Cryptography basedauthentication method for DoS attack Detection in Clustered Wireless Sensor Networks

Transcription

1 Cryptography basedauthentication method for DoS attack Detection in Clustered Wireless Sensor Networks Jerine.S 1, Dr.Julia Punitha Malar Dhas 2 1. Research Scholar, Department of Computer Applications, Noorul Islam University, Kumaracoil,Thuckalay,K.K.Dist ,Tamil Nadu,India, E.Mail: ssjerine@gmail.com 2. Professor, Dept of Computer Science and Engg, Noorul Islam University, Kumaracoil,Thuckalay,K.K.Dist ,Tamil Nadu, India, E.Mail: julaps113@yahoo.com Abstract Wireless Sensor Network (WSN) contains small sensor nodes with limited computational and communication capabilities. It is mainly used for monitoring the physical or environmental conditions such as temperature, sound, vibration, pressure, motion etc. Due to the distributed deployment of sensor nodes, it is vulnerable to many types of attacks. In this paper we propose a cluster based authentication mechanism to detect DoS attack. Our method is based on dynamic selection of cluster heads, to prolong network life time. Also three methods (i)ack and timeout (ii) Message counter (iii) Residual energy, are defined to detect malicious nodes. The detected malicious nodes are suspended by cluster head and keys are removed by KDS. The proposed method is dynamic and improves network life time by minimizing control overhead and energy consumption of sensor nodes and improves security. Key Words 1.Introduction Wireless Sensor Networks, Clustering, Authentication, Malicious node detection Wireless Sensor Network (WSN) consists of a large number of individual small sensors to monitor the environment. It is used in many applications such as battlefield surveillance, aerospace, health care etc. sensor nodes forwards the sensed data to a sink node called base station and this base station to a remote server. The sensed data is forwarded through an insecure medium, thus WSN can be easily affected by Denial of Service (DoS) attacks. DoS attacks are the most common malicious attack and cannot be easily identified. In [1], a DoS attack is defined as any event that diminishes network s capacity to perform its expected function. Compared to the Internet DoS attack in WSN is different. Each layer of WSN is vulnerable to DoS attack [1]. Each kind of DoS attack has different nature and characteristics. It is difficult to develop a unified approach to detect all DoS attacks. Therefore in this paper we look at DoS attack at transport layer, such as Hello Flood attack. In this attack, malicious nodes broadcasts large amount of unwanted packets to its neighbors in its range. Many Wireless Sensor Networks are grouped into clusters to improve network security [2]. Cluster based WSN are vulnerable to DoS attacks. Cluster head is selected dynamically to detect malicious nodes and to manage local clusters. If a sensor node is captured or compromised then the entire cluster will be affected by DoS attack. This indicates that cluster based WSN requires an efficient DoS detection mechanism. 1.1 Network model The cluster based WSN considered in this paper consists of three kinds of nodes, Sensor nodes, Cluster Head and a Base station shown in Figure

2 BST CH SN Fig 1. Architecture of Clustered WSN Usually sensor nodes are inexpensive, built with limited battery power, low memory, low data processing capability and short radio transmission coverage. Sensor nodes in a cluster communicate with each other in that cluster and finally communicate with cluster head. Cluster heads are selected dynamically to control the sensor nodes and to detect malicious nodes. Base station is a gateway to another network or access point for human interface [3]. 1.2 Notations The symbols used in this paper are given in table1, Notations Meanings ID si Identifier of i th sensor node MK si Unique master key of ith sensor ID chi Identifier of ith cluster head M BST Message sent by Base Station R BST Random value selected by Base Station EK chi Encryption key of ith cluster head M chi Message sent by ith cluster head Rchi Random value selected by ith cluster head Msi Message sent by ith sensor node M CHAL Alive message of cluster head MSG count Count on number of messages MEXCD Exceed message Table1.Symbols in proposed methodology The rest of the paper is organized as follows, in Section 2 we review the existing related works on authentication and clustering, in section 3, we propose a cluster based authentication model to detect malicious nodes, Section 4 analyzes the results and performance, and finally we conclude the paper in section6. 2. Related Work In this section, we discuss the existing schemes related with clustering, authentication and malicious node detection in WSN environment. In [4], a cluster based intrusion system is proposed; it prevents sensor networks from DoS attack. This solution uses a type of special nodes called guarding nodes (gnodes) to analyze the network traffic and report DoS attacks to cluster head. In this the detection approach for diverse attack types and the actions taken are explored for different types of nodes. 119

3 In [5], novel cluster based intrusion detection is proposed, to prevent DoS attacks. This technique builds the clusters from mobile nodes that are in communication range with each other. Among these a Cluster Head (CH) is selected based on fairness probability of a node and efficiency. In [6], Hsiegh et al, proposed a security model to improve secure communication in cluster based WSN s. It uses the authentication scheme to prevent intrusion from external malicious nodes. Internal compromised nodes also excluded by the trust evaluation module. In [7], Fan et al, proposed a simple user authentication scheme which is efficient for two tiered WSN s. This scheme establish a session key between the user and a master node in the sensor network In [8] a light weight authentication scheme is proposed for key management and security of WSN. It uses symmetric cryptography for less power consumption. It s main goal is to provide message confidentiality and authenticity. It is good resilience against node capture attacks. In [9], a dynamic password based user authentication scheme is proposed for hierarchical sensor network. It supports mutual authentication to resist DoS attacks. It supports dynamic node addition after deployment, and allows changing the password locally without the help of base station. In [10], an adaptive security design to secure cluster based communication in sensor networks is proposed. It consists of three modules which can detect malicious nodes by providing secure communication and authentication between nodes. In each cluster CH schedules transmission and monitors sensor nodes periodically. 3.Proposed Methodology Wireless Sensor Networks (WSN) is susceptible to many types of attacks like node replication, node capture, jamming, tampering, misdirection etc. These attacks are made by malicious nodes from several sources. Already many solutions have been proposed to secure the wireless sensor network from these attacks. In this paper we propose a cluster based authentication model to increase the probability of detecting malicious nodes in sensor network. Clustering the network minimizes the complexity and reduces network traffic, provides better resource utilization, data aggregation and load balancing. Our proposed authentication model prolongs network life time and minimizes control overhead. The proposed model includes four phases, 1. Key Initialization phase. 2. Dynamic Cluster Head Selection phase. 3. Mutual authentication phase. 4. Malicious node detection phase. Next, each phase will be discussed in detail. 1. Key Initialization Phase The KDS (Key Distribution Server) performs the following steps after deployment of sensor nodes. Step 1 : KDS assigns a unique identifier IDsi to all the sensor nodes that are deployed. Step 2 : KDS then assigns a unique master key MKsi to all sensor nodes. Step 3: BST (Base Station) then configures all the sensor nodes using their identifier and maser key. 2.Dynamic Cluster Head selection Phase 120

4 First the Wireless Sensor network is divided into clusters using the factor 10% of total number of sensor nodes. After clusters have been formed Cluster Heads (CH) are selected to control intra cluster coordination and inter cluster communication. Cluster Head (CH) is selected for each cluster in the network based on the parameters (i) Residual Energy (RE) (ii) Intra cluster Communication Cost (CC) (iii) Shorter Response Time (SRT).Base station performs the following steps to select a Cluster Head. Step 1 : Compare the RE of all sensor nodes with the Threshold value. Step 2 : Select the sensor nodes that have RE > Threshold Step 3 : If more than one sensor node having RE > Threshold then select node with less Communication Cost (CC). Step 4 : If the result of step 3 is greater than one then select nodes with Shorter Response Time (SRT). After CHi has been selected for each cluster, BST (Base Station) broadcasts a message to all sensor nodes to inform the IDchi of all cluster heads. Then each sensor node in that cluster register itself with their identifier and master key <ID si, MK si > to its CHi. Cluster Head selection proposed in this paper,allows us to change Cluster Heads, which makes it more reliable. 3.Mutual Authentication Phase It includes two phases, (i) Mutual authentication between Base Station (BST) and Cluster Head (CH) (ii) Mutual authentication between Cluster Head (CH) and Sensor nodes. Each phase is explained as follows, (i)mutual authentication between Base Station (BST) and Cluster Head (CH) After the selection of Cluster Head, Base Station performs the following steps, in order to authenticate CH. Step 1 : Base station sends a random value R BST to each cluster head CH i with a time stamp value as M BST = { R BST T i }. Step 2 : Each Cluster Head computes M Chi using its own master key and send it to base station. M Chi = { EK Chi (R BST ) T j }. Step 3 : Base station decrypts the message received from each CH i and checks If M BST = M Chi then CH i is successfully authenticated. Also if (T j T i ) <= T then there is no transmission delay. (ii) Mutual authentication between Cluster Head (CH) and Sensor nodes. After Cluster Head has been authenticated, it authenticates the sensor nodes, in its cluster. Step1 : Each custer head send a random value R Chi to each sensor node in the cluster. M Chi ={ R Chi T i }. Step 2: Each sensor node encrypt the random number using its own master key and send to cluster head as, M Si = { EK Si (R Chi ) T j }. Step 3 : Cluster head decrypt it to check, M Chi = M Si.If it results same, then sensor node is successfully authenticated. Also if (T j T i ) <= T then there is no transmission delay. 4.Malicious node detection phase 121

5 Malicious node is a compromised node, which affects normal flow of communication, and decreases the performance of the sensor network. This paper presents three proposals to detect malicious nodes. Proposal 1: (Based on Acknowledgement and Time out) Step 1 : CH i sends a M CHAL ( Alive) message with time stamp to all its sensor nodes,m CHAL = { ID CH i T i ALIVE } Step 2 : If the cluster head receives ACK(Acknowledgement) ACK Si = { ID Si ID CH i T j ACK }with in the time interval (T j T i ) <= T then the cluster node is not malicious. Step 3 : Nodes which have transmission time(t j T i ) > T, is declared as affected nodes and nodes which does not send ACK, are blocked temporarily. Proposal 2 : (Based on Message count) In this, each sensor node uses a message counter (MSG count ) to count the total number of messages received by that node. For an interval of time it checks its count. If MSG count >= T, then it sends an EXCEED message to its CH as, M EXCD = {ID Si OVERFLOW T i }. When a CH detects a malicious node during the above process then it blocks that node from sensing and communication with other nodes. Also it requests the KDS to cancel the keys of that node. KDS simply deletes the key from its database which results keyless node. Proposal 3 : (Based on Residual energy) Initially CH knows the energy level of sensors deployed under it. After a particular time interval, it checks the energy level. If the residual energy of sensor node is less than the predicted value then it declares it as a malicious node. 5.Performance Evaluation In this section we discuss the resiliency of our proposed work against DoS attack. Network life time is an important factor to evaluate the performance of our proposed work. Our work is designed with three malicious node detection proposals, to prolong the network life time. Once Dos attack occurs in the WSN the number of active node decreases. This paper prolongs the network life time by detecting malicious nodes, and stops its functions by removing the keys. Performance of the proposed work is defined using, effect of malicious nodes, network size and detection ratio. Effect of Malicious nodes Figure 2, shows the packet delivery ratio for malicious nodes. The delivery ratio decreases with the increase of malicious nodes without defense mechanism. Our proposed model overcomes this problem, and packet delivery ratio is high. 122

6 Delivery ratio Proposed without defense No. of malicious nodes Fig 2. Effect of Malicious nodes Effect of Network size Figure 3, shows the complexity as a function of network size. The complexity increases with the increase of number of nodes. But the result shows that, the complexity decreases in the proposed model due to the use of clustering architecture. Complexity without defense Proposed Number of nodes Fig3. Effect of Network size Malicious node detection ratio Figure 4, shows the detection ratio of IDSEP and our proposed model. The detection ratio of proposed model is higher than IDSEP. Detection Ratio Proposed without defense Time (s) Fig 4. Malicious node detection ratio 123

7 6. Conclusion Due to the limited capability of a Sensor node, it is difficult to prevent the sensor from DoS attack. DoS detection mechanism used in wireless networks are not suitable for Wireless Sensor Network because of limited energy and lack of management. In this paper, we proposed a dynamic method for cluster based WSN. It uses cluster heads to control and monitor the behavior of sensor nodes and detects malicious nodes and three methods based on Acknowledgement and timeout, Message overflow and Residual energy to detect the malicious nodes. When it detect a malicious node, it immediately stops its receiving function and inform to KDS(Key Distributing Server) to remove its key, thus it becomes a keyless node. Our proposed work allows selecting the cluster heads dynamically to prolong network life time. Our work provides many advantages over existing methods. It detects malicious nodes effectively. It prolongs network life time by dynamic selection of cluster head. Clustering the network reduces traffic and complexity and improves load balancing. It consumes less amount of energy because of simple authentication mechanism used. Moreover network security is improved by detecting malicious nodes. REFERENCES [1]. Wood, A.D., Stankovic, J.A.: Denial of service in sensor networks,computer, 2002, 35, (10), pp [2]. Chen, X.Q., Makki, K., Kang, Y., Pissinou, N.: Sensor network security: a survey,ieee Commun. Surv. Tutor., 2009, 11, (2),pp [3]. Ashok Kumar Das,Pranay Sharma, Santanu Chatterjee, Jamuna Kanta Sing, A dynamic password based user authentication scheme for hierarchical wireless sensor networks, Elsevier, 2012, [4]. Gu Hsin Lai and Chia-Mei Chen : Detecting Denial of Service Attacks in SensorNetworks. Journal of Computers Vol.18, No.4, January,2008 [5] R.S.Sachan, M.Wazid, D.P.Singh, A cluster based intrusion detection and prevention technique in misdirection attack inside WSN, 2013, IEEE. [6] Meng-Yen Hsieh et al : Adaptive security design with malicious node detection in Cluster-based sensor networks. Computer Communications30 (2007) [7]. Fan R, Ping L-D, Fu J-Q, Pan X-Z. A secure and efficient user authentication protocol for two-tiers wireless sensor networks. In: Second Pacific-Asia conference on circuits, Communications and system (PACCS 2010); p [8]. Oscar Delgado- Mohatar, Amparo fuster Sabater, Jose Sierra, A light weight authentication Scheme for WSN Elsevier Adhoc networks 9(2011), [9]. Shun-Sheng Wang, Kuo-Qin Yan, Shu-Ching Wang, Chia-Wei Liu, An Integrated Intrusion Detection System for Cluster-based WirelessSensor Networks, 2011 Elsevier [10]. TIAN Bin, YANG Yi-xian, LI Dong, LI Qi, XIN Yang, A security framework for wireless sennsor networks, 2010 Elsevier. 124