireless Networks (B3G) 3

4 NSF-NETS (NOSS) PARIS: Privacy Augmented Relaying of Information from Sensors 4

5 Motivation The things most people want to know about are usually none of their business. George Bernard Shaw Sensor network security and privacy Market expected to grow to $10B by 2010 Sensors will become part of our social fabric Information will be everywhere for the taking! Privacy is tough to define, and tougher to defend! Hacker Vs. Thug 5

6 Privacy Issues in Sensor Networks Content-Oriented Security and Privacy: Issues that arise because an adversary can observe and manipulate the exact content in a sensor message. Best addressed through cryptography and network security. Context-Oriented Privacy: Issues that arise because an adversary observes the context surrounding creation and transmission of a sensor message. Examples: Source-Location Privacy: The physical location of communication participants may be sensitive. Temporal Privacy: Temporal information corresponding to the creation of message might be sensitive. Traffic Privacy: The size and amount of messages originating from a sensor may be sensitive. Example: In sensor networks, Source-Location Privacy focuses on protecting the monitored asset from traceback. 6

7 Panda-Hunter Game Model We consider a generic asset monitoring sensor network application Panda-Hunter Game: A sensor network has been deployed to monitor a panda habitat. Sensors send Panda_Here messages, forwarded to sink. The hunter observes packets and learns information about the panda. Privacy Goal: Make it difficult for Hunter to gain knowledge about panda s behavior. Example: Source-Location Privacy Increase the time needed for an adversary to track and capture the panda. Longer safety periods mean more privacy! Data Sink Sensor Node Game Over! 7

8 Approach to Sensor Context Privacy Who should I communicate with? This question addresses source-location privacy and entails carefully designed routing solutions. When should I communicate? Here we focus on temporal privacy by introducing suitable modifications to the routing layer and MAC layer. What should I communicate? For this issue we address privacy breaches resulting from traffic analysis by modifying the underlying application s outgoing data format. How should I communicate? Here we examine modifications to the physical layer and the underlying topology which obfuscate the source s location. 8

9 Who? Routing Strategies for Privacy Sensor networks route data via multi-hops to sink. Contextual Privacy Issue: An adversary may trace his way back to source s location. Example: Flooding is a popular technique for delivering sensor data Involves each node forwarding a packet it receives Although many simultaneous paths to the sink, flooding does not increase the safety period! Explanation: Flooding contains the shortest path. Hunter will always follow shortest path to the panda. Need to change who you route to: Introduce randomization into routing Data Sink Sensor Node 9

10 Formal model Asset monitoring network is a 6 tuple : (N, S, A, R, H, M) N = network of sensor nodes S = Sink to which all messages are routed to A = The asset being monitored R = The routing strategy used by sensors H = The hunter or adversary whose movements are goverened by a set of rules M. Safety period Number of new messages initiated by the source node(s) monitoring the asset before the adversary catches up (if at all) Likelihood of capture The likelihood that the adversary will trace the asset successfully in a given period of time. Adversary characteristics Non interfering Device rich Resource rich Informed (Kerckhoff s principle) 10

11 Simulation setup Discrete event simulator written in c++ 10,000 nodes in a 6000 x 6000 (m 2 ) grid Uniform random distribution. Tx radius of nodes is 100 m. and listening radius of adversary also 100 m. Both these parameters are variable in the simulator Avg. node degree is 8 well connected network less than 1% have less than 3 neighbors. Energy consumption for Rx and Tx Single asset and single adversary 11

12 The Patient Adversary 12

13 Baseline Routing Techniques Shortest Path routing Single path Criteria: Minimum number of hops or highest gradient Minimum amount of network energy expended Minimum message delivery latency 100% message delivery guarantee Worst safety period!! Baseline flooding Each node forwards the received sensor packet once to all its neighbors. Very high energy consuion and msg overhead. Probabilistic flooding Each node forwards a received sensor packet with probability P forward to all its neighbors, the first time it receives it. Small P forward means reduced energy consumption Small P forward also means lower network reachability, lower message delivery ratio and higher delivery latency. There is a fundamental tradeoff here 13

14 Performance of Baseline routing techniques Delivery ratio P =1.0 fwd P =0.9 fwd P =0.7 fwd P =0.5 fwd shortest-path Message Delivery Ratio Source-sink distance in hops Message overhead Number of Tx per delivered msg P =1.0 fwd P =0.9 fwd P =0.7 fwd shortest-path Source-sink distance in hops 14

15 Performance of Baseline routing techniques Average message latency P =1.0 fwd P =0.9 fwd P =0.7 fwd shortest-path Avg. Msg Latency Source-sink distance in hops P =1.0 fwd P =0.9 fwd P =0.7 fwd shortest-path Safety Period Safety period Source-sink distance in hops 15

16 Routing with fake sources A second source can inject fake messages into the network to draw the adversary away from the real source. Sink can decrypt the messages and ignore the fake ones. The location of the fake source and the rate at which it floods the fake messages is very important. 16

17 Phantom routing The source message is sent out on a directed random walk for h hops before being flooded or sent down to shortest path. Combines the best of flooding and shortest path strategies but without any of the problems. 17

18 When? Traffic Strategies for Privacy Sensor networks may store, aggregate and forward data. Contextual Privacy Issue: An adversary may infer time-ofcreation context by observing and correlating traffic. Time delay translates into source-location ambiguity Need to change when you send/route/forward. Delay at the source Random delay in routing 18

19 What? Traffic Shaping Strategies for Privacy Sensor networks may report different types of data Contextual Privacy Issue: An adversary may correlate packet size and traffic with the type of data Example: Pandas and Foxes Need to change what you send Traffic Shaping for Sensor Networks: Uniform Message Size Randomized Message Size Privacy-Preserving Source Coding Panda Here! Fox Here! 19

20 How? Physical/Topology Strategies for Privacy Sensor communication infrastructure is simple Contextual Privacy Issue: Simplicity of design facilitates many contextual privacy attacks Need to change how you communicate Physical Layer Defense: Power control Localization ambiguity Network Topology Defense: Hierarchies and jump-points Network Mixing Power Received Transmit Power Uncertainty d 1 d 2 Location Uncertainty Distance 20

21 Team Approach Paris isn t for changing planes, its for changing your outlook! - Audrey Hepburn Systems meets Theory Approach: Theory: Information Theory: Huffman-coding Physical Layer Techniques Systems: Practical Implementation Issues: Observations learned from system Systems Theory Validation is key Experiments will be conducted on NSF ORBIT Wireless Testbed Hook-up imotes and Mica Motes to ORBIT Pandas-In-PARIS 21